From aefcd12c5342be8cb0d4f2253e101109b22f46d4 Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Fri, 25 Jun 2021 14:19:48 -0700
Subject: [PATCH 01/13] Add user mockup

---
 .../components/designer/FormViewerActions.vue |   9 +
 .../submission/ManageSubmissionUsers.vue      | 186 ++++++++++++++++++
 2 files changed, 195 insertions(+)
 create mode 100644 app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue

diff --git a/app/frontend/src/components/designer/FormViewerActions.vue b/app/frontend/src/components/designer/FormViewerActions.vue
index 66fd5efb9..9f4e3a702 100644
--- a/app/frontend/src/components/designer/FormViewerActions.vue
+++ b/app/frontend/src/components/designer/FormViewerActions.vue
@@ -46,15 +46,24 @@
           </v-tooltip>
         </router-link>
       </span>
+
+      <!-- Go to draft edit -->
+      <span v-if="submissionId" class="ml-2">
+        <ManageSubmissionUsers />
+      </span>
     </v-col>
   </v-row>
 </template>
 
 <script>
 import { FormPermissions } from '@/utils/constants';
+import ManageSubmissionUsers from '@/components/forms/submission/ManageSubmissionUsers.vue';
 
 export default {
   name: 'MySubmissionsActions',
+  components: {
+    ManageSubmissionUsers,
+  },
   props: {
     draftEnabled: {
       type: Boolean,
diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
new file mode 100644
index 000000000..ec3a64f6a
--- /dev/null
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -0,0 +1,186 @@
+<template>
+  <span>
+    <v-tooltip bottom>
+      <template #activator="{ on, attrs }">
+        <v-btn
+          color="primary"
+          @click="dialog = true"
+          icon
+          v-bind="attrs"
+          v-on="on"
+        >
+          <v-icon>person_add</v-icon>
+        </v-btn>
+      </template>
+      <span>Add Team Member</span>
+    </v-tooltip>
+    <v-dialog v-model="dialog" width="600">
+      <v-card>
+        <v-card-title class="headline pb-0">
+          Manage Team Members For This Submission
+        </v-card-title>
+        <v-card-text>
+          <hr />
+          <v-row>
+            <v-col cols="9">
+              <v-autocomplete
+                v-model="userSearchSelection"
+                clearable
+                dense
+                :filter="filterObject"
+                hide-details
+                :items="userSearchResults"
+                label="Enter a name, email, or username"
+                :loading="isLoadingDropdown"
+                return-object
+                :search-input.sync="findUsers"
+              >
+                <!-- no data -->
+                <template #no-data>
+                  <div class="px-2">
+                    Can't find someone? They may not have joined the site.<br />
+                    Kindly send them a link to the site and ask them to log in.
+                  </div>
+                </template>
+                <!-- selected user -->
+                <template #selection="data">
+                  <span
+                    v-bind="data.attrs"
+                    :input-value="data.selected"
+                    close
+                    @click="data.select"
+                    @click:close="remove(data.item)"
+                  >
+                    {{ data.item.fullName }}
+                  </span>
+                </template>
+                <!-- users found in dropdown -->
+                <template #item="data">
+                  <template v-if="typeof data.item !== 'object'">
+                    <v-list-item-content v-text="data.item" />
+                  </template>
+                  <template v-else>
+                    <v-list-item-content>
+                      <v-list-item-title v-html="data.item.fullName" />
+                      <v-list-item-subtitle v-html="data.item.username" />
+                      <v-list-item-subtitle v-html="data.item.email" />
+                    </v-list-item-content>
+                  </template>
+                </template>
+              </v-autocomplete>
+            </v-col>
+            <v-col cols="3">
+              <v-btn
+                color="primary"
+                class="ml-2"
+                :disabled="!userSearchSelection"
+                :loading="isLoadingDropdown"
+                @click="save"
+              >
+                <span>Add</span>
+              </v-btn>
+            </v-col>
+          </v-row>
+          <p class="mt-5">
+            <strong>Team members for this submission:</strong>
+          </p>
+          <v-simple-table dense>
+            <template v-slot:default>
+              <thead>
+                <tr>
+                  <th class="text-left">Name</th>
+                  <th class="text-left">Username</th>
+                  <th class="text-left">Email</th>
+                  <th class="text-left">Actions</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr>
+                  <td>Lucas O'Neil</td>
+                  <td>loneil</td>
+                  <td>lucas@oneil.gov.bc.ca</td>
+                  <td>
+                    <v-btn color="red" icon disabled>
+                      <v-icon>remove_circle</v-icon>
+                    </v-btn>
+                  </td>
+                </tr>
+                <tr>
+                  <td>Jane Smith</td>
+                  <td>jxsmith</td>
+                  <td>jane@smith.gov.bc.ca</td>
+                  <td>
+                    <v-btn color="red" icon>
+                      <v-icon>remove_circle</v-icon>
+                    </v-btn>
+                  </td>
+                </tr>
+              </tbody>
+            </template>
+          </v-simple-table>
+        </v-card-text>
+
+        <v-card-actions class="justify-center">
+          <v-btn class="mb-5 close-dlg" color="primary" @click="dialog = false">
+            <span>Close</span>
+          </v-btn>
+        </v-card-actions>
+      </v-card>
+    </v-dialog>
+  </span>
+</template>
+
+<script>
+import { userService } from '@/services';
+
+export default {
+  name: 'ManageSubmissionUsers',
+  data() {
+    return {
+      dialog: false,
+      isLoadingDropdown: false,
+      isLoadingTable: true,
+      findUsers: null,
+      userSearchResults: [],
+      userSearchSelection: null,
+    };
+  },
+  methods: {
+    // show users in dropdown that have a text match on multiple properties
+    filterObject(item, queryText) {
+      // eslint-disable-next-line
+      for (const [key, value] of Object.entries(item)) {
+        if (
+          value !== null &&
+          value.toLocaleLowerCase().includes(queryText.toLocaleLowerCase())
+        ) {
+          return true;
+        }
+      }
+    },
+
+    save() {
+      // emit user (object) to the parent component
+      this.$emit('new-users', [this.model]);
+      // reset search field
+      this.model = null;
+      this.addingUsers = false;
+    },
+  },
+  watch: {
+    // Get a list of user objects from database
+    async findUsers(input) {
+      if (!input) return;
+      this.isLoadingDropdown = true;
+      try {
+        const response = await userService.getUsers({ search: input });
+        this.userSearchResults = response.data;
+      } catch (error) {
+        console.error(`Error getting users: ${error}`); // eslint-disable-line no-console
+      } finally {
+        this.isLoadingDropdown = false;
+      }
+    },
+  },
+};
+</script>

From dd1f50fe9d040a474508c3c855f7069553d3cd4e Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Fri, 25 Jun 2021 16:18:02 -0700
Subject: [PATCH 02/13] Disable autocomplete on user search

