diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 592c006d..12bc306f 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -30,7 +30,7 @@ class ApplicationController < ActionController::Base rescue_from RateLimit::LimitApproached do |e| Rollbar.error(e) if defined?(Rollbar) - redirect_to request.referer, alert: 'Too many requests', status: :too_many_requests + redirect_back_or_to root_path, alert: 'Too many requests' end if Rails.env.production? || Rails.env.test? diff --git a/app/controllers/start_form_controller.rb b/app/controllers/start_form_controller.rb index accf6798..a5b6fce1 100644 --- a/app/controllers/start_form_controller.rb +++ b/app/controllers/start_form_controller.rb @@ -8,13 +8,9 @@ class StartFormController < ApplicationController around_action :with_browser_locale, only: %i[show update completed] before_action :maybe_redirect_com, only: %i[show completed] - before_action :load_resubmit_submitter, only: :update before_action :load_template before_action :authorize_start!, only: :update - COOKIES_TTL = 12.hours - COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze - def show if @template.preferences['require_phone_2fa'] || @template.preferences['require_email_2fa'] raise ActionController::RoutingError, I18n.t('not_found') @@ -23,8 +19,7 @@ class StartFormController < ApplicationController if @template.shared_link? @submitter = @template.submissions.new(account_id: @template.account_id) .submitters.new(account_id: @template.account_id, - uuid: (filter_undefined_submitters(@template).first || - @template.submitters.first)['uuid']) + uuid: Submitters::StartForm.first_submitter_uuid(@template)) render :email_verification if params[:email_verification] else Rollbar.warning("Not shared template: #{@template.id}") if defined?(Rollbar) @@ -41,24 +36,28 @@ class StartFormController < ApplicationController if @submitter.completed_at? redirect_to start_form_completed_path(@template.slug, submitter_params.compact_blank) else - if filter_undefined_submitters(@template).size > 1 && @submitter.new_record? + if Templates.filter_undefined_submitters(@template.submitters).size > 1 && @submitter.new_record? @error_message = multiple_submitters_error_message return render :show, status: :unprocessable_content end if (is_new_record = @submitter.new_record?) - assign_submission_attributes(@submitter, @template) + Submitters::StartForm.assign_submission_attributes( + @submitter, @template, ip: request.remote_ip, user_agent: request.user_agent + ) Submissions::AssignDefinedSubmitters.call(@submitter.submission) else @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent) end - if @template.preferences['shared_link_2fa'] == true - handle_require_2fa(@submitter, is_new_record:) + if require_link_2fa?(@template, @submitter) + handle_require_2fa(@template, @submitter) elsif @submitter.errors.blank? && @submitter.save - enqueue_new_submitter_jobs(@submitter) if is_new_record + Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record + + Submitters::StartForm.assign_start_form_cookie(@submitter, request) redirect_to submit_form_path(@submitter.slug) else @@ -88,41 +87,40 @@ class StartFormController < ApplicationController private - def enqueue_new_submitter_jobs(submitter) - WebhookUrls.enqueue_events(submitter.submission, 'submission.created') + def find_or_initialize_submitter(template, submitter_params) + required_fields = template.preferences.fetch('link_form_fields', ['email']) - SearchEntries.enqueue_reindex(submitter) + blank_fields = required_fields.select { |key| submitter_params[key].blank? } - expire_at = submitter.submission.expire_at + submitter = + if blank_fields.present? + Submitter.new(submitter_params) + else + Submitters::StartForm.find_or_initialize_submitter( + template, submitter_params, exclude_completed: params[:resubmit].present?, + request:, current_user: + ) + end - return unless expire_at + blank_fields.each { |key| submitter.errors.add(key.to_sym, :blank) } - ProcessSubmissionExpiredJob.perform_at(expire_at, 'submission_id' => submitter.submission_id, - 'expire_at' => expire_at.to_i) + submitter end - def load_resubmit_submitter - @resubmit_submitter = - if params[:resubmit].present? && !params[:resubmit].in?