refactor start form

app/controllers/send_submission_email_controller.rb

@@ -11,15 +11,15 @@ class SendSubmissionEmailController < ApplicationController
 
   def create
     if params[:template_slug]
-      @submitter = Submitter.joins(submission: :template).find_by!(email: params[:email].to_s.downcase,
+      @submitter = Submitter.completed.joins(submission: :template).find_by!(email: params[:email].to_s.downcase,
                                                                              template: { slug: params[:template_slug] })
     elsif params[:submission_slug]
-      @submitter = Submitter.joins(:submission).find_by(email: params[:email].to_s.downcase,
+      @submitter = Submitter.completed.joins(:submission).find_by(email: params[:email].to_s.downcase,
                                                                   submission: { slug: params[:submission_slug] })
 
       return redirect_to submissions_preview_completed_path(params[:submission_slug], status: :error) unless @submitter
     else
-      @submitter = Submitter.find_by!(slug: params[:submitter_slug])
+      @submitter = Submitter.completed.find_by!(slug: params[:submitter_slug])
     end
 
     RateLimit.call("send-email-#{@submitter.id}", limit: 2, ttl: 5.minutes)

app/controllers/start_form_controller.rb

@@ -8,7 +8,9 @@ class StartFormController < ApplicationController
 
   around_action :with_browser_locale, only: %i[show completed]
   before_action :maybe_redirect_com, only: %i[show completed]
+  before_action :load_resubmit_submitter, only: :update
   before_action :load_template
+  before_action :authorize_start!, only: :update
 
   def show
     raise ActionController::RoutingError, I18n.t('not_found') if @template.preferences['require_phone_2fa']
@@ -28,8 +30,6 @@ class StartFormController < ApplicationController
   end
 
   def update
-    return redirect_to start_form_path(@template.slug) if @template.archived_at? || !@template.shared_link?
-
     @submitter = find_or_initialize_submitter(@template, submitter_params)
 
     if @submitter.completed_at?
@@ -74,6 +74,24 @@ class StartFormController < ApplicationController
 
   private
 
+  def load_resubmit_submitter
+    @resubmit_submitter =
+      if params[:resubmit].present? && !params[:resubmit].in?([true, 'true'])
+        Submitter.find_by(slug: params[:resubmit])
+      end
+  end
+
+  def authorize_start!
+    return redirect_to start_form_path(@template.slug) if @template.archived_at?
+
+    return if @resubmit_submitter
+    return if @template.shared_link? || (current_user && current_ability.can?(:read, @template))
+
+    Rollbar.warning("Not shared template: #{@template.id}") if defined?(Rollbar)
+
+    redirect_to start_form_path(@template.slug)
+  end
+
   def enqueue_submission_create_webhooks(submitter)
     WebhookUrls.for_account_id(submitter.account_id, 'submission.created').each do |webhook_url|
       SendSubmissionCreatedWebhookRequestJob.perform_async('submission_id' => submitter.submission_id,
@@ -82,31 +100,29 @@ class StartFormController < ApplicationController
   end
 
   def find_or_initialize_submitter(template, submitter_params)
-    Submitter.where(submission: template.submissions.where(expire_at: Time.current..)
+    Submitter
+      .where(submission: template.submissions.where(expire_at: Time.current..)
                                  .or(template.submissions.where(expire_at: nil)).where(archived_at: nil))
       .order(id: :desc)
       .where(declined_at: nil)
       .where(external_id: nil)
       .where(ip: [nil, request.remote_ip])
-             .then { |rel| params[:resubmit].present? ? rel.where(completed_at: nil) : rel }
+      .then { |rel| params[:resubmit].present? || params[:selfsign].present? ? rel.where(completed_at: nil) : rel }
       .find_or_initialize_by(email: submitter_params[:email], **submitter_params.compact_blank)
   end
 
