refactor start form

app/controllers/start_form_controller.rb

@@ -8,13 +8,9 @@ class StartFormController < ApplicationController
 
   around_action :with_browser_locale, only: %i[show update completed]
   before_action :maybe_redirect_com, only: %i[show completed]
-  before_action :load_resubmit_submitter, only: :update
   before_action :load_template
   before_action :authorize_start!, only: :update
 
-  COOKIES_TTL = 12.hours
-  COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze
-
   def show
     if @template.preferences['require_phone_2fa'] || @template.preferences['require_email_2fa']
       raise ActionController::RoutingError, I18n.t('not_found')
@@ -23,7 +19,7 @@ class StartFormController < ApplicationController
     if @template.shared_link?
       @submitter = @template.submissions.new(account_id: @template.account_id)
                             .submitters.new(account_id: @template.account_id,
-                                            uuid: first_submitter_uuid(@template))
+                                            uuid: Submitters::StartForm.first_submitter_uuid(@template))
       render :email_verification if params[:email_verification]
     else
       Rollbar.warning("Not shared template: #{@template.id}") if defined?(Rollbar)
@@ -40,27 +36,28 @@ class StartFormController < ApplicationController
     if @submitter.completed_at?
       redirect_to start_form_completed_path(@template.slug, submitter_params.compact_blank)
     else
-      if filter_undefined_submitters(@template).size > 1 && @submitter.new_record?
+      if Templates.filter_undefined_submitters(@template.submitters).size > 1 && @submitter.new_record?
         @error_message = multiple_submitters_error_message
 
         return render :show, status: :unprocessable_content
       end
 
       if (is_new_record = @submitter.new_record?)
-        assign_submission_attributes(@submitter, @template)
+        Submitters::StartForm.assign_submission_attributes(
+          @submitter, @template, ip: request.remote_ip, user_agent: request.user_agent
+        )
 
         Submissions::AssignDefinedSubmitters.call(@submitter.submission)
       else
         @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent)
       end
 
-      if @template.preferences['shared_link_2fa'] == true ||
+      if require_link_2fa?(@submitter, is_new_record:)
-         (!is_new_record && @resubmit_submitter.blank? && !own_submitter?(@submitter))
         Rollbar.info("2FA requested: #{@submitter.id}") if !is_new_record && defined?(Rollbar)
 
         handle_require_2fa(@submitter, is_new_record:)
       elsif @submitter.errors.blank? && @submitter.save
-        enqueue_new_submitter_jobs(@submitter) if is_new_record
+        Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record
 
         redirect_to submit_form_path(@submitter.slug)
       else
@@ -90,45 +87,30 @@ class StartFormController < ApplicationController
 
   private
 
-  def enqueue_new_submitter_jobs(submitter)
+  def find_or_initialize_submitter(template, submitter_params)
-    WebhookUrls.enqueue_events(submitter.submission, 'submission.created')
+    submitter = Submitters::StartForm.find_or_initialize_submitter(
-
+      template, submitter_params, exclude_completed: params[:resubmit].present?,
-    SearchEntries.enqueue_reindex(submitter)
+                                  current_user:, ability: current_user && current_ability
-
+    )
-    expire_at = submitter.submission.expire_at
-
-    return unless expire_at
 
-    ProcessSubmissionExpiredJob.perform_at(expire_at, 'submission_id' => submitter.submission_id,
+    template.preferences.fetch('link_form_fields', ['email']).each do |key|
-                                                      'expire_at' => expire_at.to_i)
+      submitter.errors.add(key.to_sym, :blank) if submitter_params[key].blank?
     end
 
-  def load_resubmit_submitter
+    submitter
-    @resubmit_submitter =
-      if params[:resubmit].present? && !params[:resubmit].in?([true, 'true'])
-        submitter = Submitter.find_by(slug: params[:resubmit])
-
-        submitter if submitter && can_resubmit?(submitter)
-      end
   end
 