([true, 'true']) - submitter = Submitter.find_by(slug: params[:resubmit]) + def require_link_2fa?(template, submitter) + return true if template.preferences['shared_link_2fa'] == true + return false if cookies.encrypted[:start_form_slug] == submitter.slug + return false if current_user && submitter.email == current_user.email && + current_user.account_id == submitter.account_id - submitter if submitter && can_resubmit?(submitter) - end - end - - def can_resubmit?(submitter) - submitter.completed_at? && submitter.completed_at > 14.days.ago && - %w[api embed mcp].exclude?(submitter.submission.source) && - submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false + !submitter.new_record? end def authorize_start! is_archived = @template.archived_at? || @template.account.archived_at? - return redirect_to submit_form_path(@resubmit_submitter.slug) if @resubmit_submitter && is_archived return redirect_to start_form_path(@template.slug) if is_archived - return if @resubmit_submitter return if @template.shared_link? || (current_user && current_ability.can?(:read, @template)) Rollbar.warning("Not shared template: #{@template.id}") if defined?(Rollbar) @@ -130,90 +128,14 @@ class StartFormController < ApplicationController redirect_to start_form_path(@template.slug) end - def find_or_initialize_submitter(template, submitter_params) - required_fields = template.preferences.fetch('link_form_fields', ['email']) - - required_params = required_fields.index_with { |key| submitter_params[key] } - - find_params = required_params.except('name') - - submitter = Submitter.new if find_params.compact_blank.blank? - - submitter ||= - Submitter - .where(submission: template.submissions.non_expired.active) - .order(id: :desc) - .where(declined_at: nil) - .where(external_id: nil) - .where(template.preferences['shared_link_2fa'] == true ? {} : { ip: [nil, request.remote_ip] }) - .then { |rel| params[:resubmit].present? || params[:selfsign].present? ? rel.where(completed_at: nil) : rel } - .find_or_initialize_by(find_params) - - submitter = Submitter.new(find_params) if submitter.submission&.completed_at? && submitter.viewer? - - submitter.name = required_params['name'] if submitter.new_record? - - unless @resubmit_submitter - required_params.each do |key, value| - submitter.errors.add(key.to_sym, :blank) if value.blank? - end - end - - submitter - end - - def assign_submission_attributes(submitter, template) - submitter.assign_attributes( - uuid: (filter_undefined_submitters(template).first || @template.submitters.first)['uuid'], - ip: request.remote_ip, - ua: request.user_agent, - values: @resubmit_submitter&.preferences&.fetch('default_values', nil) || {}, - preferences: @resubmit_submitter&.preferences.presence || { 'send_email' => true }, - metadata: @resubmit_submitter&.metadata.presence || {} - ) - - submitter.assign_attributes(@resubmit_submitter.slice(:name, :email, :phone)) if @resubmit_submitter - - if submitter.values.present? - @resubmit_submitter.attachments.each do |attachment| - submitter.attachments << attachment.dup if submitter.values.value?(attachment.uuid) - end - end - - submitter.submission ||= Submission.new(template:, - account_id: template.account_id, - template_submitters: template.submitters, - expire_at: Templates.build_default_expire_at(template), - submitters: [submitter], - source: :link) - - Submissions::CreateFromSubmitters.maybe_set_dynamic_documents(submitter.submission) - - submitter.account_id = submitter.submission.account_id - - submitter - end - - def filter_undefined_submitters(template) - Templates.filter_undefined_submitters(template.submitters) - end - def submitter_params - return { 'email' => current_user.email, 'name' => current_user.full_name } if params[:selfsign] - return @resubmit_submitter.slice(:name, :phone, :email) if @resubmit_submitter.present? - params.require(:submitter).permit(:email, :phone, :name).tap do |attrs| attrs[:email] = Submissions.normalize_email(attrs[:email]) end end def load_template - @template = - if @resubmit_submitter - @resubmit_submitter.template - else - Template.find_by!