---
 .../submission/ManageSubmissionUsers.vue      | 89 ++++++++++---------
 1 file changed, 46 insertions(+), 43 deletions(-)

diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
index ec3a64f6a..62ca3c7fc 100644
--- a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -23,51 +23,54 @@
           <hr />
           <v-row>
             <v-col cols="9">
-              <v-autocomplete
-                v-model="userSearchSelection"
-                clearable
-                dense
-                :filter="filterObject"
-                hide-details
-                :items="userSearchResults"
-                label="Enter a name, email, or username"
-                :loading="isLoadingDropdown"
-                return-object
-                :search-input.sync="findUsers"
-              >
-                <!-- no data -->
-                <template #no-data>
-                  <div class="px-2">
-                    Can't find someone? They may not have joined the site.<br />
-                    Kindly send them a link to the site and ask them to log in.
-                  </div>
-                </template>
-                <!-- selected user -->
-                <template #selection="data">
-                  <span
-                    v-bind="data.attrs"
-                    :input-value="data.selected"
-                    close
-                    @click="data.select"
-                    @click:close="remove(data.item)"
-                  >
-                    {{ data.item.fullName }}
-                  </span>
-                </template>
-                <!-- users found in dropdown -->
-                <template #item="data">
-                  <template v-if="typeof data.item !== 'object'">
-                    <v-list-item-content v-text="data.item" />
+              <form autocomplete="off">
+                <v-autocomplete
+                  v-model="userSearchSelection"
+                  clearable
+                  dense
+                  :filter="filterObject"
+                  hide-details
+                  :items="userSearchResults"
+                  label="Enter a name, e-mail, or username"
+                  :loading="isLoadingDropdown"
+                  return-object
+                  :search-input.sync="findUsers"
+                >
+                  <!-- no data -->
+                  <template #no-data>
+                    <div class="px-2">
+                      Can't find someone? They may not have joined the site.<br />
+                      Kindly send them a link to the site and ask them to log
+                      in.
+                    </div>
+                  </template>
+                  <!-- selected user -->
+                  <template #selection="data">
+                    <span
+                      v-bind="data.attrs"
+                      :input-value="data.selected"
+                      close
+                      @click="data.select"
+                      @click:close="remove(data.item)"
+                    >
+                      {{ data.item.fullName }}
+                    </span>
                   </template>
-                  <template v-else>
-                    <v-list-item-content>
-                      <v-list-item-title v-html="data.item.fullName" />
-                      <v-list-item-subtitle v-html="data.item.username" />
-                      <v-list-item-subtitle v-html="data.item.email" />
-                    </v-list-item-content>
+                  <!-- users found in dropdown -->
+                  <template #item="data">
+                    <template v-if="typeof data.item !== 'object'">
+                      <v-list-item-content v-text="data.item" />
+                    </template>
+                    <template v-else>
+                      <v-list-item-content>
+                        <v-list-item-title v-html="data.item.fullName" />
+                        <v-list-item-subtitle v-html="data.item.username" />
+                        <v-list-item-subtitle v-html="data.item.email" />
+                      </v-list-item-content>
+                    </template>
                   </template>
-                </template>
-              </v-autocomplete>
+                </v-autocomplete>
+              </form>
             </v-col>
             <v-col cols="3">
               <v-btn

From e27403ca4635112d1e0c675d4068aa3f0368b70a Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Mon, 28 Jun 2021 16:04:16 -0700
Subject: [PATCH 03/13] submission rbac doc

---
 app/src/docs/v1.api-spec.yaml | 116 ++++++++++++++++++++++++++++++++++
 1 file changed, 116 insertions(+)

diff --git a/app/src/docs/v1.api-spec.yaml b/app/src/docs/v1.api-spec.yaml
index af47dfee2..63e032e83 100755
--- a/app/src/docs/v1.api-spec.yaml
+++ b/app/src/docs/v1.api-spec.yaml
@@ -1231,6 +1231,58 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/Error"
+  /rbac/current/submissions:
+    get:
+      summary: Get submissions/roles/permissions for current user
+      operationId: getCurrentUserSubmissions
+      tags:
+        - RBAC
+      parameters:
+        - in: query
+          name: formId
+          schema:
+            type: string
+            format: uuid
+            example: c6455376-382c-439d-a811-0381a012d696
+          description: form ID
+        - in: query
+          name: formSubmissionId
+          schema:
+            type: string
+            format: uuid
+            example: c6455376-382c-439d-a811-0381a012d696
+          description: submission ID
+        - in: query
+          name: userId
+          schema:
+            type: string
+            format: uuid
+            example: c6455376-382c-439d-a811-0381a012d696
+          description: user ID
+        - in: query
+          name: active
+          schema:
+            type: boolean
+          example: true
+          description: to include active or deleted submissions or not
+      responses:
+        "200":
+          description: "OK"
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - type: array
+                    items:
+                      $ref: "#/components/schemas/UserSubmission"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        default:
+          description: Unexpected error
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
   /rbac/idps:
     get:
       summary: Get a list of identity providers
@@ -2626,6 +2678,70 @@ components:
             - team_manager
           items:
             type: string
+    UserSubmission:
+      type: object
+      properties:
+        active:
+          type: boolean
+          description: If the submission is active
+          example: true
+        confirmationId:
+          type: string
+          description: The submission's Confirmation ID
+          example: B6F3E0EB
+        createdAt:
+          type: string
+          example: 2020-06-04T18:49:20.672Z
+        description:
+          type: string
+          description: The form description
+          example: A form that allows a user to fill out a survey
+        enableStatusUpdates:
+          type: boolean
+          description: If the form uses status flow
+          example: true
+        enableSubmitterDraft:
+          type: boolean
+          description: If the form's submissions can be saved as draft
+          example: true
+        formId:
+          type: string
+          format: uuid
+          description: ID of the form
+          example: d9249b52-d97c-4d28-90e3-a39a94c847ea
+        formSubmissionId:
+          type: string
+          format: uuid
+          description: ID of the submission
+          example: b6f3e0eb-52e5-4c02-833e-d514e4610d1f
+        name:
+          type: string
+          description: The form name
+          example: NR survey form
+        permissions:
+          type: array
+          description: the permission codes this user has on this submission
+          example:
+            - submission_create
+            - submission_read
+            - submission_delete
+            - submission_update
+          items:
+            type: string
+        submissionStatus:
+          type: array
+          description: the permission codes this user has on this submission
+          items:
+            $ref: "#/components/schemas/SubmissionStatus"
+        userId:
+          type: string
+          format: uuid
+          description: ID of the user
+          example: b6f3e0eb-52e5-4c02-833e-d514e4610d1f
+        version:
+          type: integer
+          description: The version number of the form for a submission
+          example: 1
     ValidationError:
       allOf:
         - $ref: "#/components/schemas/Problem"

From d08ee102b2662deb073d7ca8e8848f5c25b4ad78 Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Tue, 6 Jul 2021 11:38:30 -0700
Subject: [PATCH 04/13] Routes

---
 app/src/forms/rbac/routes.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/app/src/forms/rbac/routes.js b/app/src/forms/rbac/routes.js
index 9291160b4..d92a3710f 100644
--- a/app/src/forms/rbac/routes.js
+++ b/app/src/forms/rbac/routes.js
@@ -4,6 +4,7 @@ const routes = require('express').Router();
 const currentUser = require('../auth/middleware/userAccess').currentUser;
 const controller = require('./controller');
 const hasFormPermissions = require('../auth/middleware/userAccess').hasFormPermissions;
+const hasSubmissionPermissions = require('../auth/middleware/userAccess').hasSubmissionPermissions;
 const keycloak = require('../../components/keycloak');
 const P = require('../common/constants').Permissions;
 
