adjust resubmit

app/controllers/start_form_controller.rb

@@ -52,8 +52,8 @@ class StartFormController < ApplicationController
         @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent)
       end
 
-      if require_link_2fa?(@submitter, is_new_record:)
-        handle_require_2fa(@submitter, is_new_record:)
+      if require_link_2fa?(@template, @submitter)
+        handle_require_2fa(@template, @submitter)
       elsif @submitter.errors.blank? && @submitter.save
         Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record
 
@@ -98,7 +98,7 @@ class StartFormController < ApplicationController
       else
         Submitters::StartForm.find_or_initialize_submitter(
           template, submitter_params, exclude_completed: params[:resubmit].present?,
-                                      request:, current_user:, ability: current_user && current_ability
+                                      request:, current_user:
         )
       end
 
@@ -107,11 +107,13 @@ class StartFormController < ApplicationController
     submitter
   end
 
-  def require_link_2fa?(submitter, is_new_record:)
-    return true if @template.preferences['shared_link_2fa'] == true
+  def require_link_2fa?(template, submitter)
+    return true if template.preferences['shared_link_2fa'] == true
     return false if cookies.encrypted[:start_form_slug] == submitter.slug
+    return false if current_user && submitter.email == current_user.email &&
+                    current_user.account_id == submitter.account_id
 
-    !is_new_record && (current_user&.email != submitter.email || !current_ability.can?(:read, submitter))
+    !submitter.new_record?
   end
 
   def authorize_start!
@@ -144,13 +146,13 @@ class StartFormController < ApplicationController
     end
   end
 
-  def handle_require_2fa(submitter, is_new_record:)
+  def handle_require_2fa(template, submitter)
     return render :show, status: :unprocessable_content if submitter.errors.present?
 
-    if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record:)
+    if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record: submitter.new_record?)
       redirect_to submit_form_path(submitter.slug)
     else
-      if defined?(Rollbar) && submitter.submission.template.preferences['shared_link_2fa'] != true
+      if defined?(Rollbar) && template.preferences['shared_link_2fa'] != true
         Rollbar.info("2FA link requested: #{submitter.id}")
       end
 
@@ -161,10 +163,10 @@ class StartFormController < ApplicationController
   rescue Submitters::StartForm::NotSaved
     render :show, status: :unprocessable_content
   rescue Submitters::UnableToSendCode, Submitters::InvalidOtp => e
-    redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
+    redirect_to start_form_path(template.slug, params: submitter_params.merge(email_verification: true)),
                 alert: e.message
   rescue RateLimit::LimitApproached
-    redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
+    redirect_to start_form_path(template.slug, params: submitter_params.merge(email_verification: true)),
                 alert: I18n.t(:too_many_attempts)
   end
 end

app/controllers/start_form_resubmit_controller.rb

@@ -12,9 +12,7 @@ class StartFormResubmitController < ApplicationController
   before_action :authorize_start!
 
   def update
-    @submitter = Submitters::StartForm.find_or_initialize_submitter(
-      @template, submitter_params, exclude_completed: true, request:
-    )
+    @submitter = find_or_initialize_submitter(@template, @resubmit_submitter)
 
     if Templates.filter_undefined_submitters(@template.submitters).size > 1 && @submitter.new_record?
       @error_message = multiple_submitters_error_message
@@ -34,7 +32,7 @@ class StartFormResubmitController < ApplicationController
     end
 
     if @template.preferences['shared_link_2fa'] == true
-      handle_require_2fa(@submitter, is_new_record:)
+      handle_require_2fa(@submitter)
     elsif @submitter.save
       Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record
 
@@ -48,6 +46,12 @@ class StartFormResubmitController < ApplicationController
 
   private
 
+  def find_or_initialize_submitter(template, resubmit_submitter)
+    Submitters::StartForm.build_submitters_scope(template, exclude_completed: true)
+                         .find_by(slug: cookies.encrypted[:start_form_slug],
+                                  email: resubmit_submitter.email) || Submitter.new
+  end
+
   def load_resubmit_submitter
     @resubmit_submitter = Submitter.find_by(slug: params[:resubmit])
 
@@ -63,10 +67,6 @@ class StartFormResubmitController < ApplicationController
     redirect_to submit_form_path(@resubmit_submitter.slug) if @template.archived_at? || @template.account.archived_at?
   end
 
-  def submitter_params
-    @resubmit_submitter.slice(:name, :phone, :email)
-  end
-
   def multiple_submitters_error_message
     if current_user&.account_id == @template.account_id
       helpers.t('this_submission_has_multiple_signers_which_prevents_the_use_of_a_sharing_link_html')
@@ -75,8 +75,9 @@ class StartFormResubmitController < ApplicationController
     end
   end
 
-  def handle_require_2fa(submitter, is_new_record:)
-    if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record:)
+  def handle_require_2fa(submitter)
+    if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request,
+                                                           is_new_record: submitter.new_record?)
       redirect_to submit_form_path(submitter.slug)
     else
       Submitters.send_shared_link_email_verification_code(submitter, request:)

lib/submitters/start_form.rb

@@ -17,13 +17,18 @@ module Submitters
         submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false
     end
 
-    def can_reopen?(template, submitter, request:, current_user:, ability:)
+    def can_reopen?(template, submitter, request:, current_user:)
       return false if submitter.submission&.completed_at? && submitter.viewer?
       return true if request.cookie_jar.encrypted[:start_form_slug] == submitter.slug
+      return true if request.cookie_jar.encrypted[:email_2fa_slug] == submitter.slug
       return false if submitter.email.blank?
-      return true if submitter.completed_at? || Docuseal.multitenant?
-      return true if current_user&.email == submitter.email && ability.can?(:read, submitter)
+      return true if submitter.completed_at?
+      return false if submitter.submission.source_embed?
       return true if template.preferences['shared_link_2fa'] == true
+      return false if submitter.submission.source_link?
+      return true if Docuseal.multitenant?
+      return true if current_user && submitter.email == current_user.email &&
+                     current_user.account_id == submitter.account_id
 
       Accounts.can_send_emails?(template.account)
     end
@@ -33,8 +38,7 @@ module Submitters
         { value: submitter.slug, expires: START_FORM_COOKIES_TTL.from_now, **COOKIES_DEFAULTS }
     end
 
-    def find_or_initialize_submitter(template, submitter_params, exclude_completed:, request:,
-                                     current_user: nil, ability: nil)
+    def find_or_initialize_submitter(template, submitter_params, exclude_completed:, request:, current_user: nil)
       required_fields = template.preferences.fetch('link_form_fields', ['email'])
 
       required_params = required_fields.index_with { |key| submitter_params[key] }
@@ -48,7 +52,7 @@ module Submitters
           build_submitters_scope(template, exclude_completed:).find_or_initialize_by(find_params)
         end
 
-      if submitter.persisted? && !can_reopen?(template, submitter, request:, current_user:, ability:)
+      if submitter.persisted? && !can_reopen?(template, submitter, request:, current_user:)
         submitter = Submitter.new(find_params)
       end