validate email

app/controllers/start_form_controller.rb

@@ -92,8 +92,11 @@ class StartFormController < ApplicationController
 
     blank_fields = required_fields.select { |key| submitter_params[key].blank? }
 
+    is_invalid_email = required_fields.include?('email') && submitter_params[:email].present? &&
+                       !submitter_params[:email].match?(User::VALIDATE_EMAIL_REGEXP)
+
     submitter =
-      if blank_fields.present?
+      if blank_fields.present? || is_invalid_email
         Submitter.new(submitter_params)
       else
         Submitters::StartForm.find_or_initialize_submitter(
@@ -104,6 +107,12 @@ class StartFormController < ApplicationController
 
     blank_fields.each { |key| submitter.errors.add(key.to_sym, :blank) }
 
+    if is_invalid_email
+      Rollbar.warning("Invalid start form email: #{submitter_params[:email]}") if defined?(Rollbar)
+
+      submitter.errors.add(:email, :invalid)
+    end
+
     submitter
   end
 

app/models/user.rb

@@ -56,6 +56,8 @@ class User < ApplicationRecord
   FULL_EMAIL_REGEXP =
     /\A[a-z0-9][.']?(?:(?:[a-z0-9_-]+[.+'])*[a-z0-9_-]+)*@(?:[a-z0-9]+[.-])*[a-z0-9]+\.[a-z]{2,}\z/i
 
+  VALIDATE_EMAIL_REGEXP = /\A[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\z/
+
   has_one_attached :signature
   has_one_attached :initials
 
@@ -78,7 +80,7 @@ class User < ApplicationRecord
   scope :archived, -> { where.not(archived_at: nil) }
   scope :admins, -> { where(role: ADMIN_ROLE) }
 
-  validates :email, format: { with: /\A[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\z/ }
+  validates :email, format: { with: VALIDATE_EMAIL_REGEXP }
 
   def access_token
     super || build_access_token.tap(&:save!)