   def assign_submission_attributes(submitter, template)
-    resubmit_submitter =
-      (Submitter.where(submission: template.submissions).find_by(slug: params[:resubmit]) if params[:resubmit].present?)
-
     submitter.assign_attributes(
       uuid: (filter_undefined_submitters(template).first || @template.submitters.first)['uuid'],
       ip: request.remote_ip,
       ua: request.user_agent,
-      values: resubmit_submitter&.preferences&.fetch('default_values', nil) || {},
-      preferences: resubmit_submitter&.preferences.presence || { 'send_email' => true },
-      metadata: resubmit_submitter&.metadata.presence || {}
+      values: @resubmit_submitter&.preferences&.fetch('default_values', nil) || {},
+      preferences: @resubmit_submitter&.preferences.presence || { 'send_email' => true },
+      metadata: @resubmit_submitter&.metadata.presence || {}
     )
 
     if submitter.values.present?
-      resubmit_submitter.attachments.each do |attachment|
+      @resubmit_submitter.attachments.each do |attachment|
         submitter.attachments << attachment.dup if submitter.values.value?(attachment.uuid)
       end
     end
@@ -128,15 +144,21 @@ class StartFormController < ApplicationController
   end
 
   def submitter_params
+    return current_user.slice(:email) if params[:selfsign]
+    return @resubmit_submitter.slice(:name, :phone, :email) if @resubmit_submitter.present?
+
     params.require(:submitter).permit(:email, :phone, :name).tap do |attrs|
       attrs[:email] = Submissions.normalize_email(attrs[:email])
     end
   end
 
   def load_template
-    slug = params[:slug] || params[:start_form_slug]
-
-    @template = Template.find_by!(slug:)
+    @template =
+      if @resubmit_submitter
+        @resubmit_submitter.template
+      else
+        Template.find_by!(slug: params[:slug] || params[:start_form_slug])
+      end
   end
 
   def multiple_submitters_error_message

app/javascript/template_builder/builder.vue

@@ -79,13 +79,52 @@
           name="buttons"
         />
         <template v-else>
+          <form
+            v-if="withSignYourselfButton && template.submitters.length < 2"
+            target="_blank"
+            data-turbo="false"
+            class="inline"
+            method="post"
+            :action="`/d/${template.slug}`"
+            @submit="maybeShowErrorTemplateAlert"
+          >
+            <input
+              type="hidden"
+              name="_method"
+              value="put"
+              autocomplete="off"
+            >
+            <input
+              type="hidden"
+              name="authenticity_token"
+              :value="authenticityToken"
+              autocomplete="off"
+            >
+            <input
+              type="hidden"
+              name="selfsign"
+              value="true"
+              autocomplete="off"
+            >
+            <button
+              class="btn btn-primary btn-ghost text-base hidden md:flex"
+              type="submit"
+            >
+              <IconWritingSign
+                width="22"
+                class="inline"
+              />
+              <span class="hidden md:inline">
+                {{ t('sign_yourself') }}
+              </span>
+            </button>
+          </form>
           <a
-            v-if="withSignYourselfButton"
+            v-else-if="withSignYourselfButton"
             id="sign_yourself_button"
-            :href="template.submitters.length > 1 ? `/templates/${template.id}/submissions/new?selfsign=true` : `/d/${template.slug}`"
+            :href="`/templates/${template.id}/submissions/new?selfsign=true`"
             class="btn btn-primary btn-ghost text-base hidden md:flex"
-            :target="template.submitters.length > 1 ? '' : '_blank'"
-            :data-turbo-frame="template.submitters.length > 1 ? 'modal' : ''"
+            data-turbo-frame="modal"
             @click="maybeShowErrorTemplateAlert"
           >
             <IconWritingSign