-  def own_submitter?(submitter)
+  def require_link_2fa?(submitter, is_new_record:)
-    current_user&.email == submitter.email && current_ability.can?(:read, submitter)
+    return true if @template.preferences['shared_link_2fa'] == true
-  end
 
-  def can_resubmit?(submitter)
+    !is_new_record && (current_user&.email != submitter.email || !current_ability.can?(:read, submitter))
-    submitter.completed_at? && submitter.completed_at > 14.days.ago &&
-      %w[api embed mcp].exclude?(submitter.submission.source) &&
-      submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false
   end
 
   def authorize_start!
     is_archived = @template.archived_at? || @template.account.archived_at?
 
-    return redirect_to submit_form_path(@resubmit_submitter.slug) if @resubmit_submitter && is_archived
     return redirect_to start_form_path(@template.slug) if is_archived
 
-    return if @resubmit_submitter
     return if @template.shared_link? || (current_user && current_ability.can?(:read, @template))
 
     Rollbar.warning("Not shared template: #{@template.id}") if defined?(Rollbar)
@@ -136,104 +118,14 @@ class StartFormController < ApplicationController
     redirect_to start_form_path(@template.slug)
   end
 
-  def find_or_initialize_submitter(template, submitter_params)
-    required_fields = template.preferences.fetch('link_form_fields', ['email'])
-
-    required_params = required_fields.index_with { |key| submitter_params[key] }
-
-    find_params = required_params.except('name')
-
-    submitter = Submitter.new if find_params.compact_blank.blank?
-
-    submitter ||= build_submitters_scope(template).find_or_initialize_by(find_params)
-
-    submitter = Submitter.new(find_params) if submitter.persisted? && submitter.email.blank?
-
-    submitter = Submitter.new(find_params) if submitter.submission&.completed_at? && submitter.viewer?
-
-    if !Docuseal.multitenant? && submitter.persisted? && !submitter.completed_at? &&
-       @resubmit_submitter.blank? && !own_submitter?(submitter) &&
-       template.preferences['shared_link_2fa'] != true && !Accounts.can_send_emails?(template.account)
-      submitter = Submitter.new(find_params)
-    end
-
-    submitter.name = required_params['name'] if submitter.new_record?
-
-    unless @resubmit_submitter
-      required_params.each do |key, value|
-        submitter.errors.add(key.to_sym, :blank) if value.blank?
-      end
-    end
-
-    submitter
-  end
-
-  def build_submitters_scope(template)
-    Submitter
-      .where(submission: template.submissions.non_expired.active)
-      .where(uuid: template.submitters.pluck('uuid'))
-      .order(id: :desc)
-      .where(declined_at: nil)
-      .where(external_id: nil)
-      .then { |rel| params[:resubmit].present? || params[:selfsign].present? ? rel.where(completed_at: nil) : rel }
-  end
-
-  def assign_submission_attributes(submitter, template)
-    submitter.assign_attributes(
-      uuid: first_submitter_uuid(template),
-      ip: request.remote_ip,
-      ua: request.user_agent,
-      values: @resubmit_submitter&.preferences&.fetch('default_values', nil) || {},
-      preferences: @resubmit_submitter&.preferences.presence || { 'send_email' => true },
-      metadata: @resubmit_submitter&.metadata.presence || {}
-    )
-
-    submitter.assign_attributes(@resubmit_submitter.slice(:name, :email, :phone)) if @resubmit_submitter
-
-    if submitter.values.present?
-      @resubmit_submitter.attachments.each do |attachment|
-        submitter.attachments << attachment.dup if submitter.values.value?(attachment.uuid)
-      end
-    end
-
-    submitter.submission ||= Submission.new(template:,
-                                            account_id: template.account_id,
-                                            template_submitters: template.submitters,
-                                            expire_at: Templates.build_default_expire_at(template),
-                                            submitters: [submitter],
-                                            source: :link)
-
-    Submissions::CreateFromSubmitters.maybe_set_dynamic_documents(submitter.submission)
-
-    submitter.account_id = submitter.submission.account_id
-
-    submitter
-  end
-
-  def filter_undefined_submitters(template)
-    Templates.filter_undefined_submitters(template.submitters)
-  end
-
-  def first_submitter_uuid(template)
-    (filter_undefined_submitters(template).first || template.submitters.first)['uuid']
-  end
-
   def submitter_params
-    return { 'email' => current_user.email, 'name' => current_user.full_name } if params[:selfsign]
-    return @resubmit_submitter.slice(:name, :phone, :email) if @resubmit_submitter.present?
-
     params.require(:submitter).permit(:email, :phone, :name).tap do |attrs|
       attrs[:email] = Submissions.normalize_email(attrs[:email])
     end
   end
 
