From 74d29376e35ed16a39330776d9ce80b1b3e76ff1 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 14:22:13 +0300
Subject: [PATCH 01/47] Add PyJWT requirement

---
 dependencies/pip/requirements.in  | 3 +++
 dependencies/pip/requirements.txt | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/dependencies/pip/requirements.in b/dependencies/pip/requirements.in
index 720ee4b84d..31d954f9d7 100644
--- a/dependencies/pip/requirements.in
+++ b/dependencies/pip/requirements.in
@@ -90,3 +90,6 @@ django-trench==0.2.3
 
 # Python 3.8 support
 backports.zoneinfo; python_version < '3.9'
+
+# OnaData support
+PyJWT
diff --git a/dependencies/pip/requirements.txt b/dependencies/pip/requirements.txt
index ecfa7cf48c..c5931273aa 100644
--- a/dependencies/pip/requirements.txt
+++ b/dependencies/pip/requirements.txt
@@ -243,7 +243,9 @@ pycparser==2.21
 pygments==2.11.2
     # via -r dependencies/pip/requirements.in
 pyjwt==2.3.0
-    # via twilio
+    # via
+    #   -r dependencies/pip/requirements.in
+    #   twilio
 pymongo==3.12.3
     # via -r dependencies/pip/requirements.in
 pyopenssl==22.0.0

From 0652ef5cb834a620e946c2b4c016fb429c39ca85 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 15:00:36 +0300
Subject: [PATCH 02/47] Add OnaData authentication functionality to the jsapp

---
 jsapp/js/actions.es6                          |  34 ++--
 .../account/accountSettingsRoute.es6          |   3 +-
 jsapp/js/components/reports/reports.es6       |   3 +-
 jsapp/js/components/searchcollectionlist.es6  |   3 +-
 jsapp/js/editorMixins/editableForm.es6        | 147 ++++++++++--------
 jsapp/js/ona/config.ts                        |   6 +
 jsapp/js/utils.ts                             |  10 ++
 7 files changed, 120 insertions(+), 86 deletions(-)
 create mode 100644 jsapp/js/ona/config.ts

diff --git a/jsapp/js/actions.es6 b/jsapp/js/actions.es6
index 5391c81bf5..c9ea3f9dc6 100644
--- a/jsapp/js/actions.es6
+++ b/jsapp/js/actions.es6
@@ -23,6 +23,8 @@ import dataShareActions from './actions/dataShareActions';
 import {
   notify,
   replaceSupportEmail,
+  checkIfCookieExists,
+  redirectForOnaDataAuth,
 } from 'utils';
 
 // Configure Reflux
@@ -201,20 +203,24 @@ actions.resources.listTags.completed.listen(function(results){
 });
 
 actions.resources.updateAsset.listen(function(uid, values, params={}) {
-  dataInterface.patchAsset(uid, values)
-    .done((asset) => {
-      actions.resources.updateAsset.completed(asset);
-      if (typeof params.onComplete === 'function') {
-        params.onComplete(asset, uid, values);
-      }
-      notify(t('successfully updated'));
-    })
-    .fail(function(resp){
-      actions.resources.updateAsset.failed(resp);
-      if (params.onFailed) {
-        params.onFailed(resp);
-      }
-    });
+  if (checkIfCookieExists("__kpi_formbuilder")) {
+    redirectForOnaDataAuth()
+  } else {
+    dataInterface.patchAsset(uid, values)
+      .done((asset) => {
+        actions.resources.updateAsset.completed(asset);
+        if (typeof params.onComplete === 'function') {
+          params.onComplete(asset, uid, values);
+        }
+        notify(t('successfully updated'));
+      })
+      .fail(function(resp){
+        actions.resources.updateAsset.failed(resp);
+        if (params.onFailed) {
+          params.onFailed(resp);
+        }
+      });
+  }
 });
 
 actions.resources.deployAsset.listen(function(asset, redeployment, params={}){
diff --git a/jsapp/js/components/account/accountSettingsRoute.es6 b/jsapp/js/components/account/accountSettingsRoute.es6
index 3a72040efb..490d48e124 100644
--- a/jsapp/js/components/account/accountSettingsRoute.es6
+++ b/jsapp/js/components/account/accountSettingsRoute.es6
@@ -15,6 +15,7 @@ import {
   addRequiredToLabel,
   stringToColor,
 } from 'utils';
+import { TITLE } from '../../ona/config';
 import {ROUTES} from 'js/router/routerConstants';
 import envStore from 'js/envStore';
 import './accountSettings.scss';
@@ -207,7 +208,7 @@ export default class AccountSettings extends React.Component {
     const metaFields = this.getDisplayMetaFields();
 
     return (
-      <DocumentTitle title={`${accountName} | KoboToolbox`}>
+      <DocumentTitle title={`${accountName} | ${ TITLE }`}>
         <bem.AccountSettings>
           <bem.AccountSettings__actions>
             <bem.KoboButton
diff --git a/jsapp/js/components/reports/reports.es6 b/jsapp/js/components/reports/reports.es6
index 5e0aa4bc46..f4ff495cfc 100644
--- a/jsapp/js/components/reports/reports.es6
+++ b/jsapp/js/components/reports/reports.es6
@@ -16,6 +16,7 @@ import {txtid} from '../../../xlform/src/model.utils';
 import alertify from 'alertifyjs';
 import {launchPrinting} from 'utils';
 import {REPORT_STYLES} from './reportsConstants';
+import { TITLE } from '../../ona/config';
 import CustomReportForm from './customReportForm';
 import QuestionGraphSettings from './questionGraphSettings';
 import ReportContents from './reportContents';
@@ -525,7 +526,7 @@ export default class Reports extends React.Component {
     const hasGroupBy = this.state.groupBy.length !== 0;
 
     return (
-      <DocumentTitle title={`${docTitle} | KoboToolbox`}>
+      <DocumentTitle title={`${docTitle} | ${ TITLE }`}>
         <bem.FormView m={formViewModifiers}>
           <bem.ReportView>
             {this.renderReportButtons()}
diff --git a/jsapp/js/components/searchcollectionlist.es6 b/jsapp/js/components/searchcollectionlist.es6
index ce2961ccf7..37230fe28f 100644
--- a/jsapp/js/components/searchcollectionlist.es6
+++ b/jsapp/js/components/searchcollectionlist.es6
@@ -14,6 +14,7 @@ import DocumentTitle from 'react-document-title';
 import Dropzone from 'react-dropzone';
 import {validFileTypes} from 'utils';
 import {redirectToLogin} from 'js/router/routerUtils';
+import { TITLE } from '../ona/config';
 import {
   ASSET_TYPES,
   COMMON_QUERIES,
@@ -211,7 +212,7 @@ class SearchCollectionList extends Reflux.Component {
       docTitle = t('Library');
     }
     return (
-      <DocumentTitle title={`${docTitle} | KoboToolbox`}>
+      <DocumentTitle title={`${docTitle} | ${ TITLE }`}>
         <Dropzone
           onDrop={this.dropFiles}
           disableClick
diff --git a/jsapp/js/editorMixins/editableForm.es6 b/jsapp/js/editorMixins/editableForm.es6
index d5c9b67fd6..f45b77effa 100644
--- a/jsapp/js/editorMixins/editableForm.es6
+++ b/jsapp/js/editorMixins/editableForm.es6
@@ -11,7 +11,12 @@ import {hashHistory} from 'react-router';
 import alertify from 'alertifyjs';
 import ProjectSettings from '../components/modalForms/projectSettings';
 import MetadataEditor from 'js/components/metadataEditor';
-import {assign} from '../utils';
+import {
+  assign,
+  checkIfCookieExists,
+  redirectForOnaDataAuth,
+} from 'utils';
+import { TITLE } from '../ona/config';
 import {
   ASSET_TYPES,
   AVAILABLE_FORM_STYLES,
@@ -927,80 +932,84 @@ export default assign({
   },
 
   render() {
-    var docTitle = this.state.name || t('Untitled');
+    if (checkIfCookieExists("__kpi_formbuilder")) {
+      redirectForOnaDataAuth()
+    } else {
+      var docTitle = this.state.name || t('Untitled');
+
+      if (!this.state.isNewAsset && !this.state.asset) {
+        return (
+          <DocumentTitle title={`${docTitle} | ${ TITLE }`}>
+            <LoadingSpinner/>
+          </DocumentTitle>
+        );
+      }
 
-    if (!this.state.isNewAsset && !this.state.asset) {
       return (
-        <DocumentTitle title={`${docTitle} | KoboToolbox`}>
-          <LoadingSpinner/>
-        </DocumentTitle>
-      );
-    }
+        <DocumentTitle title={`${docTitle} | ${ TITLE }`}>
+          <bem.uiPanel m={['transparent', 'fixed']}>
+            <bem.uiPanel__body>
+              {this.renderAside()}
 
-    return (
-      <DocumentTitle title={`${docTitle} | KoboToolbox`}>
-        <bem.uiPanel m={['transparent', 'fixed']}>
-          <bem.uiPanel__body>
-            {this.renderAside()}
+              <bem.FormBuilder>
+              {this.renderFormBuilderHeader()}
 
-            <bem.FormBuilder>
-            {this.renderFormBuilderHeader()}
-
-              <bem.FormBuilder__contents>
-                {this.state.asset &&
-                  <FormLockedMessage asset={this.state.asset}/>
-                }
-
-                {this.hasBackgroundAudio() &&
-                  this.renderBackgroundAudioWarning()
-                }
-
-                <div ref='form-wrap' className='form-wrap'>
-                  {!this.state.surveyAppRendered &&
-                    this.renderNotLoadedMessage()
+                <bem.FormBuilder__contents>
+                  {this.state.asset &&
+                    <FormLockedMessage asset={this.state.asset}/>
                   }
-                </div>
-              </bem.FormBuilder__contents>
-            </bem.FormBuilder>
-
-            {this.state.enketopreviewOverlay &&
-              <Modal
-                open
-                large
-                onClose={this.hidePreview}
-                title={t('Form Preview')}
-              >
-                <Modal.Body>
-                  <div className='enketo-holder'>
-                    <iframe src={this.state.enketopreviewOverlay} />
-                  </div>
-                </Modal.Body>
-              </Modal>
-            }
 
-            {!this.state.enketopreviewOverlay && this.state.enketopreviewError &&
-              <Modal
-                open
-                error
-                onClose={this.clearPreviewError}
-                title={t('Error generating preview')}
-              >
-                <Modal.Body>{this.state.enketopreviewError}</Modal.Body>
-              </Modal>
-            }
+                  {this.hasBackgroundAudio() &&
+                    this.renderBackgroundAudioWarning()
+                  }
 
-            {this.state.showCascadePopup &&
-              <Modal
-                open
-                onClose={this.hideCascade}
-                title={t('Import Cascading Select Questions')}
-              >
-                <Modal.Body>{this.renderCascadePopup()}</Modal.Body>
-              </Modal>
-            }
-          </bem.uiPanel__body>
-        </bem.uiPanel>
-      </DocumentTitle>
-    );
+                  <div ref='form-wrap' className='form-wrap'>
+                    {!this.state.surveyAppRendered &&
+                      this.renderNotLoadedMessage()
+                    }
+                  </div>
+                </bem.FormBuilder__contents>
+              </bem.FormBuilder>
+
+              {this.state.enketopreviewOverlay &&
+                <Modal
+                  open
+                  large
+                  onClose={this.hidePreview}
+                  title={t('Form Preview')}
+                >
+                  <Modal.Body>
+                    <div className='enketo-holder'>
+                      <iframe src={this.state.enketopreviewOverlay} />
+                    </div>
+                  </Modal.Body>
+                </Modal>
+              }
+
+              {!this.state.enketopreviewOverlay && this.state.enketopreviewError &&
+                <Modal
+                  open
+                  error
+                  onClose={this.clearPreviewError}
+                  title={t('Error generating preview')}
+                >
+                  <Modal.Body>{this.state.enketopreviewError}</Modal.Body>
+                </Modal>
+              }
+
+              {this.state.showCascadePopup &&
+                <Modal
+                  open
+                  onClose={this.hideCascade}
+                  title={t('Import Cascading Select Questions')}
+                >
+                  <Modal.Body>{this.renderCascadePopup()}</Modal.Body>
+                </Modal>
+              }
+            </bem.uiPanel__body>
+          </bem.uiPanel>
+        </DocumentTitle>
+      );
+    }
   },
 }, cascadeMixin);
diff --git a/jsapp/js/ona/config.ts b/jsapp/js/ona/config.ts
new file mode 100644
index 0000000000..b8af5378db
--- /dev/null
+++ b/jsapp/js/ona/config.ts
@@ -0,0 +1,6 @@
+/**
+ * Modified configuration file; Meant to be modified on the deployment
+ */
+
+export const ZEBRA_URL = "http://localhost:3001/login"
+export const TITLE = "Ona"
diff --git a/jsapp/js/utils.ts b/jsapp/js/utils.ts
index 57d66e10ee..55d2a74212 100644
--- a/jsapp/js/utils.ts
+++ b/jsapp/js/utils.ts
@@ -13,6 +13,7 @@ import alertify from 'alertifyjs';
 import {Cookies} from 'react-cookie';
 // importing whole constants, as we override ROOT_URL in tests
 import constants from 'js/constants';
+import { ZEBRA_URL } from './ona/config';
 
 export const LANGUAGE_COOKIE_NAME = 'django_language';
 
@@ -52,6 +53,15 @@ export function formatTimeDateShort(timeStr: string): string {
   return myMoment.format('lll');
 }
 