(slug: params[:slug] || params[:start_form_slug]) - end + @template = Template.find_by!(slug: params[:slug] || params[:start_form_slug]) end def multiple_submitters_error_message @@ -224,38 +146,27 @@ class StartFormController < ApplicationController end end - def handle_require_2fa(submitter, is_new_record:) + def handle_require_2fa(template, submitter) return render :show, status: :unprocessable_content if submitter.errors.present? - is_otp_verified = Submitters.verify_link_otp!(params[:one_time_code], submitter) - - if cookies.encrypted[:email_2fa_slug] == submitter.slug || is_otp_verified - if submitter.save - enqueue_new_submitter_jobs(submitter) if is_new_record - - if is_otp_verified - SubmissionEvents.create_with_tracking_data(submitter, 'email_verified', request) - - cookies.encrypted[:email_2fa_slug] = - { value: submitter.slug, expires: COOKIES_TTL.from_now, **COOKIES_DEFAULTS } - end - - redirect_to submit_form_path(submitter.slug) - else - render :show, status: :unprocessable_content - end + if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record: submitter.new_record?) + redirect_to submit_form_path(submitter.slug) else + if defined?(Rollbar) && template.preferences['shared_link_2fa'] != true + Rollbar.info("2FA link requested: #{submitter.id}") + end + Submitters.send_shared_link_email_verification_code(submitter, request:) render :email_verification end + rescue Submitters::StartForm::NotSaved + render :show, status: :unprocessable_content rescue Submitters::UnableToSendCode, Submitters::InvalidOtp => e - redirect_to start_form_path(submitter.submission.template.slug, - params: submitter_params.merge(email_verification: true)), + redirect_to start_form_path(template.slug, params: submitter_params.merge(email_verification: true)), alert: e.message rescue RateLimit::LimitApproached - redirect_to start_form_path(submitter.submission.template.slug, - params: submitter_params.merge(email_verification: true)), + redirect_to start_form_path(template.slug, params: submitter_params.merge(email_verification: true)), alert: I18n.t(:too_many_attempts) end end diff --git a/app/controllers/start_form_email_2fa_send_controller.rb b/app/controllers/start_form_email_2fa_send_controller.rb index eb20dfc7..07dd18c4 100644 --- a/app/controllers/start_form_email_2fa_send_controller.rb +++ b/app/controllers/start_form_email_2fa_send_controller.rb @@ -13,6 +13,10 @@ class StartFormEmail2faSendController < ApplicationController @submitter = @template.submissions.new(account_id: @template.account_id) .submitters.new(**submitter_params, account_id: @template.account_id) + if @submitter.email.blank? + return redirect_to start_form_path(@template.slug), alert: I18n.t(:provide_your_email_to_start) + end + Submitters.send_shared_link_email_verification_code(@submitter, request:) redir_params = { notice: I18n.t(:code_has_been_resent) } if params[:resend] @@ -36,14 +40,24 @@ class StartFormEmail2faSendController < ApplicationController return redirect_to start_form_path(@template.slug) if is_archived return if (@template.shared_link? || (current_user && current_ability.can?(:read, @template))) && - @template.preferences['shared_link_2fa'] == true + (@template.preferences['shared_link_2fa'] == true || submitter_exists?(@template, params)) - Rollbar.warning("Not shared template: #{@template.id}") if defined?(Rollbar) + Rollbar.warning("Not 2FA shared template: #{@template.id}") if defined?(Rollbar) redirect_to start_form_path(@template.slug) end + def submitter_exists?(template, params) + email = Submissions.normalize_email(params.dig(:submitter, :email)) + + return false if email.blank? + + Submitters::StartForm.build_submitters_scope(template, exclude_completed: true).exists?