fh-forms - npm Package Compare versions

Comparing version 0.2.13 to 0.2.18

lib/common/forms-rule-engine.js

@@ -243,3 +243,3 @@ (function () {
           },
-          checkIfRequiredFieldsNotSubmitted,
+          checkIfRequiredFieldsNotSubmitted
         ], function (err, results) {
@@ -556,2 +556,48 @@ if (err) return cb(err);
 
+  function convertSimpleFormatToRegex(field_format_string) {
+    var regex = "^";
+    var C = "c".charCodeAt(0);
+    var N = "n".charCodeAt(0);
+
+    var i;
+    var ch;
+    var match;
+    var len = field_format_string.length;
+    for (i = 0; i < len; i += 1) {
+      ch = field_format_string.charCodeAt(i);
+      switch (ch) {
+        case C:
+          match = "[a-zA-Z0-9]";
+          break;
+        case N:
+          match = "[0-9]";
+          break;
+        default:
+          var num = ch.toString(16).toUpperCase();
+          match = "\\u" + ("0000" + num).substr(-4);
+          break;
+      }
+      regex += match;
+    }
+    return regex + "$";
+  }
+
+  function validFormatRegex(fieldValue, field_format_string) {
+    var pattern = new RegExp(field_format_string);
+    return pattern.test(fieldValue);
+  }
+
+  function validFormat(fieldValue, field_format_mode, field_format_string) {
+    var regex;
+    if ("simple" === field_format_mode) {
+      regex = convertSimpleFormatToRegex(field_format_string);
+    } else if ("regex" === field_format_mode) {
+      regex = field_format_string;
+    } else { // should never be anything else, but if it is then default to simple format
+      regex = convertSimpleFormatToRegex(field_format_string);
+    }
+
+    return validFormatRegex(fieldValue, regex);
+  }
+
   function validatorString (fieldValue, fieldDefinition, previousFieldValues, cb) {
@@ -562,2 +608,18 @@ if(typeof fieldValue !== "string"){
 
+    var validation = {};
+    if (fieldDefinition && fieldDefinition.fieldOptions && fieldDefinition.fieldOptions.validation) {
+      validation = fieldDefinition.fieldOptions.validation;
+    }
+
+    var field_format_mode = validation.field_format_mode || "";
+    field_format_mode = field_format_mode.trim();
+    var field_format_string = validation.field_format_string || "";
+    field_format_string = field_format_string.trim();
+
+    if (field_format_string && (field_format_string.length > 0) && field_format_mode && (field_format_mode.length > 0)) {
+      if(!validFormat(fieldValue, field_format_mode, field_format_string)) {
+        return cb(new Error("field value in incorrect format, expected format: " + field_format_string + " but submission value is: " + fieldValue));
+      }
+    }
+
     if(fieldDefinition.fieldOptions && fieldDefinition.fieldOptions.validation && fieldDefinition.fieldOptions.validation.min){
@@ -703,4 +765,4 @@ if(fieldValue.length < fieldDefinition.fieldOptions.validation.min){
   function validatorLocationMap (fieldValue, fieldDefinition, previousFieldValues, cb) {
-    if(fieldValue.lat && fieldValue.long) {
-      if(isNaN(parseFloat(fieldValue.lat)) || isNaN(parseFloat(fieldValue.lat))) {
+    if(fieldValue.lat && fieldValue["long"]) {
+      if(isNaN(parseFloat(fieldValue.lat)) || isNaN(parseFloat(fieldValue["long"]))) {
         return cb(new Error("Invalid latitude and longitude values"));
@@ -717,5 +779,5 @@ } else {
   function validatorLocation (fieldValue, fieldDefinition, previousFieldValues, cb) {
-    if(fieldDefinition.fieldOptions.definition.locationUnit === "latLong") {
-      if(fieldValue.lat && fieldValue.long){
-        if(isNaN(parseFloat(fieldValue.lat)) || isNaN(parseFloat(fieldValue.lat))){
+    if(fieldDefinition.fieldOptions.definition.locationUnit === "latlong") {
+      if(fieldValue.lat && fieldValue["long"]){
+        if(isNaN(parseFloat(fieldValue.lat)) || isNaN(parseFloat(fieldValue["long"]))){
           return cb(new Error("Invalid latitude and longitude values"));
@@ -742,3 +804,3 @@ } else {
 
-      var east = parseInt(fieldValue.eastings);
+      var east = parseInt(fieldValue.eastings,10);
       if(isNaN(east)){
@@ -748,3 +810,3 @@ return cb(new Error("Invalid eastings definition for northings and eastings location. " + fieldValue.eastings));
 
-      var north = parseInt(fieldValue.northings);
+      var north = parseInt(fieldValue.northings, 10);
       if(isNaN(north)){
@@ -931,6 +993,8 @@ return cb(new Error("Invalid northings definition for northings and eastings location. " + fieldValue.northings));
         var submissionValues = [];
+        var condition;
+        var testValue;
         if (submissionFieldsMap[ruleConditionalStatement.sourceField] && submissionFieldsMap[ruleConditionalStatement.sourceField].fieldValues) {
           submissionValues = submissionFieldsMap[ruleConditionalStatement.sourceField].fieldValues;
-          var condition = ruleConditionalStatement.restriction;
-          var testValue = ruleConditionalStatement.sourceValue;
+          condition = ruleConditionalStatement.restriction;
+          testValue = ruleConditionalStatement.sourceValue;
 
@@ -937,0 +1001,0 @@ // Validate rule predictes on the first entry only.

lib/common/models.js

@@ -15,7 +15,8 @@ var mongoose = require('mongoose'),
     APP_THEMES: "AppThemes",
-    FORM_SUBMISSION: "FormSubmission"
+    FORM_SUBMISSION: "FormSubmission",
+    GROUPS: "Groups"
   };
 
 
-  return{
+  return {
     "init": function (conn) {
@@ -69,3 +70,4 @@ var schemaOptions = { strict: true,  versionKey: false  };
         "fieldRules": [{ type: Schema.Types.ObjectId, ref: MODELNAMES.FIELD_RULE }],
-        "pageRules": [{ type: Schema.Types.ObjectId, ref: MODELNAMES.PAGE_RULE }]
+        "pageRules": [{ type: Schema.Types.ObjectId, ref: MODELNAMES.PAGE_RULE }],
+        "subscribers" : [{type: String}]
       }, schemaOptions);
@@ -79,8 +81,15 @@
         "css" : {type : String, required:true, default: "/*Error Generating Appforms CSS*/"},
-        "logo": String,
+        "logo": {
+          "base64String": {type: String, required: true},
+          "height": {type: String, required: true},
+          "width": {type: String, required: true}
+        },
         "colours": {
           "buttons": {
             "navigation": {type: String, required: true},
+            "navigation_active" : {type: String, required: true},
             "action": {type: String, required: true},
-            "cancel": {type: String, required: true}
+            "action_active" : {type: String, required: true},
+            "cancel": {type: String, required: true},
+            "cancel_active" : {type: String, required: true}
           },
@@ -94,3 +103,9 @@ "backgrounds": {
             "fieldInput": {type: String, required: true},
-            "fieldInstructions": {type: String, required: true}
+            "fieldInstructions": {type: String, required: true},
+            "error" : {type: String, required: true},
+            "progress_steps" : {type: String, required: true},
+            "progress_steps_number_container" : {type: String, required: true},
+            "progress_steps_number_container_active" : {type: String, required: true},
+            "field_required" : {type: String, required: true},
+            "section_area" : {type: String, required: true}
           }
@@ -111,2 +126,14 @@ },
           },
+          "page_title": {
+            "fontFamily": {type: String, required: true},
+            "fontStyle": {type: String, required: true, enum: ["normal", "bold", "italic"]},
+            "fontSize": {type: String, required: true},
+            "fontColour": {type: String, required: true}
+          },
+          "page_description": {
+            "fontFamily": {type: String, required: true},
+            "fontStyle": {type: String, required: true, enum: ["normal", "bold", "italic"]},
+            "fontSize": {type: String, required: true},
+            "fontColour": {type: String, required: true}
+          },
           "fieldTitle": {
@@ -135,2 +162,38 @@ "fontFamily": {type: String, required: true},
             "fontColour": {type: String, required: true}
+          },
+          "buttons_active": {
+            "fontFamily": {type: String, required: true},
+            "fontStyle": {type: String, required: true, enum: ["normal", "bold", "italic"]},
+            "fontSize": {type: String, required: true},
+            "fontColour": {type: String, required: true}
+          },
+          "error" : {
+            "fontFamily": {type: String, required: true},
+            "fontStyle": {type: String, required: true, enum: ["normal", "bold", "italic"]},
+            "fontSize": {type: String, required: true},
+            "fontColour": {type: String, required: true}
+          },
+          "section_break_title" : {
+            "fontFamily": {type: String, required: true},
+            "fontStyle": {type: String, required: true, enum: ["normal", "bold", "italic"]},
+            "fontSize": {type: String, required: true},
+            "fontColour": {type: String, required: true}
+          },
+          "section_break_description" : {
+            "fontFamily": {type: String, required: true},
+            "fontStyle": {type: String, required: true, enum: ["normal", "bold", "italic"]},
+            "fontSize": {type: String, required: true},
+            "fontColour": {type: String, required: true}
+          },
+          "progress_steps_number_container": {
+            "fontFamily": {type: String, required: true},
+            "fontStyle": {type: String, required: true, enum: ["normal", "bold", "italic"]},
+            "fontSize": {type: String, required: true},
+            "fontColour": {type: String, required: true}
+          },
+          "progress_steps_number_container_active": {
+            "fontFamily": {type: String, required: true},
+            "fontStyle": {type: String, required: true, enum: ["normal", "bold", "italic"]},
+            "fontSize": {type: String, required: true},
+            "fontColour": {type: String, required: true}
           }
@@ -158,2 +221,22 @@ },
             "colour": {type: String, required: true}
+          },
+          "error" : {
+            "thickness": {type: String, required: true, enum: ["none", "hairline", "thin", "medium", "thick"]},
+            "style": {type: String, required: true, enum: ["solid", "dotted", "dashed", "double"]},
+            "colour": {type: String, required: true}
+          },
+          "progress_steps" : {
+            "thickness": {type: String, required: true, enum: ["none", "hairline", "thin", "medium", "thick"]},
+            "style": {type: String, required: true, enum: ["solid", "dotted", "dashed", "double"]},
+            "colour": {type: String, required: true}
+          },
+          "progress_steps_number_container" : {
+            "thickness": {type: String, required: true, enum: ["none", "hairline", "thin", "medium", "thick"]},
+            "style": {type: String, required: true, enum: ["solid", "dotted", "dashed", "double"]},
+            "colour": {type: String, required: true}
+          },
+          "progress_steps_number_container_active" : {
+            "thickness": {type: String, required: true, enum: ["none", "hairline", "thin", "medium", "thick"]},
+            "style": {type: String, required: true, enum: ["solid", "dotted", "dashed", "double"]},
+            "colour": {type: String, required: true}
           }
@@ -173,2 +256,9 @@ }
 