@@ -29,6 +30,14 @@ routes.put('/forms', hasFormPermissions(P.TEAM_UPDATE), async (req, res, next) =
   await controller.setFormUsers(req, res, next);
 });
 
+routes.get('/submissions', hasSubmissionPermissions(P.SUBMISSION_READ), async (req, res, next) => {
+  await controller.getSubmissionUsers(req, res, next);
+});
+
+routes.put('/submissions', hasFormPermissions(P.SUBMISSION_UPDATE), async (req, res, next) => {
+  await controller.setSubmissionUsers(req, res, next);
+});
+
 routes.get('/users', keycloak.protect(`${config.get('server.keycloak.clientId')}:admin`), async (req, res, next) => {
   await controller.getUserForms(req, res, next);
 });

From 947bc55988ca5f1ef8d7487043ba5728c98b553f Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Thu, 8 Jul 2021 22:12:53 -0700
Subject: [PATCH 05/13] submission user api

---
 .../components/designer/FormViewerActions.vue |   2 +-
 .../submission/ManageSubmissionUsers.vue      | 150 +++++++++++++-----
 .../forms/submission/NotesPanel.vue           |   5 +-
 app/frontend/src/services/rbacService.js      |  27 +++-
 app/src/forms/common/models/models.js         |   8 +
 app/src/forms/rbac/controller.js              |  16 ++
 app/src/forms/rbac/routes.js                  |   4 +-
 app/src/forms/rbac/service.js                 |  46 +++++-
 8 files changed, 210 insertions(+), 48 deletions(-)

diff --git a/app/frontend/src/components/designer/FormViewerActions.vue b/app/frontend/src/components/designer/FormViewerActions.vue
index 9f4e3a702..4983b9db6 100644
--- a/app/frontend/src/components/designer/FormViewerActions.vue
+++ b/app/frontend/src/components/designer/FormViewerActions.vue
@@ -49,7 +49,7 @@
 
       <!-- Go to draft edit -->
       <span v-if="submissionId" class="ml-2">
-        <ManageSubmissionUsers />
+        <ManageSubmissionUsers :submissionId="submissionId"/>
       </span>
     </v-col>
   </v-row>
diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
index 62ca3c7fc..cc7805960 100644
--- a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -19,8 +19,10 @@
         <v-card-title class="headline pb-0">
           Manage Team Members For This Submission
         </v-card-title>
+
         <v-card-text>
           <hr />
+
           <v-row>
             <v-col cols="9">
               <form autocomplete="off">
@@ -75,52 +77,50 @@
             <v-col cols="3">
               <v-btn
                 color="primary"
-                class="ml-2"
                 :disabled="!userSearchSelection"
                 :loading="isLoadingDropdown"
-                @click="save"
+                @click="addUser"
               >
                 <span>Add</span>
               </v-btn>
             </v-col>
           </v-row>
+
           <p class="mt-5">
             <strong>Team members for this submission:</strong>
           </p>
-          <v-simple-table dense>
-            <template v-slot:default>
-              <thead>
-                <tr>
-                  <th class="text-left">Name</th>
-                  <th class="text-left">Username</th>
-                  <th class="text-left">Email</th>
-                  <th class="text-left">Actions</th>
-                </tr>
-              </thead>
-              <tbody>
-                <tr>
-                  <td>Lucas O'Neil</td>
-                  <td>loneil</td>
-                  <td>lucas@oneil.gov.bc.ca</td>
-                  <td>
-                    <v-btn color="red" icon disabled>
-                      <v-icon>remove_circle</v-icon>
-                    </v-btn>
-                  </td>
-                </tr>
-                <tr>
-                  <td>Jane Smith</td>
-                  <td>jxsmith</td>
-                  <td>jane@smith.gov.bc.ca</td>
-                  <td>
-                    <v-btn color="red" icon>
-                      <v-icon>remove_circle</v-icon>
-                    </v-btn>
-                  </td>
-                </tr>
-              </tbody>
-            </template>
-          </v-simple-table>
+
+          <v-skeleton-loader :loading="isLoadingTable" type="table-row">
+            <v-simple-table dense>
+              <template v-slot:default>
+                <thead>
+                  <tr>
+                    <th class="text-left">Name</th>
+                    <th class="text-left">Username</th>
+                    <th class="text-left">Email</th>
+                    <th class="text-left">Actions</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  <tr :key="item.userId" v-for="item in userTableList">
+                    <td>{{ item.fullName }}</td>
+                    <td>{{ item.username }}</td>
+                    <td>{{ item.email }}</td>
+                    <td>
+                      <v-btn
+                        color="red"
+                        icon
+                        :disabled="item.isOwner"
+                        @click="removeUser(item)"
+                      >
+                        <v-icon>remove_circle</v-icon>
+                      </v-btn>
+                    </td>
+                  </tr>
+                </tbody>
+              </template>
+            </v-simple-table>
+          </v-skeleton-loader>
         </v-card-text>
 
         <v-card-actions class="justify-center">
@@ -129,26 +129,58 @@
           </v-btn>
         </v-card-actions>
       </v-card>
+
+      <BaseDialog
+        v-model="showDeleteDialog"
+        type="CONTINUE"
+        @close-dialog="showDeleteDialog = false"
+        @continue-dialog="modifyPermissions(userToDelete.id, [])"
+      >
+        <template #title>Remove {{ userToDelete.username }}</template>
+        <template #text>
+          Are you sure you wish to remove
+          <strong>{{ userToDelete.username }}</strong
+          >? They will no longer have permissions for this submission.
+        </template>
+        <template #button-text-continue>
+          <span>Remove</span>
+        </template>
+      </BaseDialog>
     </v-dialog>
   </span>
 </template>
 
 <script>
-import { userService } from '@/services';
+import { mapActions } from 'vuex';
+
+import { FormPermissions } from '@/utils/constants';
+import { rbacService, userService } from '@/services';
 