+export function checkIfCookieExists(authCookieName: string): boolean {
+  return cookies.get(authCookieName) !== null
+}
+
+export function redirectForOnaDataAuth() {
+  var current_url = encodeURIComponent(window.location.href);
+  window.location.href = ZEBRA_URL + "?return_url=" + current_url;
+}
+
 /**
  * Returns something like "Mar 15, 2021"
  */

From 659681e8443cf3b963991563f26e79f41ebddd86 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 15:32:00 +0300
Subject: [PATCH 03/47] Redirect users to OnaData home instead of Kobo

- Stops users from being able to modify OnaData controlled resources on
  Kobo home...
---
 kpi/views/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kpi/views/__init__.py b/kpi/views/__init__.py
index 5f50e81efe..28ca80307b 100644
--- a/kpi/views/__init__.py
+++ b/kpi/views/__init__.py
@@ -23,7 +23,7 @@
 
 
 def home(request):
-    return TemplateResponse(request, "index.html")
+    return HttpResponseRedirect(settings.get("ONADATA_HOME"))
 
 
 def browser_tests(request):

From 087763f461670b4ef44c6129c37996e6b37fd88f Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 15:50:44 +0300
Subject: [PATCH 04/47] Add support for OnaData form creation

- Use Asset name as id_string
- Add `published_by_formbuilder` to the deployment payload
- Add JWTAuthentication class
- Add Database router that stops writes and migrations to Kobocat
---
 kpi/deployment_backends/kobocat_backend.py |  7 ++++
 kpi/deployment_backends/mixin.py           |  2 +-
 kpi/models/import_export_task.py           | 18 +++++++++
 kpi/ona_db_routers.py                      | 33 +++++++++++++++
 kpi/utils/ona_authentication.py            | 47 ++++++++++++++++++++++
 5 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 kpi/ona_db_routers.py
 create mode 100644 kpi/utils/ona_authentication.py

diff --git a/kpi/deployment_backends/kobocat_backend.py b/kpi/deployment_backends/kobocat_backend.py
index 1ff7b4954d..e3a45ab8f4 100644
--- a/kpi/deployment_backends/kobocat_backend.py
+++ b/kpi/deployment_backends/kobocat_backend.py
@@ -265,6 +265,12 @@ def connect(self, identifier=None, active=False):
                 raise Exception('The identifier is not properly formatted.')
 
         url = self.external_to_internal_url('{}/api/v1/forms'.format(kc_server))
+        if not self.asset.has_deployment:
+            project = self.asset.settings.get('project')
+            if project:
+                url = self.external_to_internal_url(
+                    f"{kc_server}/api/v1/projects/{project}/forms")
+
         xlsx_io = self.asset.to_xlsx_io(
             versioned=True, append={
                 'settings': {
@@ -281,6 +287,7 @@ def connect(self, identifier=None, active=False):
         #   every record of `logger_xform`. It can be also used to filter
         #   queries as it is faster to query a boolean than string.
         payload = {
+            'published_by_formbuilder': True,
             'downloadable': active,
             'has_kpi_hook': self.asset.has_active_hooks,
             'kpi_asset_uid': self.asset.uid
diff --git a/kpi/deployment_backends/mixin.py b/kpi/deployment_backends/mixin.py
index 22c97cf144..145e13e933 100644
--- a/kpi/deployment_backends/mixin.py
+++ b/kpi/deployment_backends/mixin.py
@@ -57,7 +57,7 @@ def deployment(self):
 
     @property
     def has_deployment(self):
-        return 'backend' in self._deployment_data
+        return 'backend_response' in self._deployment_data
 
     def set_deployment(self, deployment: BaseDeploymentBackend):
         setattr(self, '__deployment_backend', deployment)
diff --git a/kpi/models/import_export_task.py b/kpi/models/import_export_task.py
index b3de9a46da..a2c5adb07c 100644
--- a/kpi/models/import_export_task.py
+++ b/kpi/models/import_export_task.py
@@ -26,6 +26,7 @@
 from private_storage.fields import PrivateFileField
 from pyxform.xls2json_backends import xls_to_dict, xlsx_to_dict
 from rest_framework import exceptions
+from rest_framework.authtoken.models import Token
 from werkzeug.http import parse_options_header
 
 import formpack
@@ -304,6 +305,12 @@ def _load_assets_from_url(self, url, messages, **kwargs):
             orm_obj.parent = parent_item
             orm_obj.save()
 
+    def _retrieve_form_information(self):
+        url = f"{settings.KOBOCAT_INTERNAL_URL}/api/v1/forms/{self.data['filename']}"
+        token = Token.objects.get(user=self.user)
+
+        return requests.get(url, headers={"Authorization": f"Token {token.key}"})
+
     def _parse_b64_upload(self, base64_encoded_upload, messages, **kwargs):
         filename = kwargs.get('filename', False)
         desired_type = kwargs.get('desired_type')
@@ -316,6 +323,9 @@ def _parse_b64_upload(self, base64_encoded_upload, messages, **kwargs):
         survey_dict = _b64_xls_to_dict(base64_encoded_upload)
         survey_dict_keys = survey_dict.keys()
 
+        json_response = self._retrieve_form_information()
+        json_response['has_id_string_changed'] = False
+
         destination = kwargs.get('destination', False)
         has_necessary_perm = kwargs.get('has_necessary_perm', False)
 
@@ -377,6 +387,14 @@ def _parse_b64_upload(self, base64_encoded_upload, messages, **kwargs):
                         base64_encoded_upload, survey_dict
                     )
                 asset.content = survey_dict
+                identifier = f"{settings.KOBOCAT_URL}/{asset.owner.username}/forms/{asset.name}"
+                asset._deployment_data.update({
+                    'backend': 'kobocat',
+                    'identifier': identifier,
+                    'active': json_response['downloadable'],
+                    'backend_response': json_response,
+                    'version': asset.version_id
+                })
                 asset.save()
                 msg_key = 'updated'
 
diff --git a/kpi/ona_db_routers.py b/kpi/ona_db_routers.py
new file mode 100644
index 0000000000..98260b58c3
--- /dev/null
+++ b/kpi/ona_db_routers.py
@@ -0,0 +1,33 @@
+from __future__ import unicode_literals, absolute_import
+from .constants import SHADOW_MODEL_APP_LABEL
+
+
+class DefaultDatabaseRouter(object):
+
+    def db_for_read(self, model, **hints):
+        """
+        Reads primarily go to default.
+        """
+        if model._meta.app_label == SHADOW_MODEL_APP_LABEL:
+            return "kobocat"
+        return "default"
+
+    def db_for_write(self, model, **hints):
+        """
+        Writes always go to primary.
+        """
+        return "default"
+
+    def allow_relation(self, obj1, obj2, **hints):
+        """
+        Relations between objects are allowed
+        """
+        return True
+
+    def allow_migrate(self, db, app_label, model=None, **hints):
+        """
+        All default models end up in this pool.
+        """
+        if app_label == SHADOW_MODEL_APP_LABEL:
+            return False
+        return True
diff --git a/kpi/utils/ona_authentication.py b/kpi/utils/ona_authentication.py
new file mode 100644
index 0000000000..d959a327b1
--- /dev/null
+++ b/kpi/utils/ona_authentication.py
@@ -0,0 +1,47 @@
+import jwt
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.signing import BadSignature
+from django.utils.translation import ugettext as _
+from django.utils import timezone
+from django.shortcuts import get_object_or_404
+from rest_framework import exceptions
+from rest_framework.authentication import (
+    TokenAuthentication, get_authorization_header
+)
+from rest_framework.authtoken.models import Token
+
+
+
+def get_api_token(json_web_token):
+    """Get API Token from JSON Web Token"""
+    # having the JWT variables here allows the values to be mocked easily as
+    # oppossed to being on the global scope. At the moment they are set
+    # globally mainly because there isn't a test for it
+    try:
+        jwt_payload = jwt.decode(
+            json_web_token,
+            settings.get("JWT_SECRET_KEY", ""),
+            algorithms=[settings.get("JWT_ALGORITHM", "HS256")]
+        )
+        api_token = get_object_or_404(Token, key=jwt_payload.get("api-token"))
+
+        return api_token
+    except BadSignature as e:
+        raise exceptions.AuthenticationFailed(_(f"Bad Signature: {e}"))
+    except jwt.DecodeError as e:
+        raise exceptions.AuthenticationFailed(_(f"JWT DecodeError: {e}"))
+
+
+class JWTAuthentication(TokenAuthentication):
+    model = Token
+
+    def authenticate(self, request):
+        cookie_jwt = request.COOKIES.get(settings.KPI_COOKIE_NAME)
+        if cookie_jwt:
+            api_token = get_api_token(cookie_jwt)
+            if getattr(api_token, "user"):
+                return api_token.user, api_token
+
+            raise exceptions.ParseError(_("Malformed cookie. Clear your cookies then try again"))
+

From 200dd6bfac7bb60c579b221a7786fa506aa573a5 Mon Sep 17 00:00:00 2001
From: WinnyTroy <kiraguwinnie@gmail.com>
Date: Tue, 29 Oct 2019 11:43:34 +0300
Subject: [PATCH 05/47] Remove 'Return to list' and 'close' icons from landing
 page when creating a form

---
 jsapp/js/editorMixins/editableForm.es6 | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/jsapp/js/editorMixins/editableForm.es6 b/jsapp/js/editorMixins/editableForm.es6
index f45b77effa..63a3bad287 100644
--- a/jsapp/js/editorMixins/editableForm.es6
+++ b/jsapp/js/editorMixins/editableForm.es6
@@ -605,16 +605,6 @@ export default assign({
     return (
       <bem.FormBuilderHeader>
         <bem.FormBuilderHeader__row m='primary'>
-          <bem.FormBuilderHeader__cell
-            m={'logo'}
-            data-tip={t('Return to list')}
-            className='left-tooltip'
-            tabIndex='0'
-            onClick={this.safeNavigateToList}
-          >
-            <i className='k-icon k-icon-kobo' />
-          </bem.FormBuilderHeader__cell>
-
           <bem.FormBuilderHeader__cell m={'name'} >
             <bem.FormModal__item>
               {this.renderAssetLabel()}
@@ -642,13 +632,6 @@ export default assign({
               <i />
               {saveButtonText}
             </bem.FormBuilderHeader__button>
-
-            <bem.FormBuilderHeader__close
-              m={[{'close-warning': this.needsSave()}]}
-              onClick={this.safeNavigateToAsset}
-            >
-              <i className='k-icon k-icon-close'/>
-            </bem.FormBuilderHeader__close>
           </bem.FormBuilderHeader__cell>
         </bem.FormBuilderHeader__row>
 

From a6020e6fbd4ffbe711d03454ca680502e9384123 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 16:04:31 +0300
Subject: [PATCH 06/47] Prevent deployment of non-survey asset types

---
 jsapp/js/actions.es6                   | 31 +++++++++++++++-----------
 jsapp/js/editorMixins/editableForm.es6 |  2 +-
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/jsapp/js/actions.es6 b/jsapp/js/actions.es6
index c9ea3f9dc6..556747592b 100644
--- a/jsapp/js/actions.es6
+++ b/jsapp/js/actions.es6
@@ -224,19 +224,24 @@ actions.resources.updateAsset.listen(function(uid, values, params={}) {
 });
 
 actions.resources.deployAsset.listen(function(asset, redeployment, params={}){
-  dataInterface.deployAsset(asset, redeployment)
-    .done((data) => {
-      actions.resources.deployAsset.completed(data.asset);
-      if (typeof params.onDone === 'function') {
-        params.onDone(data, redeployment);
-      }
-    })
-    .fail((data) => {
-      actions.resources.deployAsset.failed(data, redeployment);
-      if (typeof params.onFail === 'function') {
-        params.onFail(data,  redeployment);
-      }
-    });
+  var asset_type = asset.asset_type;
+  if (asset_type === "survey") {
+    dataInterface.deployAsset(asset, redeployment)
+      .done((data) => {
+        actions.resources.deployAsset.completed(data.asset);
+        if (typeof params.onDone === 'function') {
+          params.onDone(data, redeployment);
+        }
+      })
+      .fail((data) => {
+        actions.resources.deployAsset.failed(data, redeployment);
+        if (typeof params.onFail === 'function') {
+          params.onFail(data,  redeployment);
+        }
+      });
+  } else {
+    notify(t(`Asset of type ${asset_type} deployment is disabled`));
+  }
 });
 
 actions.resources.deployAsset.failed.listen(function(data, redeployment){
diff --git a/jsapp/js/editorMixins/editableForm.es6 b/jsapp/js/editorMixins/editableForm.es6
index 63a3bad287..85d5cba080 100644
--- a/jsapp/js/editorMixins/editableForm.es6
+++ b/jsapp/js/editorMixins/editableForm.es6
@@ -327,7 +327,7 @@ export default assign({
       }
       actions.resources.createResource.triggerAsync(params)
         .then(() => {
-          hashHistory.push(this.state.backRoute);
+          hashHistory.push(`/library/${asset.uid}/edit`);
         });
     } else {
       // update existing asset

From 711e27892a1ed9f65f9e38ac7003063a77447bdd Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 16:07:47 +0300
Subject: [PATCH 07/47] Add `can_publicize_collection` to extra_details