   def load_template
-    @template =
+    @template = Template.find_by!(slug: params[:slug] || params[:start_form_slug])
-      if @resubmit_submitter
-        @resubmit_submitter.template
-      else
-        Template.find_by!(slug: params[:slug] || params[:start_form_slug])
-      end
   end
 
   def multiple_submitters_error_message
@@ -247,35 +139,20 @@ class StartFormController < ApplicationController
   def handle_require_2fa(submitter, is_new_record:)
     return render :show, status: :unprocessable_content if submitter.errors.present?
 
-    is_otp_verified = Submitters.verify_link_otp!(params[:one_time_code], submitter)
+    if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record:)
-
-    if cookies.encrypted[:email_2fa_slug] == submitter.slug || is_otp_verified
-      if submitter.save
-        enqueue_new_submitter_jobs(submitter) if is_new_record
-
-        if is_otp_verified
-          SubmissionEvents.create_with_tracking_data(submitter, 'email_verified', request)
-
-          cookies.encrypted[:email_2fa_slug] =
-            { value: submitter.slug, expires: COOKIES_TTL.from_now, **COOKIES_DEFAULTS }
-        end
-
       redirect_to submit_form_path(submitter.slug)
-      else
-        render :show, status: :unprocessable_content
-      end
     else
       Submitters.send_shared_link_email_verification_code(submitter, request:)
 
       render :email_verification
     end
+  rescue Submitters::StartForm::NotSaved
+    render :show, status: :unprocessable_content
   rescue Submitters::UnableToSendCode, Submitters::InvalidOtp => e
-    redirect_to start_form_path(submitter.submission.template.slug,
+    redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
-                                params: submitter_params.merge(email_verification: true)),
                 alert: e.message
   rescue RateLimit::LimitApproached
-    redirect_to start_form_path(submitter.submission.template.slug,
+    redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
-                                params: submitter_params.merge(email_verification: true)),
                 alert: I18n.t(:too_many_attempts)
   end
 end

app/controllers/start_form_email_2fa_send_controller.rb

@@ -53,13 +53,7 @@ class StartFormEmail2faSendController < ApplicationController
 
     return false if email.blank?
 
-    Submitter
+    Submitters::StartForm.build_submitters_scope(template, exclude_completed: true).exists?(email:)
-      .where(submission: template.submissions.non_expired.active)
-      .where(uuid: template.submitters.pluck('uuid'))
-      .where(declined_at: nil)
-      .where(external_id: nil)
-      .where(completed_at: nil)
-      .exists?(email:)
   end
 