 export default {
   name: 'ManageSubmissionUsers',
+  props: {
+    submissionId: {
+      type: String,
+      required: true,
+    },
+  },
   data() {
     return {
       dialog: false,
-      isLoadingDropdown: false,
       isLoadingTable: true,
+      showDeleteDialog: false,
+      userTableList: [],
+      userToDelete: {},
+
+      // search box
       findUsers: null,
+      isLoadingDropdown: false,
       userSearchResults: [],
       userSearchSelection: null,
     };
   },
   methods: {
+    ...mapActions('notifications', ['addNotification']),
     // show users in dropdown that have a text match on multiple properties
     filterObject(item, queryText) {
       // eslint-disable-next-line
@@ -161,14 +193,49 @@ export default {
         }
       }
     },
-
-    save() {
+    async getSubmissionUsers() {
+      this.isLoadingTable = true;
+      try {
+        const response = await rbacService.getSubmissionUsers({
+          formSubmissionId: this.submissionId,
+        });
+        if (response.data) {
+          this.userTableList = response.data.map((su) => {
+            return {
+              email: su.user.email,
+              fullName: su.user.fullName,
+              id: su.userId,
+              isOwner: !su.permissions.includes(
+                FormPermissions.SUBMISSION_CREATE
+              ),
+              username: su.user.username,
+            };
+          });
+        }
+      } catch (error) {
+        this.addNotification({
+          message:
+            'An error occured while trying to fetch users for this submission.',
+          consoleError: `Error getting users for ${this.submissionId}: ${error}`,
+        });
+      } finally {
+        this.isLoadingTable = false;
+      }
+    },
+    addUser() {
       // emit user (object) to the parent component
       this.$emit('new-users', [this.model]);
       // reset search field
       this.model = null;
       this.addingUsers = false;
     },
+    modifyPermissions(userId, permissions) {
+      alert(`${userId} + ${permissions.length}`);
+    },
+    removeUser(userRow) {
+      this.userToDelete = userRow;
+      this.showDeleteDialog = true;
+    },
   },
   watch: {
     // Get a list of user objects from database
@@ -185,5 +252,8 @@ export default {
       }
     },
   },
+  created() {
+    this.getSubmissionUsers();
+  },
 };
 </script>
diff --git a/app/frontend/src/components/forms/submission/NotesPanel.vue b/app/frontend/src/components/forms/submission/NotesPanel.vue
index d3b8d882f..209aa183c 100644
--- a/app/frontend/src/components/forms/submission/NotesPanel.vue
+++ b/app/frontend/src/components/forms/submission/NotesPanel.vue
@@ -71,8 +71,7 @@
 <script>
 import { mapActions, mapGetters } from 'vuex';
 
-import formService from '@/services/formService';
-import { rbacService } from '@/services';
+import { formService, rbacService } from '@/services';
 
 export default {
   name: 'NotesPanel',
@@ -101,7 +100,7 @@ export default {
         const user = await rbacService.getCurrentUser();
         const body = {
           note: this.newNote,
-          userId: user.data.id
+          userId: user.data.id,
         };
         const response = await formService.addNote(this.submissionId, body);
         if (!response.data) {
diff --git a/app/frontend/src/services/rbacService.js b/app/frontend/src/services/rbacService.js
index 78de94439..711a748ef 100644
--- a/app/frontend/src/services/rbacService.js
+++ b/app/frontend/src/services/rbacService.js
@@ -69,5 +69,30 @@ export default {
    */
   setUserForms(requestBody, params = {}) {
     return appAxios().put(`${ApiRoutes.RBAC}/users`, requestBody, { params });
-  }
+  },
+
+  //
+  // Submission Management calls
+  //
+
+  /**
+   * @function getSubmissionUsers
+   * Get the list of associated users for a submission
+   * @param {Object} [params={}] The query parameters
+   * @returns {Promise} An axios response
+   */
+  getSubmissionUsers(params = {}) {
+    return appAxios().get(`${ApiRoutes.RBAC}/submissions`, { params });
+  },
+
+  /**
+   * @function setFormUsers
+   * Set permissions for a user on the form
+   * @param {Object} requestBody The request body containing the permissions list
+   * @param {Object} [params={}] The query parameters
+   * @returns {Promise} An axios response
+   */
+  setSubmissionUserPermissions(requestBody, params = {}) {
+    return appAxios().put(`${ApiRoutes.RBAC}/submissions`, requestBody, { params });
+  },
 };
diff --git a/app/src/forms/common/models/models.js b/app/src/forms/common/models/models.js
index b59ef8ac4..262ba9a84 100644
--- a/app/src/forms/common/models/models.js
+++ b/app/src/forms/common/models/models.js
@@ -767,6 +767,14 @@ class UserSubmissions extends Model {
           from: 'submissions_submitters_vw.formSubmissionId',
           to: 'form_submission_status.submissionId'
         }
+      },
+      user: {
+        relation: Model.HasOneRelation,
+        modelClass: User,
+        join: {
+          from: 'submissions_submitters_vw.userId',
+          to: 'user.id'
+        }
       }
     };
   }
diff --git a/app/src/forms/rbac/controller.js b/app/src/forms/rbac/controller.js
index 27fd16eb1..8b58da07d 100644
--- a/app/src/forms/rbac/controller.js
+++ b/app/src/forms/rbac/controller.js
@@ -75,6 +75,22 @@ module.exports = {
       next(error);
     }
   },
+  getSubmissionUsers:  async (req, res, next) => {
+    try {
+      const response = await service.getSubmissionUsers(req.query);
+      res.status(200).json(response);
+    } catch (error) {
+      next(error);
+    }
+  },
+  setSubmissionUserPermissions:  async (req, res, next) => {
+    try {
+      const response = await service.modifySubmissionUser(req.query.formSubmissionId, req.query.userId, req.body, req.currentUser);
+      res.status(200).json(response);
+    } catch (error) {
+      next(error);
+    }
+  },
   getUserForms:  async (req, res, next) => {
     try {
       const response = await service.getUserForms(req.query);
diff --git a/app/src/forms/rbac/routes.js b/app/src/forms/rbac/routes.js
index d92a3710f..17e37fad1 100644
--- a/app/src/forms/rbac/routes.js
+++ b/app/src/forms/rbac/routes.js
@@ -34,8 +34,8 @@ routes.get('/submissions', hasSubmissionPermissions(P.SUBMISSION_READ), async (r
   await controller.getSubmissionUsers(req, res, next);
 });
 
-routes.put('/submissions', hasFormPermissions(P.SUBMISSION_UPDATE), async (req, res, next) => {
-  await controller.setSubmissionUsers(req, res, next);
+routes.put('/submissions', hasSubmissionPermissions(P.SUBMISSION_UPDATE), async (req, res, next) => {
+  await controller.setSubmissionUserPermissions(req, res, next);
 });
 
 routes.get('/users', keycloak.protect(`${config.get('server.keycloak.clientId')}:admin`), async (req, res, next) => {
diff --git a/app/src/forms/rbac/service.js b/app/src/forms/rbac/service.js
index 00738dae2..8de4d10ff 100644
--- a/app/src/forms/rbac/service.js
+++ b/app/src/forms/rbac/service.js
@@ -1,4 +1,4 @@
-const { FormRoleUser, IdentityProvider, User, UserFormAccess, UserSubmissions } = require('../common/models');
+const { FormRoleUser, FormSubmissionUser, IdentityProvider, User, UserFormAccess, UserSubmissions } = require('../common/models');
 const { queryUtils } = require('../common/utils');
 
 const { transaction } = require('objection');
@@ -165,6 +165,18 @@ const service = {
     return items;
   },
 
+  getSubmissionUsers: async (params) => {
+    params = queryUtils.defaultActiveOnly(params);
+    const items = await UserSubmissions.query()
+      .skipUndefined()
+      .withGraphFetched('user')
+      .modify('filterFormSubmissionId', params.formSubmissionId)
+      .modify('filterUserId', params.userId)
+      .modify('filterActive', params.active)
+      .modify('orderDefault');
+    return items;
+  },
+
   getUserForms: async (params) => {
     params = queryUtils.defaultActiveOnly(params);
     const items = await UserFormAccess.query()
@@ -221,6 +233,38 @@ const service = {
     }
   },
 