+      var groupsSchema = new Schema({
+        "name": {type: String, required: true},
+        "users" : [{ type: String, required: true}],
+        "forms": [{ type: Schema.Types.ObjectId, ref: MODELNAMES.FORM, required: true}],
+        "apps" : [{ type: String, required: true}],
+        "themes": [{ type: Schema.Types.ObjectId, ref: MODELNAMES.THEME, required: true}]
+      }, schemaOptions);
 
@@ -222,8 +312,9 @@ var formFieldsSchema = new Schema({
       conn.model(MODELNAMES.FORM_SUBMISSION, formSubmissionSchema);
+      conn.model(MODELNAMES.GROUPS, groupsSchema);
     },
     "get": function(conn, modelName){
-      return conn.model(modelName)
+      return conn.model(modelName);
     },
     "MODELNAMES": MODELNAMES
-  }
-}
+  };
+};

lib/common/themeCSSGenerator.js

@@ -7,55 +7,41 @@
   "logo" : function(themeJSON){
-    var logoStr = "background-image:url(\"data:image/png;base64,";
-    if(themeJSON.logo){
-      logoStr = logoStr.concat(themeJSON.logo.toString());
+    var logoStr = "";
+    var base64Image = themeJSON.logo.base64String;
+    var imageHeight = themeJSON.logo.height;
+    var imageWidth = themeJSON.logo.width;
+
+
+    if(base64Image){
+      logoStr += "background-image: url(\"" + base64Image + "\");";
+      logoStr += "height: " + imageHeight + "px;";
+      logoStr += "width:" + imageWidth + "px;";
+      return logoStr;
     } else {
       return "";
     }
-
-    logoStr = logoStr.concat("\");");
-    return logoStr;
   },
   "button_navigation" : function(themeJSON){
-    var navButtonStr = "";
-
-    if(themeJSON.colours.buttons.navigation){
-      navButtonStr = navButtonStr.concat(this.getBackgroundColour(themeJSON.colours.buttons.navigation));
-    } else {
-      return null;
-    }
-
-    navButtonStr = navButtonStr.concat(this.getButtonFont(themeJSON));
-
-    return navButtonStr;
+    return this.get_button_css(themeJSON, "navigation", "buttons");
   },
+  "button_navigation_active" : function(themeJSON){
+    return this.get_button_css(themeJSON, "navigation_active", "buttons_active");
+  },
   "button_action" : function(themeJSON){
-    var actionButtonStr = "";
-
-    if(themeJSON.colours.buttons.action){
-      actionButtonStr = actionButtonStr.concat(this.getBackgroundColour(themeJSON.colours.buttons.action));
-    } else {
-      return null;
-    }
-
-    actionButtonStr = actionButtonStr.concat(this.getButtonFont(themeJSON));
-    return actionButtonStr;
+    return this.get_button_css(themeJSON, "action", "buttons");
   },
+  "button_action_active" : function(themeJSON){
+    return this.get_button_css(themeJSON, "action_active", "buttons");
+  },
   "button_cancel" : function(themeJSON){
-    var cancelButtonStr = "";
-
-    if(themeJSON.colours.buttons.cancel){
-      cancelButtonStr = cancelButtonStr.concat(this.getBackgroundColour(themeJSON.colours.buttons.cancel));
-    } else {
-      return null;
-    }
-
-    cancelButtonStr = cancelButtonStr.concat(this.getButtonFont(themeJSON));
-
-    return cancelButtonStr;
+    return this.get_button_css(themeJSON, "cancel", "buttons");
   },
+  "button_cancel_active" : function(themeJSON){
+    return this.get_button_css(themeJSON, "cancel_active", "buttons");
+  },
   "navigation" : function(themeJSON){
     var navigationBarStr = "";
+    var navigationBarColour = themeJSON.colours.backgrounds.navigationBar;
 
-    if(themeJSON.colours.backgrounds.navigationBar){
-      navigationBarStr = navigationBarStr.concat(this.getBackgroundColour(themeJSON.colours.backgrounds.navigationBar));
+    if(navigationBarColour){
+      navigationBarStr = navigationBarStr.concat(this.getBackgroundColour(navigationBarColour));
     } else {
@@ -130,5 +116,7 @@ return null;
     var fieldAreaStr = "";
+    var fieldAreaBorder = themeJSON.borders.fieldArea;
+    var fieldAreaBackgroundColor = themeJSON.colours.backgrounds.fieldArea;
 
-    if(themeJSON.colours.backgrounds.fieldArea){
-      fieldAreaStr = fieldAreaStr.concat(this.getBackgroundColour(themeJSON.colours.backgrounds.fieldArea));
+    if(fieldAreaBackgroundColor){
+      fieldAreaStr = fieldAreaStr.concat(this.getBackgroundColour(fieldAreaBackgroundColor));
     } else {
@@ -138,4 +126,4 @@ return null;
 