(email:) + end + def submitter_params - params.require(:submitter).permit(:name, :email, :phone) + params.require(:submitter).permit(:name, :email, :phone).tap do |attrs| + attrs[:email] = Submissions.normalize_email(attrs[:email]) + end end end diff --git a/app/controllers/start_form_resubmit_controller.rb b/app/controllers/start_form_resubmit_controller.rb new file mode 100644 index 00000000..d0c91c69 --- /dev/null +++ b/app/controllers/start_form_resubmit_controller.rb @@ -0,0 +1,99 @@ +# frozen_string_literal: true + +class StartFormResubmitController < ApplicationController + layout 'form' + + skip_before_action :authenticate_user! + skip_authorization_check + + around_action :with_browser_locale + before_action :load_resubmit_submitter + before_action :load_template + before_action :authorize_start! + + def update + @submitter = find_or_initialize_submitter(@template, @resubmit_submitter) + + if Templates.filter_undefined_submitters(@template.submitters).size > 1 && @submitter.new_record? + @error_message = multiple_submitters_error_message + + return render 'start_form/show', status: :unprocessable_content + end + + if (is_new_record = @submitter.new_record?) + Submitters::StartForm.assign_submission_attributes( + @submitter, @template, + ip: request.remote_ip, user_agent: request.user_agent, resubmit_submitter: @resubmit_submitter, + source: @resubmit_submitter.submission.source_self? ? :self : :link + ) + + Submissions::AssignDefinedSubmitters.call(@submitter.submission) + else + @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent) + end + + if @template.preferences['shared_link_2fa'] == true + handle_require_2fa(@submitter) + elsif @submitter.save + Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record + + Submitters::StartForm.assign_start_form_cookie(@submitter, request) + + redirect_to submit_form_path(@submitter.slug) + else + render 'start_form/show', status: :unprocessable_content + end + end + + private + + def find_or_initialize_submitter(template, resubmit_submitter) + Submitters::StartForm.build_submitters_scope(template, exclude_completed: true) + .find_by(slug: cookies.encrypted[:start_form_slug], + email: resubmit_submitter.email) || Submitter.new + end + + def load_resubmit_submitter + @resubmit_submitter = Submitter.find_by(slug: params[:resubmit]) + + raise ActiveRecord::RecordNotFound if @resubmit_submitter.blank? || + !Submitters::StartForm.can_resubmit?(@resubmit_submitter) + end + + def load_template + @template = @resubmit_submitter.template + end + + def authorize_start! + redirect_to submit_form_path(@resubmit_submitter.slug) if @template.archived_at? || @template.account.archived_at? + end + + def multiple_submitters_error_message + if current_user&.account_id == @template.account_id + helpers.t('this_submission_has_multiple_signers_which_prevents_the_use_of_a_sharing_link_html') + else + I18n.t('not_found') + end + end + + def handle_require_2fa(submitter) + if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, + is_new_record: submitter.new_record?) + redirect_to submit_form_path(submitter.slug) + else + Submitters.send_shared_link_email_verification_code(submitter, request:) + + render 'start_form/email_verification' + end + rescue Submitters::StartForm::NotSaved + render 'start_form/show', status: :unprocessable_content + rescue Submitters::UnableToSendCode, Submitters::InvalidOtp => e + flash.now[:alert] = e.message + + render 'start_form/email_verification' + rescue RateLimit::LimitApproached + flash.now[:alert] = I18n.t(:too_many_attempts) + + render 'start_form/email_verification' + end +end diff --git a/app/controllers/start_form_self_controller.rb b/app/controllers/start_form_self_controller.rb new file mode 100644 index 00000000..2a6d904c --- /dev/null +++ b/app/controllers/start_form_self_controller.rb @@ -0,0 +1,50 @@ +# frozen_string_literal: true + +class StartFormSelfController < ApplicationController + load_resource :template, parent: false + + around_action :with_browser_locale + before_action :authorize_start! + + def update + @submitter = Submitters::StartForm.build_submitters_scope(@template, exclude_completed: true, source: :self) + .find_or_initialize_by(email: current_user.email) + + @submitter = Submitter.new(email: current_user.email) if @submitter.persisted? && + outdated_template_fields?