mirror of https://github.com/docusealco/docuseal
Pete Matsyburka
1 month ago
parent
807463c465
commit
0480572ef5
@ -0,0 +1,93 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class StartFormResubmitController < ApplicationController
|
||||
layout 'form'
|
||||
|
||||
skip_before_action :authenticate_user!
|
||||
skip_authorization_check
|
||||
|
||||
around_action :with_browser_locale
|
||||
before_action :load_resubmit_submitter
|
||||
before_action :load_template
|
||||
before_action :authorize_start!
|
||||
|
||||
def update
|
||||
@submitter = Submitters::StartForm.find_or_initialize_submitter(
|
||||
@template, submitter_params, exclude_completed: true
|
||||
)
|
||||
|
||||
if Templates.filter_undefined_submitters(@template.submitters).size > 1 && @submitter.new_record?
|
||||
@error_message = multiple_submitters_error_message
|
||||
|
||||
return render 'start_form/show', status: :unprocessable_content
|
||||
end
|
||||
|
||||
if (is_new_record = @submitter.new_record?)
|
||||
Submitters::StartForm.assign_submission_attributes(
|
||||
@submitter, @template,
|
||||
ip: request.remote_ip, user_agent: request.user_agent, resubmit_submitter: @resubmit_submitter
|
||||
)
|
||||
|
||||
Submissions::AssignDefinedSubmitters.call(@submitter.submission)
|
||||
else
|
||||
@submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent)
|
||||
end
|
||||
|
||||
if @template.preferences['shared_link_2fa'] == true
|
||||
handle_require_2fa(@submitter, is_new_record:)
|
||||
elsif @submitter.save
|
||||
Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record
|
||||
|
||||
redirect_to submit_form_path(@submitter.slug)
|
||||
else
|
||||
render 'start_form/show', status: :unprocessable_content
|
||||
end
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def load_resubmit_submitter
|
||||
@resubmit_submitter = Submitter.find_by(slug: params[:resubmit])
|
||||
|
||||
raise ActiveRecord::RecordNotFound if @resubmit_submitter.blank? ||
|
||||
!Submitters::StartForm.can_resubmit?(@resubmit_submitter)
|
||||
end
|
||||
|
||||
def load_template
|
||||
@template = @resubmit_submitter.template
|
||||
end
|
||||
|
||||
def authorize_start!
|
||||
redirect_to submit_form_path(@resubmit_submitter.slug) if @template.archived_at? || @template.account.archived_at?
|
||||
end
|
||||
|
||||
def submitter_params
|
||||
@resubmit_submitter.slice(:name, :phone, :email)
|
||||
end
|
||||
|
||||
def multiple_submitters_error_message
|
||||
if current_user&.account_id == @template.account_id
|
||||
helpers.t('this_submission_has_multiple_signers_which_prevents_the_use_of_a_sharing_link_html')
|
||||
else
|
||||
I18n.t('not_found')
|
||||
end
|
||||
end
|
||||
|
||||
def handle_require_2fa(submitter, is_new_record:)
|
||||
if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record:)
|
||||
redirect_to submit_form_path(submitter.slug)
|
||||
else
|
||||
Submitters.send_shared_link_email_verification_code(submitter, request:)
|
||||
|
||||
render 'start_form/email_verification'
|
||||
end
|
||||
rescue Submitters::StartForm::NotSaved
|
||||
render 'start_form/show', status: :unprocessable_content
|
||||
rescue Submitters::UnableToSendCode, Submitters::InvalidOtp => e
|
||||
redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
|
||||
alert: e.message
|
||||
rescue RateLimit::LimitApproached
|
||||
redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
|
||||
alert: I18n.t(:too_many_attempts)
|
||||
end
|
||||
end
|
||||
@ -0,0 +1,39 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class StartFormSelfController < ApplicationController
|
||||
load_resource :template, parent: false
|
||||
|
||||
around_action :with_browser_locale
|
||||
before_action :authorize_start!
|
||||
|
||||
def update
|
||||
@submitter = Submitters::StartForm.build_submitters_scope(@template, exclude_completed: true)
|
||||
.find_or_initialize_by(email: current_user.email)
|
||||
|
||||
if (is_new_record = @submitter.new_record?)
|
||||
@submitter.name = current_user.full_name
|
||||
|
||||
Submitters::StartForm.assign_submission_attributes(
|
||||
@submitter, @template, ip: request.remote_ip, user_agent: request.user_agent
|
||||
)
|
||||
|
||||
Submissions::AssignDefinedSubmitters.call(@submitter.submission)
|
||||
else
|
||||
@submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent)
|
||||
end
|
||||
|
||||
@submitter.save!
|
||||
|
||||
Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record
|
||||
|
||||
redirect_to submit_form_path(@submitter.slug)
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def authorize_start!
|
||||
authorize!(:read, @template)
|
||||
|
||||
redirect_to template_path(@template) if @template.archived_at?