   def submitter_params

app/controllers/start_form_resubmit_controller.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+class StartFormResubmitController < ApplicationController
+  layout 'form'
+
+  skip_before_action :authenticate_user!
+  skip_authorization_check
+
+  around_action :with_browser_locale
+  before_action :load_resubmit_submitter
+  before_action :load_template
+  before_action :authorize_start!
+
+  def update
+    @submitter = Submitters::StartForm.find_or_initialize_submitter(
+      @template, submitter_params, exclude_completed: true
+    )
+
+    if Templates.filter_undefined_submitters(@template.submitters).size > 1 && @submitter.new_record?
+      @error_message = multiple_submitters_error_message
+
+      return render 'start_form/show', status: :unprocessable_content
+    end
+
+    if (is_new_record = @submitter.new_record?)
+      Submitters::StartForm.assign_submission_attributes(
+        @submitter, @template,
+        ip: request.remote_ip, user_agent: request.user_agent, resubmit_submitter: @resubmit_submitter
+      )
+
+      Submissions::AssignDefinedSubmitters.call(@submitter.submission)
+    else
+      @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent)
+    end
+
+    if @template.preferences['shared_link_2fa'] == true
+      handle_require_2fa(@submitter, is_new_record:)
+    elsif @submitter.save
+      Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record
+
+      redirect_to submit_form_path(@submitter.slug)
+    else
+      render 'start_form/show', status: :unprocessable_content
+    end
+  end
+
+  private
+
+  def load_resubmit_submitter
+    @resubmit_submitter = Submitter.find_by(slug: params[:resubmit])
+
+    raise ActiveRecord::RecordNotFound if @resubmit_submitter.blank? ||
+                                          !Submitters::StartForm.can_resubmit?(@resubmit_submitter)
+  end
+
+  def load_template
+    @template = @resubmit_submitter.template
+  end
+
+  def authorize_start!
+    redirect_to submit_form_path(@resubmit_submitter.slug) if @template.archived_at? || @template.account.archived_at?
+  end
+
+  def submitter_params
+    @resubmit_submitter.slice(:name, :phone, :email)
+  end
+
+  def multiple_submitters_error_message
+    if current_user&.account_id == @template.account_id
+      helpers.t('this_submission_has_multiple_signers_which_prevents_the_use_of_a_sharing_link_html')
+    else
+      I18n.t('not_found')
+    end
+  end
+
+  def handle_require_2fa(submitter, is_new_record:)
+    if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record:)
+      redirect_to submit_form_path(submitter.slug)
+    else
+      Submitters.send_shared_link_email_verification_code(submitter, request:)
+
+      render 'start_form/email_verification'
+    end
+  rescue Submitters::StartForm::NotSaved
+    render 'start_form/show', status: :unprocessable_content
+  rescue Submitters::UnableToSendCode, Submitters::InvalidOtp => e
+    redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
+                alert: e.message
+  rescue RateLimit::LimitApproached
+    redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
+                alert: I18n.t(:too_many_attempts)
+  end
+end

app/controllers/start_form_self_controller.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+class StartFormSelfController < ApplicationController
+  load_resource :template, parent: false
+
+  around_action :with_browser_locale
+  before_action :authorize_start!
+
+  def update
+    @submitter = Submitters::StartForm.build_submitters_scope(@template, exclude_completed: true)
+                                      .find_or_initialize_by(email: current_user.email)
+
+    if (is_new_record = @submitter.new_record?)
+      @submitter.name = current_user.full_name
+
+      Submitters::StartForm.assign_submission_attributes(
+        @submitter, @template, ip: request.remote_ip, user_agent: request.user_agent
+      )
+
+      Submissions::AssignDefinedSubmitters.call(@submitter.submission)
+    else
+      @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent)
+    end
+
+    @submitter.save!
+
+    Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record
+
+    redirect_to submit_form_path(@submitter.slug)
+  end
+
+  private
+
+  def authorize_start!
+    authorize!(:read, @template)
+
+    redirect_to template_path(@template) if @template.archived_at?
+  end
+end

app/controllers/submit_form_email_2fas_controller.rb

@@ -8,9 +8,6 @@ class SubmitFormEmail2fasController < ApplicationController
 
   before_action :load_submitter
 
-  COOKIES_TTL = 12.hours
-  COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze
-
   def create
     RateLimit.call("verify-2fa-code-#{@submitter.id}", limit: 2, ttl: 45.seconds, enabled: true)
 