(@submitter, @template) + + if (is_new_record = @submitter.new_record?) + @submitter.name = current_user.full_name + + Submitters::StartForm.assign_submission_attributes( + @submitter, @template, ip: request.remote_ip, user_agent: request.user_agent, source: :self + ) + + Submissions::AssignDefinedSubmitters.call(@submitter.submission) + else + @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent) + end + + @submitter.save! + + Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record + + Submitters::StartForm.assign_start_form_cookie(@submitter, request) + + redirect_to submit_form_path(@submitter.slug) + end + + private + + def outdated_template_fields?(submitter, template) + template_fields = submitter.submission.template_fields + + template_fields.present? && template_fields != template.fields + end + + def authorize_start! + authorize!(:read, @template) + + redirect_to template_path(@template) if @template.archived_at? + end +end diff --git a/app/controllers/submit_form_decline_controller.rb b/app/controllers/submit_form_decline_controller.rb index 94054196..ca50e60c 100644 --- a/app/controllers/submit_form_decline_controller.rb +++ b/app/controllers/submit_form_decline_controller.rb @@ -19,7 +19,7 @@ class SubmitFormDeclineController < ApplicationController request) ApplicationRecord.transaction do - @submitter.update!(declined_at: Time.current) + @submitter.update!(declined_at: Time.current, values: @submitter.preferences['default_values'] || {}) SubmissionEvents.create_with_tracking_data(@submitter, 'decline_form', request, { reason: params[:reason] }) end diff --git a/app/controllers/submit_form_email_2fas_controller.rb b/app/controllers/submit_form_email_2fas_controller.rb index ec627b5d..dfe518b0 100644 --- a/app/controllers/submit_form_email_2fas_controller.rb +++ b/app/controllers/submit_form_email_2fas_controller.rb @@ -8,9 +8,6 @@ class SubmitFormEmail2fasController < ApplicationController before_action :load_submitter - COOKIES_TTL = 12.hours - COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze - def create RateLimit.call("verify-2fa-code-#{@submitter.id}", limit: 2, ttl: 45.seconds, enabled: true) @@ -20,7 +17,8 @@ class SubmitFormEmail2fasController < ApplicationController SubmissionEvents.create_with_tracking_data(@submitter, 'email_verified', request, { email: @submitter.email }) cookies.encrypted[:email_2fa_slug] = - { value: @submitter.slug, expires: COOKIES_TTL.from_now, **COOKIES_DEFAULTS } + { value: @submitter.slug, expires: Submitters::StartForm::COOKIES_TTL.from_now, + **Submitters::StartForm::COOKIES_DEFAULTS } redirect_to submit_form_path(@submitter.slug) else diff --git a/app/javascript/submission_form/form.vue b/app/javascript/submission_form/form.vue index 882d7d08..61ae047c 100644 --- a/app/javascript/submission_form/form.vue +++ b/app/javascript/submission_form/form.vue @@ -560,6 +560,7 @@ :fields="formulaFields" :values="values" :readonly-values="readonlyFieldValues" + :fetch-options="fetchOptions" :provider="paymentProvider" @attached="attachments.push($event)" @focus="scrollIntoField(currentField)" @@ -573,6 +574,7 @@ :empty-value-required-step="emptyValueRequiredStep" :field="currentField" :submitter-slug="submitterSlug" + :fetch-options="fetchOptions" :values="values" @submit="!isSubmitting && submitStep()" /> @@ -585,6 +587,7 @@ :empty-value-required-step="emptyValueRequiredStep" :field="currentField" :submitter-slug="submitterSlug" + :fetch-options="fetchOptions" :values="values" @focus="scrollIntoField(currentField)" @submit="!isSubmitting && submitStep()" @@ -1776,7 +1779,7 @@ export default { window.location.href = sanitizeUrl(this.completedRedirectUrl) } else { this.