BAH-4865: Include form privileges in exported form JSON

[rishitoshr]

Summary

• Fetch form privileges via getFormPrivilegesFromUuid when exporting a form and embed them in the exported form JSON's formJson.privileges field.
• Add getFormPrivilegesFromUuidUrl to UrlHelper.
• Fix getFormPrivilegesFromUuid API call to parse JSON response instead of forcing 'text'.

Test plan

• yarn test passes locally (412/412 tests, 0 lint errors)
• Updated FormList.spec.js to assert the privileges endpoint is called and that the exported JSON includes the fetched privileges

🤖 Generated with Claude Code

[rishitoshr]

Claude Describtion : -

PR Description

JIRA: BAH-4865

What Changed

• FormList.downloadFile(): now fetches privileges via the existing getFormPrivilegesFromUuid() API and merges them into formJson.privileges before the file is downloaded.
• UrlHelper.js: added the missing getFormPrivilegesFromUuidUrl() method — formPrivilegesApi.getFormPrivilegesFromUuid() was calling a method that didn't exist and would have thrown if invoked; it was previously dead code.
• formPrivilegesApi.js: removed an incorrect 'text' response-type argument from getFormPrivilegesFromUuid() so the JSON privileges array is parsed correctly rather than embedded as a raw string.
• FormList.spec.js: extended the export test to cover the third (privileges) call and assert the actual downloaded content.

Why
The per-row "Export Form" icon builds its downloaded JSON entirely client-side from two REST calls (form + translations) and never fetched privileges. Fixing this required also fixing two pre-existing, previously-dormant bugs in the privilege-fetching helper it now depends on (see the Deviations section above and the linked discovery doc for full traceability).

How Tested

• Unit tests added/updated
• All tests passing (412/412, karma start under Node 12.x); lint clean on changed files
• Manual testing performed — recommended against a live instance as a final check

Acceptance Criteria Met

• Per-row Export Form download includes the form's privileges

[hamsavarthiniR-Bahmni]

Review for BAH-4865

Clean, well-targeted fix — endpoint scoping, response-shape assumptions, and the 'text'→JSON blast radius all checked out on independent trace, and the updated test asserts on the actual serialized payload rather than just that an API was called.

Found 1 suggestion and 3 nits inline, plus 2 items below that touch files/lines outside this diff.

Acceptance Criteria: Export now correctly includes form privileges, scoped to the right version, verified by test. Round-trip (export → re-import) does not currently restore privileges — see below.

Issues not in diff

File:Line	Type	Issue
src/form-builder/components/FormBuilder.jsx:237	suggestion	validateFormJsonAndConcepts destructures the exact { formJson, translations } shape this PR's export now produces, but never reads formJson.privileges — traced saveFormPrivileges usage and it's only called from the manual "Manage Privileges" UI, never from the import pipeline. A form exported with this PR, then re-imported, silently loses its privileges. May be intentionally export-only scope for this ticket — worth confirming/disclosing either way.
src/common/apis/formPrivilegesApi.js:17-19	question	Sibling getFormPrivileges still forces 'text' on what looks like the same class of JSON endpoint that getFormPrivilegesFromUuid below it was just fixed for. Out of scope for this PR, but might be worth a follow-up ticket since it's the identical defect in the same file.

[hamsavarthiniR-Bahmni]

nit: Translations and privileges are independent of each other (both only need form.uuid/formJson), so this could be a Promise.all([translationsPromise, privilegesPromise]) instead of a third nested .then()/.catch() level — Promise.all for combining independent calls is already established elsewhere in this directory (FormTranslationsContainer.jsx:102, several spots in FormBuilder.jsx/FormBuilderContainer.jsx). Would also collapse the now-tripled identical catch(() => this.setMessage('Export Failed', ...)) block down to two copies.

[hamsavarthiniR-Bahmni]

nit: No test currently simulates a rejected getFormPrivilegesFromUuid call (with form/translations succeeding) to verify this catch fires 'Export Failed' and skips fileDownload. Worth an isolated test case for this new failure path.

[hamsavarthiniR-Bahmni]

nit: FormPrivilegesPreviewGrid.jsx:50 already builds this identical URL string inline (${formBuilderConstants.getFormPrivilegesFromUuidUrl}?formUuid=${formUuid}). Could point that file at this new method (or at getFormPrivilegesFromUuid from the api layer) instead of leaving two copies of the same URL-building logic. Not blocking — low-cost follow-up.

Also, minor readability note: this method's name is one word away from the pre-existing getFormPrivilegesUuidUrl right above it, which actually returns the form endpoint (getFormFromUuid), not privileges — predates this PR, but worth a naming cleanup follow-up given they now sit side by side.

[rishitoshr]

Done with First comment.
For second one, actually previous function name getFormPrivilegesUuidUrl is not appropiate. We can take seperate tech debt task to correct it.