-    if(themeJSON.borders.fieldArea){
-      fieldAreaStr = fieldAreaStr.concat(this.getBorder(themeJSON.borders.fieldArea));
+    if(fieldAreaBorder){
+      fieldAreaStr = fieldAreaStr.concat(this.getBorder(fieldAreaBorder));
     } else {
@@ -147,2 +135,15 @@ return null;
   },
+  "field_area_last_child" : function(themeJSON){
+    //Needs to inherit the border styling from fh_appform_field_area
+    var fieldAreaLastStr = "";
+    var fieldAreaBorder = themeJSON.borders.fieldArea;
+
+    if(fieldAreaBorder){
+      fieldAreaLastStr = fieldAreaLastStr.concat(this.getBorder(fieldAreaBorder));
+    } else {
+      return null;
+    }
+
+    return fieldAreaLastStr;
+  },
   "field_input": function(themeJSON){
@@ -182,3 +183,3 @@ var fieldInputStr = "";
   },
-  "field_instructions": function(themeJSON){
+  "field_instructions": function(themeJSON){ //TODO Functionalise this
     var fieldInstructionsStr = "";
@@ -247,9 +248,200 @@
   },
-  "getButtonFont" : function(themeJSON){
+  "error" : function(themeJSON){
+    var errCss = "";
+
+    var errorTypography = themeJSON.typography.error;
+    var errorColor = themeJSON.colours.backgrounds.error;
+    var errorBorder = themeJSON.borders.error;
+
+    if(errorTypography){
+      if(this.getFontDetails(errorTypography) != null){
+        errCss = errCss.concat(this.getFontDetails(errorTypography));
+      } else {
+        return null;
+      }
+    } else {
+      return null;
+    }
+
+    if(errorColor){
+      errCss = errCss.concat(this.getBackgroundColour(errorColor));
+    } else {
+      return null;
+    }
+
+    if(errorBorder){
+      errCss = errCss.concat(this.getBorder(errorBorder));
+    } else {
+      return null;
+    }
+
+    return errCss;
+  },
+  "field_section_break_title": function(themeJSON){
+    var sectionBreakTitleCSS = "";
+    var sectionBreakTitleTypography = themeJSON.typography.section_break_title;
+
+    if(sectionBreakTitleTypography){
+      sectionBreakTitleCSS = sectionBreakTitleCSS.concat(this.getFontDetails(sectionBreakTitleTypography));
+    } else {
+      return null;
+    }
+
+    return sectionBreakTitleCSS;
+  },
+  "field_section_break_description": function(themeJSON){
+    var sectionBreakDescriptionCSS = "";
+    var sectionBreakDescriptionTypography = themeJSON.typography.section_break_description;
+
+    if(sectionBreakDescriptionTypography){
+      sectionBreakDescriptionCSS = sectionBreakDescriptionCSS.concat(this.getFontDetails(sectionBreakDescriptionTypography));
+    } else {
+      return null;
+    }
+
+    return sectionBreakDescriptionCSS;
+  },
+  "page_title" : function(themeJSON){
+    var pageTitleCSS = "";
+    var pageTitleTypography = themeJSON.typography.page_title;
+
+    if(pageTitleTypography){
+      pageTitleCSS = pageTitleCSS.concat(this.getFontDetails(pageTitleTypography));
+    } else {
+      return null;
+    }
+
+    return pageTitleCSS;
+  },
+  "page_description" : function(themeJSON){
+    var pageDescriptionCSS = "";
+    var pageDescriptionTypography = themeJSON.typography.page_description;
+
+    if(pageDescriptionTypography){
+      pageDescriptionCSS = pageDescriptionCSS.concat(this.getFontDetails(pageDescriptionTypography));
+    } else {
+      return null;
+    }
+
+    return pageDescriptionCSS;
+  },
+  "progress_wrapper" : function(themeJSON){
+    //No generated css for the progress_wrapper
+    return "";
+  },
+  "progress_steps" : function(themeJSON){
+    var progressStepsCSS = "";
+    var progressStepsBackground = themeJSON.colours.backgrounds.progress_steps;
+    var progressStepsBorder = themeJSON.borders.progress_steps;
+    if(progressStepsBackground){
+      progressStepsCSS = progressStepsCSS.concat(this.getBackgroundColour(progressStepsBackground));
+    } else {
+      return null;
+    }
+
+    if(progressStepsBorder){
+      progressStepsCSS = progressStepsCSS.concat(this.getBorder(progressStepsBorder));
+    } else {
+      return null;
+    }
+
+
+    return progressStepsCSS;
+
+  },
+  "progress_steps_number_container" : function(themeJSON){
+    var progressStepsContainerCSS = "";
+    var progressStepsContainerBackground = themeJSON.colours.backgrounds.progress_steps_number_container;
+    var progressStepsContainerBorder = themeJSON.borders.progress_steps_number_container;
+    var progressStepsContainerTypography = themeJSON.typography.progress_steps_number_container;
+
+    if(progressStepsContainerBackground){
+      progressStepsContainerCSS = progressStepsContainerCSS.concat(this.getBackgroundColour(progressStepsContainerBackground));
+    } else {
+      return null;
+    }
+
+    if(progressStepsContainerBorder){
+      progressStepsContainerCSS = progressStepsContainerCSS.concat(this.getBorder(progressStepsContainerBorder));
+    } else {
+      return null;
+    }
+
+    if(progressStepsContainerTypography){
+      progressStepsContainerCSS = progressStepsContainerCSS.concat(this.getFontDetails(progressStepsContainerTypography));
+    } else {
+      return null;
+    }
+
+    return progressStepsContainerCSS;
+  },
+  "progress_steps_number_container_active" : function(themeJSON){
+    var progressStepsContainerActiveCSS = "";
+    var progressStepsContainerActiveBackground = themeJSON.colours.backgrounds.progress_steps_number_container_active;
+    var progressStepsContainerActiveBorder = themeJSON.borders.progress_steps_number_container_active;
+    var progressStepsContainerActiveTypography = themeJSON.typography.progress_steps_number_container_active;
+
+    if(progressStepsContainerActiveBackground){
+      progressStepsContainerActiveCSS = progressStepsContainerActiveCSS.concat(this.getBackgroundColour(progressStepsContainerActiveBackground));
+    } else {
+      return null;
+    }
+
+    if(progressStepsContainerActiveBorder){
+      progressStepsContainerActiveCSS = progressStepsContainerActiveCSS.concat(this.getBorder(progressStepsContainerActiveBorder));
+    } else {
+      return null;
+    }
+
+    if(progressStepsContainerActiveTypography){
+      progressStepsContainerActiveCSS = progressStepsContainerActiveCSS.concat(this.getFontDetails(progressStepsContainerActiveTypography));
+    } else {
+      return null;
+    }
+
+    return progressStepsContainerActiveCSS;
+  },
+  "field_required": function(themeJSON){
+    //Required is a bit special --> it has a color associated with it only. Also has the 'content' bit. Stored in colours.backgrounds.
+    var requiredCSS = "";
+    var requiredColour = themeJSON.colours.backgrounds.field_required;
+
+    //Background Color -->set to set the text color.
+    if(requiredColour){
+      requiredCSS = this.getBackgroundColour(requiredColour);
+    } else {
+      return null;
+    }
+
+    return requiredCSS;
+  },
+  "action_bar" : function(themeJSON){
+    //No theme generation needed for the fh_appform_action_bar.
+    return "";
+  },
+  "section_area" : function(themeJSON){
+    var sectionCSSString = "";
+
+    var sectionBackgroundColour = themeJSON.colours.backgrounds.section_area;
+
+    if(sectionBackgroundColour){
+      sectionCSSString += this.getBackgroundColour(sectionBackgroundColour);
+    } else {
+      return null;
+    }
+
+    return sectionCSSString;
+  },
+  "hidden" : function(themeJSON){
+    return "";
+  },
+  "getButtonFont" : function(themeJSON, active){
     var buttonFontCSS = "";
+    var buttonName = active ? active : "buttons";
+    var buttonTypography = themeJSON.typography[buttonName];
 
-    if(themeJSON.typography.buttons){
+    if(buttonTypography){
 
-      if(this.getFontDetails(themeJSON.typography.buttons) != null){
-        buttonFontCSS = buttonFontCSS.concat(this.getFontDetails(themeJSON.typography.buttons));
+      if(this.getFontDetails(buttonTypography) != null){
+        buttonFontCSS = buttonFontCSS.concat(this.getFontDetails(buttonTypography));
       } else {
@@ -268,3 +460,7 @@ return null;
     if(borderField.thickness){
-      borderStr = borderStr.concat("border-width:" + borderField.thickness + ";" );
+      if(borderField.thickness == "none"){
+        return borderStr.concat("border:" + borderField.thickness + ";" );
+      } else {
+        borderStr = borderStr.concat("border-width:" + borderField.thickness + ";" );
+      }
     } else {
@@ -329,3 +525,21 @@ return null;
   "getBackgroundColour" : function(colourField){
-    return "background-color:" + colourField + ";"
+    return "background-color:" + colourField + ";";
+  },
+  "getButtonBorder" : function(buttonColor){
+    return "border: 1px solid " + buttonColor + ";";
+  },
+  "get_button_css": function(themeJSON, button_name, button_font){
+    var buttonStr = "";
+    var buttonColor = themeJSON.colours.buttons[button_name];
+
+    if(buttonColor){
+      buttonStr = buttonStr.concat(this.getBackgroundColour(buttonColor));
+      buttonStr = buttonStr.concat(this.getButtonBorder(buttonColor));
+    } else {
+      return null;
+    }
+
+    buttonStr = buttonStr.concat(this.getButtonFont(themeJSON, button_font));
+
+    return buttonStr;
   }
@@ -337,17 +551,314 @@ };
 
