From 76b7f27fcfc5aa2c6071f11fdbe14b9dafe28bb0 Mon Sep 17 00:00:00 2001
From: "devin-ai-integration[bot]"
 <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sun, 26 Apr 2026 10:30:15 -0400
Subject: [PATCH] fix: guard submitStep() against consent bypass via child
 @submit and forceComplete paths (#19)

* fix: guard submitStep() against consent bypass via child component @submit events

* fix: extend consent guard to cover forceComplete path and disable Complete button

---------

Co-authored-by: mario.pander <developbob50@gmail.com>
---
 app/javascript/submission_form/form.vue | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/app/javascript/submission_form/form.vue b/app/javascript/submission_form/form.vue
index 1e612b72..b2d4a799 100644
--- a/app/javascript/submission_form/form.vue
+++ b/app/javascript/submission_form/form.vue
@@ -99,7 +99,7 @@
       type="submit"
       name="completed"
       value="true"
-      :disabled="isSubmittingComplete"
+      :disabled="isSubmittingComplete || (requireConsent && !consentAccepted)"
     >
       <span class="flex items-center">
         <IconInnerShadowTop
@@ -1646,10 +1646,14 @@ export default {
       return this.$refs.areas.scrollIntoArea(area)
     },
     async submitStep (e) {
-      this.isSubmitting = true
-
       const forceComplete = e?.submitter?.getAttribute('name') === 'completed'
 
+      if (this.requireConsent && !this.consentAccepted && (this.isLastStep || forceComplete)) {
+        return
+      }
+
+      this.isSubmitting = true
+
       if (forceComplete) {
         this.isSubmittingComplete = true
       }