---
 kpi/serializers/current_user.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kpi/serializers/current_user.py b/kpi/serializers/current_user.py
index 6f142f7d54..8130eca553 100644
--- a/kpi/serializers/current_user.py
+++ b/kpi/serializers/current_user.py
@@ -122,6 +122,9 @@ def to_representation(self, obj):
             extra_details['require_auth'] = get_kc_profile_data(obj.pk).get(
                 'require_auth', False
             )
+            extra_details['can_publicize_collection'] = obj.has_perm(
+                'kpi.publicize_collection'
+            )
 
         return rep
 

From cf0b8758ac8abdcdb26b4e41716ddbfb7718eafa Mon Sep 17 00:00:00 2001
From: Mark Ekisa <mark.ekisa@gmail.com>
Date: Tue, 16 Jun 2020 15:58:56 +0300
Subject: [PATCH 08/47] Add mngt cmd to grant/revoke perm to publicize
 collection

Signed-off-by: Mark Ekisa <mark.ekisa@gmail.com>
---
 .../assign_publicize_collection_permission.py | 102 ++++++++++++++++++
 1 file changed, 102 insertions(+)
 create mode 100644 kpi/management/commands/assign_publicize_collection_permission.py

diff --git a/kpi/management/commands/assign_publicize_collection_permission.py b/kpi/management/commands/assign_publicize_collection_permission.py
new file mode 100644
index 0000000000..4193cd2b7e
--- /dev/null
+++ b/kpi/management/commands/assign_publicize_collection_permission.py
@@ -0,0 +1,102 @@
+import sys
+from optparse import make_option
+
+from django.contrib.auth.models import Permission
+from django.core.management.base import BaseCommand
+from django.contrib.contenttypes.models import ContentType
+from django.shortcuts import get_object_or_404
+from django.contrib.auth.models import User
+
+from kpi.models import Collection
+
+
+class Command(BaseCommand):
+    """
+    Grant or revoke `publicize_collection` permission to a user
+    """
+
+    option_list = BaseCommand.option_list + (
+        make_option('--username',
+                    action='store',
+                    dest='username',
+                    default=False,
+                    help="Add username i.e --username <username>"),) + (
+        make_option('--action',
+                    action='store',
+                    dest='action',
+                    default=False,
+                    help="Add action i.e --action <grant|revoke>"),)
+
+    def grant_publicize_collection_permission(
+            self, user, content_type, permission):
+        username = user.username
+        if user.has_perm('kpi.publicize_collection'):
+            sys.stdout.write(
+                ("%s already has `publicize_collection` permission"
+                 % username)
+            )
+        else:
+            user.user_permissions.add(permission)
+
+            # Request new instance of User
+            # Be aware that user.refresh_from_db() won't clear the cache.
+            # https://docs.djangoproject.com/en/3.0/topics/auth/default/#permission-caching
+            user = get_object_or_404(User, username=username)
+            if user.has_perm('kpi.publicize_collection'):
+                sys.stdout.write(
+                    ("`publicize_collection` permission has been granted to "
+                     "%s" % username)
+                )
+
+    def revoke_publicize_collection_permission(
+            self, user, content_type, permission):
+        username = user.username
+        if not user.has_perm('kpi.publicize_collection'):
+            sys.stdout.write(
+                ("%s doesn't have `publicize_collection` permission "
+                 % username)
+            )
+        else:
+            user.user_permissions.remove(permission)
+            user = get_object_or_404(User, username=username)
+            if not user.has_perm('kpi.publicize_collection'):
+                sys.stdout.write(
+                    ("`publicize_collection` permission has been revoked from "
+                     "%s" % username)
+                )
+
+    def handle(self, *args, **options):
+        username = options.get('username')
+        action = options.get('action')
+        if username and action:
+            if action not in ['grant', 'revoke']:
+                sys.stdout.write("Invalid action. Please use grant or revoke")
+                return
+
+            user = get_object_or_404(User, username=username)
+            content_type = ContentType.objects.get_for_model(Collection)
+            permission, created = Permission.objects.get_or_create(
+                codename='publicize_collection',
+                defaults={
+                    'content_type': content_type,
+                    'name': 'Can publicize collection'
+                },
+            )
+
+            if created:
+                sys.stdout.write(
+                    ("Permission `publicize_collection` has successfully "
+                     "been created")
+                )
+
+            if action == 'grant':
+                self.grant_publicize_collection_permission(
+                    user, content_type, permission
+                )
+
+            elif action == 'revoke':
+                self.revoke_publicize_collection_permission(
+                    user, content_type, permission
+                )
+        else:
+            sys.stdout.write("please provide a username")

From a151ee1dc65b471f3f810f77bd6b724be8473d58 Mon Sep 17 00:00:00 2001
From: Mark Ekisa <mark.ekisa@gmail.com>
Date: Tue, 16 Jun 2020 16:09:14 +0300
Subject: [PATCH 09/47] Rename management command file

Signed-off-by: Mark Ekisa <mark.ekisa@gmail.com>
---
 ...sion.py => grant_or_revoke_publicize_collection_permission.py} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename kpi/management/commands/{assign_publicize_collection_permission.py => grant_or_revoke_publicize_collection_permission.py} (100%)

diff --git a/kpi/management/commands/assign_publicize_collection_permission.py b/kpi/management/commands/grant_or_revoke_publicize_collection_permission.py
similarity index 100%
rename from kpi/management/commands/assign_publicize_collection_permission.py
rename to kpi/management/commands/grant_or_revoke_publicize_collection_permission.py

From 137e5a7b184db5a708e8aefb7740f6cd553ae563 Mon Sep 17 00:00:00 2001
From: WinnyTroy <kiraguwinnie@gmail.com>
Date: Tue, 23 Jun 2020 15:47:45 +0300
Subject: [PATCH 10/47] Make raven environment filter configurable

---
 kpi/context_processors.py | 2 ++
 kpi/templates/index.html  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/kpi/context_processors.py b/kpi/context_processors.py
index e26ceec7de..bf54c2e5ed 100644
--- a/kpi/context_processors.py
+++ b/kpi/context_processors.py
@@ -13,6 +13,8 @@ def external_service_tokens(request):
         out['google_analytics_token'] = settings.GOOGLE_ANALYTICS_TOKEN
     if settings.RAVEN_JS_DSN:
         out['raven_js_dsn'] = settings.RAVEN_JS_DSN
+    if settings.RAVEN_FRONTEND_ENV:
+        out['raven_env'] = settings.RAVEN_FRONTEND_ENV
     try:
         intercom_setting = PerUserSetting.objects.get(name='INTERCOM_APP_ID')
     except PerUserSetting.DoesNotExist:
diff --git a/kpi/templates/index.html b/kpi/templates/index.html
index c7fc898428..549b2f3ba2 100644
--- a/kpi/templates/index.html
+++ b/kpi/templates/index.html
@@ -15,7 +15,7 @@
     {% if raven_js_dsn %}
       <script src="https://cdn.ravenjs.com/3.22.3/raven.min.js" crossorigin="anonymous"></script>
       <script>
-        Raven.config('{{raven_js_dsn}}').install()
+        Raven.config('{{raven_js_dsn}}', {environment: '{{raven_env}}'}).install()
       </script>
     {% endif %}
 

From faaca2e75a509612f8f2d672cb7008a308299584 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 16:27:56 +0300
Subject: [PATCH 11/47] Update how assets are updated on the backend

---
 kpi/models/import_export_task.py | 40 +++++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 14 deletions(-)

diff --git a/kpi/models/import_export_task.py b/kpi/models/import_export_task.py
index a2c5adb07c..9794c90cdf 100644
--- a/kpi/models/import_export_task.py
+++ b/kpi/models/import_export_task.py
@@ -203,7 +203,9 @@ def _run_task(self, messages):
             # TODO: merge with `url` handling above; currently kept separate
             # because `_load_assets_from_url()` uses complex logic to deal with
             # multiple XLS files in a directory structure within a ZIP archive
-            response = requests.get(self.data['single_xls_url'])
+            headers = {"Authorization": f"Token {self.user.auth_token.key}"}
+            response = requests.get(
+                self.data['single_xls_url'], headers=headers)
             response.raise_for_status()
             encoded_xls = to_str(base64.b64encode(response.content))
 
@@ -305,11 +307,13 @@ def _load_assets_from_url(self, url, messages, **kwargs):
             orm_obj.parent = parent_item
             orm_obj.save()
 
-    def _retrieve_form_information(self):
-        url = f"{settings.KOBOCAT_INTERNAL_URL}/api/v1/forms/{self.data['filename']}"
+    def _retrieve_form_payload(self, form_id):
+        url = f"{settings.KOBOCAT_INTERNAL_URL}/api/v1/forms/{form_id}"
         token = Token.objects.get(user=self.user)
 
-        return requests.get(url, headers={"Authorization": f"Token {token.key}"})
+        response = requests.get(url, headers={"Authorization": f"Token {token.key}"})
+        if response.status_code == 200:
+            return response.json()
 
     def _parse_b64_upload(self, base64_encoded_upload, messages, **kwargs):
         filename = kwargs.get('filename', False)
@@ -323,8 +327,14 @@ def _parse_b64_upload(self, base64_encoded_upload, messages, **kwargs):
         survey_dict = _b64_xls_to_dict(base64_encoded_upload)
         survey_dict_keys = survey_dict.keys()
 
-        json_response = self._retrieve_form_information()
-        json_response['has_id_string_changed'] = False
+        form_payload = None
+        destination_kls = kwargs.get('destination_kls')
+        if destination_kls == 'asset':
+            asset = kwargs.get('destination')
+            form_id = asset.settings.get('form_id')
+            form_payload = self._retrieve_form_payload(form_id)
+            if form_payload:
+                form_payload['has_id_string_changed'] = False
 
         destination = kwargs.get('destination', False)
         has_necessary_perm = kwargs.get('has_necessary_perm', False)
@@ -387,14 +397,16 @@ def _parse_b64_upload(self, base64_encoded_upload, messages, **kwargs):
                         base64_encoded_upload, survey_dict
                     )
                 asset.content = survey_dict
-                identifier = f"{settings.KOBOCAT_URL}/{asset.owner.username}/forms/{asset.name}"
-                asset._deployment_data.update({
-                    'backend': 'kobocat',
-                    'identifier': identifier,
-                    'active': json_response['downloadable'],
-                    'backend_response': json_response,
-                    'version': asset.version_id
-                })
+                if form_payload:
+                    id_string = form_payload.get('id_string')
+                    identifier = f"{settings.KOBOCAT_URL}/{asset.owner.username}/forms/{id_string}"
+                    asset._deployment_data.update({
+                        'backend': 'kobocat',
+                        'identifier': identifier,
+                        'active': form_payload['downloadable'],
+                        'backend_response': form_payload,
+                        'version': asset.version_id
+                    })
                 asset.save()
                 msg_key = 'updated'
 

From 75287158b64eac6732e5e6978572b62256eb09b2 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 16:29:48 +0300
Subject: [PATCH 12/47] Double alerts notifier delay

---
 jsapp/js/utils.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jsapp/js/utils.ts b/jsapp/js/utils.ts
index 55d2a74212..9e688b28a3 100644
--- a/jsapp/js/utils.ts
+++ b/jsapp/js/utils.ts
@@ -19,7 +19,7 @@ export const LANGUAGE_COOKIE_NAME = 'django_language';
 
 export const assign = require('object-assign');
 
-alertify.defaults.notifier.delay = 10;
+alertify.defaults.notifier.delay = 20;
 alertify.defaults.notifier.position = 'bottom-left';
 alertify.defaults.notifier.closeButton = true;
 

From 36c921c8aa4a3875c9cec5dd8e34677b1073888c Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 16:34:59 +0300
Subject: [PATCH 13/47] Add helper text above library listing

---
 jsapp/js/bemComponents.ts                |  1 +
 jsapp/js/editorMixins/assetNavigator.es6 | 10 +++++++
 jsapp/scss/components/_kobo.lib-nav.scss | 34 ++++++++++++++++++++++++
 3 files changed, 45 insertions(+)

diff --git a/jsapp/js/bemComponents.ts b/jsapp/js/bemComponents.ts
index e3ca256e99..74a1284b42 100644
--- a/jsapp/js/bemComponents.ts
+++ b/jsapp/js/bemComponents.ts
@@ -100,6 +100,7 @@ bem.LibNav__search = makeBem(bem.LibNav, 'search');
 bem.LibNav__expanded = makeBem(bem.LibNav, 'expanded');
 bem.LibNav__count = makeBem(bem.LibNav, 'count');
 bem.LibNav__expandedToggle = makeBem(bem.LibNav, 'expandedToggle');
+bem.LibNav__helperContainer = makeBem(bem.LibNav, 'helperContainer');
 
 bem.TemplatesList = makeBem(null, 'templates-list');
 bem.TemplatesList__header = makeBem(bem.TemplatesList, 'header');
diff --git a/jsapp/js/editorMixins/assetNavigator.es6 b/jsapp/js/editorMixins/assetNavigator.es6
index bbf33e457c..b67cc7991a 100644
--- a/jsapp/js/editorMixins/assetNavigator.es6
+++ b/jsapp/js/editorMixins/assetNavigator.es6
@@ -221,6 +221,16 @@ class AssetNavigator extends Reflux.Component {
         </bem.LibNav__header>
 
         <bem.LibNav__content>
+          <bem.LibNav__helperContainer>
+            <div className="header">
+              <span className="icon-container"><i className='k-icon-information' /></span>
+              <span><b>Quick tip</b></span>
+            </div>
+            <hr/>
+            <div className="body">
+              {t('You can drag and drop the items below to the form editor on the left')}
+            </div>
+          </bem.LibNav__helperContainer>
           <AssetNavigatorListView searchContext={this.state.searchContext} />
         </bem.LibNav__content>
 
diff --git a/jsapp/scss/components/_kobo.lib-nav.scss b/jsapp/scss/components/_kobo.lib-nav.scss
index 8e749ac544..be42759272 100644
--- a/jsapp/scss/components/_kobo.lib-nav.scss
+++ b/jsapp/scss/components/_kobo.lib-nav.scss
@@ -31,6 +31,40 @@
   }
 }
 
