Purav Taking over for Meenashi - collaboration ads creation page (clean re-port onto development)

[pixelpix13]

Description

Backend support for the collaboration job ads creation feature: create collaboration job ads with new fields, accept public job-form applications (including Dropbox file upload), and gate ad creation behind the createCollabJobAds permission.

This is a clean re-port of the feature-scoped work from #1872 onto current development (not a full-branch merge of the old conflicted history).

Pair with frontend: HighestGoodNetworkApp#5629 — check out both branches together for end-to-end create → list → details → apply flows.

What this PR adds

• Jobs model / create API — requirements, projects, ourCommunity; auto-fills jobDetailsLink when missing; POST /api/jobs validates inputs and requires createCollabJobAds.
• Public job form responses — POST /api/jobforms/responses/upload (Dropbox, 5MB limit) and POST /api/jobforms/responses (save answers + email JOB_APPLICATION_RECIPIENT_EMAIL); no auth.
• Middleware — unauthenticated access for jobforms GET and responses POST / upload.
• JobForms / JobApplications — isRequired defaults to true; answers store questionText.
• Positions — optional category filter on /api/jobs/positions/:category?.
• Permission seed — createCollabJobAds registered in initial permissions.

Required environment variables

BASE_FRONTEND_URL=http://localhost:5173
DROPBOX_APP_KEY=
DROPBOX_APP_SECRET=
DROPBOX_REDIRECT_URI=http://localhost:4500/oauth-callback
DROPBOX_REFRESH_TOKEN=
DROPBOX_PATH='/ResumeUploader-HGN'
JOB_APPLICATION_RECIPIENT_EMAIL='yourEmail'

Dropbox refresh-token OAuth is required for file upload testing. Gmail OAuth (same pattern as prior collab ads PRs) is required if you want to verify application emails.

Related PRS (if any):

• Frontend (required for E2E UI): Purav takeover- collaboration ads creation page (clean re-port onto development) HighestGoodNetworkApp#5629
• Prior backend PR this re-ports: Manoj taking over for Meenashi - collaboration ads creation page #1872
• Older frontend work replaced by #5629: Purav taking over - creation tool for questions for the user to answer HighestGoodNetworkApp#4307

Main changes explained:

Area	Change
jobs model	New required fields requirements, projects, ourCommunity; pre-validate sets jobDetailsLink from BASE_FRONTEND_URL
jobsController	Permissioned create with sanitized category/title/applyLink checks and min word counts
collaborationController + router	Public Dropbox upload + public response submit + email notify
middleware	Public jobforms GET / responses POST / upload
JobFormsModel	isRequired default true
jobApplicationsModel	Persist questionText on answers
createInitialPermissions	Seeds createCollabJobAds

How to test:

Setup

1. Check out manoj-collaboration-ads-creation-page on HGNRest and the matching branch on HighestGoodNetworkApp for frontend PR #5629.
2. Confirm Node 20; npm install if needed.
3. Add the env vars above to HGNRest .env.
4. Backend: npm run build then npm start (API at http://localhost:4500).
5. Frontend (for E2E): npm run start:local → http://localhost:5173.

A) Login (for authenticated job create)

• Request: POST http://localhost:4500/api/login
• Body:

{
  "email": "devadmin@hgn.net",
  "password": "DeveloperPassword100%!"
}

• Expected: JWT + Admin/Owner user. Use the token for POST /api/jobs.

B) Dropbox file upload — no authorization

• Request: POST {{baseUrl}}/api/jobforms/responses/upload
• Body: form-data key file = selected file (PDF/DOC/DOCX/JPG/PNG/BMP, ≤ 5MB)
• Expected: Dropbox shared-link payload; opening the link shows the file.
• Oversized / wrong mime type → error response.

C) Save job form responses — no authorization

• Request: POST {{baseUrl}}/api/jobforms/responses
• Body: raw JSON with formId (from jobForms) and answers for that form’s questions. For file questions, use the Dropbox link from step B. Fill all isRequired questions.

Example:

{
  "formId": "6920189d05b65c73344d265d",
  "answers": [
    {
      "questionId": "6920189d05b65c73344d265e",
      "questionText": "Name",
      "answer": "test applicant"
    }
  ]
}

• Expected: Responses saved; email sent to JOB_APPLICATION_RECIPIENT_EMAIL.

