From 339ceda18dd1229d173ec7206a2a29ce09da33bb Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Tue, 7 Apr 2026 17:59:20 +0300
Subject: [PATCH] upload attachment if not completed

---
 app/controllers/api/attachments_controller.rb | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/app/controllers/api/attachments_controller.rb b/app/controllers/api/attachments_controller.rb
index f00552cd..c81aa0f9 100644
--- a/app/controllers/api/attachments_controller.rb
+++ b/app/controllers/api/attachments_controller.rb
@@ -10,6 +10,12 @@ module Api
     def create
       submitter = Submitter.find_by!(slug: params[:submitter_slug])
 
+      unless can_upload?(submitter)
+        Rollbar.error("Can't upload: #{submitter.id}") if defined?(Rollbar)
+
+        return render json: { error: I18n.t('form_has_been_archived') }, status: :unprocessable_content
+      end
+
       if params[:type].in?(%w[initials signature])
         image = Vips::Image.new_from_file(params[:file].path)
 
@@ -40,6 +46,14 @@ module Api
       render json: { error: e.message }, status: :unprocessable_content
     end
 
+    def can_upload?(submitter)
+      !submitter.declined_at? &&
+        !submitter.completed_at? &&
+        !submitter.submission.archived_at? &&
+        !submitter.submission.expired? &&
+        !submitter.submission.template&.archived_at?
+    end
+
     def build_new_cookie_signatures_json(submitter, attachment)
       values =
         begin