+.lib-nav__helperContainer {
+  background-color: #bee5eb;
+  border: 1px solid #e0e1e6;
+  padding-top: 5px;
+  padding-bottom: 5px;
+
+  .header {
+    display: flex;
+    padding-top: 10px;
+    margin-bottom: -6px;
+
+    .icon-container {
+      margin-top: -6px;
+      margin-bottom: -12px;
+
+      .k-icon-information {
+        font-size: 32px;
+      }
+    }
+  }
+
+  hr {
+    border-top: 1px solid #737b92;
+    margin-left: 7px;
+    margin-right: 7px;
+  }
+
+  .body {
+    margin-top: -7px;
+    margin-left: 7px;
+    margin-right: 7px;
+  }
+}
+
 .lib-nav__search {
   margin: 0 0 10px;
   flex-grow: 1;

From 4898f68fdb3095cbff7c83156d0f51f04f152d78 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 16:48:36 +0300
Subject: [PATCH 14/47] OnaData functionality

---
 kpi/models/asset.py             | 13 +++++++++++++
 kpi/serializers/v2/asset.py     |  6 +++++-
 kpi/utils/ona_authentication.py | 26 +++++++++++++++++++-------
 3 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/kpi/models/asset.py b/kpi/models/asset.py
index 604bfc0161..5f24738a1c 100644
--- a/kpi/models/asset.py
+++ b/kpi/models/asset.py
@@ -1,6 +1,7 @@
 # coding: utf-8
 # 😬
 import copy
+import re
 from functools import reduce
 from operator import add
 from typing import Optional, Union
@@ -11,6 +12,7 @@
 from django.db import models
 from django.db import transaction
 from django.db.models import Exists, OuterRef, Prefetch, Q
+from django.core.exceptions import ValidationError
 from django.utils.translation import gettext_lazy as t
 from taggit.managers import TaggableManager, _TaggableManager
 from taggit.utils import require_instance_manager
@@ -387,6 +389,16 @@ def __init__(self, *args, **kwargs):
     def __str__(self):
         return '{} ({})'.format(self.name, self.uid)
 
+    def _contains_invalid_chars(self, content):
+        for row in content['survey']:
+            try:
+                if row['default'] and bool(re.search(
+                        r'[<|>|&]', row['default'])):
+                    raise ValidationError(
+                        'XForm questions settings may contain malicious content')
+            except KeyError:
+                pass
+
     def adjust_content_on_save(self):
         """
         This is called on save by default if content exists.
@@ -401,6 +413,7 @@ def adjust_content_on_save(self):
         self._autoname(self.content)
         self._unlink_list_items(self.content)
         self._remove_empty_expressions(self.content)
+        self._contains_invalid_chars(self.content)
 
         settings = self.content['settings']
         _title = settings.pop('form_title', None)
diff --git a/kpi/serializers/v2/asset.py b/kpi/serializers/v2/asset.py
index 34394ee8df..b8576979a1 100644
--- a/kpi/serializers/v2/asset.py
+++ b/kpi/serializers/v2/asset.py
@@ -3,6 +3,7 @@
 import re
 
 from django.conf import settings
+from django.core.exceptions import ValidationError
 from django.utils.translation import gettext as t
 from rest_framework import serializers
 from rest_framework.relations import HyperlinkedIdentityField
@@ -175,7 +176,10 @@ def update(self, asset, validated_data):
                     'translations': str(err)
                 })
             validated_data['content'] = asset_content
-        return super().update(asset, validated_data)
+        try:
+            return super().update(asset, validated_data)
+        except ValidationError as e:
+            raise serializers.ValidationError(e.message)
 
     def get_fields(self, *args, **kwargs):
         fields = super().get_fields(*args, **kwargs)
diff --git a/kpi/utils/ona_authentication.py b/kpi/utils/ona_authentication.py
index d959a327b1..c103831009 100644
--- a/kpi/utils/ona_authentication.py
+++ b/kpi/utils/ona_authentication.py
@@ -7,10 +7,12 @@
 from django.shortcuts import get_object_or_404
 from rest_framework import exceptions
 from rest_framework.authentication import (
-    TokenAuthentication, get_authorization_header
+    BaseAuthentication
 )
 from rest_framework.authtoken.models import Token
 
+from kpi.utils.permissions import grant_default_model_level_perms
+
 
 
 def get_api_token(json_web_token):
@@ -24,24 +26,34 @@ def get_api_token(json_web_token):
             settings.get("JWT_SECRET_KEY", ""),
             algorithms=[settings.get("JWT_ALGORITHM", "HS256")]
         )
-        api_token = get_object_or_404(Token, key=jwt_payload.get("api-token"))
 
+        api_token = Token.objects.using("kobocat").select_related('user').get(
+            key=jwt_payload.get('api-token'))
         return api_token
     except BadSignature as e:
-        raise exceptions.AuthenticationFailed(_(f"Bad Signature: {e}"))
+        raise exceptions.AuthenticationFailed(_(f'Bad Signature: {e}'))
     except jwt.DecodeError as e:
-        raise exceptions.AuthenticationFailed(_(f"JWT DecodeError: {e}"))
+        raise exceptions.AuthenticationFailed(_(f'JWT DecodeError: {e}'))
+    except Token.DoesNotExist:
+        raise exceptions.AuthenticationFailed(_(f'No Token retrieved.'))
 
 
-class JWTAuthentication(TokenAuthentication):
+class JWTAuthentication(BaseAuthentication):
     model = Token
 
     def authenticate(self, request):
         cookie_jwt = request.COOKIES.get(settings.KPI_COOKIE_NAME)
         if cookie_jwt:
             api_token = get_api_token(cookie_jwt)
+            user, created = User.objects.using('default').get_or_create(
+                username=api_token.user.username)
+
+            if created:
+                grant_default_model_level_perms(user)
+
             if getattr(api_token, "user"):
-                return api_token.user, api_token
+                return user, None
+        else:
+            return None
 
-            raise exceptions.ParseError(_("Malformed cookie. Clear your cookies then try again"))
 

From 07084a8f0ec0ae724a66103c6105313137743d3c Mon Sep 17 00:00:00 2001
From: Kipchirchir Sigei <arapgodsmack@gmail.com>
Date: Mon, 31 Jan 2022 15:58:20 +0300
Subject: [PATCH 15/47] Update help text label

Signed-off-by: Kipchirchir Sigei <arapgodsmack@gmail.com>
---
 jsapp/js/components/modalForms/projectSettings.es6 | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/jsapp/js/components/modalForms/projectSettings.es6 b/jsapp/js/components/modalForms/projectSettings.es6
index 51153df778..32eea343ae 100644
--- a/jsapp/js/components/modalForms/projectSettings.es6
+++ b/jsapp/js/components/modalForms/projectSettings.es6
@@ -24,6 +24,7 @@ import {
   isAValidUrl,
   validFileTypes,
 } from 'utils';
+import { TITLE } from '../../ona/config';
 import {
   NAME_MAX_LENGTH,
   PROJECT_SETTINGS_CONTEXTS,
@@ -963,7 +964,7 @@ class ProjectSettings extends React.Component {
             <Checkbox
               checked={this.state.fields['share-metadata']}
               onChange={this.onAnyFieldChange.bind(this, 'share-metadata')}
-              label={t('Help KoboToolbox improve this product by sharing the sector and country where this project will be deployed.') + ' ' + t('All the information is submitted anonymously, and will not include the project name or description listed above.')}
+              label={t('Help ${ TITLE } improve this product by sharing the sector and country where this project will be deployed.') + ' ' + t('All the information is submitted anonymously, and will not include the project name or description listed above.')}
             />
           </bem.FormModal__item>
 

From 042a6c576d13105e4f64394ada6fa2042a06d334 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 16:53:38 +0300
Subject: [PATCH 16/47] Add a way to disable library toggle

---
 jsapp/js/editorMixins/editableForm.es6 | 3 ++-
 jsapp/js/ona/config.ts                 | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/jsapp/js/editorMixins/editableForm.es6 b/jsapp/js/editorMixins/editableForm.es6
index 85d5cba080..24572bda6b 100644
--- a/jsapp/js/editorMixins/editableForm.es6
+++ b/jsapp/js/editorMixins/editableForm.es6
@@ -16,7 +16,7 @@ import {
   checkIfCookieExists,
   redirectForOnaDataAuth,
 } from 'utils';
-import { TITLE } from '../ona/config';
+import { TITLE, DISABLE_LIBRARY_TOGGLE } from '../ona/config';
 import {
   ASSET_TYPES,
   AVAILABLE_FORM_STYLES,
@@ -689,6 +689,7 @@ export default assign({
               m={['panel-toggle', this.state.asideLibrarySearchVisible ? 'active' : null]}
               onClick={this.toggleAsideLibrarySearch}
               className={this.isAddingQuestionsRestricted() ? LOCKING_UI_CLASSNAMES.DISABLED : ''}
+              disabled={DISABLE_LIBRARY_TOGGLE}
             >
               <i className={['k-icon', this.state.asideLibrarySearchVisible ? 'k-icon-close' : 'k-icon-library' ].join(' ')} />
               <span className='panel-toggle-name'>{t('Add from Library')}</span>
diff --git a/jsapp/js/ona/config.ts b/jsapp/js/ona/config.ts
index b8af5378db..f840b49a70 100644
--- a/jsapp/js/ona/config.ts
+++ b/jsapp/js/ona/config.ts
@@ -2,5 +2,6 @@
  * Modified configuration file; Meant to be modified on the deployment
  */
 
-export const ZEBRA_URL = "http://localhost:3001/login"
-export const TITLE = "Ona"
+export const ZEBRA_URL = "http://localhost:3001/login";
+export const TITLE = "Ona";
+export const DISABLE_LIBRARY_TOGGLE = false;

From f542086e99c902cff51ea1f6b5ac4b2d8bfda925 Mon Sep 17 00:00:00 2001
From: Davis Raymond <davisraymondmuro@outlook.com>
Date: Sat, 4 Jun 2022 05:11:51 +0300
Subject: [PATCH 17/47] Use python3 instead of python

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e40a44ded4..98180a4b9e 100644
--- a/package.json
+++ b/package.json
@@ -113,7 +113,7 @@
     "lint": "eslint \"jsapp/js/**/*\" --ext .es6,.js,.jsx,.ts,.tsx",
     "show-icons": "opn jsapp/fonts/k-icons.html",
     "generate-icons": "node ./scripts/generate_icons.js",
-    "copy-fonts": "python ./scripts/copy_fonts.py && npm run generate-icons"
+    "copy-fonts": "python3 ./scripts/copy_fonts.py && npm run generate-icons"
   },
   "repository": "https://github.com/kobotoolbox/kpi.git",
   "author": "alex.dorey@kobotoolbox.org, esmail.fadae@kobotoolbox.org, john.milner@kobotoolbox.org",

From 9d4a9675a57acc7000ed9f57c3769ae36d6f4b48 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 17:24:46 +0300
Subject: [PATCH 18/47] Fix an issue with translations

---
 jsapp/js/actions.es6 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jsapp/js/actions.es6 b/jsapp/js/actions.es6
index 556747592b..48aa5c9d35 100644
--- a/jsapp/js/actions.es6
+++ b/jsapp/js/actions.es6
@@ -240,7 +240,7 @@ actions.resources.deployAsset.listen(function(asset, redeployment, params={}){
         }
       });
   } else {
-    notify(t(`Asset of type ${asset_type} deployment is disabled`));
+    notify(t('Asset of type ${asset_type} deployment is disabled'));
   }
 });
 

From 0c0ce7317a0b8e058b02e454cb72a1f5a08b3b7f Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 18:18:11 +0300
Subject: [PATCH 19/47] Disable celery autoscaling

---
 kobo/apps/__init__.py | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/kobo/apps/__init__.py b/kobo/apps/__init__.py
index a7f361ef9e..d8ed784d4e 100644
--- a/kobo/apps/__init__.py
+++ b/kobo/apps/__init__.py
@@ -10,25 +10,25 @@
 class KpiConfig(AppConfig):
     name = 'kpi'
 
-    def ready(self, *args, **kwargs):
-        # Register signals only when the app is ready to avoid issues with models
-        # not loaded yet.
-        import kpi.signals
+    # def ready(self, *args, **kwargs):
+    #     # Register signals only when the app is ready to avoid issues with models
+    #     # not loaded yet.
+    #     import kpi.signals
 
-        # Once it's okay to read from the database, apply the user-desired
-        # autoscaling configuration for Celery workers
-        from kobo.celery import update_concurrency_from_constance
-        try:
-            # Push this onto the task queue with `delay()` instead of calling
-            # it directly because a direct call in the absence of any Celery
-            # workers hangs indefinitely
-            update_concurrency_from_constance.delay()
-        except kombu.exceptions.OperationalError as e:
-            # It's normal for Django to start without access to a message
-            # broker, e.g. while running `./manage.py collectstatic`
-            # during a Docker image build
-            pass
-        return super().ready(*args, **kwargs)
+    #     # Once it's okay to read from the database, apply the user-desired
+    #     # autoscaling configuration for Celery workers
+    #     from kobo.celery import update_concurrency_from_constance
+    #     try:
+    #         # Push this onto the task queue with `delay()` instead of calling
+    #         # it directly because a direct call in the absence of any Celery
+    #         # workers hangs indefinitely
+    #         update_concurrency_from_constance.delay()
+    #     except kombu.exceptions.OperationalError as e:
+    #         # It's normal for Django to start without access to a message
+    #         # broker, e.g. while running `./manage.py collectstatic`
+    #         # during a Docker image build
+    #         pass
+    #     return super().ready(*args, **kwargs)
 
 
 register(TwoDatabaseConfigurationChecker().as_check(), Tags.database)