@@ -20,7 +17,8 @@ class SubmitFormEmail2fasController < ApplicationController
       SubmissionEvents.create_with_tracking_data(@submitter, 'email_verified', request, { email: @submitter.email })
 
       cookies.encrypted[:email_2fa_slug] =
-        { value: @submitter.slug, expires: COOKIES_TTL.from_now, **COOKIES_DEFAULTS }
+        { value: @submitter.slug, expires: Submitters::StartForm::COOKIES_TTL.from_now,
+          **Submitters::StartForm::COOKIES_DEFAULTS }
 
       redirect_to submit_form_path(@submitter.slug)
     else

app/javascript/template_builder/builder.vue

@@ -110,7 +110,7 @@
             data-turbo="false"
             class="inline"
             method="post"
-            :action="`/d/${template.slug}`"
+            :action="`/start_form_self/${template.id}`"
             @submit="maybeShowErrorTemplateAlert"
           >
             <input
@@ -125,12 +125,6 @@
               :value="authenticityToken"
               autocomplete="off"
             >
-            <input
-              type="hidden"
-              name="selfsign"
-              value="true"
-              autocomplete="off"
-            >
             <button
               class="btn btn-primary btn-ghost text-base hidden md:flex"
               type="submit"

app/views/start_form/completed.html.erb

@@ -2,7 +2,7 @@
   <div class="space-y-6 mx-auto">
     <div class="space-y-6">
       <div class="flex items-center justify-center">
-        <%= render 'banner' %>
+        <%= render 'start_form/banner' %>
       </div>
       <div class="flex items-center bg-base-200 rounded-xl p-4 mb-4">
         <div class="flex items-center">
@@ -26,7 +26,7 @@
         <%= button_to button_title(title: t('send_copy_to_email'), disabled_with: t('sending'), icon: svg_icon('mail_forward', class: 'w-6 h-6')), send_submission_email_index_path, params: { template_slug: @template.slug, email: params[:email] }, class: 'base-button w-full' %>
       </toggle-submit>
     <% end %>
-    <% if Templates.filter_undefined_submitters(@template.submitters).size == 1 && %w[api embed mcp].exclude?(@submitter.submission.source) && @submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false && @template.shared_link? %>
+    <% if @template.shared_link? && Templates.filter_undefined_submitters(@template.submitters).size == 1 && %w[api embed mcp].exclude?(@submitter.submission.source) && @submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false %>
       <toggle-submit class="block">
         <%= button_to button_title(title: t('resubmit'), disabled_with: t('resubmit'), icon: svg_icon('reload', class: 'w-6 h-6')), start_form_path(@template.slug), params: { submitter: params.permit(:name, :email, :phone).compact_blank, resubmit: true }, method: :put, class: 'white-button w-full' %>
       </toggle-submit>

app/views/start_form/email_verification.html.erb

@@ -23,7 +23,7 @@
     <div>
       <%= t('we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue') %>
     </div>
-    <%= form_for '', url: start_form_path(@template.slug), method: :put, html: { class: 'space-y-4', id: 'code_form' } do |f| %>
+    <%= form_for '', url: @resubmit_submitter ? resubmit_form_path : start_form_path(@template.slug), method: :put, html: { class: 'space-y-4', id: 'code_form' } do |f| %>
       <div dir="auto" class="form-control !mt-0">
         <%= f.hidden_field 'resubmit', value: params[:resubmit] %>
         <%= f.hidden_field 'submitter[name]', value: params[:name] || @submitter&.name %>

app/views/start_form/private.html.erb

@@ -4,7 +4,7 @@
 <% end %>
 <main class="max-w-md space-y-6 mx-auto px-2 mt-12 mb-4">
   <div class="text-center w-full space-y-6">
-    <%= render 'banner' %>
+    <%= render 'start_form/banner' %>
     <p class="text-xl font-semibold text-center">
       <%= t('share_link_is_currently_disabled') %>
     </p>

