1861 Commits (dfc12095ffbd8dd7b988914ac3da10f5d016f015)

Author	SHA1	Message	Date
Vs	dfc12095ff	Merge branch 'master' into master	1 month ago
Pete Matsyburka	065dcf6f9f	fix include combined_document_url	1 month ago
Pete Matsyburka	a66b16ce1c	fix rubocop	1 month ago
Pete Matsyburka	3cb37748e9	optimize select	1 month ago
Pete Matsyburka	e54d76f0e2	redact and crop on touchscreen	1 month ago
Pete Matsyburka	f19e037011	fix input mode	1 month ago
Pete Matsyburka	ee3f47d918	adjust edit condition	1 month ago
Pete Matsyburka	a49a645022	fix completed_at index	1 month ago
Pete Matsyburka	c9bcf866ab	optimize query	1 month ago
Pete Matsyburka	506609f3cd	optimize search	1 month ago
Pete Matsyburka	721172c980	adjust accessibility	1 month ago
Pete Matsyburka	b183db5b80	fix rubocop	1 month ago
Pete Matsyburka	c7f277f404	fix search pagination	1 month ago
Pete Matsyburka	8ac03a9f8a	fix template archived send event	1 month ago
Pete Matsyburka	dc1c386d7e	adjust search	1 month ago
Pete Matsyburka	1eaf4e5bab	fix email stats	1 month ago
Pete Matsyburka	3c0f1c2e73	default order if countless	1 month ago
Pete Matsyburka	b2790776ef	show archived shared templates	1 month ago
Pete Matsyburka	2840359396	adjust shared tag	1 month ago
Pete Matsyburka	c18ddb99a8	optimize queries	1 month ago
Pete Matsyburka	432435aa23	adjust shared templates	1 month ago
Pete Matsyburka	90c1a6f4ad	fix can send emails	1 month ago
Pete Matsyburka	0e8f478c2e	optimize query	1 month ago
Pete Matsyburka	76821a4c2d	fix opt email footer	1 month ago
Pete Matsyburka	6024ed4cd1	adjust accessibility	1 month ago
Pete Matsyburka	3811f8bbb8	fix submission nil name	1 month ago
Pete Matsyburka	10d45c3e20	add checks	1 month ago
shipeasy-ai	7e670bd139	feat(internal-api): per-tenant account provisioning + token template create ... Add two internal endpoints so an embedding app can run one DocuSeal account per tenant, authenticated entirely by tokens (no shared Devise admin session): - POST /api/internal/provision_account — HMAC-signed (DOCUSEAL_PROVISION_SECRET) handoff that idempotently creates an Account + owner User + access token and returns them. Fails closed when the secret is unset. - POST /api/internal/templates — X-Auth-Token-authed create-from-PDF that builds a template under the caller's account via the same service the web uploader uses, idempotent by external_id (scoped per account). EmbedBuilderController/EmbedScoped already scope to user.account.templates, so giving each tenant its own account makes that a real isolation boundary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	1 month ago
Pete Matsyburka	6fb247ec06	adjust can resubmit	1 month ago
shipeasy-ai	b2d7199756	EmbedScoped: allow /embed/builder re-entry with a pinned scope ... EmbedBuilderController is the JWT re-entry point but runs behind EmbedScoped's enforce_embed_scope! before_action. Once a prior open pins an embed_scope into the session cookie, re-opening the builder (the same template again, or a different one) hit `head :forbidden` because /embed/builder was not in UNSCOPED_ALLOW — the concern locked out its own re-entry endpoint. First open worked; every reopen 403'd. The token, not the session, authenticates /embed/builder, so always let it through; EmbedBuilderController then overwrites the scope from the fresh token. Add a request spec covering the re-entry/re-scope case.	2 months ago
Pete Matsyburka	1546258529	add service url time	2 months ago
Pete Matsyburka	7ec83b8af6	adjust upload url	2 months ago
Pete Matsyburka	21d0a87c17	adjust replace button	2 months ago
shipeasy-ai	ff567ee260	CSP: allow multiple space-separated EMBED_ALLOWED_ORIGIN values ... The embedding EHR spans an apex plus an app/tenant subdomain; frame-ancestors must list each origin separately. Split EMBED_ALLOWED_ORIGIN on whitespace so "https://enwella.com https://app.enwella.com" both become sources. The deploy already sets two space-separated origins; the single-value form emitted one malformed token and the browser blocked the iframe.	2 months ago
shipeasy-ai	1269391f4c	Spec fixtures + Time.current; embed builder specs green ... - Eager account user so Account#default_template_folder can pick an author. - Pass author: in template fixtures; create the foreign account's user. - Positive scope control tolerates the missing webpack manifest (reaching the view proves the guard allowed the in-scope template). - Time.current over Time.now (Rails/TimeZone).	2 months ago
shipeasy-ai	3c05712819	Token-authenticated embedded builder (no cross-origin cookies) ... Adds a JWT-authenticated entry point so the embedding app can mount <docuseal-builder data-token="…"> without the host pre-establishing a DocuSeal session via cross-origin cookies + an external auth gate. - EmbedBuilderController (GET /embed/builder?token=…): verifies a short-lived HS256 JWT against the owner account's API access token (the same key the JSON API uses; raw value is recoverable via the encrypted `token` column), signs that user in (a first-party session inside the iframe), records a template-scoped grant in the session, and redirects into the regular builder — /templates/:id/edit for an existing template, or /new?url=… to download + create from `document_urls`. Requires `exp` and caps token lifetime (replay bound). Only opens template_ids the account owns. - EmbedScoped concern: confines an embed session to its own template (by id, or by external_id for the /new→create→edit redirect) plus the create + builder-support paths; refuses enumeration / other templates / the JSON template API. Fails closed. Path rules mirror the allow-list the host app enforced at the edge, so the builder keeps working while the cross-origin cookie + gate machinery on the host side can be removed. - builder.js shim now iframes /embed/builder?token=… (the server decides edit vs. new) instead of a bare authenticated /new that 404s without a pre-set session cookie. - Request specs for token verification, ownership, exp/lifetime, and scope.	2 months ago
Pete Matsyburka	d1535c4cd8	add redact color	2 months ago
Pete Matsyburka	13874b8830	add documents editor	2 months ago
Pete Matsyburka	ac66809a05	fix date tz	2 months ago
Pete Matsyburka	f5229d5dec	fix zoom	2 months ago
Pete Matsyburka	28f47e1093	handle template archived	2 months ago
Pete Matsyburka	8e462047ba	fix upload callback	2 months ago
Pete Matsyburka	b7f8b65d9d	adjust button style	2 months ago
Alex Turchyn	da21c37254	add Google Drive replace option	2 months ago
Pete Matsyburka	a89aef4a89	adjust zoom	2 months ago
Alex Turchyn	dd6516fd11	add cmd+scroll zooming to template builder	2 months ago
Pete Matsyburka	344a3ce198	adjust sanitize	2 months ago
Pete Matsyburka	8bf7a1f95a	adjust image detect fields	2 months ago
Pete Matsyburka	04cf36891e	fix complete button press enter	2 months ago
Pete Matsyburka	b2d9948c30	remove active storage analyzers	2 months ago