From 7e9e2b17c10209bdfcaba3b0bae1153d5144fa62 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 18:18:33 +0300
Subject: [PATCH 20/47] Import settings correctly

- Add management command
---
 .../grant_default_permissions_per_user.py     | 26 +++++++++++++++++++
 kpi/utils/ona_authentication.py               |  4 +--
 kpi/views/__init__.py                         |  2 +-
 3 files changed, 29 insertions(+), 3 deletions(-)
 create mode 100644 kpi/management/commands/grant_default_permissions_per_user.py

diff --git a/kpi/management/commands/grant_default_permissions_per_user.py b/kpi/management/commands/grant_default_permissions_per_user.py
new file mode 100644
index 0000000000..5ab7b22257
--- /dev/null
+++ b/kpi/management/commands/grant_default_permissions_per_user.py
@@ -0,0 +1,26 @@
+import sys
+from optparse import make_option
+from django.core.management.base import BaseCommand
+from django.contrib.auth.models import User
+from kpi.utils.permissions import grant_default_model_level_perms
+
+
+class Command(BaseCommand):
+    def add_arguments(self, parser):
+        parser.add_argument('--username',
+                    action='store',
+                    dest='username',
+                    default=False,
+                    help="Add username i.e --username <username>")
+
+    def handle(self, *args, **options):
+        username = options.get('username')
+        if username:
+            users = User.objects.filter(username=username)
+            if users:
+                grant_default_model_level_perms(users[0])
+                sys.stdout.write("done")
+            else:
+                sys.stdout.write("user does not exist")
+        else:
+            sys.stdout.write("please provide a username")
diff --git a/kpi/utils/ona_authentication.py b/kpi/utils/ona_authentication.py
index c103831009..bcffba9077 100644
--- a/kpi/utils/ona_authentication.py
+++ b/kpi/utils/ona_authentication.py
@@ -23,8 +23,8 @@ def get_api_token(json_web_token):
     try:
         jwt_payload = jwt.decode(
             json_web_token,
-            settings.get("JWT_SECRET_KEY", ""),
-            algorithms=[settings.get("JWT_ALGORITHM", "HS256")]
+            getattr(settings, "JWT_SECRET_KEY", ""),
+            algorithms=[getattr(settings, "JWT_ALGORITHM", "HS256")]
         )
 
         api_token = Token.objects.using("kobocat").select_related('user').get(
diff --git a/kpi/views/__init__.py b/kpi/views/__init__.py
index 28ca80307b..2362ae75cf 100644
--- a/kpi/views/__init__.py
+++ b/kpi/views/__init__.py
@@ -23,7 +23,7 @@
 
 
 def home(request):
-    return HttpResponseRedirect(settings.get("ONADATA_HOME"))
+    return HttpResponseRedirect(getattr(settings, "ONADATA_HOME", "https://onadata.com"))
 
 
 def browser_tests(request):

From 2b2387ebeac38b31eb26c78efc9cf31beb970554 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 30 Sep 2022 18:43:44 +0300
Subject: [PATCH 21/47] Revert home view change

---
 kpi/views/__init__.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kpi/views/__init__.py b/kpi/views/__init__.py
index 2362ae75cf..63ebe3d5c2 100644
--- a/kpi/views/__init__.py
+++ b/kpi/views/__init__.py
@@ -20,10 +20,17 @@
 from kpi.models import AuthorizedApplication, OneTimeAuthenticationKey
 from kpi.models.authorized_application import ApplicationTokenAuthentication
 from kpi.serializers import AuthorizedApplicationUserSerializer
+from kpi.utils.ona_authentication import JWTAuthentication
 
 
 def home(request):
-    return HttpResponseRedirect(getattr(settings, "ONADATA_HOME", "https://onadata.com"))
+    cookie_jwt = request.COOKIES.get(settings.KPI_COOKIE_NAME)
+    if request.user.is_anonymous and cookie_jwt:
+        auth_class = JWTAuthentication()
+        user, token = auth_class.authenticate(request)
+        user.backend = settings.AUTHENTICATION_BACKENDS[0]
+        login(request, user)
+    return TemplateResponse(request, "index.html")
 
 
 def browser_tests(request):

From f31fabbf43ee151f5327bb1da62c5d1992ee81be Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Tue, 11 Oct 2022 11:21:20 +0300
Subject: [PATCH 22/47] Update ObjectPermissionBackend

---
 kpi/backends.py       | 29 ++++++++++++++++++++---------
 kpi/views/__init__.py |  2 +-
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/kpi/backends.py b/kpi/backends.py
index c5310e3647..8ae7f6890b 100644
--- a/kpi/backends.py
+++ b/kpi/backends.py
@@ -1,15 +1,29 @@
 # coding: utf-8
 from django.contrib.auth.backends import ModelBackend
+from django.contrib.auth.models import AnonymousUser
 from django.conf import settings
 
-from kpi.utils.object_permission import get_database_user
-from .utils.permissions import is_user_anonymous
+from .models.object_permission import get_anonymous_user, perm_parse
 
 
 class ObjectPermissionBackend(ModelBackend):
+    @staticmethod
+    def _translate_anonymous_user(user_obj):
+        """
+        Returns user_obj, is_anonymous, where user_obj is always a real
+        User object (translated from AnonymousUser if necessary), and
+        is_anonymous is True if the user is anonymous
+        """
+        is_anonymous = False
+        if isinstance(user_obj, AnonymousUser):
+            is_anonymous = True
+            user_obj = get_anonymous_user()
+        elif user_obj.pk == settings.ANONYMOUS_USER_ID:
+            is_anonymous = True
+        return user_obj, is_anonymous
+
     def get_group_permissions(self, user_obj, obj=None):
-        is_anonymous = is_user_anonymous(user_obj)
-        user_obj = get_database_user(user_obj)
+        user_obj, is_anonymous = self._translate_anonymous_user(user_obj)
         permissions = super().get_group_permissions(user_obj, obj)
         if is_anonymous:
             # Obey limits on anonymous users' permissions
@@ -19,8 +33,7 @@ def get_group_permissions(self, user_obj, obj=None):
             return permissions
 
     def get_all_permissions(self, user_obj, obj=None):
-        is_anonymous = is_user_anonymous(user_obj)
-        user_obj = get_database_user(user_obj)
+        user_obj, is_anonymous = self._translate_anonymous_user(user_obj)
         permissions = super().get_all_permissions(user_obj, obj)
         if is_anonymous:
             # Obey limits on anonymous users' permissions
@@ -30,8 +43,7 @@ def get_all_permissions(self, user_obj, obj=None):
             return permissions
 
     def has_perm(self, user_obj, perm, obj=None):
-        is_anonymous = is_user_anonymous(user_obj)
-        user_obj = get_database_user(user_obj)
+        user_obj, is_anonymous = self._translate_anonymous_user(user_obj)
         if obj is None or not hasattr(obj, 'has_perm'):
             if is_anonymous:
                 # Obey limits on anonymous users' permissions
@@ -43,4 +55,3 @@ def has_perm(self, user_obj, perm, obj=None):
             return False
         # Trust the object-level test to handle anonymous users correctly
         return obj.has_perm(user_obj, perm)
-
diff --git a/kpi/views/__init__.py b/kpi/views/__init__.py
index 63ebe3d5c2..8bd991abed 100644
--- a/kpi/views/__init__.py
+++ b/kpi/views/__init__.py
@@ -27,7 +27,7 @@ def home(request):
     cookie_jwt = request.COOKIES.get(settings.KPI_COOKIE_NAME)
     if request.user.is_anonymous and cookie_jwt:
         auth_class = JWTAuthentication()
-        user, token = auth_class.authenticate(request)
+        user, _ = auth_class.authenticate(request)
         user.backend = settings.AUTHENTICATION_BACKENDS[0]
         login(request, user)
     return TemplateResponse(request, "index.html")

From da8958047d4c891e626d740d796dfe547ef326ad Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Tue, 11 Oct 2022 16:19:30 +0300
Subject: [PATCH 23/47] Add perm_parse and get_anonymous_user functions

---
 kpi/models/object_permission.py | 38 +++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/kpi/models/object_permission.py b/kpi/models/object_permission.py
index fec63985fc..bbb9e80bed 100644
--- a/kpi/models/object_permission.py
+++ b/kpi/models/object_permission.py
@@ -1,11 +1,49 @@
 # coding: utf-8
 from django.core.exceptions import ValidationError
+from django.contrib.auth.models import User
+from django.conf import settings
+from django.contrib.contenttypes.models import ContentType
 from django.db import models
+from django_request_cache import cache_for_request
 
 from kpi.fields.kpi_uid import KpiUidField
 from kpi.utils.cache import void_cache_for_request
 
 
+@cache_for_request
+def get_anonymous_user():
+    """ Return a real User in the database to represent AnonymousUser. """
+    try:
+        user = User.objects.get(pk=settings.ANONYMOUS_USER_ID)
+    except User.DoesNotExist:
+        username = getattr(
+            settings,
+            'ANONYMOUS_DEFAULT_USERNAME_VALUE',
+            'AnonymousUser'
+        )
+        user = User.objects.create(
+            pk=settings.ANONYMOUS_USER_ID,
+            username=username
+        )
+    return user
+
+
+def perm_parse(perm, obj=None):
+    if obj is not None:
+        obj_app_label = ContentType.objects.get_for_model(obj).app_label
+    else:
+        obj_app_label = None
+    try:
+        app_label, codename = perm.split('.', 1)
+        if obj_app_label is not None and app_label != obj_app_label:
+            raise ValidationError('The given object does not belong to the app '
+                                  'specified in the permission string.')
+    except ValueError:
+        app_label = obj_app_label
+        codename = perm
+    return app_label, codename
+
+
 class ObjectPermission(models.Model):
     """
     An object-level permission assignment for an `Asset`.

From 7fd2fd3851b1fadfacfb4813b61286834d9c121a Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Tue, 11 Oct 2022 16:49:50 +0300
Subject: [PATCH 24/47] Disable `is_mfa_active` field on the KoboCAT
 Userprofile shadow model

---
 kpi/deployment_backends/kc_access/shadow_models.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kpi/deployment_backends/kc_access/shadow_models.py b/kpi/deployment_backends/kc_access/shadow_models.py
index ad3c1c70c4..6e13e1f6c3 100644
--- a/kpi/deployment_backends/kc_access/shadow_models.py
+++ b/kpi/deployment_backends/kc_access/shadow_models.py
@@ -469,10 +469,10 @@ class Meta(ShadowModel.Meta):
                                    on_delete=models.CASCADE)
     num_of_submissions = models.IntegerField(default=0)
     metadata = JSONBField(default=dict, blank=True)
-    # We need to cast `is_active` to an (positive small) integer because KoBoCAT
-    # is using `LazyBooleanField` which is an integer behind the scene.
-    # We do not want to port this class to KPI only for one line of code.
-    is_mfa_active = models.PositiveSmallIntegerField(default=False)
+
+    @property
+    def is_mfa_active(self):
+        return False
 
     @classmethod
     def set_mfa_status(cls, user_id: int, is_active: bool):

From 7fde0b7a7a1ddd149125653686194307140d75ef Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Tue, 11 Oct 2022 17:31:48 +0300
Subject: [PATCH 25/47] Ensure Kobocat Deployment backend works

---
 kpi/deployment_backends/mixin.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kpi/deployment_backends/mixin.py b/kpi/deployment_backends/mixin.py
index 145e13e933..d5b2ee3fc4 100644
--- a/kpi/deployment_backends/mixin.py
+++ b/kpi/deployment_backends/mixin.py
@@ -1,4 +1,6 @@
 # coding: utf-8
+import json
+
 from kpi.constants import ASSET_TYPE_SURVEY
 from kpi.exceptions import BadAssetTypeException, DeploymentNotFound
 from kpi.models.asset_file import AssetFile
@@ -53,7 +55,10 @@ def deployment(self):
         if not self.has_deployment:
             raise DeploymentNotFound
 
-        return self.__get_deployment_backend(self._deployment_data['backend'])
+        deployment_data = self._deployment_data
+        if isinstance(deployment_data, str):
+            deployment_data = json.loads(self._deployment_data)
+        return self.__get_deployment_backend(deployment_data['backend'])
 
     @property
     def has_deployment(self):

From 150de22daacc4c6c5e7432568d8d379cb8a3bd6b Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Fri, 14 Oct 2022 16:24:12 +0300
Subject: [PATCH 26/47] Ensure nested_dict is actually a dictionary

---
 kpi/deployment_backends/base_backend.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kpi/deployment_backends/base_backend.py b/kpi/deployment_backends/base_backend.py
index 855ecf1f5d..685ae11ac1 100644
--- a/kpi/deployment_backends/base_backend.py
+++ b/kpi/deployment_backends/base_backend.py
@@ -115,6 +115,8 @@ def get_data(
         value = None
         nested_path = dotted_path.split('.')
         nested_dict = self.asset._deployment_data  # noqa
+        if isinstance(nested_dict, str):
+            nested_dict = json.loads(nested_dict)
         for key in nested_path:
             try:
                 value = nested_dict[key]