+  //All of these have to build values that are customizable.
   generatedCSSJSON[FH_APPFORM_PREFIX] = {
-    "logo" : "",
-    "button_navigation" : "",
-    "button_action" : "",
-    "button_cancel" : "",
-    "navigation" : "",
-    "header" : "",
-    "body" : "",
-    "form" : "",
-    "field_title": "",
-    "field_area": "",
-    "field_input": "",
-    "field_instructions": "",
-    "title": "",
-    "description": ""
+    "button_navigation" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "border-radius": "5px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "button_navigation_active": {
+      "generatedCSS": "",
+      "parentClass" : "button_navigation",
+      "staticCSSAdditions": {
+        "border-radius": "5px"
+      },
+      "classNameAdditions": [":active"],
+      "classAdditions": {}
+    },
+    "button_action" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "border-radius": "5px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {
+        ".special_button" :{
+          "width": "100%",
+          "margin-top": "10px",
+          "line-height": "28px"
+        },
+        ".special_button.fh_appform_removeInputBtn" :{
+          "width": "50%",
+          "margin-top": "10px",
+          "line-height": "28px"
+        },
+        ".special_button.fh_appform_addInputBtn" :{
+          "width": "50%",
+          "margin-top": "10px",
+          "line-height": "28px"
+        }
+      }
+    },
+    "button_action_active" : {
+      "generatedCSS": "",
+      "parentClass" : "button_action",
+      "staticCSSAdditions": {
+        "border-radius": "5px"
+      },
+      "classNameAdditions": [":active"],
+      "classAdditions": {}
+    },
+    "button_cancel" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "border-radius": "5px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "button_cancel_active" : {
+      "generatedCSS": "",
+      "parentClass" : "button_cancel",
+      "staticCSSAdditions": {
+        "border-radius": "5px"
+      },
+      "classNameAdditions": [":active"],
+      "classAdditions": {}
+    },
+    "navigation" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {},
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "header" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {},
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "body" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {},
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "form" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "padding": "5px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "field_title": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "display": "block"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {
+        ".fh_appform_field_numbering":{
+          "display" : "inline-block"
+        }
+      }
+    },
+    "field_area": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "padding": "5px",
+        "border-bottom": "none",
+        "border-radius": "5px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {
+        ":last-child" : {
+          "inheritedCSS" : themeCSSFunctions[FH_APPFORM_PREFIX].field_area_last_child(themeJSON)
+        },
+        ".fh_appform_field_section_break" : {
+          "border" : "none",
+          "background" : "transparent"
+        }
+      }
+    },
+    "field_input": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "width": "100%",
+        "border-radius": "5px",
+        "line-height": "1.4em",
+        "padding": "5px 0px 5px 5px"
+      },
+      "classNameAdditions": [],
+      "classNameAdditionsChildren": [],
+      "classAdditions": {
+        " .radio": {
+          "margin-right": "10px"
+        },
+        " .checkbox": {
+          "margin-right": "10px",
+          "display" : "inline"
+        }," .choice": {
+          "margin-right" : "10px",
+          "display" : "inline"
+        }
+      }
+    },
+    "field_instructions": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "margin-bottom": "10px",
+        "border-radius": "5px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "title": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "text-align": "center"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "description": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "text-align": "center"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "error": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "field_section_break_title": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "text-align" : "center"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "field_section_break_description": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "text-align" : "center"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "page_title": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {},
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "page_description" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {},
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "progress_wrapper" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "padding-top": "20px",
+        "padding-bottom": "10px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+  },
+    "progress_steps" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "width" : "100%"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {
+        " td": {
+          "text-align": "center"
+        },
+        " td .active .page_title": {
+          "text-align": "center"
+        },
+        " .page_title" : {
+          "padding-left": "10px",
+          "display": "none"
+        },
+        " .number" : {
+          "padding-top": "4px"
+        }
+      }
+    },
+    "progress_steps_number_container" : {
+      "generatedCSS": "",
+      "parentClass" : "progress_steps",
+      "staticCSSAdditions": {
+        "display": "inline-block",
+        "border-radius": "13px",
+        "padding-left": "10px",
+        "padding-right": "10px",
+        "margin-top": "5px",
+        "margin-bottom" : "5px"
+      },
+      "classNameAdditions": [" .number_container"],
+      "classAdditions": {}
+    },
+    "progress_steps_number_container_active" : {
+      "generatedCSS": "",
+      "parentClass" : "progress_steps",
+      "staticCSSAdditions": {},
+      "classNameAdditions": [" td.active .number_container"],
+      "classAdditions": {}
+    },
+    "field_required" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "content": "' *'",
+        "display" : "inline"
+      },
+      "classNameAdditions": [":first-child:after"],
+      "classAdditions": {}
+    },
+    "action_bar": {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "padding": "18px 20px 18px 20px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {
+        " button.fh_appform_two_button" : {
+          "width": "50%"
+        },
+        " button.fh_appform_three_button" : {
+          "width": "33.3%"
+        }
+      }
+    },
+    "section_area" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "padding": "5px",
+        "border-radius": "5px",
+        "margin-top": "5px"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "hidden" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "display": "none"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    },
+    "logo" : {
+      "generatedCSS": "",
+      "staticCSSAdditions": {
+        "background-position" : "center",
+        "background-repeat" : "no-repeat",
+        "width" : "100%"
+      },
+      "classNameAdditions": [],
+      "classAdditions": {}
+    }
   };
@@ -357,2 +868,4 @@
 
+    var fullThemeCSSString = "";
+
     for(var cssClass in generatedCSSJSON[FH_APPFORM_PREFIX]){
@@ -366,16 +879,69 @@ var generatedCSS = themeCSSFunctions[FH_APPFORM_PREFIX][cssClass](themeJSON);
 
-      generatedCSSJSON[FH_APPFORM_PREFIX][cssClass] = generatedCSS;
-    }
+      var cssClassInfo = generatedCSSJSON[FH_APPFORM_PREFIX][cssClass];
 
-    //Finished generating css --> now combine all of the strings
+      //Have generated all of the css dynamic content, need to add in the static content.
+      generatedCSS += getStaticCSSString(cssClassInfo.staticCSSAdditions);
 
-    var cssStr = "";
-    for(var cssClass in generatedCSSJSON[FH_APPFORM_PREFIX]){
-      cssStr += "." + FH_APPFORM_PREFIX + cssClass + "{" + generatedCSSJSON[FH_APPFORM_PREFIX][cssClass] + "}";
+//      if(cssClass == "button_navigation"){
+//        console.log("generatedCSS", generatedCSS);
+//      }
+
+      var cssStr = "";
+      var printCSSClass = cssClassInfo.parentClass ? cssClassInfo.parentClass : cssClass;
+      var cssClassName = ".fh_appform_container " + "." + FH_APPFORM_PREFIX + printCSSClass;
+      var classNameAdditions = "";
+
+      //Building the css class name
+      var classAdditionIndex;
+      for(classAdditionIndex=0; classAdditionIndex < generatedCSSJSON[FH_APPFORM_PREFIX][cssClass].classNameAdditions.length; classAdditionIndex++){
+        classNameAdditions += generatedCSSJSON[FH_APPFORM_PREFIX][cssClass].classNameAdditions[classAdditionIndex];
+      }
+
+      if(generatedCSSJSON[FH_APPFORM_PREFIX][cssClass].classNameAdditionsChildren){
+        for(classAdditionIndex=0; classAdditionIndex < generatedCSSJSON[FH_APPFORM_PREFIX][cssClass].classNameAdditionsChildren.length; classAdditionIndex++){
+          classNameAdditions += cssClassName + generatedCSSJSON[FH_APPFORM_PREFIX][cssClass].classNameAdditionsChildren[classAdditionIndex];
+        }
+      }
+
+      cssStr = cssClassName + classNameAdditions + "{" + generatedCSS + "}";
+
+      fullThemeCSSString += cssStr;
+
+      fullThemeCSSString += generateSubClassCSS(cssClassName, cssClassInfo.classAdditions);
+
+
+      generatedCSSJSON[FH_APPFORM_PREFIX][cssClass].generatedCSS = generatedCSS;
     }
 
-    return cssStr;
+    return fullThemeCSSString;
+  }
 
+  function generateSubClassCSS(superCSSClassName, classAdditions){
+    var subCSSStr = "";
+    for(var subClass in classAdditions){
+      var subClassCSS = "";
+      var subClassName = superCSSClassName + subClass;
+      var subClassDetails = classAdditions[subClass];
+
+      for(var subClassKey in subClassDetails){
+        if(subClassKey != "inheritedCSS"){
+          subClassCSS += subClassKey + ":" + subClassDetails[subClassKey] + ";";
+        } else {
+          subClassCSS += subClassDetails[subClassKey];
+        }
+      }
+
+      subCSSStr += subClassName + "{" + subClassCSS + "}";
+    }
+    return subCSSStr;
   }
 
+  function getStaticCSSString(staticJSON){
+    var staticCSSString = "";
+    for(var styleKey in staticJSON){
+      staticCSSString += styleKey + ":" + staticJSON[styleKey] + ";";
+    }
+    return staticCSSString;
+  }
+
   return processThemeJSON;
@@ -382,0 +948,0 @@ };

lib/forms.js

@@ -5,2 +5,4 @@ var mongoose = require('mongoose');
 var validate = require('./common/validate.js');
+var getForms = require('./impl/getForms.js')();
+var groups = require('./impl/groups.js');
 
@@ -65,3 +67,2 @@ var forms = {
     var self = this;
-
     self.initConnection(options, function(err, connections) {
@@ -72,3 +73,3 @@ if(err) return cb(err);
 
-      return require('./impl/getForms.js')(connections, options, cb);
+      return getForms.getForms(connections, options, cb);
     });
@@ -308,2 +309,22 @@ },
 
+  getNotifications : function(options, cb){
+    var self = this;
+
+    self.initConnection(options, function(err, connections) {
+      if(err) return cb(err);
+
+      return require('./impl/getNotifications.js')(connections, options, cb);
+    });
+  },
+
+  updateNotifications : function(options, subscribers, cb){
+    var self = this;
+
+    self.initConnection(options, function(err, connections) {
+      if(err) return cb(err);
+
+      return require('./impl/updateNotifications.js')(connections, options, subscribers, cb);
+    });
+  },
+
   getFormApps: function(options, cb) {
@@ -347,5 +368,45 @@ var self = this;
     });
+  },
+
+  getAllGroups: function (options, cb) {
+    var self = this;
+    self.initConnection(options, function(err, connections) {
+      if(err) return cb(err);
+      return groups.getAllGroups(connections, options, cb);
+    });
+  },
+
+  getGroup: function (options, params, cb) {
+    var self = this;
+    self.initConnection(options, function(err, connections) {
+      if(err) return cb(err);
+      return groups.getGroup(connections, options, params, cb);
+    });
+  },
+
+  updateGroup: function (options, params, cb) {
+    var self = this;
+    self.initConnection(options, function(err, connections) {
+      if(err) return cb(err);
+      return groups.updateGroup(connections, options, params, cb);
+    });
+  },
+
+  createGroup: function (options, params, cb) {
+    var self = this;
+    self.initConnection(options, function(err, connections) {
+      if(err) return cb(err);
+      return groups.createGroup(connections, options, params, cb);
+    });
+  },
+
+  deleteGroup: function (options, params, cb) {
+    var self = this;
+    self.initConnection(options, function(err, connections) {
+      if(err) return cb(err);
+      return groups.deleteGroup(connections, options, params, cb);
+    });
   }
 };
 