app/views/start_form/show.html.erb

@@ -6,7 +6,7 @@
   <div class="space-y-6 mx-auto">
     <div class="space-y-6">
       <div class="text-center w-full space-y-6">
-        <%= render 'banner' %>
+        <%= render 'start_form/banner' %>
         <% unless @template.archived_at? %>
           <p class="text-xl font-semibold text-center"><%= t('you_have_been_invited_to_submit_a_form') %></p>
         <% end %>

app/views/submit_form/completed.html.erb

@@ -44,7 +44,7 @@
       <% end %>
     </div>
     <% undefined_submitters = Templates.filter_undefined_submitters(@submitter.submission.template_submitters) %>
-    <% if undefined_submitters.size == 1 && undefined_submitters.first['uuid'] == @submitter.uuid && @submitter.completed_at? && @submitter.completed_at > 14.days.ago && %w[api embed mcp].exclude?(@submitter.submission.source) && @submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false && @submitter.template && !@submitter.template.archived_at? %>
+    <% if undefined_submitters.size == 1 && undefined_submitters.first['uuid'] == @submitter.uuid && Submitters::StartForm.can_resubmit?(@submitter) && @submitter.template && !@submitter.template.archived_at? %>
       <div class="divider uppercase"><%= t('or') %></div>
       <toggle-submit class="block">
         <%= button_to button_title(title: t('resubmit'), disabled_with: t('resubmit'), icon: svg_icon('reload', class: 'w-6 h-6')), resubmit_form_path, params: { resubmit: @submitter.slug }, method: :put, class: 'white-button w-full' %>

app/views/templates/show.html.erb

@@ -99,7 +99,7 @@
                 </open-modal-mobile>
               <% end %>
               <% if Templates.filter_undefined_submitters(@template.submitters).size == 1 && @template.variables_schema.blank? %>
-                <%= button_to start_form_path(@template.slug), params: { selfsign: true }, method: :put, class: 'white-button w-full', form: { style: 'display: inline', target: '_blank', data: { turbo: false } } do %>
+                <%= button_to start_form_self_path(@template), method: :put, class: 'white-button w-full', form: { style: 'display: inline', target: '_blank', data: { turbo: false } } do %>
                   <%= svg_icon('writing', class: 'w-6 h-6') %>
                   <span class="mr-1"><%= t('sign_it_yourself') %></span>
                 <% end %>

config/routes.rb

@@ -142,7 +142,8 @@ Rails.application.routes.draw do
     get :completed
   end
 
-  resource :resubmit_form, controller: 'start_form', only: :update
+  resource :resubmit_form, controller: 'start_form_resubmit', only: :update
+  resources :start_form_self, only: :update
   resource :submit_form_email_2fa, only: %i[create update]
   resources :start_form_email_2fa_send, only: :create
 