D) Create collaboration job ad (createCollabJobAds)

• Request: POST {{baseUrl}}/api/jobs
• Authorization: JWT from login (Admin/Owner with createCollabJobAds)
• Body: title/category, description, requirements, projects, ourCommunity, imageUrl, applyLink (must reference a real job form id in the path)
• imageUrl: Dropbox image link ending in raw=1 (not dl=0). Suggested folder: https://www.dropbox.com/scl/fo/817lsk8fmvx5cdexbk07x/APOLV_TrgXHFLJATnj1xVFg?rlkey=rgs3pfrbav2hf6a2el6dtblnf&e=1&dl=0
• Expected: 201 + saved job (jobDetailsLink auto-filled if omitted).
• Missing permission → 403. Invalid category/title/applyLink or short text → validation error.

E) Permission / public access checks

• Admin/Owner with createCollabJobAds → can create jobs.
• User without permission → cannot create jobs.
• Unauthenticated → can GET jobforms and POST responses/upload.

F) Paired frontend E2E (#5629)

1. As Admin/Owner, open Other Links → Job Ads Creation (/jobAdsCreation).
2. Create an ad using this API (Dropbox raw=1 image + apply form).
3. Confirm the ad appears on /collaboration with the correct image/category filter.
4. Volunteer should not see Job Ads Creation / should be denied create.

Screenshots or videos of changes:

Asset	Description
SS1	Unauth Dropbox upload success
SS2	Unauth save responses + email received
SS3	Auth POST /api/jobs with new fields + raw=1 imageUrl
SS4	Permission denial or validation failure
Video	Upload → save responses → create job → FE listing (#5629)

Note:

• Clean re-port onto current development; review only the feature-scoped files in this PR.
• Must pair with HighestGoodNetworkApp#5629 for UI E2E.
• imageUrl should end with raw=1, not dl=0.
• Dropbox + Gmail env vars are required for full upload/email verification.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
87.9% Coverage on New Code
0.4% Duplication on New Code

See analysis details on SonarQube Cloud

[vidiyala99]

Reviewed 070055f together with frontend OneCommunityGlobal/HighestGoodNetworkApp#5629 (details of the UI test there). I ran this branch on a test server against the shared dev data; nothing was created (the create request was blocked in the browser).

What works:

• Tests: collaborationController.collabAds.test.js, jobsController.test.js, jobs.preValidate.test.js and middleware.jobforms.test.js pass (4 suites, 57/57).
• Read paths the new page uses: GET /api/jobs/categories, GET /api/jobs/positions/:category (Administrative & Support returns its two positions) and GET /api/jobforms/all (41 forms) all work for the creation form.
• Public routes don't expose responses: the middleware now lets every GET /api/jobforms* through without a token, which also covers GET /jobforms/:formId/responses. I checked that this doesn't leak applicant data: without a token that route still returns 403 "You are not authorized to view form responses.", because getFormResponses checks canManageJobForms itself. Other routes stay protected (anonymous GET /api/userprofile is still 401).

Concerns with the new public upload (POST /api/jobforms/responses/upload, no auth), from reading the code; I didn't call it, since it uploads to the real Dropbox:

1. The Dropbox path uses the client's file name as is: ${DROPBOX_PATH}/${uploadFile.originalname}. A name containing / creates folders under the upload path, and the name is otherwise unchecked. Please reduce it to a safe base name (strip path separators and control characters, cap the length), ideally with a generated prefix such as the form id plus a timestamp.
2. It's an unauthenticated write to the organization's Dropbox with no rate limit. Anyone can send unlimited 5 MB files, and mimetype is what the client declares. A per-IP rate limit, plus requiring a valid formId for an active form, would make abuse much harder.
3. Minor: "File too large" and "Invalid file type" return HTTP 500; 413 and 415 (or 400) would let the frontend tell user errors from server failures.

Requesting changes for items 1 and 2, since the route is public.

[RichaSapre]

I reviewed the backend validation, permission enforcement, job creation, apply-link validation, and job-form middleware.

The targeted backend tests passed 57/57, and the Babel build compiled 773 files successfully. I did not identify a blocking backend issue.