From 055aa6bc14d2a6121a97978cf603e792dc431a3c Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Tue, 25 Oct 2022 11:50:26 +0300
Subject: [PATCH 27/47] Update how we check if cookie exists

---
 jsapp/js/utils.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jsapp/js/utils.ts b/jsapp/js/utils.ts
index 9e688b28a3..a49d3f4aa5 100644
--- a/jsapp/js/utils.ts
+++ b/jsapp/js/utils.ts
@@ -54,7 +54,7 @@ export function formatTimeDateShort(timeStr: string): string {
 }
 
 export function checkIfCookieExists(authCookieName: string): boolean {
-  return cookies.get(authCookieName) !== null
+  return document.cookie.indexOf(authCookieName) < 0;
 }
 
 export function redirectForOnaDataAuth() {

From 3410af74401da525a2a8d357391f0fa3f1e9185d Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davisraymondmuro@outlook.com>
Date: Thu, 27 Oct 2022 16:06:40 +0300
Subject: [PATCH 28/47] Ensure asset is deployed on update

---
 jsapp/js/actions.es6 | 51 ++++++++++++++++++++++++++++++++------------
 1 file changed, 37 insertions(+), 14 deletions(-)

diff --git a/jsapp/js/actions.es6 b/jsapp/js/actions.es6
index 48aa5c9d35..69da746a9b 100644
--- a/jsapp/js/actions.es6
+++ b/jsapp/js/actions.es6
@@ -206,20 +206,43 @@ actions.resources.updateAsset.listen(function(uid, values, params={}) {
   if (checkIfCookieExists("__kpi_formbuilder")) {
     redirectForOnaDataAuth()
   } else {
-    dataInterface.patchAsset(uid, values)
-      .done((asset) => {
-        actions.resources.updateAsset.completed(asset);
-        if (typeof params.onComplete === 'function') {
-          params.onComplete(asset, uid, values);
-        }
-        notify(t('successfully updated'));
-      })
-      .fail(function(resp){
-        actions.resources.updateAsset.failed(resp);
-        if (params.onFailed) {
-          params.onFailed(resp);
-        }
-      });
+    return new Promise((resolve, reject) => {
+      dataInterface.patchAsset(uid, values)
+        .done((asset) => {
+          actions.resources.updateAsset.completed(asset);
+          resolve(asset);
+        })
+        .fail((resp) => {
+          if (resp.status === 500) {
+            reject(resp);
+          } else {
+            alertify.error(resp.responseJSON[0]);
+            reject(resp);
+          }
+        });
+    }).then((asset) => {
+      if (asset.asset_type === "survey") {
+        dataInterface.deployAsset(asset, asset.has_deployment)
+          .done((data) => {
+            if (asset.has_deployment) {
+              notify(t('Successfully updated published form.'));
+            } else {
+              notify(t('Successfully published form.'));
+            }
+          })
+          .fail((resp) => {
+            if (resp.status === 500) {
+              alertify.error(t('Internal Server Error: Kindly ensure the form has atleast one question'));
+            } else {
+              alertify.error(resp.responseText);
+            }
+          });
+      } else {
+        notify(t('Successfully updated asset.'));
+      }
+
+      return asset
+    })
   }
 });
 

From e96106dfe8a2ca7d4d7883d176b51b2c16b1817c Mon Sep 17 00:00:00 2001
From: Davis Muro <davis.ray.muro@gmail.com>
Date: Thu, 17 Nov 2022 10:13:18 +0300
Subject: [PATCH 29/47] [TEMP] Add JWT Header authentication support

---
 kpi/utils/ona_authentication.py | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/kpi/utils/ona_authentication.py b/kpi/utils/ona_authentication.py
index bcffba9077..edfdade8cb 100644
--- a/kpi/utils/ona_authentication.py
+++ b/kpi/utils/ona_authentication.py
@@ -43,17 +43,23 @@ class JWTAuthentication(BaseAuthentication):
 
     def authenticate(self, request):
         cookie_jwt = request.COOKIES.get(settings.KPI_COOKIE_NAME)
+        auth_header = request.META.get("X-ONADATA-KOBOCAT-AUTH")
         if cookie_jwt:
             api_token = get_api_token(cookie_jwt)
-            user, created = User.objects.using('default').get_or_create(
-                username=api_token.user.username)
-
-            if created:
-                grant_default_model_level_perms(user)
-
-            if getattr(api_token, "user"):
-                return user, None
+        elif auth_header:
+            api_token = get_api_token(auth_header)
         else:
             return None
 
+        if not getattr(api_token, "user"):
+            return None
+
+        user, created = User.objects.using('default').get_or_create(
+            username=api_token.user.username)
+
+        if created:
+            grant_default_model_level_perms(user)
+
+        return user, None
+
 

From 20492577f0e3c2b5505fa0c23d02358d63bc60ea Mon Sep 17 00:00:00 2001
From: Davis Muro <davis.ray.muro@gmail.com>
Date: Mon, 21 Nov 2022 13:02:50 +0300
Subject: [PATCH 30/47] Use correct header name

---
 kpi/utils/ona_authentication.py | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/kpi/utils/ona_authentication.py b/kpi/utils/ona_authentication.py
index edfdade8cb..387f91bff0 100644
--- a/kpi/utils/ona_authentication.py
+++ b/kpi/utils/ona_authentication.py
@@ -2,19 +2,16 @@
 from django.conf import settings
 from django.contrib.auth.models import User
 from django.core.signing import BadSignature
-from django.utils.translation import ugettext as _
-from django.utils import timezone
 from django.shortcuts import get_object_or_404
+from django.utils import timezone
+from django.utils.translation import ugettext as _
 from rest_framework import exceptions
-from rest_framework.authentication import (
-    BaseAuthentication
-)
+from rest_framework.authentication import BaseAuthentication
 from rest_framework.authtoken.models import Token
 
 from kpi.utils.permissions import grant_default_model_level_perms
 
 
-
 def get_api_token(json_web_token):
     """Get API Token from JSON Web Token"""
     # having the JWT variables here allows the values to be mocked easily as
@@ -43,7 +40,7 @@ class JWTAuthentication(BaseAuthentication):
 
     def authenticate(self, request):
         cookie_jwt = request.COOKIES.get(settings.KPI_COOKIE_NAME)
-        auth_header = request.META.get("X-ONADATA-KOBOCAT-AUTH")
+        auth_header = request.META.get("HTTP_X_ONADATA_KOBOCAT_AUTH")
         if cookie_jwt:
             api_token = get_api_token(cookie_jwt)
         elif auth_header:

From 05dc735172d0406bc48cbbcbcaad0c7188e2cda6 Mon Sep 17 00:00:00 2001
From: Davis Muro <davis.ray.muro@gmail.com>
Date: Wed, 23 Nov 2022 13:30:18 +0300
Subject: [PATCH 31/47] Ensure user is authenticated correctly when deploying
 asset

---
 kpi/deployment_backends/kobocat_backend.py | 57 +++++++++-------------
 1 file changed, 23 insertions(+), 34 deletions(-)

diff --git a/kpi/deployment_backends/kobocat_backend.py b/kpi/deployment_backends/kobocat_backend.py
index e3a45ab8f4..16b7fdfa5f 100644
--- a/kpi/deployment_backends/kobocat_backend.py
+++ b/kpi/deployment_backends/kobocat_backend.py
@@ -10,6 +10,7 @@
 from typing import Generator, Optional, Union
 from urllib.parse import urlparse
 from xml.etree import ElementTree as ET
+
 try:
     from zoneinfo import ZoneInfo
 except ImportError:
@@ -17,30 +18,24 @@
 
 import requests
 from django.conf import settings
+from django.contrib.auth.models import User
 from django.core.exceptions import ImproperlyConfigured
-from lxml import etree
 from django.core.files import File
 from django.db.models.query import QuerySet
 from django.utils.translation import gettext_lazy as t
+from lxml import etree
 from rest_framework import status
 from rest_framework.authtoken.models import Token
 from rest_framework.reverse import reverse
 
-from kpi.constants import (
-    SUBMISSION_FORMAT_TYPE_JSON,
-    SUBMISSION_FORMAT_TYPE_XML,
-    PERM_FROM_KC_ONLY,
-    PERM_CHANGE_SUBMISSIONS,
-    PERM_DELETE_SUBMISSIONS,
-    PERM_VALIDATE_SUBMISSIONS,
-)
-from kpi.exceptions import (
-    AttachmentNotFoundException,
-    InvalidXPathException,
-    SubmissionIntegrityError,
-    SubmissionNotFoundException,
-    XPathNotFoundException,
-)
+from kpi.constants import (PERM_CHANGE_SUBMISSIONS, PERM_DELETE_SUBMISSIONS,
+                           PERM_FROM_KC_ONLY, PERM_VALIDATE_SUBMISSIONS,
+                           SUBMISSION_FORMAT_TYPE_JSON,
+                           SUBMISSION_FORMAT_TYPE_XML)
+from kpi.exceptions import (AttachmentNotFoundException, InvalidXPathException,
+                            SubmissionIntegrityError,
+                            SubmissionNotFoundException,
+                            XPathNotFoundException)
 from kpi.interfaces.sync_backend_media import SyncBackendMediaInterface
 from kpi.models.asset_file import AssetFile
 from kpi.models.object_permission import ObjectPermission
@@ -49,24 +44,17 @@
 from kpi.utils.mongo_helper import MongoHelper
 from kpi.utils.permissions import is_user_anonymous
 from kpi.utils.xml import edit_submission_xml
+
+from ..exceptions import (BadFormatException,
+                          KobocatBulkUpdateSubmissionsClientException,
+                          KobocatDeploymentException,
+                          KobocatDuplicateSubmissionException)
 from .base_backend import BaseDeploymentBackend
-from .kc_access.shadow_models import (
-    KobocatOneTimeAuthToken,
-    KobocatXForm,
-    ReadOnlyKobocatAttachment,
-    ReadOnlyKobocatInstance,
-)
-from .kc_access.utils import (
-    assign_applicable_kc_permissions,
-    instance_count,
-    last_submission_time
-)
-from ..exceptions import (
-    BadFormatException,
-    KobocatBulkUpdateSubmissionsClientException,
-    KobocatDeploymentException,
-    KobocatDuplicateSubmissionException,
-)
+from .kc_access.shadow_models import (KobocatOneTimeAuthToken, KobocatXForm,
+                                      ReadOnlyKobocatAttachment,
+                                      ReadOnlyKobocatInstance)
+from .kc_access.utils import (assign_applicable_kc_permissions, instance_count,
+                              last_submission_time)
 
 
 class KobocatDeploymentBackend(BaseDeploymentBackend):
@@ -1372,7 +1360,8 @@ def __kobocat_proxy_request(kc_request, user=None):
         :return: requests.models.Response
         """
         if not is_user_anonymous(user):
-            token, created = Token.objects.get_or_create(user=user)
+            token = User.objects.using("kobocat").select_related(
+                "auth_token").get(username=user.username).auth_token
             kc_request.headers['Authorization'] = 'Token %s' % token.key
         session = requests.Session()
         return session.send(kc_request.prepare())

From 44ba389d233df20d00f21cd27443f3062bd70ea2 Mon Sep 17 00:00:00 2001
From: Davis Muro <davis.ray.muro@gmail.com>
Date: Fri, 25 Nov 2022 14:21:37 +0300
Subject: [PATCH 32/47] Disable set_asset_uid functionality

---
 kpi/deployment_backends/kobocat_backend.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kpi/deployment_backends/kobocat_backend.py b/kpi/deployment_backends/kobocat_backend.py
index 16b7fdfa5f..14c9cdd579 100644
--- a/kpi/deployment_backends/kobocat_backend.py
+++ b/kpi/deployment_backends/kobocat_backend.py
@@ -841,7 +841,7 @@ def redeploy(self, active=None):
                 return self.connect(self.identifier, active)
             raise
 
-        self.set_asset_uid()
+        # self.set_asset_uid()
 
     def remove_from_kc_only_flag(self,
                                  specific_user: Union[int, 'User'] = None):

From c17f46181f35325c4891342d4d8c531f33a1703f Mon Sep 17 00:00:00 2001
From: Kipchirchir Sigei <arapgodsmack@gmail.com>
Date: Wed, 9 Nov 2022 11:43:20 +0300
Subject: [PATCH 33/47] Add config to hide add to library option on UI

Signed-off-by: Kipchirchir Sigei <arapgodsmack@gmail.com>
---
 jsapp/js/editorMixins/editableForm.es6 | 25 +++++++++++++------------
 jsapp/js/ona/config.ts                 |  1 +
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/jsapp/js/editorMixins/editableForm.es6 b/jsapp/js/editorMixins/editableForm.es6
index 24572bda6b..467c45c571 100644
--- a/jsapp/js/editorMixins/editableForm.es6
+++ b/jsapp/js/editorMixins/editableForm.es6
@@ -16,7 +16,7 @@ import {
   checkIfCookieExists,
   redirectForOnaDataAuth,
 } from 'utils';
-import { TITLE, DISABLE_LIBRARY_TOGGLE } from '../ona/config';
+import { TITLE, HIDE_LIBRARY_TOGGLE } from '../ona/config';
 import {
   ASSET_TYPES,
   AVAILABLE_FORM_STYLES,
@@ -684,17 +684,18 @@ export default assign({
 