-module.exports = forms;
+module.exports = forms;

lib/impl/appforms.js

 var async = require('async');
 var util = require('util');
 var models = require('../common/models.js')();
+var getForms = require('./getForms.js')();
+var groups = require('./groups.js');
+var _ = require('underscore');
 var validation = require('./../common/validate');
@@ -9,3 +12,75 @@
 exports.getAllAppForms = getAllAppForms;
+exports.getAppFormsWithPopulatedForms = getAppFormsWithPopulatedForms;
 
+function mapArrayOfFormIdsToForms(connections, formsIds, allowedForms, cb) {
+  async.map(formsIds, function(form, cb) {
+    return cb(undefined, form.toString());        // get list of ObjectIDs as strings, to allo filtering
+  }, function (err, stringifiedFormIds) {
+    if (err) return cb(err);
+
+    if (allowedForms) {     // if should restrict access
+      formsToReturn = _.intersection(stringifiedFormIds, allowedForms);
+    } else {
+      formsToReturn = stringifiedFormIds;    // else return all forms
+    }
+    getForms.findForms(connections, formsToReturn, function(err, forms){   // get all forms listed in array
+      if(err) return cb(err);
+
+      return cb(undefined, forms);
+    });
+  });
+}
+
+function getAppFormsWithPopulatedForms(connections, restrictToUser, appid, cb) {
+    var AppForms = models.get(connections.mongooseConnection, models.MODELNAMES.APP_FORMS);
+    async.waterfall([
+      function (cb) {  // ensure user authorised for app before getting list of forms
+        groups.validateAppAllowedForUser(connections, restrictToUser, appid, cb);
+      },
+      function (cb) {  // get forms that user has access to
+        groups.getFormsForUser(connections, restrictToUser, function (err, allowedForms) {
+          var query = {"appId" : appid};
+          AppForms.findOne(query, function (err, appForms) {  // get all forms associated with this app
+            if (err) return cb(err);
+
+            if(!appForms || !appForms.forms) {
+              return cb();
+            }
+            return mapArrayOfFormIdsToForms(connections, appForms.forms, allowedForms, cb);
+          });
+        });
+      }
+    ], cb);
+}
+
+function getAllAppFormsWithPopulatedForms(connections, restrictToUser, cb) {
+    var AppForms = models.get(connections.mongooseConnection, models.MODELNAMES.APP_FORMS);
+    async.waterfall([
+      function (cb) {  // ensure user authorised for app before getting list of forms
+        groups.getAppsForUser(connections, restrictToUser, cb);
+      },
+      function (allowedApps, cb) {
+        var query = {};
+        if (allowedApps) {
+          query.appId = allowedApps;
+        }
+
+        groups.getFormsForUser(connections, restrictToUser, function (err, allowedForms) {
+          AppForms.find(query, function (err, appForms) {  // get all forms associated with this app
+            if (err) return cb(err);
+
+            if(!appForms) {
+              return cb(undefined, null);
+            }
+            async.map(appForms, function (item, cb) {
+              mapArrayOfFormIdsToForms(connections, item.forms, allowedForms, function (err, populatedForms) {
+                return cb(undefined, {_id: item._id, appId: item.appId, forms: populatedForms});
+              });
+            }, cb);
+          });
+        });
+      }
+    ], cb);
+}
+
 /*
@@ -44,14 +119,29 @@ * updateAppForms(connections, options, appForms, cb)
 
-    appFormsModel.findOne({appId:appId}).exec(function (err, af) {
+    groups.validateAppAllowedForUser(connections, options.restrictToUser, appId, function (err) {
       if (err) return cb(err);
-      if (af) {
-        af.forms = appForms.forms;
-        af.save(cb);
-      }else {
-        var afm = new appFormsModel(appForms);
-        afm.save(cb);
-      }
+
+      groups.getFormsForUser(connections, options.restrictToUser, function (err, allowedForms) {
+        if (err) return cb(err);
+
+        if (allowedForms) {
+          var disallowedForms = _.difference(forms, allowedForms);
+          if (disallowedForms.length > 0) {
+            return cb(new Error('No permission for forms: ' + util.inspect(disallowedForms)));
+          } 
+        }
+
+        appFormsModel.findOne({appId:appId}).exec(function (err, af) {
+          if (err) return cb(err);
+          if (af) {
+            af.forms = appForms.forms;
+            af.save(cb);
+          } else {
+            var afm = new appFormsModel(appForms);
+            afm.save(cb);
+          }
+        });
+      });
     });
   });
-};
+}
 
@@ -77,9 +167,10 @@ /*
 function getAppFormsForApp(connections, options, cb) {
-  var conn = connections.mongooseConnection;
-  var appFormsModel = models.get(conn, models.MODELNAMES.APP_FORMS);
-  appFormsModel.findOne({appId: options.appId}).populate('forms').exec(function (err, af) {
+  getAppFormsWithPopulatedForms(connections, options.restrictToUser, options.appId, function (err, forms) {
     if (err) return cb(err);
-    return cb(null, af);
+    return cb(undefined, {
+      _id: options.appId,
+      forms: forms
+    });
   });
-};
+}
 
@@ -103,8 +194,3 @@ /*
 function getAllAppForms(connections, options, cb) {
-  var conn = connections.mongooseConnection;
-  var appFormsModel = models.get(conn, models.MODELNAMES.APP_FORMS);
-  appFormsModel.find().populate('forms').exec(function (err, afs) {
-    if (err) return cb(err);
-    return cb(null, afs || []); // Note: purposely returning empty array here for now, maybe this should be null instead?
-  });
-};
+  return getAllAppFormsWithPopulatedForms(connections, options.restrictToUser, cb);
+}

lib/impl/deleteForm.js

 var models = require('../common/models.js')();
 var validate = require('../common/validate.js');
+var groups = require('./groups.js');
 var async = require('async');
@@ -8,7 +9,7 @@ var util = require('util');
 
-  async.series([validateParams, deleteFormUsingId], cb);
+  async.series([validateParams, validateGroupAccessToForm, deleteFormUsingId], cb);
 
   function validateParams(cb){
-    var validateParams = validate(options);
-    validateParams.has("_id", function(failure){
+    var paramsValidator = validate(options);
+    paramsValidator.has("_id", function(failure){
       if(failure){
@@ -20,4 +21,8 @@ return cb(new Error("Invalid params to deleteForm. No form Id specified."));
     });
-  };
+  }
 
+  function validateGroupAccessToForm(cb) {
+    return groups.validateFormAllowedForUser(connections, options.restrictToUser, options._id, cb);
+  }
+
   // updates to AppForms sub collection
@@ -40,6 +45,6 @@ function updateAppForms(formId, cb) {
         });
-      };
+      }
       async.map(apps, removeAppForm, cb);
     });
-  };
+  }
 
@@ -54,3 +59,3 @@ // delete submissions for this form
     .exec(cb);
-  };
+  }
 
@@ -61,21 +66,22 @@ function deleteFormUsingId(cb){
 
-    // first remove the form itself
-    formModel.findById(formId).remove().exec(function(err, data){
+    async.series([
+      function (cb) { // first remove the form itself
+        return formModel.findById(formId).remove().exec(cb);
+      },
+      function (cb) { // then remove the AppForms
+        updateAppForms(formId, cb);
+      },
+      function (cb) { // remove deleted from from any groups
+        groups.removeFormFromAllGroups(connections, formId, cb);
+      },
+      function (cb) { // remove submissions
+        deleteSubmissions(formId, cb);
+      }
+    ], function (err) {
       if (err) return cb(err);
-
-      // then remove the AppForms
-      updateAppForms(formId, function(err){
-        if (err) return cb(err);
-
-        // remove submissions
-        deleteSubmissions(formId, function(err) {
-          if (err) return cb(err);
-
-          return cb(null, data);
-        });
-      });
+      return cb(null);
     });
-  };
+  }
 };
 
 module.exports = deleteForm;

lib/impl/deleteTheme.js

 var util = require('util');
 var models = require('../common/models.js')();
 var validate = require('../common/validate.js');
+var groups = require('./groups.js');
 var async = require('async');
 
 module.exports = function (connections, options, cb) {
-  async.waterfall([
+  async.series([
     async.apply(validateParams, options),
+    async.apply(groups.validateThemeAllowedForUser, connections, options.restrictToUser, options._id),
     deleteTheme
@@ -18,3 +20,3 @@ ], cb);
       } else {
-        return cb(undefined, options._id);
+        return cb(undefined);
       }
@@ -24,5 +26,5 @@ });
 
-  function deleteTheme(themeId, cb){
+  function deleteTheme(cb){
     var themeModel = models.get(connections.mongooseConnection, models.MODELNAMES.THEME);
-
+    var themeId = options._id;
     themeModel.findById(themeId).remove().exec(function(err, theme){
@@ -32,3 +34,5 @@ if(err) return cb(err);
       if(theme !== null){
-        return cb(undefined, JSON.stringify(theme));
+        groups.removeThemeFromAllGroups(connections, themeId, function (err) {
+          return cb(undefined, JSON.stringify(theme));
+        });
       } else {
@@ -35,0 +39,0 @@ return cb(new Error("No theme matches appId " + options.appId));

lib/impl/formapps.js

 var async = require('async');
 var util = require('util');
 var models = require('../common/models.js')();
+var groups = require('./groups.js');
 var validation = require('./../common/validate');
@@ -36,8 +37,20 @@
     var formId = options.formId;
+    var restrictToUser = options.restrictToUser;
 
