From e9888c7466b84e7f0dee25a03a37ba1e025de5ba Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Wed, 21 Oct 2026 11:50:40 +0300
Subject: [PATCH] add validation

---
 lib/submitters/submit_values.rb | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/lib/submitters/submit_values.rb b/lib/submitters/submit_values.rb
index 08920ea1c..20b135e7a 100644
--- a/lib/submitters/submit_values.rb
+++ b/lib/submitters/submit_values.rb
@@ -9,6 +9,8 @@ module Submitters
     PHONE_REGEXP = /[+\d()\s-]+/
     NONEDITABLE_FIELD_TYPES = %w[stamp heading strikethrough].freeze
     REQUIRED_FIELD_TYPES = %w[payment kba verification].freeze
+    CHOICE_FIELD_TYPES = %w[radio multiple select].freeze
+    BOOLEAN_VALUES = [true, false].freeze
 
     STRFTIME_MAP = {
       'hour' => '%-k',
@@ -55,6 +57,7 @@ module Submitters
         validate_values!(reason_field ? values.except(reason_field['uuid']) : values, submitter, params, request)
 
         if params[:completed] == 'true'
+          validate_invite_submitters!(submitter)
           maybe_invite_via_field(submitter, request)
 
           SubmissionEvents.create_with_tracking_data(submitter, 'complete_form', request)
@@ -504,7 +507,7 @@ module Submitters
       submitter
     end
 
-    def validate_value!(_value, field, _params, submitter, _request)
+    def validate_value!(value, field, _params, submitter, _request)
       raise ValidationError, 'Missing field' unless field
       raise ValidationError, 'Invalid field' if field['submitter_uuid'] != submitter.uuid
 
@@ -514,7 +517,34 @@ module Submitters
         raise ValidationError, 'Read-only field'
       end
 
+      raise ValidationError, 'Value is invalid' if field['type'] == 'checkbox' && !value.in?(BOOLEAN_VALUES)
+
+      validate_choice_value!(value, field, submitter) if field['type'].in?(CHOICE_FIELD_TYPES)
+
       true
     end
+
+    def validate_choice_value!(value, field, submitter)
+      return if value.blank?
+
+      raise ValidationError, 'Value is invalid' unless value.is_a?(field['type'] == 'multiple' ? Array : String)
+
+      option_names = field['options'].to_a.map.with_index do |option, index|
+        option['value'].presence ||
+          "#{I18n.t('option', locale: submitter.metadata.fetch('lang', submitter.account.locale))} #{index + 1}"
+      end
+
+      raise ValidationError, 'Value is invalid' unless Array.wrap(value).all? { |item| option_names.include?(item) }
+    end
+
+    def validate_invite_submitters!(submitter)
+      submission = submitter.submission
+
+      is_pending_invite = (submission.template_submitters || submission.template.submitters).any? do |s|
+        s['invite_by_uuid'] == submitter.uuid && submission.submitters.none? { |e| e.uuid == s['uuid'] }
+      end
+
+      raise ValidationError, 'Invite required' if is_pending_invite
+    end
   end
 end