+  modifySubmissionUser: async (formSubmissionId, userId, body, currentUser) => {
+    if (!formSubmissionId || !userId || !body.permissions) {
+      throw new Error('Submission ID, user ID, or permisssions missing');
+    }
+
+    let trx;
+    try {
+      trx = await transaction.start(FormSubmissionUser.knex());
+      // remove existing mappings for the user...
+      await FormSubmissionUser.query(trx)
+        .delete()
+        .where('formSubmissionId', formSubmissionId)
+        .where('userId', userId);
+
+      // create the batch and insert. So if permissions is empty it removes the user from the submission
+      let permissions = body ? body.permissions : [];
+      if (permissions && permissions !== []) {
+        if (!Array.isArray(permissions)) {
+          permissions = [permissions];
+        }
+        // add ids and save them
+        const items = permissions.map(perm => { return { id: uuidv4(), formSubmissionId: formSubmissionId, userId: userId, createdBy: currentUser.username, ...perm }; });
+        await FormSubmissionUser.query(trx).insert(items);
+      }
+      await trx.commit();
+      return service.getSubmissionUsers({ userId: userId, formSubmissionId: formSubmissionId });
+    } catch (err) {
+      if (trx) await trx.rollback();
+      throw err;
+    }
+  },
+
   setUserForms: async (userId, formId, data, currentUser) => {
     // check this in middleware? 422 in valid params
     if (!userId || 0 === userId.length) {

From a068dcbe6975474bfa0f91d674feb11b9d4d8605 Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Fri, 9 Jul 2021 12:04:13 -0700
Subject: [PATCH 06/13] Add user

---
 .../base/BaseNotificationContainer.vue        |  2 +-
 .../submission/ManageSubmissionUsers.vue      | 63 ++++++++++++++++---
 app/src/forms/rbac/service.js                 | 15 ++---
 3 files changed, 60 insertions(+), 20 deletions(-)

diff --git a/app/frontend/src/components/base/BaseNotificationContainer.vue b/app/frontend/src/components/base/BaseNotificationContainer.vue
index 5c7c46313..4182075d2 100644
--- a/app/frontend/src/components/base/BaseNotificationContainer.vue
+++ b/app/frontend/src/components/base/BaseNotificationContainer.vue
@@ -18,7 +18,7 @@ export default {
 
 <style scoped>
 .notification-container {
-  z-index: 99;
+  z-index: 999;
   position: fixed;
   top: 0;
   left: 25%;
diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
index cc7805960..691a00ad3 100644
--- a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -182,6 +182,24 @@ export default {
   methods: {
     ...mapActions('notifications', ['addNotification']),
     // show users in dropdown that have a text match on multiple properties
+    async addUser() {
+      if (this.userSearchSelection) {
+        const id = this.userSearchSelection.id;
+        if (this.userTableList.some((u) => u.id === id)) {
+          this.addNotification({
+            type: 'warning',
+            message: `User ${this.userSearchSelection.username} is already in the list of team members.`,
+          });
+        } else {
+          this.modifyPermissions(id, [
+            FormPermissions.SUBMISSION_UPDATE,
+            FormPermissions.SUBMISSION_READ,
+          ]);
+        }
+      }
+      // reset search field
+      this.userSearchSelection = null;
+    },
     filterObject(item, queryText) {
       // eslint-disable-next-line
       for (const [key, value] of Object.entries(item)) {
@@ -205,12 +223,13 @@ export default {
               email: su.user.email,
               fullName: su.user.fullName,
               id: su.userId,
-              isOwner: !su.permissions.includes(
+              isOwner: su.permissions.includes(
                 FormPermissions.SUBMISSION_CREATE
               ),
               username: su.user.username,
             };
           });
+          this.userTableList.sort((a, b) => a.isOwner - b.isOwner);
         }
       } catch (error) {
         this.addNotification({
@@ -222,15 +241,39 @@ export default {
         this.isLoadingTable = false;
       }
     },
-    addUser() {
-      // emit user (object) to the parent component
-      this.$emit('new-users', [this.model]);
-      // reset search field
-      this.model = null;
-      this.addingUsers = false;
-    },
-    modifyPermissions(userId, permissions) {
-      alert(`${userId} + ${permissions.length}`);
+    async modifyPermissions(userId, permissions) {
+      this.isLoadingTable = true;
+      try {
+        // Add the selected user with read/update permissions on this submission
+        const response = await rbacService.setSubmissionUserPermissions(
+          { permissions: permissions },
+          {
+            formSubmissionId: this.submissionId,
+            userId: userId,
+          }
+        );
+        if (response.data) {
+          this.userTableList = response.data.map((su) => {
+            return {
+              email: su.user.email,
+              fullName: su.user.fullName,
+              id: su.userId,
+              isOwner: !su.permissions.includes(
+                FormPermissions.SUBMISSION_CREATE
+              ),
+              username: su.user.username,
+            };
+          });
+        }
+      } catch (error) {
+        this.addNotification({
+          message:
+            'An error occured while trying to update users for this submission.',
+          consoleError: `Error setting user permissions. Sub: ${this.submissionId} User: ${userId} Error: ${error}`,
+        });
+      } finally {
+        this.isLoadingTable = false;
+      }
     },
     removeUser(userRow) {
       this.userToDelete = userRow;
diff --git a/app/src/forms/rbac/service.js b/app/src/forms/rbac/service.js
index 8de4d10ff..8a990f03a 100644
--- a/app/src/forms/rbac/service.js
+++ b/app/src/forms/rbac/service.js
@@ -2,6 +2,7 @@ const { FormRoleUser, FormSubmissionUser, IdentityProvider, User, UserFormAccess
 const { queryUtils } = require('../common/utils');
 
 const { transaction } = require('objection');
+const Problem = require('api-problem');
 const { v4: uuidv4 } = require('uuid');
 
 const authService = require('../auth/service');
@@ -234,8 +235,8 @@ const service = {
   },
 
   modifySubmissionUser: async (formSubmissionId, userId, body, currentUser) => {
-    if (!formSubmissionId || !userId || !body.permissions) {
-      throw new Error('Submission ID, user ID, or permisssions missing');
+    if (!userId || !body.permissions) {
+      throw new Problem(422, 'User ID or permissions missing from request');
     }
 
     let trx;
@@ -248,17 +249,13 @@ const service = {
         .where('userId', userId);
 
       // create the batch and insert. So if permissions is empty it removes the user from the submission
-      let permissions = body ? body.permissions : [];
-      if (permissions && permissions !== []) {
-        if (!Array.isArray(permissions)) {
-          permissions = [permissions];
-        }
+      if (body.permissions !== []) {
         // add ids and save them
-        const items = permissions.map(perm => { return { id: uuidv4(), formSubmissionId: formSubmissionId, userId: userId, createdBy: currentUser.username, ...perm }; });
+        const items = body.permissions.map(perm => { return { id: uuidv4(), formSubmissionId: formSubmissionId, userId: userId, createdBy: currentUser.username, permission: perm }; });
         await FormSubmissionUser.query(trx).insert(items);
       }
       await trx.commit();
-      return service.getSubmissionUsers({ userId: userId, formSubmissionId: formSubmissionId });
+      return service.getSubmissionUsers({ formSubmissionId: formSubmissionId });
     } catch (err) {
       if (trx) await trx.rollback();
       throw err;