-    appFormsModel.find({forms: formId}).exec(function (err, apps) {
+    groups.validateFormAllowedForUser(connections, restrictToUser, formId, function (err) {
       if (err) return cb(err);
-      return cb(null, apps);
+
+      groups.getAppsForUser(connections, restrictToUser, function (err, allowedApps) {
+        var query = {forms: formId};
+        if(allowedApps) {
+          query.apps = {$in: allowedApps};
+        }
+        appFormsModel.find(query).exec(function (err, apps) {
+          if (err) return cb(err);
+          return cb(null, apps);
+        });
+      });
+
     });
   });
 };

lib/impl/getForm.js

 var models = require('../common/models.js')();
 var validate = require('../common/validate.js');
 var async = require('async');
+var groups = require('./groups.js');
 
 var getForm = function(connections, options, cb) {
-  var populatedForms = undefined;
-  var resultJSON = undefined;
-
-
-
-  async.series([validateParams, getFormUsingId, constructResultJSON], function(err){
+  async.waterfall([validateParams, getFormUsingId, constructResultJSON], function(err, resultJSON){
     return cb(err, resultJSON);
@@ -16,18 +12,18 @@ });
   function validateParams(cb){
-    var validateParams = validate(options);
+    var paramsValidator = validate(options);
 
     if(!(options.getAllForms === true)){
-      validateParams.has("_id", function(failure){
+      paramsValidator.has("_id", function(failure){
         if(failure){
           return cb(new Error("Invalid params to getForm. FormId Not specified"));
         } else {
-          return cb();
+          return cb(undefined, options._id.toString());
         }
       });
     } else {
-      return cb();
+      return cb(undefined, null);
     }
   }
 
-  function getFormUsingId(cb){
+  function getFormUsingId(formId, cb){
     var Form = models.get(connections.mongooseConnection, models.MODELNAMES.FORM);
@@ -38,29 +34,40 @@ var Page = models.get(connections.mongooseConnection, models.MODELNAMES.PAGE);
 
-    if(options.getAllForms === true){
-      query = {}
-    }else{
-      query = {"_id": options._id};
-    }
+    groups.getFormsForUser(connections, options.restrictToUser, function (err, allowedForms) {
+      if (err) return cb(err);
 
-    Form.find(query).populate("pages", "-__v").populate("pageRules", "-__v").populate("fieldRules", "-__v").select("-__v").exec(function(err, formResults){
-      if(err) return cb(err);
-
-
-      if((formResults === null || formResults === undefined) && !(options.getAllForms === true)){
-        return cb(new Error("No form exists matching id " + options._id));
+      if (!options.getAllForms) {      // single form requested
+        query = {"_id": formId};
+        if (allowedForms) {            // if this user is restricted
+          if (allowedForms.indexOf(formId) < 0) {   // check if requested if in allowed list
+            return cb(new Error("Not allowed access to that form: " + formId));
+          }
+        }
+      } else {
+        if (options.getAllForms && allowedForms) {
+          query._id = { $in: allowedForms};
+        } else {
+          query = {};
+        }
       }
 
-      //Now have a form with all pages, pageRules and fieldRules populated
-      Form.populate(formResults, {"path": "pages.fields", "model": Field, "select": "-__v"}, function(err, updatedForms){
+      Form.find(query).populate("pages", "-__v").populate("pageRules", "-__v").populate("fieldRules", "-__v").select("-__v").exec(function(err, formResults){
         if(err) return cb(err);
 
 
-        populatedForms = updatedForms;
+        if((formResults === null || formResults === undefined) && !(options.getAllForms === true)){
+          return cb(new Error("No form exists matching id " + options._id));
+        }
 
-        cb();
+        //Now have a form with all pages, pageRules and fieldRules populated
+        Form.populate(formResults, {"path": "pages.fields", "model": Field, "select": "-__v"}, function(err, updatedForms){
+          if(err) return cb(err);
+
+          cb(undefined, updatedForms);
+        });
       });
-    });
+    });    
   }
 
-  function constructResultJSON(cb){
+  function constructResultJSON(populatedForms, cb){
+    var resultJSON;
 
@@ -76,4 +83,2 @@ if(!(options.getAllForms === true)){
 
-
-
     async.eachSeries(populatedForms, function(formToReturn, cb){
@@ -112,3 +117,6 @@ var pageRef = {};
       return cb();
-    }, cb);
+    }, function (err) {
+      if (err) return cb(err);
+      return cb(undefined, resultJSON);
+    });
   }
@@ -115,0 +123,0 @@

lib/impl/getForms.js

@@ -1,124 +0,141 @@
-var models = require('../common/models.js')();
-var validate = require('../common/validate.js');
-var async = require('async');
+module.exports = function () {
+  var models = require('../common/models.js')();
+  var validate = require('../common/validate.js');
+  var async = require('async');
+  var _ = require('underscore');
+  var groups = require('./groups.js');
+  var appforms = require('./appforms.js');
 
-var getForms = function(connections, options, cb) {
+  function findForms(connections, listOfIds, cb) {
+    var Form = models.get(connections.mongooseConnection, models.MODELNAMES.FORM);
 
-  var foundAppForms = undefined;
-  var resJSON = undefined;
-  var formStatistics = {}; //Form statistics is
-
-  async.series([validateParams, getFormsForAppId, buildFormStatistics, constructResultJSON], function(err){
-    if(err) {
-      return cb(err);
-    } else {
-      return cb(undefined, resJSON);
+    var query;
+    if (listOfIds) {
+      query = {_id: { $in: listOfIds}};
+    } else {    // if list not passed, get all forms
+      query = {};
     }
-  });
-
-  function buildFormStatistics(cb){
-
-    //If not getting all of the forms, do not populate statistics...
-    if(!(options.getAllForms === true)){
-      return cb();
-    }
-
-    async.eachSeries(foundAppForms, function(appForm, cb){
-      formStatistics[appForm._id] = {};
-      formStatistics[appForm._id].appsUsingForm = 12; //TODO --THIS IS DUMMY DATA. NEED TO DO ACUTAL STATISTICS
-      formStatistics[appForm._id].submissionsToday = 33; //TODO -- THIS IS DUMMY DATA. NEED TO DO ACTUAL STATISTICS
-      formStatistics[appForm._id].submissionsTotal = 22; //TODO -- THIS IS DUMMY DATA. NEED TO DO ACTUAL STATISTICS
-      cb();
-    }, cb);
+    Form.find(query).exec(cb);
   }
 
-  function validateParams(cb){
-    var val = validate(options);
+  function getForms(connections, options, cb) {
 
-    //If the getAllForms parameter is set to true, then the appId will not be included.
-    if(options.getAllForms === true){
-      return cb();
-    }
+    var foundAppForms;
+    var resJSON;
+    var formStatistics = {}; //Form statistics is
 
-    val.has("appId", function(failed){
-      if(failed){
-        return cb(new Error("Invalid parameters to getForms. No AppId Specified."));
+    async.series([validateParams, getFormsForAppId, buildFormStatistics, constructResultJSON], function(err){
+      if(err) {
+        return cb(err);
       } else {
-        return cb();
+        return cb(undefined, resJSON);
       }
     });
-  }
 
-  function getFormsForAppId(cb){
+    function buildFormStatistics(cb){
 
-    if(!(options.getAllForms === true)){
-      findAppForms(cb);
-    } else {
-      findAllForms(cb);
+      //If not getting all of the forms, do not populate statistics...
+      if(!(options.getAllForms === true)){
+        return cb();
+      }
+
+      async.eachSeries(foundAppForms, function(appForm, cb){
+        formStatistics[appForm._id] = {};
+        formStatistics[appForm._id].appsUsingForm = 12; //TODO --THIS IS DUMMY DATA. NEED TO DO ACUTAL STATISTICS
+        formStatistics[appForm._id].submissionsToday = 33; //TODO -- THIS IS DUMMY DATA. NEED TO DO ACTUAL STATISTICS
+        formStatistics[appForm._id].submissionsTotal = 22; //TODO -- THIS IS DUMMY DATA. NEED TO DO ACTUAL STATISTICS
+        cb();
+      }, cb);
     }
-  }
 
-  function findAppForms(cb){
-    var AppForms = models.get(connections.mongooseConnection, models.MODELNAMES.APP_FORMS);
-    var query = {"appId" : options.appId};
-    AppForms.findOne(query).populate("forms").exec(function(err, appForm){
-      if(err) return cb(err);
+    function validateParams(cb){
+      var val = validate(options);
 
-      if(appForm !== null){
-        foundAppForms = appForm.forms;
+      //If the getAllForms parameter is set to true, then the appId will not be included.
+      if(options.getAllForms === true){
+        return cb();
       }
 
-      return cb();
-    });
-  }
+      val.has("appId", function(failed){
+        if(failed){
+          return cb(new Error("Invalid parameters to getForms. No AppId Specified."));
+        } else {
+          return cb();
+        }
+      });
+    }
 
-  function findAllForms(cb){
-    var Form = models.get(connections.mongooseConnection, models.MODELNAMES.FORM);
-    Form.find({}).exec(function(err, form){
-      if(err) return cb(err);
-
-      if(form !== null){
-        foundAppForms = form;
+    function getFormsForAppId(cb){
+      if(!(options.getAllForms === true)){
+        findAppForms(cb);
+      } else {
+        findAllForms(cb);
       }
+    }
 