app/views/start_form/completed.html.erb

@@ -23,12 +23,12 @@
     </div>
     <% if Docuseal.multitenant? || Accounts.can_send_emails?(@submitter.account) %>
       <toggle-submit class="block">
-        <%= button_to button_title(title: t('send_copy_to_email'), disabled_with: t('sending'), icon: svg_icon('mail_forward', class: 'w-6 h-6')), send_submission_email_index_path, params: { submitter_slug: @submitter.slug }, class: 'base-button w-full' %>
+        <%= button_to button_title(title: t('send_copy_to_email'), disabled_with: t('sending'), icon: svg_icon('mail_forward', class: 'w-6 h-6')), send_submission_email_index_path, params: { template_slug: @template.slug, email: params[:email] }, class: 'base-button w-full' %>
       </toggle-submit>
     <% end %>
     <% if Templates.filter_undefined_submitters(@template).size == 1 && %w[api embed].exclude?(@submitter.submission.source) && @submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false && @template.shared_link? %>
       <toggle-submit class="block">
-        <%= button_to button_title(title: t('resubmit'), disabled_with: t('resubmit'), icon: svg_icon('reload', class: 'w-6 h-6')), start_form_path(@template.slug), params: { submitter: { email: params[:email] }, resubmit: @submitter.slug }, method: :put, class: 'white-button w-full' %>
+        <%= button_to button_title(title: t('resubmit'), disabled_with: t('resubmit'), icon: svg_icon('reload', class: 'w-6 h-6')), start_form_path(@template.slug), params: { submitter: { email: params[:email] }, resubmit: true }, method: :put, class: 'white-button w-full' %>
       </toggle-submit>
     <% end %>
   </div>

app/views/submit_form/completed.html.erb

@@ -43,10 +43,10 @@
       <% end %>
     </div>
     <% undefined_submitters = Templates.filter_undefined_submitters(@submitter.submission.template) %>
-    <% if undefined_submitters.size == 1 && undefined_submitters.first['uuid'] == @submitter.uuid && %w[api embed].exclude?(@submitter.submission.source) && @submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false && !@submitter.template.archived_at? && @submitter.template.shared_link? %>
+    <% if undefined_submitters.size == 1 && undefined_submitters.first['uuid'] == @submitter.uuid && %w[api embed].exclude?(@submitter.submission.source) && @submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false %>
       <div class="divider uppercase"><%= t('or') %></div>
       <toggle-submit class="block">
-        <%= button_to button_title(title: t('resubmit'), disabled_with: t('resubmit'), icon: svg_icon('reload', class: 'w-6 h-6')), start_form_path(@submitter.submission.template.slug), params: { submitter: { email: @submitter.email, phone: @submitter.phone, name: @submitter.name }, resubmit: @submitter.slug }, method: :put, class: 'white-button w-full' %>
+        <%= button_to button_title(title: t('resubmit'), disabled_with: t('resubmit'), icon: svg_icon('reload', class: 'w-6 h-6')), resubmit_form_path, params: { resubmit: @submitter.slug }, method: :put, class: 'white-button w-full' %>
       </toggle-submit>
     <% end %>
   </div>

app/views/templates/show.html.erb

@@ -95,7 +95,7 @@
                 <% end %>
               <% end %>
               <% if @template.submitters.size == 1 %>
-                <%= link_to start_form_url(slug: @template.slug), id: 'sign_yourself_button', class: 'white-button mt-6', target: '_blank', rel: 'noopener' do %>
+                <%= button_to start_form_path(@template.slug), params: { selfsign: true }, method: :put, class: 'white-button w-full', form: { style: 'display: inline', target: '_blank', data: { turbo: false } } do %>
                   <%= svg_icon('writing', class: 'w-6 h-6') %>
                   <span class="mr-1"><%= t('sign_it_yourself') %></span>
                 <% end %>

config/routes.rb

@@ -132,6 +132,8 @@ Rails.application.routes.draw do
     get :completed
   end
 
+  resource :resubmit_form, controller: 'start_form', only: :update
+
   resources :submit_form, only: %i[], path: '' do
     get :success, on: :collection
   end

spec/system/template_spec.rb

@@ -16,7 +16,7 @@ RSpec.describe 'Template' do
       expect(page).to have_content(template.name)
       expect(page).to have_content('There are no Submissions')
       expect(page).to have_content('Send an invitation to fill and complete the form')
-      expect(page).to have_link('Sign it Yourself')
+      expect(page).to have_button('Sign it Yourself')
     end
   end