From eecb89a465c3e4813b5e26a96636e075242f9694 Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Fri, 9 Jul 2021 14:50:27 -0700
Subject: [PATCH 07/13] Order of list

---
 .../submission/ManageSubmissionUsers.vue      | 42 ++++++++-----------
 1 file changed, 18 insertions(+), 24 deletions(-)

diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
index 691a00ad3..7b0c228c5 100644
--- a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -134,7 +134,7 @@
         v-model="showDeleteDialog"
         type="CONTINUE"
         @close-dialog="showDeleteDialog = false"
-        @continue-dialog="modifyPermissions(userToDelete.id, [])"
+        @continue-dialog="modifyPermissions(userToDelete.id, []); showDeleteDialog = false"
       >
         <template #title>Remove {{ userToDelete.username }}</template>
         <template #text>
@@ -218,18 +218,7 @@ export default {
           formSubmissionId: this.submissionId,
         });
         if (response.data) {
-          this.userTableList = response.data.map((su) => {
-            return {
-              email: su.user.email,
-              fullName: su.user.fullName,
-              id: su.userId,
-              isOwner: su.permissions.includes(
-                FormPermissions.SUBMISSION_CREATE
-              ),
-              username: su.user.username,
-            };
-          });
-          this.userTableList.sort((a, b) => a.isOwner - b.isOwner);
+          this.userTableList = this.transformResponseToTable(response.data);
         }
       } catch (error) {
         this.addNotification({
@@ -253,17 +242,7 @@ export default {
           }
         );
         if (response.data) {
-          this.userTableList = response.data.map((su) => {
-            return {
-              email: su.user.email,
-              fullName: su.user.fullName,
-              id: su.userId,
-              isOwner: !su.permissions.includes(
-                FormPermissions.SUBMISSION_CREATE
-              ),
-              username: su.user.username,
-            };
-          });
+          this.userTableList = this.transformResponseToTable(response.data);
         }
       } catch (error) {
         this.addNotification({
@@ -279,6 +258,21 @@ export default {
       this.userToDelete = userRow;
       this.showDeleteDialog = true;
     },
+    transformResponseToTable(responseData) {
+      return responseData
+        .map((su) => {
+          return {
+            email: su.user.email,
+            fullName: su.user.fullName,
+            id: su.userId,
+            isOwner: su.permissions.includes(
+              FormPermissions.SUBMISSION_CREATE
+            ),
+            username: su.user.username,
+          };
+        })
+        .sort((a, b) => b.isOwner - a.isOwner);
+    },
   },
   watch: {
     // Get a list of user objects from database

From 3789317f79b149fe994ca4a482cc7df6f80ad861 Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Fri, 9 Jul 2021 15:54:13 -0700
Subject: [PATCH 08/13] Don't let submitted forms add team

---
 .../src/components/designer/FormViewer.vue        |  1 +
 .../src/components/designer/FormViewerActions.vue |  9 +++++++--
 .../forms/submission/ManageSubmissionUsers.vue    | 15 +++++++++++----
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/app/frontend/src/components/designer/FormViewer.vue b/app/frontend/src/components/designer/FormViewer.vue
index 1a018c27f..590f4f3c9 100644
--- a/app/frontend/src/components/designer/FormViewer.vue
+++ b/app/frontend/src/components/designer/FormViewer.vue
@@ -5,6 +5,7 @@
         <FormViewerActions
           :draftEnabled="form.enableSubmitterDraft"
           :formId="form.id"
+          :isDraft="submissionRecord.draft"
           :permissions="permissions"
           :readOnly="readOnly"
           :submissionId="submissionId"
diff --git a/app/frontend/src/components/designer/FormViewerActions.vue b/app/frontend/src/components/designer/FormViewerActions.vue
index 4983b9db6..507cc63d3 100644
--- a/app/frontend/src/components/designer/FormViewerActions.vue
+++ b/app/frontend/src/components/designer/FormViewerActions.vue
@@ -49,7 +49,7 @@
 
       <!-- Go to draft edit -->
       <span v-if="submissionId" class="ml-2">
-        <ManageSubmissionUsers :submissionId="submissionId"/>
+        <ManageSubmissionUsers :isDraft="isDraft" :submissionId="submissionId" />
       </span>
     </v-col>
   </v-row>
@@ -73,6 +73,10 @@ export default {
       type: String,
       default: undefined,
     },
+    isDraft: {
+      type: Boolean,
+      default: false,
+    },
     permissions: {
       type: Array,
     },
@@ -87,10 +91,11 @@ export default {
   },
   computed: {
     canSaveDraft() {
-      return !this.readOnly;
+      return this.isDraft && !this.readOnly;
     },
     showEditToggle() {
       return (
+        this.isDraft &&
         this.readOnly &&
         this.permissions.includes(FormPermissions.SUBMISSION_UPDATE)
       );
diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
index 7b0c228c5..88b972c83 100644
--- a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -12,7 +12,7 @@
           <v-icon>person_add</v-icon>
         </v-btn>
       </template>
-      <span>Add Team Member</span>
+      <span>Manage Team Members</span>
     </v-tooltip>
     <v-dialog v-model="dialog" width="600">
       <v-card>
@@ -23,7 +23,7 @@
         <v-card-text>
           <hr />
 
-          <v-row>
+          <v-row v-if="isDraft">
             <v-col cols="9">
               <form autocomplete="off">
                 <v-autocomplete
@@ -85,6 +85,9 @@
               </v-btn>
             </v-col>
           </v-row>
+          <div v-else>
+            You cannot manage team members after the form has been submitted
+          </div>
 
           <p class="mt-5">
             <strong>Team members for this submission:</strong>
@@ -98,7 +101,7 @@
                     <th class="text-left">Name</th>
                     <th class="text-left">Username</th>
                     <th class="text-left">Email</th>
-                    <th class="text-left">Actions</th>
+                    <th class="text-left" v-if="isDraft">Actions</th>
                   </tr>
                 </thead>
                 <tbody>
@@ -106,7 +109,7 @@
                     <td>{{ item.fullName }}</td>
                     <td>{{ item.username }}</td>
                     <td>{{ item.email }}</td>
-                    <td>
+                    <td v-if="isDraft">
                       <v-btn
                         color="red"
                         icon
@@ -159,6 +162,10 @@ import { rbacService, userService } from '@/services';
 export default {
   name: 'ManageSubmissionUsers',
   props: {
+    isDraft: {
+      type: Boolean,
+      required: true,
+    },
     submissionId: {
       type: String,
       required: true,

From c4f629e35ec5548f87db283ada72fab7ed3daf68 Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Fri, 9 Jul 2021 16:04:47 -0700
Subject: [PATCH 09/13] Fix boolean conditions

---
 app/frontend/src/components/designer/FormViewerActions.vue | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/app/frontend/src/components/designer/FormViewerActions.vue b/app/frontend/src/components/designer/FormViewerActions.vue
index 507cc63d3..1b03c8918 100644
--- a/app/frontend/src/components/designer/FormViewerActions.vue
+++ b/app/frontend/src/components/designer/FormViewerActions.vue
@@ -91,11 +91,10 @@ export default {
   },
   computed: {
     canSaveDraft() {
-      return this.isDraft && !this.readOnly;
+      return !this.readOnly;
     },
     showEditToggle() {
       return (
-        this.isDraft &&
         this.readOnly &&
         this.permissions.includes(FormPermissions.SUBMISSION_UPDATE)
       );

From e157dfb1916c121e54fe1dbfba37c24bd918dfa5 Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Fri, 9 Jul 2021 16:26:49 -0700
Subject: [PATCH 10/13] Icon change

---
 .../src/components/forms/submission/ManageSubmissionUsers.vue   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
index 88b972c83..f3046e16b 100644
--- a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -9,7 +9,7 @@
           v-bind="attrs"
           v-on="on"
         >
-          <v-icon>person_add</v-icon>
+          <v-icon>group</v-icon>
         </v-btn>
       </template>
       <span>Manage Team Members</span>

From 632eab7610d9a9d5cdb8a0b7e1bb3ed0decf3188 Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Fri, 9 Jul 2021 16:28:22 -0700
Subject: [PATCH 11/13] Wording

---
 .../src/components/forms/submission/ManageSubmissionUsers.vue | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
index f3046e16b..db9a82a50 100644
--- a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -17,7 +17,7 @@
     <v-dialog v-model="dialog" width="600">
       <v-card>
         <v-card-title class="headline pb-0">
-          Manage Team Members For This Submission
+          Manage Team Members
         </v-card-title>
 
         <v-card-text>
@@ -86,7 +86,7 @@
             </v-col>
           </v-row>
           <div v-else>
-            You cannot manage team members after the form has been submitted
+            You can invite and manage team members while this form is a draft
           </div>
 
           <p class="mt-5">

From 022276cd0beafcb4214d045952b1916f52a7b38c Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Mon, 12 Jul 2021 09:30:42 -0700
Subject: [PATCH 12/13] Spec

---
 app/src/docs/v1.api-spec.yaml | 131 ++++++++++++++++++++++++++++++++++
 1 file changed, 131 insertions(+)

diff --git a/app/src/docs/v1.api-spec.yaml b/app/src/docs/v1.api-spec.yaml
index 63e032e83..dea18707a 100755
--- a/app/src/docs/v1.api-spec.yaml
+++ b/app/src/docs/v1.api-spec.yaml
@@ -1443,6 +1443,90 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/Error"
+  /rbac/submissions:
+    get:
+      summary: Get a list of users and permissions for a submission
+      operationId: getSubmissionUsers
+      tags:
+        - RBAC
+      parameters:
+        - in: query
+          name: formSubmissionId
+          schema:
+            type: string
+            format: uuid
+            example: c6455376-382c-439d-a811-0381a012d696
+          description: submission ID
+          required: true
+        - in: query
+          name: userId
+          schema:
+            type: string
+          description: user ID
+      responses:
+        "200":
+          description: "OK"
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/UserAccessSubmission"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        default:
+          description: Unexpected error
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
+    put:
+      summary: Set premissions for a user on a submission
+      operationId: setSubmissionUser
+      tags:
+        - RBAC
+      parameters:
+        - in: query
+          name: formSubmissionId
+          schema:
+            type: string
+            format: uuid
+            example: c6455376-382c-439d-a811-0381a012d696
+          description: submission id
+          required: true
+        - in: query
+          name: userId
+          schema:
+            type: string
+          description: user ID
+          required: true
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                type: string
+                example: "SUBMISSION_UPDATE"
+              description: an array of the sumbission permissions to apply to this user. [] to remove.
+      responses:
+        "200":
+          description: "OK"
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/UserAccessSubmission"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        default:
+          description: Unexpected error
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Error"
   /rbac/users:
     get:
       summary: Get a list of forms and roles for a user
@@ -2079,6 +2163,7 @@ components:
               format: uuid
               description: ID of the FormVersion this submission is for.
               example: a675ab2a-1e88-4fb5-88f9-c7cb051a18b2
+        - $ref: "#/components/schemas/FormSchema"
         - $ref: "#/components/schemas/TimeStampUserData"
     FormRoleUser:
       type: object
@@ -2607,6 +2692,52 @@ components:
             - submission_create
           items:
             type: string
+    UserAccessSubmission:
+      type: object
+      properties:
+        active:
+          type: boolean
+          example: true
+        confirmationId:
+          type: string
+          example: 5DAD1EC9
+        createdAt:
+          type: string
+          example: 2020-06-04T18:49:20.672Z
+        description:
+          type: string
+          example: A BC Hunting licence application
+        draft:
+          type: boolean
+          example: true
+        enableStatusUpdates:
+          type: boolean
+          example: true
+        enableSubmitterDraft:
+          type: boolean
+          example: true
+        formId:
+          type: string
+          example: 5dad1ec9-d3c0-4b0f-8ead-cb4d9fa98987
+        formSubmissionId:
+          type: string
+          example: 6dad1ec9-d3c0-4b0f-8ead-cb4d9fa98987
+        name:
+          type: string
+          example: Licence Application
+        permissions:
+          type: array
+          description: the permission codes this user has on this form
+          example:
+            - submission_delete
+            - submission_create
+          items:
+            type: string
+        user:
+          $ref: "#/components/schemas/User"
+        userId:
+          type: string
+          example: 7dad1ec9-d3c0-4b0f-8ead-cb4d9fa98987
     UserForm:
       type: object
       properties:

From 5597637070fb089ca78846a88b1adab8e13885eb Mon Sep 17 00:00:00 2001
From: Lucas O'Neil <lucasoneil@gmail.com>
Date: Mon, 12 Jul 2021 15:12:34 -0700
Subject: [PATCH 13/13] Fixes from review

---
 .../submission/ManageSubmissionUsers.vue      | 16 +---
 app/src/docs/v1.api-spec.yaml                 |  9 +--
 app/src/forms/rbac/service.js                 |  8 +-
 app/tests/unit/forms/rbac/controller.spec.js  | 34 +++++++++
 app/tests/unit/routes/v1/rbac.spec.js         | 75 +++++++++++++++++++
 5 files changed, 124 insertions(+), 18 deletions(-)
 create mode 100644 app/tests/unit/forms/rbac/controller.spec.js

diff --git a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
index db9a82a50..b72603aae 100644
--- a/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
+++ b/app/frontend/src/components/forms/submission/ManageSubmissionUsers.vue
@@ -86,7 +86,7 @@
             </v-col>
           </v-row>
           <div v-else>
-            You can invite and manage team members while this form is a draft
+            You can only invite and manage team members while this form is a draft
           </div>
 
           <p class="mt-5">
@@ -95,7 +95,7 @@
 
           <v-skeleton-loader :loading="isLoadingTable" type="table-row">
             <v-simple-table dense>
-              <template v-slot:default>
+              <template>
                 <thead>
                   <tr>
                     <th class="text-left">Name</th>
@@ -189,7 +189,7 @@ export default {
   methods: {
     ...mapActions('notifications', ['addNotification']),
     // show users in dropdown that have a text match on multiple properties
-    async addUser() {
+    addUser() {
       if (this.userSearchSelection) {
         const id = this.userSearchSelection.id;
         if (this.userTableList.some((u) => u.id === id)) {
@@ -208,15 +208,7 @@ export default {
       this.userSearchSelection = null;
     },
     filterObject(item, queryText) {
-      // eslint-disable-next-line
-      for (const [key, value] of Object.entries(item)) {
-        if (
-          value !== null &&
-          value.toLocaleLowerCase().includes(queryText.toLocaleLowerCase())
-        ) {
-          return true;
-        }
-      }
+      return Object.values(item).some((v) => v !== null && v.toLocaleLowerCase().includes(queryText.toLocaleLowerCase()));
     },
     async getSubmissionUsers() {
       this.isLoadingTable = true;
diff --git a/app/src/docs/v1.api-spec.yaml b/app/src/docs/v1.api-spec.yaml
index dea18707a..23f716bae 100755
--- a/app/src/docs/v1.api-spec.yaml
+++ b/app/src/docs/v1.api-spec.yaml
@@ -1271,10 +1271,9 @@ paths:
           content:
             application/json:
               schema:
-                allOf:
-                  - type: array
-                    items:
-                      $ref: "#/components/schemas/UserSubmission"
+                - type: array
+                  items:
+                    $ref: "#/components/schemas/UserSubmission"
         "403":
           $ref: "#/components/responses/Forbidden"
         default:
@@ -1509,7 +1508,7 @@ paths:
               items:
                 type: string
                 example: "SUBMISSION_UPDATE"
-              description: an array of the sumbission permissions to apply to this user. [] to remove.
+              description: an array of the sumbission permissions to apply to this user. Set an empty array to remove.
       responses:
         "200":
           description: "OK"
diff --git a/app/src/forms/rbac/service.js b/app/src/forms/rbac/service.js
index 8a990f03a..4c869eced 100644
--- a/app/src/forms/rbac/service.js
+++ b/app/src/forms/rbac/service.js
@@ -251,7 +251,13 @@ const service = {
       // create the batch and insert. So if permissions is empty it removes the user from the submission
       if (body.permissions !== []) {
         // add ids and save them
-        const items = body.permissions.map(perm => { return { id: uuidv4(), formSubmissionId: formSubmissionId, userId: userId, createdBy: currentUser.username, permission: perm }; });
+        const items = body.permissions.map(perm => ({
+          id: uuidv4(),
+          formSubmissionId: formSubmissionId,
+          userId: userId,
+          createdBy: currentUser.username,
+          permission: perm
+        }));
         await FormSubmissionUser.query(trx).insert(items);
       }
       await trx.commit();
diff --git a/app/tests/unit/forms/rbac/controller.spec.js b/app/tests/unit/forms/rbac/controller.spec.js
new file mode 100644
index 000000000..90481ae94
--- /dev/null
+++ b/app/tests/unit/forms/rbac/controller.spec.js
@@ -0,0 +1,34 @@
+const controller = require('../../../../src/forms/rbac/controller');
+const service = require('../../../../src/forms/rbac/service');
+
+describe('getSubmissionUsers', () => {
+  const req = {
+    query: { formSubmissionId: '1', userId: '2' },
+    body: { permissions: [] },
+    currentUser: {},
+    headers: { referer: 'a' },
+  };
+  it('should call the service with the query params', async () => {
+    service.getSubmissionUsers = jest.fn().mockReturnValue({ form: { id: '123' } });
+    await controller.getSubmissionUsers(req, {}, jest.fn());
+
+    expect(service.getSubmissionUsers).toHaveBeenCalledTimes(1);
+    expect(service.getSubmissionUsers).toHaveBeenCalledWith(req.query);
+  });
+});
+
+describe('setSubmissionUserPermissions', () => {
+  const req = {
+    query: { formSubmissionId: '1', userId: '2' },
+    body: { permissions: [1, 2, 3] },
+    currentUser: { me: 'I'},
+    headers: { referer: 'a' },
+  };
+  it('should call the service with the appropriate request stuff', async () => {
+    service.modifySubmissionUser = jest.fn().mockReturnValue({ form: { id: '123' } });
+    await controller.setSubmissionUserPermissions(req, {}, jest.fn());
+
+    expect(service.modifySubmissionUser).toHaveBeenCalledTimes(1);
+    expect(service.modifySubmissionUser).toHaveBeenCalledWith(req.query.formSubmissionId, req.query.userId, req.body, req.currentUser);
+  });
+});
diff --git a/app/tests/unit/routes/v1/rbac.spec.js b/app/tests/unit/routes/v1/rbac.spec.js
index acecdfdea..39717e44e 100644
--- a/app/tests/unit/routes/v1/rbac.spec.js
+++ b/app/tests/unit/routes/v1/rbac.spec.js
@@ -25,6 +25,12 @@ userAccess.hasFormPermissions = jest.fn(() => {
     next();
   });
 });
+userAccess.hasSubmissionPermissions = jest.fn(() => {
+  return jest.fn((req, res, next) => {
+    next();
+  });
+});
+
 
 //
 // we will mock the underlying data service calls...
@@ -282,3 +288,72 @@ describe(`PUT ${basePath}/users`, () => {
   });
 
 });
+
+
+describe(`GET ${basePath}/submissions`, () => {
+
+  it('should return 200', async () => {
+    // mock a success return value...
+    service.getSubmissionUsers = jest.fn().mockReturnValue([]);
+
+    const response = await request(app).get(`${basePath}/submissions`);
+
+    expect(response.statusCode).toBe(200);
+    expect(response.body).toBeTruthy();
+  });
+
+  it('should handle 401', async () => {
+    // mock an authentication/permission issue...
+    service.getSubmissionUsers = jest.fn(() => { throw new Problem(401); });
+
+    const response = await request(app).get(`${basePath}/submissions`);
+
+    expect(response.statusCode).toBe(401);
+    expect(response.body).toBeTruthy();
+  });
+
+  it('should handle 500', async () => {
+    // mock an unexpected error...
+    service.getSubmissionUsers = jest.fn(() => { throw new Error(); });
+
+    const response = await request(app).get(`${basePath}/submissions`);
+
+    expect(response.statusCode).toBe(500);
+    expect(response.body).toBeTruthy();
+  });
+
+});
+
+describe(`PUT ${basePath}/submissions`, () => {
+
+  it('should return 200', async () => {
+    // mock a success return value...
+    service.modifySubmissionUser = jest.fn().mockReturnValue([]);
+
+    const response = await request(app).put(`${basePath}/submissions`);
+
+    expect(response.statusCode).toBe(200);
+    expect(response.body).toBeTruthy();
+  });
+
+  it('should handle 401', async () => {
+    // mock an authentication/permission issue...
+    service.modifySubmissionUser = jest.fn(() => { throw new Problem(401); });
+
+    const response = await request(app).put(`${basePath}/submissions`);
+
+    expect(response.statusCode).toBe(401);
+    expect(response.body).toBeTruthy();
+  });
+
+  it('should handle 500', async () => {
+    // mock an unexpected error...
+    service.modifySubmissionUser = jest.fn(() => { throw new Error(); });
+
+    const response = await request(app).put(`${basePath}/submissions`);
+
+    expect(response.statusCode).toBe(500);
+    expect(response.body).toBeTruthy();
+  });
+
+});