|
||||
end
|
||||
end
|
||||
@ -0,0 +1,125 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
module Submitters
|
||||
module StartForm
|
||||
COOKIES_TTL = 12.hours
|
||||
RESUBMIT_TTL = 8.days
|
||||
COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze
|
||||
|
||||
NotSaved = Class.new(StandardError)
|
||||
|
||||
module_function
|
||||
|
||||
def can_resubmit?(submitter)
|
||||
submitter.completed_at? && submitter.completed_at > RESUBMIT_TTL.ago &&
|
||||
%w[api embed mcp].exclude?(submitter.submission.source) &&
|
||||
submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false
|
||||
end
|
||||
|
||||
def can_reopen?(template, submitter, current_user:, ability:)
|
||||
Docuseal.multitenant? || !submitter.persisted? || submitter.completed_at? ||
|
||||
(current_user&.email == submitter.email && ability.can?(:read, submitter)) ||
|
||||
template.preferences['shared_link_2fa'] == true || Accounts.can_send_emails?(template.account)
|
||||
end
|
||||
|
||||
def find_or_initialize_submitter(template, submitter_params, exclude_completed:, current_user: nil, ability: nil)
|
||||
required_fields = template.preferences.fetch('link_form_fields', ['email'])
|
||||
|
||||
required_params = required_fields.index_with { |key| submitter_params[key] }
|
||||
|
||||
find_params = required_params.except('name')
|
||||
|
||||
submitter = Submitter.new if find_params.compact_blank.blank?
|
||||
|
||||
submitter ||= build_submitters_scope(template, exclude_completed:).find_or_initialize_by(find_params)
|
||||
|
||||
submitter = Submitter.new(find_params) if submitter.persisted? && submitter.email.blank?
|
||||
|
||||
submitter = Submitter.new(find_params) if submitter.submission&.completed_at? && submitter.viewer?
|
||||
|
||||
submitter = Submitter.new(find_params) unless can_reopen?(template, submitter, current_user:, ability:)
|
||||
|
||||
submitter.name = required_params['name'] if submitter.new_record?
|
||||
|
||||
submitter
|
||||
end
|
||||
|
||||
def build_submitters_scope(template, exclude_completed: false)
|
||||
Submitter
|
||||
.where(submission: template.submissions.non_expired.active)
|
||||
.where(uuid: template.submitters.pluck('uuid').compact_blank)
|
||||
.order(id: :desc)
|
||||
.where(declined_at: nil)
|
||||
.where(external_id: nil)
|
||||
.then { |rel| exclude_completed ? rel.where(completed_at: nil) : rel }
|
||||
end
|
||||
|
||||
def assign_submission_attributes(submitter, template, ip:, user_agent:, resubmit_submitter: nil)
|
||||
submitter.assign_attributes(
|
||||
uuid: first_submitter_uuid(template),
|
||||
ip:,
|
||||
ua: user_agent,
|
||||
values: resubmit_submitter&.preferences&.fetch('default_values', nil) || {},
|
||||
preferences: resubmit_submitter&.preferences.presence || { 'send_email' => true },
|
||||
metadata: resubmit_submitter&.metadata.presence || {}
|
||||
)
|
||||
|
||||
submitter.assign_attributes(resubmit_submitter.slice(:name, :email, :phone)) if resubmit_submitter
|
||||
|
||||
if submitter.values.present?
|
||||
resubmit_submitter.attachments.each do |attachment|
|
||||
submitter.attachments << attachment.dup if submitter.values.value?(attachment.uuid)
|
||||
end
|
||||
end
|
||||
|
||||
submitter.submission ||= Submission.new(template:,
|
||||
account_id: template.account_id,
|
||||
template_submitters: template.submitters,
|
||||
expire_at: Templates.build_default_expire_at(template),
|
||||
submitters: [submitter],
|
||||
source: :link)
|
||||
|
||||
Submissions::CreateFromSubmitters.maybe_set_dynamic_documents(submitter.submission)
|
||||
|
||||
submitter.account_id = submitter.submission.account_id
|
||||
|
||||
submitter
|
||||
end
|
||||
|
||||
def first_submitter_uuid(template)
|
||||
(Templates.filter_undefined_submitters(template.submitters).first || template.submitters.first)['uuid']
|
||||
end
|
||||
|
||||
def verify_2fa_and_save_submitter(submitter, request, is_new_record:)
|
||||
is_otp_verified = Submitters.verify_link_otp!(request.params[:one_time_code], submitter)
|
||||
|
||||
return false if !is_otp_verified && request.cookie_jar.encrypted[:email_2fa_slug] != submitter.slug
|
||||
|
||||
raise NotSaved unless submitter.save
|
||||
|
||||
enqueue_new_submitter_jobs(submitter) if is_new_record
|
||||
|
||||
if is_otp_verified
|
||||
SubmissionEvents.create_with_tracking_data(submitter, 'email_verified', request)
|
||||
|
||||
request.cookie_jar.encrypted[:email_2fa_slug] =
|
||||
{ value: submitter.slug, expires: COOKIES_TTL.from_now, **COOKIES_DEFAULTS }
|
||||
end
|
||||
|
||||
true
|
||||
end
|
||||
|
||||
def enqueue_new_submitter_jobs(submitter)
|
||||
WebhookUrls.enqueue_events(submitter.submission, 'submission.created')
|
||||
|
||||
SearchEntries.enqueue_reindex(submitter)
|
||||
|
||||
expire_at = submitter.submission.expire_at
|
||||
|
||||
return unless expire_at
|
||||
|
||||
ProcessSubmissionExpiredJob.perform_at(expire_at, 'submission_id' => submitter.submission_id,
|
||||
'expire_at' => expire_at.to_i)
|
||||
end
|
||||
end
|
||||
end
|
||||
Loading…
Reference in new issue