-      return cb();
-    });
-  }
+    function findAppForms(cb){
+      var restrictToUser = options.restrictToUser;
+      var appid = options.appId;
+      appforms.getAppFormsWithPopulatedForms(connections, restrictToUser, appid, function (err, forms) {
+        if(forms !== null){
+          foundAppForms = forms;
+        }
+        return cb();
+      });
+    }
 
-  function constructResultJSON(cb){
-    var res = {"forms": []};
-    if(foundAppForms){
-      //There is a form associated with the
-      async.eachSeries(foundAppForms, function(foundAppForm, cb){
-        var formEntry = {"_id": undefined, "formName": undefined, "lastUpdated" : undefined, "description" : ""};
-        formEntry._id = foundAppForm._id;
-        formEntry.formName = foundAppForm.name;
-        formEntry.lastUpdated = foundAppForm.lastUpdated.toUTCString();
-        formEntry.lastUpdatedTimestamp = foundAppForm.lastUpdated.getTime();
+    function findAllForms(cb){
+      groups.getFormsForUser(connections, options.restrictToUser, function (err, allowedForms) {
+        findForms(connections, allowedForms, function(err, forms) {
+          if(err) return cb(err);
 
-        if(foundAppForm.description){
-          formEntry.description = foundAppForm.description;
-        }
+          if(forms !== null){
+            foundAppForms = forms;
+          }
 
-        //If getting all the forms, need to submit statistics... TODO currently dummy data.
-        if(options.getAllForms === true){
-          formEntry.appsUsingForm = formStatistics[foundAppForm._id].appsUsingForm;
-          formEntry.submissionsToday = formStatistics[foundAppForm._id].submissionsToday;
-          formEntry.submissionsTotal = formStatistics[foundAppForm._id].submissionsTotal;
-        }
+          return cb();
+        });
+      });
+    }
 
-        res.forms.push(formEntry);
+    function constructResultJSON(cb){
+      var res = {"forms": []};
+      if(foundAppForms){
+        //There is a form associated with the
+        async.eachSeries(foundAppForms, function(foundAppForm, cb){
+          var formEntry = {"_id": undefined, "formName": undefined, "lastUpdated" : undefined, "description" : ""};
+          formEntry._id = foundAppForm._id;
+          formEntry.formName = foundAppForm.name;
+          formEntry.lastUpdated = foundAppForm.lastUpdated.toUTCString();
+          formEntry.lastUpdatedTimestamp = foundAppForm.lastUpdated.getTime();
 
+          if(foundAppForm.description){
+            formEntry.description = foundAppForm.description;
+          }
+
+          //If getting all the forms, need to submit statistics... TODO currently dummy data.
+          if(options.getAllForms === true){
+            formEntry.appsUsingForm = formStatistics[foundAppForm._id].appsUsingForm;
+            formEntry.submissionsToday = formStatistics[foundAppForm._id].submissionsToday;
+            formEntry.submissionsTotal = formStatistics[foundAppForm._id].submissionsTotal;
+          }
+
+          res.forms.push(formEntry);
+
+          return cb();
+        }, function(err){
+          resJSON = res;
+          return cb(err);
+        });
+      } else {
+        resJSON = res;
         return cb();
-      }, function(err){
-        resJSON = res;
-        return cb(err);
-      });
-    } else {
-      resJSON = res;
-      return cb();
+      }
     }
   }
+
+  return {
+    getForms: getForms,
+    findForms: findForms
+  };
 };
-
-module.exports = getForms;

lib/impl/getSubmission.js

 var models = require('../common/models.js')();
 var validate = require('../common/validate.js');
 var async = require('async');
+var groups = require('./groups.js');
 
@@ -35,5 +36,8 @@ /*
 
-    return cb(undefined, foundSubmission.toJSON());
+    groups.validateFormAllowedForUser(connections, options.restrictToUser, foundSubmission.formId.toString(), function(err) {
+      if(err) return cb(err);
+      return cb(undefined, foundSubmission.toJSON());
+    });
   });
 
 };

lib/impl/getSubmissions.js

 var models = require('../common/models.js')();
 var validate = require('../common/validate.js');
+var groups = require('./groups.js');
 var async = require('async');
@@ -31,2 +32,3 @@ var util = require('util');
   var formModel = models.get(connections.mongooseConnection, models.MODELNAMES.FORM);
+  var restrictToUser = options.restrictToUser;
 
@@ -36,9 +38,72 @@ var query = {
   };
-  if (params.appId) {
-    query.appId = params.appId;
-  }
-  if (params.formId) {
-    query.formId = params.formId;
-  }
 
+  async.waterfall([
+    function (cb) {
+      if (params.appId) {  // if appid specified then ensure user is allowed access
+        query.appId = params.appId;
+        return groups.validateAppAllowedForUser(connections, restrictToUser, params.appId, function(err) {
+          return cb(err);
+        });
+      } else {  // restrict to particular allowed apps
+        groups.getAppsForUser(connections, restrictToUser, function (err, allowedApps) {
+          if (err) return cb(err);
+          if (allowedApps) {
+            query.appId = {$in: allowedApps};
+          }
+          return cb();
+        });
+      }
+    },
+    function (cb) {
+      if (params.formId) {
+        query.formId = params.formId;
+        groups.validateFormAllowedForUser(connections, restrictToUser, params.formId, cb);
+      } else {  // restrict to particular allowed forms
+        groups.getFormsForUser(connections, restrictToUser, function (err, allowedForms) {
+          if (err) return cb(err);
+          if (allowedForms) {
+            query.formId = {$in: allowedForms};
+          }
+          return cb();
+        });
+      }
+    }
+  ], function (err, finalResult) {
+    if (err) return cb(err);
+
+    formSubmissionModel
+    .find(query)
+    .sort({submissionStartedTimestamp: -1})
+    .populate({"path": "formId", "model": formModel, "select": "name"})
+    .populate({"path": "formFields.fieldId", "model": fieldModel, "select": "-__v"})
+    .exec(function(err, foundSubmissions){
+      if(err) return cb(err);
+      var retSubmissions = [];
+      async.eachSeries(
+        foundSubmissions,
+        function(item, cb) {
+          var submission = JSON.parse(JSON.stringify(item));
+          reformatFormIdAndName(submission, function (err, submission) {
+            if(err) return cb(err);
+            submission.appName = resolveAppName(submission.appId);
+
+            function restrict(submission, rcb) {
+              if (params.wantRestrictions === false) return rcb(null, submission);
+              restrictSubmissionForSummary(submission, rcb);
+            };
+
+            restrict(submission, function (err, restrictedSubmission) {
+              if(err) return cb(err);
+              retSubmissions.push(restrictedSubmission);
+              return cb();
+            });
+          });
+        }, function (err) {
+          if (err) return cb(err);
+          return cb(undefined, {submissions: retSubmissions});
+        }
+      );
+    });
+  });
+
   function resolveAppName(appId) {
@@ -65,36 +130,2 @@ var name = "Unknown";
   }
-
-  formSubmissionModel
-  .find(query)
-  .sort({submissionStartedTimestamp: -1})
-  .populate({"path": "formId", "model": formModel, "select": "name"})
-  .populate({"path": "formFields.fieldId", "model": fieldModel, "select": "-__v"})
-  .exec(function(err, foundSubmissions){
-    if(err) return cb(err);
-    var retSubmissions = [];
-    async.eachSeries(
-      foundSubmissions,
-      function(item, cb) {
-        var submission = JSON.parse(JSON.stringify(item));
-        reformatFormIdAndName(submission, function (err, submission) {
-          if(err) return cb(err);
-          submission.appName = resolveAppName(submission.appId);
-
-          function restrict(submission, rcb) {
-            if (params.wantRestrictions === false) return rcb(null, submission);
-            restrictSubmissionForSummary(submission, rcb);
-          };
-
-          restrict(submission, function (err, restrictedSubmission) {
-            if(err) return cb(err);
-            retSubmissions.push(restrictedSubmission);
-            return cb();
-          });
-        });
-      }, function (err) {
-        if (err) return cb(err);
-        return cb(undefined, {submissions: retSubmissions});
-      }
-    );
-  });
 };
@@ -101,0 +132,0 @@

lib/impl/getTheme.js

 var models = require('../common/models.js')();
 var validate = require('../common/validate.js');
+var groups = require('./groups.js');
 var async = require('async');
@@ -8,2 +9,7 @@
     async.apply(validateParams, options),
+    function (themeId, cb) {
+      groups.validateThemeAllowedForUser(connections, options.restrictToUser, themeId.toString(), function (err) {
+        return cb(err, themeId);
+      });
+    },
     getTheme
@@ -10,0 +16,0 @@ ], cb);

lib/impl/getThemeForApp.js

 var models = require('../common/models.js')();
 var validate = require('../common/validate.js');
 var async = require('async');
+var groups = require('./groups.js');
 
 var getTheme = function(connections, options, cb) {
+  var restrictToUser = options.restrictToUser;
 
-  var foundAppTheme = undefined;
-
-  async.series([validateParams, getThemeForAppId], function(err){
+  async.waterfall([
+    validateParams, 
+    function (appId, cb) {
+      groups.validateAppAllowedForUser(connections, restrictToUser, appId, function (err) {
+        if(err) return cb(err);
+        return cb(undefined, appId);
+      });
+    },
+    getThemeForAppId
+  ], function(err, theme) {
     if(err) {
       return cb(err);
     } else {
-      cb(undefined, foundAppTheme);
+      cb(undefined, theme);
     }
@@ -23,3 +32,3 @@ });
       } else {
-        return cb();
+        return cb(undefined, options.appId);
       }
@@ -29,13 +38,15 @@ });
 