$nextTick(() => { - const root = this.$root.$el.parentNode.getRootNode() + const root = this.$root.$el.parentNode?.getRootNode() || document const completedEl = root.getElementById('form_completed') if (completedEl) { diff --git a/app/javascript/submission_form/kba_step.vue b/app/javascript/submission_form/kba_step.vue index 1c98f1af..bb2ac672 100644 --- a/app/javascript/submission_form/kba_step.vue +++ b/app/javascript/submission_form/kba_step.vue @@ -312,6 +312,11 @@ export default { values: { type: Object, required: true + }, + fetchOptions: { + type: Object, + required: false, + default: () => ({}) } }, emits: ['submit'], @@ -494,8 +499,9 @@ export default { const resp = await fetch(this.baseUrl + '/api/kba', { method: 'POST', - headers: { 'Content-Type': 'application/json' }, - body: JSON.stringify(payload) + body: JSON.stringify(payload), + ...this.fetchOptions, + headers: { 'Content-Type': 'application/json', ...this.fetchOptions.headers } }) const data = await resp.json() @@ -550,7 +556,8 @@ export default { reference: this.reference, submitter_slug: this.submitterSlug }), - headers: { 'Content-Type': 'application/json' } + ...this.fetchOptions, + headers: { 'Content-Type': 'application/json', ...this.fetchOptions.headers } }) const data = await resp.json() diff --git a/app/javascript/submission_form/payment_step.vue b/app/javascript/submission_form/payment_step.vue index f1ebabcc..ab015954 100644 --- a/app/javascript/submission_form/payment_step.vue +++ b/app/javascript/submission_form/payment_step.vue @@ -121,6 +121,11 @@ export default { type: String, required: false, default: '' + }, + fetchOptions: { + type: Object, + required: false, + default: () => ({}) } }, emits: ['focus', 'submit', 'update:model-value', 'attached'], @@ -234,7 +239,8 @@ export default { body: JSON.stringify({ submitter_slug: this.submitterSlug }), - headers: { 'Content-Type': 'application/json' } + ...this.fetchOptions, + headers: { 'Content-Type': 'application/json', ...this.fetchOptions.headers } }).then(async (resp) => { if (resp.status === 422 || resp.status === 500) { this.isProcessing = false @@ -274,7 +280,8 @@ export default { check_status: checkStatus, referer: this.normalizedPaymentUrl() }), - headers: { 'Content-Type': 'application/json' } + ...this.fetchOptions, + headers: { 'Content-Type': 'application/json', ...this.fetchOptions.headers } }).then(async (resp) => { if (resp.status === 422 || resp.status === 500) { const data = await resp.json() diff --git a/app/javascript/submission_form/verification_step.vue b/app/javascript/submission_form/verification_step.vue index 59ae6c4c..20c5c960 100644 --- a/app/javascript/submission_form/verification_step.vue +++ b/app/javascript/submission_form/verification_step.vue @@ -91,6 +91,11 @@ export default { submitterSlug: { type: String, required: true + }, + fetchOptions: { + type: Object, + required: false, + default: () => ({}) } }, emits: ['focus', 'submit', 'update:model-value', 'attached'], @@ -163,7 +168,8 @@ export default { submitter_slug: this.submitterSlug, redirect_url: document.location.href }), - headers: { 'Content-Type': 'application/json' } + ...this.fetchOptions, + headers: { 'Content-Type': 'application/json', ...this.fetchOptions.headers } }).then(async (resp) => { this.eidEasyData = await resp.json() @@ -205,7 +211,8 @@ export default { body: JSON.stringify({ submitter_slug: this.submitterSlug }), - headers: { 'Content-Type': 'application/json' } + ...this.fetchOptions, + headers: { 'Content-Type': 'application/json', ...this.fetchOptions.headers } }) if (resp.status === 404) { diff --git a/app/javascript/template_builder/builder.vue b/app/javascript/template_builder/builder.vue index 0b49de40..a834e373 100644 --- a/app/javascript/template_builder/builder.vue +++ b/app/javascript/template_builder/builder.vue @@ -110,7 +110,7 @@ data-turbo="false" class="inline" method="post" - :action="`/d/${template.slug}`" + :action="`/start_form_self/${template.id}`" @submit="maybeShowErrorTemplateAlert" > -