           <bem.FormBuilderHeader__cell m='verticalRule'/>
 
-          <bem.FormBuilderHeader__cell>
-            <bem.FormBuilderHeader__button
-              m={['panel-toggle', this.state.asideLibrarySearchVisible ? 'active' : null]}
-              onClick={this.toggleAsideLibrarySearch}
-              className={this.isAddingQuestionsRestricted() ? LOCKING_UI_CLASSNAMES.DISABLED : ''}
-              disabled={DISABLE_LIBRARY_TOGGLE}
-            >
-              <i className={['k-icon', this.state.asideLibrarySearchVisible ? 'k-icon-close' : 'k-icon-library' ].join(' ')} />
-              <span className='panel-toggle-name'>{t('Add from Library')}</span>
-            </bem.FormBuilderHeader__button>
-          </bem.FormBuilderHeader__cell>
+          { HIDE_LIBRARY_TOGGLE &&
+            <bem.FormBuilderHeader__cell>
+              <bem.FormBuilderHeader__button
+                m={['panel-toggle', this.state.asideLibrarySearchVisible ? 'active' : null]}
+                onClick={this.toggleAsideLibrarySearch}
+                className={this.isAddingQuestionsRestricted() ? LOCKING_UI_CLASSNAMES.DISABLED : ''}
+              >
+                <i className={['k-icon', this.state.asideLibrarySearchVisible ? 'k-icon-close' : 'k-icon-library' ].join(' ')} />
+                <span className='panel-toggle-name'>{t('Add from Library')}</span>
+              </bem.FormBuilderHeader__button>
+            </bem.FormBuilderHeader__cell>
+          }
 
           <bem.FormBuilderHeader__cell m={'verticalRule'} />
 
diff --git a/jsapp/js/ona/config.ts b/jsapp/js/ona/config.ts
index f840b49a70..5364860241 100644
--- a/jsapp/js/ona/config.ts
+++ b/jsapp/js/ona/config.ts
@@ -5,3 +5,4 @@
 export const ZEBRA_URL = "http://localhost:3001/login";
 export const TITLE = "Ona";
 export const DISABLE_LIBRARY_TOGGLE = false;
+export const HIDE_LIBRARY_TOGGLE = false;

From 301b48aea5bf46dfa51c4e07344f85d5dc79d7cd Mon Sep 17 00:00:00 2001
From: Davis Muro <davis.ray.muro@gmail.com>
Date: Fri, 9 Dec 2022 13:20:34 +0300
Subject: [PATCH 34/47] Ensure title is correctly formatted

---
 jsapp/js/components/modalForms/projectSettings.es6 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jsapp/js/components/modalForms/projectSettings.es6 b/jsapp/js/components/modalForms/projectSettings.es6
index 32eea343ae..4a22dd4be9 100644
--- a/jsapp/js/components/modalForms/projectSettings.es6
+++ b/jsapp/js/components/modalForms/projectSettings.es6
@@ -964,7 +964,7 @@ class ProjectSettings extends React.Component {
             <Checkbox
               checked={this.state.fields['share-metadata']}
               onChange={this.onAnyFieldChange.bind(this, 'share-metadata')}
-              label={t('Help ${ TITLE } improve this product by sharing the sector and country where this project will be deployed.') + ' ' + t('All the information is submitted anonymously, and will not include the project name or description listed above.')}
+              label={`Help ${ TITLE } improve this product by sharing the sector and country where this project will be deployed.') + ' ' + t('All the information is submitted anonymously, and will not include the project name or description listed above.`}
             />
           </bem.FormModal__item>
 

From 87102b235f26823980b9c32db1c475bb4d9e366e Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Tue, 20 Dec 2022 11:49:19 +0300
Subject: [PATCH 35/47] Ensure correct authentication credentials are used

---
 kpi/deployment_backends/kc_access/utils.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kpi/deployment_backends/kc_access/utils.py b/kpi/deployment_backends/kc_access/utils.py
index fc20a52738..cf32622419 100644
--- a/kpi/deployment_backends/kc_access/utils.py
+++ b/kpi/deployment_backends/kc_access/utils.py
@@ -34,7 +34,8 @@ def _trigger_kc_profile_creation(user):
     UserProfile if none exists already
     """
     url = settings.KOBOCAT_INTERNAL_URL + '/api/v1/user'
-    token, _ = Token.objects.get_or_create(user=user)
+    kobo_user = User.objects.using("kobocat").get(username=user.username)
+    token = Token.objects.using("kobocat").get(user=kobo_user)
     response = requests.get(
         url, headers={'Authorization': 'Token ' + token.key})
     if not response.status_code == 200:

From a4ec3f9ddb9cd1d14a8188d032ede9338ea80f3a Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Tue, 20 Dec 2022 11:51:09 +0300
Subject: [PATCH 36/47] Remove assign and revoke kc permissions

---
 kpi/mixins/object_permission.py | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/kpi/mixins/object_permission.py b/kpi/mixins/object_permission.py
index df1fb7576f..a80ac443fc 100644
--- a/kpi/mixins/object_permission.py
+++ b/kpi/mixins/object_permission.py
@@ -19,7 +19,7 @@
     PREFIX_PARTIAL_PERMS,
 )
 from kpi.deployment_backends.kc_access.utils import (
-    remove_applicable_kc_permissions,
+    # remove_applicable_kc_permissions,
     assign_applicable_kc_permissions
 )
 from kpi.models.object_permission import ObjectPermission
@@ -114,10 +114,10 @@ def copy_permissions_from(self, source_object):
                     )
                 )
             )
-            for user_codename in user_codenames:
-                remove_applicable_kc_permissions(
-                    self, user_codename['user_id'], user_codename['all_codenames']
-                )
+            # for user_codename in user_codenames:
+            #     remove_applicable_kc_permissions(
+            #         self, user_codename['user_id'], user_codename['all_codenames']
+            #     )
 
             # Remove all permissions from the asset (except the owner's)
             perm_queryset.delete()
@@ -502,9 +502,9 @@ def assign_perm(self, user_obj, perm, deny=False, defer_recalc=False,
 
         contradictory_perms.delete()
         # Check if any KC permissions should be removed as well
-        if deny and not skip_kc:
-            remove_applicable_kc_permissions(
-                self, user_obj, contradictory_codenames)
+        # if deny and not skip_kc:
+        #     remove_applicable_kc_permissions(
+        #         self, user_obj, contradictory_codenames)
         # Create the new permission
         new_permission = ObjectPermission.objects.create(
             asset=self,
@@ -514,8 +514,8 @@ def assign_perm(self, user_obj, perm, deny=False, defer_recalc=False,
             inherited=False
         )
         # Assign any applicable KC permissions
-        if not deny and not skip_kc:
-            assign_applicable_kc_permissions(self, user_obj, codename)
+        #if not deny and not skip_kc:
+        #    assign_applicable_kc_permissions(self, user_obj, codename)
         # Resolve implied permissions, e.g. granting change implies granting
         # view
         implied_perms = self.get_implied_perms(
@@ -670,8 +670,8 @@ def remove_perm(self, user_obj, perm, defer_recalc=False, skip_kc=False):
             # Add a deny permission to block future inheritance
             self.assign_perm(user_obj, perm, deny=True, defer_recalc=True)
         # Remove any applicable KC permissions
-        if not skip_kc:
-            remove_applicable_kc_permissions(self, user_obj, codename)
+        # if not skip_kc:
+        #     remove_applicable_kc_permissions(self, user_obj, codename)
 
         # We might have been called by ourself to assign a related
         # permission. In that case, don't recalculate here.

From 37107aa7264ec14bb9ee555cf539c295ed28a8fc Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Tue, 20 Dec 2022 12:03:51 +0300
Subject: [PATCH 37/47] Ensure Import and Export task uses correct auth

---
 kpi/models/import_export_task.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kpi/models/import_export_task.py b/kpi/models/import_export_task.py
index 9794c90cdf..5c5f47ea11 100644
--- a/kpi/models/import_export_task.py
+++ b/kpi/models/import_export_task.py
@@ -17,6 +17,7 @@
 import constance
 import requests
 from django.conf import settings
+from django.contrib.auth.models import User
 from django.contrib.postgres.fields import JSONField as JSONBField
 from django.core.files.base import ContentFile
 from django.db import models, transaction
@@ -203,7 +204,9 @@ def _run_task(self, messages):
             # TODO: merge with `url` handling above; currently kept separate
             # because `_load_assets_from_url()` uses complex logic to deal with
             # multiple XLS files in a directory structure within a ZIP archive
-            headers = {"Authorization": f"Token {self.user.auth_token.key}"}
+            username = self.user.username
+            token = User.objects.using("kobocat").select_related("auth_token").get(username=username).auth_token.key
+            headers = {"Authorization": f"Token {token}"}
             response = requests.get(
                 self.data['single_xls_url'], headers=headers)
             response.raise_for_status()

From a9447f0b788d00e435363dbe1755e9791f097fcf Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Wed, 21 Dec 2022 09:26:54 +0300
Subject: [PATCH 38/47] Add `grant-default-model-level-perms` route

---
 kpi/urls/__init__.py      | 25 +++++++++++--------------
 kpi/views/current_user.py | 20 +++++++++++++++++++-
 2 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/kpi/urls/__init__.py b/kpi/urls/__init__.py
index cd55e6a001..11ff0fa2cb 100644
--- a/kpi/urls/__init__.py
+++ b/kpi/urls/__init__.py
@@ -1,29 +1,23 @@
 # coding: utf-8
 import private_storage.urls
 from django.conf import settings
-from django.urls import include, re_path, path
+from django.urls import include, path, re_path
 from django.views.i18n import JavaScriptCatalog
 
 from hub.models import ConfigurationFile
 from hub.views import ExtraDetailRegistrationView
-from kobo.apps.superuser_stats.views import (
-    user_report,
-    country_report,
-    retrieve_reports,
-)
+from kobo.apps.mfa.views import MfaLoginView, MfaTokenView
+from kobo.apps.superuser_stats.views import (country_report, retrieve_reports,
+                                             user_report)
 from kpi.forms.registration import RegistrationForm
-from kpi.views import authorized_application_authenticate_user
-from kpi.views import home, one_time_login, browser_tests, design_system, modern_browsers
-from kpi.views.environment import EnvironmentView
+from kpi.views import (authorized_application_authenticate_user, browser_tests,
+                       design_system, home, modern_browsers, one_time_login)
 from kpi.views.current_user import CurrentUserViewSet
-from kobo.apps.mfa.views import (
-    MfaLoginView,
-    MfaTokenView,
-)
+from kpi.views.environment import EnvironmentView
 from kpi.views.token import TokenView
 
 from .router_api_v1 import router_api_v1
-from .router_api_v2 import router_api_v2, URL_NAMESPACE
+from .router_api_v2 import URL_NAMESPACE, router_api_v2
 
 # TODO: Give other apps their own `urls.py` files instead of importing their
 # views directly! See
@@ -37,6 +31,9 @@
         'get': 'retrieve',
         'patch': 'partial_update',
     }), name='currentuser-detail'),
+    path('grant-default-model-level-perms', CurrentUserViewSet.as_view({
+        'post': 'grant_default_model_level_perms',
+    }), name='currentuser-default-perms'),
     re_path(r'^', include(router_api_v1.urls)),
     re_path(r'^api/v2/', include((router_api_v2.urls, URL_NAMESPACE))),
     re_path(r'^api/v2/auth/', include('kobo.apps.mfa.urls')),
diff --git a/kpi/views/current_user.py b/kpi/views/current_user.py
index 791f81e0d0..58f88ff5df 100644
--- a/kpi/views/current_user.py
+++ b/kpi/views/current_user.py
@@ -1,8 +1,11 @@
 # coding: utf-8
 from django.contrib.auth.models import User
-from rest_framework import viewsets
+from rest_framework import renderers, status, viewsets
+from rest_framework.decorators import action
+from rest_framework.response import Response
 
 from kpi.serializers import CurrentUserSerializer
+from kpi.utils.permissions import grant_default_model_level_perms
 
 
 class CurrentUserViewSet(viewsets.ModelViewSet):
@@ -11,3 +14,18 @@ class CurrentUserViewSet(viewsets.ModelViewSet):
 
     def get_object(self):
         return self.request.user
+
+    @action(detail=True, methods=["POST"], renderer_classes=[renderers.JSONRenderer])
+    def grant_default_model_level_perms(self, request, *args, **kwargs):
+        user = self.get_object()
+        grant_default_model_level_perms(user)
+
+        return Response(
+            data={
+                "detail": (
+                    "Successfully granted default model level "
+                    f"perms to user {user.username}"
+                )
+            },
+            status=status.HTTP_200_OK
+        )

From 9ffae88f9ea565b2c4a5c81ce17a959ac38bf0c4 Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Fri, 23 Dec 2022 12:51:49 +0300
Subject: [PATCH 39/47] POST to project if project arg is present

---
 kpi/deployment_backends/kobocat_backend.py | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/kpi/deployment_backends/kobocat_backend.py b/kpi/deployment_backends/kobocat_backend.py
index 14c9cdd579..571a2bef6b 100644
--- a/kpi/deployment_backends/kobocat_backend.py
+++ b/kpi/deployment_backends/kobocat_backend.py
@@ -253,11 +253,10 @@ def connect(self, identifier=None, active=False):
                 raise Exception('The identifier is not properly formatted.')
 
         url = self.external_to_internal_url('{}/api/v1/forms'.format(kc_server))
-        if not self.asset.has_deployment:
-            project = self.asset.settings.get('project')
-            if project:
-                url = self.external_to_internal_url(
-                    f"{kc_server}/api/v1/projects/{project}/forms")
+        project = self.asset.settings.get('project')
+        if project:
+            url = self.external_to_internal_url(
+                f"{kc_server}/api/v1/projects/{project}/forms")
 
         xlsx_io = self.asset.to_xlsx_io(
             versioned=True, append={

From 130d6917dceb47044cbbe8087ca356b551adad7b Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Fri, 23 Dec 2022 14:12:46 +0300
Subject: [PATCH 40/47] Ensure Import Task uses correct auth credentials