-  function getThemeForAppId(cb){
+  function getThemeForAppId(appId, cb){
     var AppThemes = models.get(connections.mongooseConnection, models.MODELNAMES.APP_THEMES);
 
-    AppThemes.findOne({"appId" : options.appId}).populate("theme", "-__v").select("-__v -_id").exec(function(err, appTheme){
+    AppThemes.findOne({"appId" : appId}).populate("theme", "-__v").select("-__v -_id").exec(function(err, appTheme){
       if(err) return cb(err);
 
       if(appTheme !== null && appTheme.theme !== null){
-        foundAppTheme = appTheme.theme.toJSON();
+        groups.validateThemeAllowedForUser(connections, restrictToUser, appTheme.theme._id, function (err) {
+          if(err) return cb(err);
+          return cb(undefined, appTheme.theme.toJSON());
+        });
+      } else {
         return cb();
-      } else {
-        return cb(null, null);
       }
@@ -42,0 +53,0 @@ });

lib/impl/getThemes.js

@@ -5,4 +5,7 @@ var models = require('../common/models.js')();
 var util = require('util');
+var groups = require('./groups.js');
 
 module.exports = function (connections, options, cb) {
+  var restrictToUser = options.restrictToUser;
+
   async.waterfall([
@@ -23,26 +26,42 @@ async.apply(validateParams, options),
 
-    themeModel.find().exec(function(err, themes){
+    groups.getThemesForUser(connections, restrictToUser, function (err, allowedThemes) {
       if(err) return cb(err);
-
-      if(themes === null){
-        themes = [];
+      var query = {};
+      if (allowedThemes) {
+        query._id = {$in: allowedThemes};
       }
+      themeModel.find(query).exec(function(err, themes){
+        if(err) return cb(err);
 
-      return cb(undefined, {themes: themes});
+        if(themes === null){
+          themes = [];
+        }
+        return cb(undefined, {themes: themes}, allowedThemes);
+      });
     });
   }
 
-  function getAppsUsingTheme(themes, cb){
-
+  function getAppsUsingTheme(themes, allowedThemes, cb){
     var appThemeModel = models.get(connections.mongooseConnection, models.MODELNAMES.APP_THEMES);
 
-    appThemeModel.find().select("-_id").exec(function(err, appThemes){
+    groups.getAppsForUser(connections, restrictToUser, function (err, allowedApps) {
       if(err) return cb(err);
 
-      if(appThemes === null){
-        appThemes = [];
+      var query = {};
+      if (allowedThemes) {
+        query.theme = {$in: allowedThemes};
       }
+      if (allowedApps) {
+        query.appId = {$in: allowedApps};
+      }
+      appThemeModel.find(query).select("-_id").exec(function(err, appThemes){
+        if(err) return cb(err);
 
-      themes.appThemes = appThemes;
-      return cb(undefined, themes);
+        if(appThemes === null){
+          appThemes = [];
+        }
+
+        themes.appThemes = appThemes;
+        return cb(undefined, themes);
+      });
     });
@@ -49,0 +68,0 @@ }

lib/impl/setThemeForApp.js

 var models = require('../common/models.js')();
 var validate = require('../common/validate.js');
+var groups = require('./groups.js');
 var async = require('async');
@@ -9,3 +10,8 @@
 
-  async.series([validateParams, setThemeForAppId], function(err){
+  async.series([
+    validateParams,
+    async.apply(groups.validateAppAllowedForUser, connections, options.restrictToUser, options.appId),
+    async.apply(groups.validateThemeAllowedForUser, connections, options.restrictToUser, options.theme),
+    setThemeForAppId
+  ], function(err){
     if(err) {
@@ -12,0 +18,0 @@ return cb(err);

lib/impl/submitFormFile.js

@@ -13,6 +13,6 @@ var models = require('../common/models.js')();
   var FormSubmission = models.get(connections.mongooseConnection, models.MODELNAMES.FORM_SUBMISSION);
-  var submissionToUse = undefined;
-  var submissionFieldIndex = undefined;
-  var filePlaceholderIndex = undefined;
-  var savedFileGroupId = undefined;
+  var submissionToUse;
+  var submissionFieldIndex;
+  var filePlaceholderIndex;
+  var savedFileGroupId;
   var submission = options.submission;
@@ -106,3 +106,3 @@ var fileHandler = new fhgridfs();
     if(fileNameToSave.indexOf("." + fileExtension) === -1){
-      fileNameToSave + "." + fileExtension;
+      fileNameToSave += "." + fileExtension;
     }
@@ -109,0 +109,0 @@

lib/impl/updateForm.js

@@ -5,2 +5,3 @@ var async = require('async');
 var _ = require('underscore');
+var groups = require('./groups.js');
 
@@ -77,5 +78,5 @@ /*
     if(fieldToUpdateOrCreate._id) {
-      updateField(fieldToUpdateOrCreate, cb)
+      updateField(fieldToUpdateOrCreate, cb);
     } else {
-      createField(fieldToUpdateOrCreate, cb)
+      createField(fieldToUpdateOrCreate, cb);
     }
@@ -280,5 +281,14 @@ }
       if(formData._id) {
-        doUpdate(formData, cb);
+        groups.validateFormAllowedForUser(connections, options.restrictToUser, formData._id, function (err) {
+          if (err) return cb(err);
+          doUpdate(formData, cb);
+        });
       } else {
-        doCreate(formData, cb);
+        doCreate(formData, function (err, form) {
+          if (err) return cb(err);
+          groups.addFormToUsersGroups(connections, options.restrictToUser, form._id.toString(), function (err, numAffected) {
+            if (err) return cb(err);
+            return cb(undefined, form);
+          });
+        });
       }
@@ -285,0 +295,0 @@ }

lib/impl/updateRules.js

@@ -5,2 +5,3 @@ var async = require('async');
 var validation = require('./../common/validate');
+var groups = require('./groups.js');
 
@@ -43,6 +44,10 @@ var Rules = {
     if (err) return cb(err);
-    var conn = connections.mongooseConnection;
-    var formModel = models.get(conn, models.MODELNAMES.FORM);
-    var fieldRulesModel = models.get(conn, models.MODELNAMES.FIELD_RULE);
-    doUpdate(connections, options, fieldRules, formModel, fieldRulesModel, Rules.FIELD_RULE, cb);
+    groups.validateFormAllowedForUser(connections, options.restrictToUser, options.formId, function (err) {
+      if (err) return cb(err);
+
+      var conn = connections.mongooseConnection;
+      var formModel = models.get(conn, models.MODELNAMES.FORM);
+      var fieldRulesModel = models.get(conn, models.MODELNAMES.FIELD_RULE);
+      doUpdate(connections, options, fieldRules, formModel, fieldRulesModel, Rules.FIELD_RULE, cb);
+    });
   });
@@ -79,6 +84,9 @@ };
     if (err) return cb(err);
-    var conn = connections.mongooseConnection;
-    var formModel = models.get(conn, models.MODELNAMES.FORM);
-    var pageRulesModel = models.get(conn, models.MODELNAMES.PAGE_RULE);
-    doUpdate(connections, options, pageRules, formModel, pageRulesModel, Rules.PAGE_RULE, cb);
+    groups.validateFormAllowedForUser(connections, options.restrictToUser, options.formId, function (err) {
+      if (err) return cb(err);
+      var conn = connections.mongooseConnection;
+      var formModel = models.get(conn, models.MODELNAMES.FORM);
+      var pageRulesModel = models.get(conn, models.MODELNAMES.PAGE_RULE);
+      doUpdate(connections, options, pageRules, formModel, pageRulesModel, Rules.PAGE_RULE, cb);
+    });
   });
@@ -85,0 +93,0 @@ };

lib/impl/updateTheme.js

@@ -5,2 +5,3 @@ var models = require('../common/models.js')();
 var async = require('async');
+var groups = require('./groups.js');
 
@@ -41,5 +42,13 @@ var THEME_UPDATE_FIELDS = [
     if(themeData._id) {
-      doUpdate(themeData._id, themeData, cb);
+      groups.validateThemeAllowedForUser(connections, options.restrictToUser, themeData._id, function (err) {
+        if (err) return cb(err);
+        doUpdate(themeData._id, themeData, cb);
+      });
     } else {
-      doCreate(themeData, cb);
+      doCreate(themeData, function (err, themeData) {
+        if (err) return cb(err);
+        groups.addThemeToUsersGroups(connections, options.restrictToUser, themeData._id.toString(), function (err) {
+          return cb(undefined, themeData);
+        });
+      });
     }
@@ -46,0 +55,0 @@ }

package.json

 {
   "name": "fh-forms",
-  "version": "0.2.13",
+  "version": "0.2.18",
   "description": "Cloud Forms API for form submission",
@@ -5,0 +5,0 @@ "main": "lib/forms.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

No README

Quality

Package does not have a README. This may indicate a failed publish or a low quality package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Number of low supply chain risk alerts

3

decreased by-97.64%

Worsened metrics

Total package byte prevSize

192078

decreased by-90.44%

Number of package files

32

decreased by-58.44%

Lines of code

5170

decreased by-65.53%

Number of medium quality alerts

3

increased by50%

Number of lines in readme file

0

decreased by-100%

No dependency changes