lib/submitters/start_form.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+module Submitters
+  module StartForm
+    COOKIES_TTL = 12.hours
+    RESUBMIT_TTL = 8.days
+    COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze
+
+    NotSaved = Class.new(StandardError)
+
+    module_function
+
+    def can_resubmit?(submitter)
+      submitter.completed_at? && submitter.completed_at > RESUBMIT_TTL.ago &&
+        %w[api embed mcp].exclude?(submitter.submission.source) &&
+        submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false
+    end
+
+    def can_reopen?(template, submitter, current_user:, ability:)
+      Docuseal.multitenant? || !submitter.persisted? || submitter.completed_at? ||
+        (current_user&.email == submitter.email && ability.can?(:read, submitter)) ||
+        template.preferences['shared_link_2fa'] == true || Accounts.can_send_emails?(template.account)
+    end
+
+    def find_or_initialize_submitter(template, submitter_params, exclude_completed:, current_user: nil, ability: nil)
+      required_fields = template.preferences.fetch('link_form_fields', ['email'])
+
+      required_params = required_fields.index_with { |key| submitter_params[key] }
+
+      find_params = required_params.except('name')
+
+      submitter = Submitter.new if find_params.compact_blank.blank?
+
+      submitter ||= build_submitters_scope(template, exclude_completed:).find_or_initialize_by(find_params)
+
+      submitter = Submitter.new(find_params) if submitter.persisted? && submitter.email.blank?
+
+      submitter = Submitter.new(find_params) if submitter.submission&.completed_at? && submitter.viewer?
+
+      submitter = Submitter.new(find_params) unless can_reopen?(template, submitter, current_user:, ability:)
+
+      submitter.name = required_params['name'] if submitter.new_record?
+
+      submitter
+    end
+
+    def build_submitters_scope(template, exclude_completed: false)
+      Submitter
+        .where(submission: template.submissions.non_expired.active)
+        .where(uuid: template.submitters.pluck('uuid').compact_blank)
+        .order(id: :desc)
+        .where(declined_at: nil)
+        .where(external_id: nil)
+        .then { |rel| exclude_completed ? rel.where(completed_at: nil) : rel }
+    end
+
+    def assign_submission_attributes(submitter, template, ip:, user_agent:, resubmit_submitter: nil)
+      submitter.assign_attributes(
+        uuid: first_submitter_uuid(template),
+        ip:,
+        ua: user_agent,
+        values: resubmit_submitter&.preferences&.fetch('default_values', nil) || {},
+        preferences: resubmit_submitter&.preferences.presence || { 'send_email' => true },
+        metadata: resubmit_submitter&.metadata.presence || {}
+      )
+
+      submitter.assign_attributes(resubmit_submitter.slice(:name, :email, :phone)) if resubmit_submitter
+
+      if submitter.values.present?
+        resubmit_submitter.attachments.each do |attachment|
+          submitter.attachments << attachment.dup if submitter.values.value?(attachment.uuid)
+        end
+      end
+
+      submitter.submission ||= Submission.new(template:,
+                                              account_id: template.account_id,
+                                              template_submitters: template.submitters,
+                                              expire_at: Templates.build_default_expire_at(template),
+                                              submitters: [submitter],
+                                              source: :link)
+
+      Submissions::CreateFromSubmitters.maybe_set_dynamic_documents(submitter.submission)
+
+      submitter.account_id = submitter.submission.account_id
+
+      submitter
+    end
+
+    def first_submitter_uuid(template)
+      (Templates.filter_undefined_submitters(template.submitters).first || template.submitters.first)['uuid']
+    end
+
+    def verify_2fa_and_save_submitter(submitter, request, is_new_record:)
+      is_otp_verified = Submitters.verify_link_otp!(request.params[:one_time_code], submitter)
+
+      return false if !is_otp_verified && request.cookie_jar.encrypted[:email_2fa_slug] != submitter.slug
+
+      raise NotSaved unless submitter.save
+
+      enqueue_new_submitter_jobs(submitter) if is_new_record
+
+      if is_otp_verified
+        SubmissionEvents.create_with_tracking_data(submitter, 'email_verified', request)
+
+        request.cookie_jar.encrypted[:email_2fa_slug] =
+          { value: submitter.slug, expires: COOKIES_TTL.from_now, **COOKIES_DEFAULTS }
+      end
+
+      true
+    end
+
+    def enqueue_new_submitter_jobs(submitter)
+      WebhookUrls.enqueue_events(submitter.submission, 'submission.created')
+
+      SearchEntries.enqueue_reindex(submitter)
+
+      expire_at = submitter.submission.expire_at
+
+      return unless expire_at
+
+      ProcessSubmissionExpiredJob.perform_at(expire_at, 'submission_id' => submitter.submission_id,
+                                                        'expire_at' => expire_at.to_i)
+    end
+  end
+end