633 allow survey answers to be multiselect (#639)

* 633 Backend: Allow survey answers to be multiselect

* fix CVE-2024-49761

backend/Gemfile

@@ -18,7 +18,7 @@ gem 'pundit'
 gem 'rack', '~> 2.0'
 gem 'rack-cors', '~> 2.0'
 gem 'rails', '~> 7.1.4'
-gem 'rexml', '>= 3.3.3'
+gem 'rexml', '>= 3.3.9'
 gem 'sendgrid-actionmailer'
 gem 'sprockets-rails'
 gem 'sucker_punch', '~> 3.0'

backend/Gemfile.lock

@@ -242,8 +242,7 @@ GEM
     responders (3.1.1)
       actionpack (>= 5.2)
       railties (>= 5.2)
-    rexml (3.3.6)
-      strscan
+    rexml (3.3.9)
     rspec-core (3.13.0)
       rspec-support (~> 3.13.0)
     rspec-expectations (3.13.1)
@@ -296,7 +295,6 @@ GEM
       activesupport (>= 6.1)
       sprockets (>= 3.0.0)
     stringio (3.1.1)
-    strscan (3.1.0)
     sucker_punch (3.2.0)
       concurrent-ruby (~> 1.0)
     syntax_suggest (2.0.0)
@@ -347,7 +345,7 @@ DEPENDENCIES
   rack (~> 2.0)
   rack-cors (~> 2.0)
   rails (~> 7.1.4)
-  rexml (>= 3.3.3)
+  rexml (>= 3.3.9)
   rspec-rails (~> 6.0.0)
   rubocop
   rubocop-rails

backend/app/controllers/survey_visits_controller.rb

@@ -73,7 +73,8 @@ def survey_visit_params
     params.require(:survey_visit)
           .permit(:surveyor_id, :home_id, :latitude, :longitude,
                   survey_response_attributes: [:survey_id,
-                                               { survey_answers_attributes: %i[survey_question_id answer] }])
+                                               { survey_answers_attributes: [:survey_question_id,
+                                                                             :answer, { answers: [] }] }])
   end
 
   def search_params

backend/app/views/survey_visits/_survey_visit.json.jbuilder

@@ -26,6 +26,7 @@ if survey_visit.survey_response.present?
       json.id sa.id
       json.survey_question_id sa.survey_question_id
       json.answer sa.answer
+      json.answers sa.answers
     end
   end
 end

backend/db/migrate/20241029235813_add_answers_to_survey_answers.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddAnswersToSurveyAnswers < ActiveRecord::Migration[7.1]
+  def change
+    add_column :survey_answers, :answers, :string, array: true, default: []
+  end
+end

backend/spec/requests/survey_visits_spec.rb

@@ -35,7 +35,8 @@
         survey_answers_attributes: [
           {
             survey_question_id: survey_question.id,
-            answer: 1
+            answer: 1,
+            answers: %w[Foo Bar]
           }
         ]
       }
@@ -88,6 +89,9 @@
         expect(survey_response).to be_present
         expect(survey_response.survey_id).to eq(survey.id)
         expect(survey_response.survey_answers.count).to eq(1)
+
+        survey_answer = survey_response.survey_answers.first
+        expect(survey_answer.answers).to include('Foo', 'Bar')
       end
 
       it 'redirects to the created survey_visit' do