---
 kpi/models/import_export_task.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kpi/models/import_export_task.py b/kpi/models/import_export_task.py
index 5c5f47ea11..0fc6190be5 100644
--- a/kpi/models/import_export_task.py
+++ b/kpi/models/import_export_task.py
@@ -312,9 +312,11 @@ def _load_assets_from_url(self, url, messages, **kwargs):
 
     def _retrieve_form_payload(self, form_id):
         url = f"{settings.KOBOCAT_INTERNAL_URL}/api/v1/forms/{form_id}"
-        token = Token.objects.get(user=self.user)
+        username = self.user.username
+        token = User.objects.using("kobocat").select_related("auth_token").get(
+            username=username).auth_token
 
-        response = requests.get(url, headers={"Authorization": f"Token {token.key}"})
+        response = requests.get(url, headers={"Authorization": f"Token {token}"})
         if response.status_code == 200:
             return response.json()
 

From 522daf18482f9ddd39ff7397d0f3cde2c9eb798f Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Fri, 23 Dec 2022 15:15:30 +0300
Subject: [PATCH 41/47] Revert "POST to project if project arg is present"

This reverts commit 9ffae88f9ea565b2c4a5c81ce17a959ac38bf0c4.
---
 kpi/deployment_backends/kobocat_backend.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/kpi/deployment_backends/kobocat_backend.py b/kpi/deployment_backends/kobocat_backend.py
index 571a2bef6b..14c9cdd579 100644
--- a/kpi/deployment_backends/kobocat_backend.py
+++ b/kpi/deployment_backends/kobocat_backend.py
@@ -253,10 +253,11 @@ def connect(self, identifier=None, active=False):
                 raise Exception('The identifier is not properly formatted.')
 
         url = self.external_to_internal_url('{}/api/v1/forms'.format(kc_server))
-        project = self.asset.settings.get('project')
-        if project:
-            url = self.external_to_internal_url(
-                f"{kc_server}/api/v1/projects/{project}/forms")
+        if not self.asset.has_deployment:
+            project = self.asset.settings.get('project')
+            if project:
+                url = self.external_to_internal_url(
+                    f"{kc_server}/api/v1/projects/{project}/forms")
 
         xlsx_io = self.asset.to_xlsx_io(
             versioned=True, append={

From ebd168414172783e41c76faa3a148129edf11695 Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Fri, 23 Dec 2022 15:15:42 +0300
Subject: [PATCH 42/47] Ensure form payload is retrieved

---
 kpi/models/import_export_task.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/kpi/models/import_export_task.py b/kpi/models/import_export_task.py
index 0fc6190be5..f999a3f0d8 100644
--- a/kpi/models/import_export_task.py
+++ b/kpi/models/import_export_task.py
@@ -333,16 +333,16 @@ def _parse_b64_upload(self, base64_encoded_upload, messages, **kwargs):
         survey_dict_keys = survey_dict.keys()
 
         form_payload = None
-        destination_kls = kwargs.get('destination_kls')
-        if destination_kls == 'asset':
-            asset = kwargs.get('destination')
-            form_id = asset.settings.get('form_id')
-            form_payload = self._retrieve_form_payload(form_id)
-            if form_payload:
-                form_payload['has_id_string_changed'] = False
 
         destination = kwargs.get('destination', False)
         has_necessary_perm = kwargs.get('has_necessary_perm', False)
+        if destination and hasattr(destination, "settings"):
+            form_id = destination.settings.get('form_id')
+            if form_id:
+                form_payload = self._retrieve_form_payload(form_id)
+                if form_payload:
+                    form_payload['has_id_string_changed'] = False
+
 
         if destination and not has_necessary_perm:
             # redundant check

From 6b5caba68a4ac375e1dec7bd0420126c1d4d61c0 Mon Sep 17 00:00:00 2001
From: Davis Muro <dmuro@ona.io>
Date: Fri, 23 Dec 2022 15:36:44 +0300
Subject: [PATCH 43/47] Bypass _deployment_data editing to allow edit on
 formbuilder

---
 kpi/models/asset.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kpi/models/asset.py b/kpi/models/asset.py
index 5f24738a1c..d2be8a4a3f 100644
--- a/kpi/models/asset.py
+++ b/kpi/models/asset.py
@@ -776,8 +776,7 @@ def save(
         try:
             stored_data_key = self._deployment_data['_stored_data_key']
         except KeyError:
-            if self._deployment_data != self.__deployment_data_copy:
-                raise DeploymentDataException
+            pass
         else:
             if stored_data_key != self.deployment.stored_data_key:
                 raise DeploymentDataException

From 0ae18fa1216f2102fef18096cd77e147ac5b05cc Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davis.ray.muro@gmail.com>
Date: Tue, 25 Apr 2023 11:12:11 +0300
Subject: [PATCH 44/47] bug(deserialization): ensure `self.data` is always a
 dictionary

---
 kpi/models/import_export_task.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kpi/models/import_export_task.py b/kpi/models/import_export_task.py
index f999a3f0d8..931702bc61 100644
--- a/kpi/models/import_export_task.py
+++ b/kpi/models/import_export_task.py
@@ -1,6 +1,7 @@
 # coding: utf-8
 import base64
 import datetime
+import json
 import dateutil.parser
 import posixpath
 import re
@@ -175,6 +176,9 @@ def _run_task(self, messages):
         self.save(update_fields=['status'])
         dest_item = has_necessary_perm = False
 
+        if isinstance(self.data, str):
+            self.data = json.loads(self.data)
+
         if 'destination' in self.data and self.data['destination']:
             _d = self.data.get('destination')
             dest_item = resolve_url_to_asset(_d)

From cf05f155e802906f094282dea36fef2df1e9e3d0 Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davis.ray.muro@gmail.com>
Date: Tue, 25 Apr 2023 12:46:45 +0300
Subject: [PATCH 45/47] cleanup(database): remove unneeded checks

- Main issue was that the database table was not correctly updated
---
 kpi/deployment_backends/base_backend.py | 2 --
 kpi/deployment_backends/mixin.py        | 2 --
 kpi/models/import_export_task.py        | 3 ---
 3 files changed, 7 deletions(-)

diff --git a/kpi/deployment_backends/base_backend.py b/kpi/deployment_backends/base_backend.py
index 685ae11ac1..855ecf1f5d 100644
--- a/kpi/deployment_backends/base_backend.py
+++ b/kpi/deployment_backends/base_backend.py
@@ -115,8 +115,6 @@ def get_data(
         value = None
         nested_path = dotted_path.split('.')
         nested_dict = self.asset._deployment_data  # noqa
-        if isinstance(nested_dict, str):
-            nested_dict = json.loads(nested_dict)
         for key in nested_path:
             try:
                 value = nested_dict[key]
diff --git a/kpi/deployment_backends/mixin.py b/kpi/deployment_backends/mixin.py
index d5b2ee3fc4..8a6fae9ced 100644
--- a/kpi/deployment_backends/mixin.py
+++ b/kpi/deployment_backends/mixin.py
@@ -56,8 +56,6 @@ def deployment(self):
             raise DeploymentNotFound
 
         deployment_data = self._deployment_data
-        if isinstance(deployment_data, str):
-            deployment_data = json.loads(self._deployment_data)
         return self.__get_deployment_backend(deployment_data['backend'])
 
     @property
diff --git a/kpi/models/import_export_task.py b/kpi/models/import_export_task.py
index 931702bc61..746e2249a3 100644
--- a/kpi/models/import_export_task.py
+++ b/kpi/models/import_export_task.py
@@ -176,9 +176,6 @@ def _run_task(self, messages):
         self.save(update_fields=['status'])
         dest_item = has_necessary_perm = False
 
-        if isinstance(self.data, str):
-            self.data = json.loads(self.data)
-
         if 'destination' in self.data and self.data['destination']:
             _d = self.data.get('destination')
             dest_item = resolve_url_to_asset(_d)

From 04362c122abce683b473e7beb6c611983faafc0e Mon Sep 17 00:00:00 2001
From: Davis Raymond Muro <davis.ray.muro@gmail.com>
Date: Tue, 25 Apr 2023 17:44:14 +0300
Subject: [PATCH 46/47] bug(editableForm): Ensure `asset` is passed in as an
 argument

---
 jsapp/js/editorMixins/editableForm.es6 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/jsapp/js/editorMixins/editableForm.es6 b/jsapp/js/editorMixins/editableForm.es6
index 467c45c571..578cb292b1 100644
--- a/jsapp/js/editorMixins/editableForm.es6
+++ b/jsapp/js/editorMixins/editableForm.es6
@@ -326,8 +326,8 @@ export default assign({
         params.parent = assetUtils.buildAssetUrl(this.state.parentAsset);
       }
       actions.resources.createResource.triggerAsync(params)
-        .then(() => {
-          hashHistory.push(`/library/${asset.uid}/edit`);
+        .then((asset) => {
+          hashHistory.push(`/library/asset/${asset.uid}/edit`);
         });
     } else {
       // update existing asset

From 9d07081d31ea4fe4535e52667a49bfb9848e04a9 Mon Sep 17 00:00:00 2001
From: Kipchirchir Sigei <arapgodsmack@gmail.com>
Date: Fri, 11 Aug 2023 09:55:07 +0300
Subject: [PATCH 47/47] Fix webform preview auth issue

Signed-off-by: Kipchirchir Sigei <arapgodsmack@gmail.com>
---
 Dockerfile                     |  4 ++-
 kpi/views/v2/asset_snapshot.py | 60 ++++++++++++++++++++--------------
 2 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 3d52ee1425..a59d2a0444 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -52,10 +52,11 @@ RUN mkdir -p "${NGINX_STATIC_DIR}" && \
 # Install `apt` packages.                #
 ##########################################
 
-RUN apt-get -qq update && \
+RUN apt-get -qq update -y && \
     apt-get -qq -y install curl && \
     curl -sL https://deb.nodesource.com/setup_16.x | bash - && \
     apt-get -qq -y install --no-install-recommends \
+        npm \
         ffmpeg \
         gdal-bin \
         gettext \
@@ -106,6 +107,7 @@ WORKDIR ${KPI_SRC_DIR}/
 
 RUN rm -rf ${KPI_NODE_PATH} && \
     npm install -g npm@8.5.5 && \
+    npm config set legacy-peer-deps true && \
     npm install -g check-dependencies && \
     npm install --quiet && \
     npm cache clean --force
diff --git a/kpi/views/v2/asset_snapshot.py b/kpi/views/v2/asset_snapshot.py
index 162fd8d0e2..3070d4eb58 100644
--- a/kpi/views/v2/asset_snapshot.py
+++ b/kpi/views/v2/asset_snapshot.py
@@ -137,34 +137,44 @@ def preview(self, request, *args, **kwargs):
         # **Not** part of the OpenRosa API
         snapshot = self.get_object()
         if snapshot.details.get('status') == 'success':
-            data = {
-                'server_url': reverse(viewname='assetsnapshot-detail',
+            # data = {
+            #     'server_url': reverse(viewname='assetsnapshot-detail',
+            #                           kwargs={'uid': snapshot.uid},
+            #                           request=request
+            #                           ),
+            #     'form_id': snapshot.uid
+            # }
+
+            # # Use Enketo API to create preview instead of `preview?form=`,
+            # # which does not load any form media files.
+            # response = requests.post(
+            #     f'{settings.ENKETO_URL}/{settings.ENKETO_PREVIEW_ENDPOINT}',
+            #     # bare tuple implies basic auth
+            #     auth=(settings.ENKETO_API_TOKEN, ''),
+            #     data=data
+            # )
+            # response.raise_for_status()
+
+            # # Ask Celery to remove the preview from its XSLT cache after some
+            # # reasonable delay; see
+            # # https://github.com/enketo/enketo-express/issues/357
+            # enketo_flush_cached_preview.apply_async(
+            #     kwargs=data,  # server_url and form_id
+            #     countdown=settings.ENKETO_FLUSH_CACHED_PREVIEW_DELAY,
+            # )
+
+            # json_response = response.json()
+            # preview_url = json_response.get('preview_url')
+
+            preview_url = "{}{}?form={}".format(
+                              settings.ENKETO_URL,
+                              settings.ENKETO_PREVIEW_URI,
+                              reverse(viewname='assetsnapshot-detail',
+                                      format='xml',
                                       kwargs={'uid': snapshot.uid},
                                       request=request
                                       ),
-                'form_id': snapshot.uid
-            }
-
-            # Use Enketo API to create preview instead of `preview?form=`,
-            # which does not load any form media files.
-            response = requests.post(
-                f'{settings.ENKETO_URL}/{settings.ENKETO_PREVIEW_ENDPOINT}',
-                # bare tuple implies basic auth
-                auth=(settings.ENKETO_API_TOKEN, ''),
-                data=data
-            )
-            response.raise_for_status()
-
-            # Ask Celery to remove the preview from its XSLT cache after some
-            # reasonable delay; see
-            # https://github.com/enketo/enketo-express/issues/357
-            enketo_flush_cached_preview.apply_async(
-                kwargs=data,  # server_url and form_id
-                countdown=settings.ENKETO_FLUSH_CACHED_PREVIEW_DELAY,
-            )
-
-            json_response = response.json()
-            preview_url = json_response.get('preview_url')
+                            )
 
             return HttpResponseRedirect(preview_url)
         else: