fix(fb,ff): harden form service security and proxy user-service token server-side

[seberatolmez]

What does this PR do?

Fixes multiple security vulnerabilities in the form service (backend + frontend):

1. Protects submission read endpoints — GET /submissions/{id} and GET /submissions/by-form/{form_id} now require X-API-Token authentication. Previously anyone could enumerate and read all submission data (PII: emails, names, answers) without any auth.

2. Moves user-service token server-side — The frontend was embedding VITE_USER_SERVICE_TOKEN in the JS bundle, making it extractable by anyone. A new proxy router (/users/*) on the form backend forwards these requests to the user service with the token held server-side only. Frontend no longer ships any service token.

3. Protects form list endpoint — GET /forms/ (list all) now requires admin auth. GET /forms/{id} remains public for respondents.

4. Disables OpenAPI docs in production — /docs, /redoc, /openapi.json are now None when ENV != "development".

5. Hardens token comparison — Switched to hmac.compare_digest to prevent timing side-channel attacks.

6. Tightens CORS — Restricted allow_methods and allow_headers from ["*"] to only the methods/headers actually used.

7. Sanitizes error messages — detail=str(e) replaced with generic messages to avoid leaking internal state.

8. Form submission UX Improvements : after successfull submition, show full success screeen rather than a alert

New files

• services/form/app/clients/__init__.py
• services/form/app/clients/user_client.py — lazy-initialized httpx async client for user-service proxy
• services/form/app/routers/users.py — proxy router forwarding /users/* to user service

Modified files

• services/form/app/routers/submissions.py — auth on GETs, sanitized error
• services/form/app/routers/forms.py — auth on list, sanitized error
• services/form/app/main.py — register user router, disable prod docs, tighten CORS
• services/form/app/config.py — added USER_SERVICE_URL, USER_SERVICE_TOKEN
• services/form/app/auth/api_key.py — hmac.compare_digest
• services/form/pyproject.toml — added httpx runtime dependency
• services/form/.env.example — documented new env vars
• services/form/.env.prod.example — documented new env vars + missing ADMIN_API_TOKEN
• frontend/form/src/services/formService.ts — listForms, getSubmissionsByForm use authenticatedRequest
• frontend/form/src/services/userService.ts — points to form service proxy, no token
• frontend/form/.env.example — removed VITE_USER_SERVICE_*
• frontend/form/.env.prod.example — removed VITE_USER_SERVICE_*

Deployment checklist

• Set USER_SERVICE_URL env var on form service production instance
• Set USER_SERVICE_TOKEN env var (must match FORM_FRONTEND_TOKEN on user service)
• Run uv sync on form service to install httpx
• Remove VITE_USER_SERVICE_URL and VITE_USER_SERVICE_TOKEN from Vercel frontend env vars
• Rebuild and redeploy frontend on Vercel
• After verifying, rotate old FORM_FRONTEND_TOKEN (was exposed in browser bundle)

Checklist

• Code follows project conventions
• I tested my changes locally
• Linting passes (Ruff + Biome)
• I updated/added tests for my changes
• I added @seberatolmez or @DogukanUrker as reviewers

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gdg-yu-form-service	Ready	Preview, Comment	Mar 30, 2026 1:31pm
gdg-yu-forms	Ready	Preview, Comment	Mar 30, 2026 1:31pm
gdg-yu-user-service	Ready	Preview, Comment	Mar 30, 2026 1:31pm