618 Commits (e042fad308d23c802e03e7d0299b1a554cad5c9c)

Author	SHA1	Message	Date
shipeasy-ai	7e670bd139	feat(internal-api): per-tenant account provisioning + token template create ... Add two internal endpoints so an embedding app can run one DocuSeal account per tenant, authenticated entirely by tokens (no shared Devise admin session): - POST /api/internal/provision_account — HMAC-signed (DOCUSEAL_PROVISION_SECRET) handoff that idempotently creates an Account + owner User + access token and returns them. Fails closed when the secret is unset. - POST /api/internal/templates — X-Auth-Token-authed create-from-PDF that builds a template under the caller's account via the same service the web uploader uses, idempotent by external_id (scoped per account). EmbedBuilderController/EmbedScoped already scope to user.account.templates, so giving each tenant its own account makes that a real isolation boundary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	1 month ago
shipeasy-ai	b2d7199756	EmbedScoped: allow /embed/builder re-entry with a pinned scope ... EmbedBuilderController is the JWT re-entry point but runs behind EmbedScoped's enforce_embed_scope! before_action. Once a prior open pins an embed_scope into the session cookie, re-opening the builder (the same template again, or a different one) hit `head :forbidden` because /embed/builder was not in UNSCOPED_ALLOW — the concern locked out its own re-entry endpoint. First open worked; every reopen 403'd. The token, not the session, authenticates /embed/builder, so always let it through; EmbedBuilderController then overwrites the scope from the fresh token. Add a request spec covering the re-entry/re-scope case.	2 months ago
shipeasy-ai	ff567ee260	CSP: allow multiple space-separated EMBED_ALLOWED_ORIGIN values ... The embedding EHR spans an apex plus an app/tenant subdomain; frame-ancestors must list each origin separately. Split EMBED_ALLOWED_ORIGIN on whitespace so "https://enwella.com https://app.enwella.com" both become sources. The deploy already sets two space-separated origins; the single-value form emitted one malformed token and the browser blocked the iframe.	2 months ago
shipeasy-ai	1269391f4c	Spec fixtures + Time.current; embed builder specs green ... - Eager account user so Account#default_template_folder can pick an author. - Pass author: in template fixtures; create the foreign account's user. - Positive scope control tolerates the missing webpack manifest (reaching the view proves the guard allowed the in-scope template). - Time.current over Time.now (Rails/TimeZone).	2 months ago
shipeasy-ai	3c05712819	Token-authenticated embedded builder (no cross-origin cookies) ... Adds a JWT-authenticated entry point so the embedding app can mount <docuseal-builder data-token="…"> without the host pre-establishing a DocuSeal session via cross-origin cookies + an external auth gate. - EmbedBuilderController (GET /embed/builder?token=…): verifies a short-lived HS256 JWT against the owner account's API access token (the same key the JSON API uses; raw value is recoverable via the encrypted `token` column), signs that user in (a first-party session inside the iframe), records a template-scoped grant in the session, and redirects into the regular builder — /templates/:id/edit for an existing template, or /new?url=… to download + create from `document_urls`. Requires `exp` and caps token lifetime (replay bound). Only opens template_ids the account owns. - EmbedScoped concern: confines an embed session to its own template (by id, or by external_id for the /new→create→edit redirect) plus the create + builder-support paths; refuses enumeration / other templates / the JSON template API. Fails closed. Path rules mirror the allow-list the host app enforced at the edge, so the builder keeps working while the cross-origin cookie + gate machinery on the host side can be removed. - builder.js shim now iframes /embed/builder?token=… (the server decides edit vs. new) instead of a bare authenticated /new that 404s without a pre-set session cookie. - Request specs for token verification, ownership, exp/lifetime, and scope.	2 months ago
Vadym Shaveiko	f4324122cc	Self-hosted embed: JWT shim + Rails-side glue for cross-origin iframe ... Lets the EnWella EHR mount <docuseal-builder> (and -form) without a paid Pro license. Upstream's `EmbedScriptsController` returns an "Upgrade to Pro" stub; we override it via the static-asset path so the real shim wins without touching the controller. JS shim (public/js/builder.js) - Web component that decodes the JWT minted by the embedder (`name`, `document_urls`, `external_id`, optional `template_id`). - Iframes /templates/:id/edit for existing templates, /new?... for the upload-from-URL flow. - Relays a `save` postMessage from the inner builder up as a DOM `CustomEvent('save')` on the outer element so @docuseal/react's onSave callback fires. - Discovers host from its own <script src> so embedders don't have to set data-host. JWT signature not re-verified (session cookies + shared HMAC at the calling app are authoritative). Builder (app/javascript/template_builder/builder.vue) - isEmbedded computed (window.parent !== window). - Hide #title_container in embed (sheet already shows the consent name). - Fire the `save` postMessage at the end of the manual SAVE handler so the outer shim can dispatch the DOM event. Rails glue - application_controller.rb / config/application.rb: when EMBED_ALLOWED_ORIGIN is set, add `frame-ancestors 'self' <origin>` to the per-request CSP and drop the default `X-Frame-Options: SAMEORIGIN` header (different scheme/host/port = different origin, so SAMEORIGIN blocks the EHR's iframe even in same-domain prod). - templates_uploads_controller.rb: persist `external_id` from the upload params so the host app can later look the template up via `GET /api/templates?external_id=...` (deterministic fallback link path when the `template.created` webhook doesn't reach us). - templates_uploads_controller.rb: skip the SSRF guard when fetching documents in development — it rejects http / non-443 / localhost, which is exactly the Active Storage URLs the EHR sends from https://localhost:3000. - templates_uploads/show.html.erb: carry `external_id` through the resubmit form (used on the encrypted-PDF prompt path). Local HTTPS dev (puma.rb, Procfile.dev, .env.example) - Bind ssl://0.0.0.0:PORT when LOCAL_HTTPS_CERT/KEY are set (wired by ../bin/docuseal-dev to ../.certs/lvh.me.pem). EHR runs HTTPS too, so HTTPS iframe avoids mixed-content blocking. - Procfile.dev runs `puma -C config/puma.rb` directly so the ssl bind applies. - SSL_CERT_FILE example for trusting the mkcert root so DocuSeal's outbound HTTPS to Rails (Active Storage downloads) verifies.	3 months ago
Pete Matsyburka	50eb5b070e	fix typo	3 months ago
Pete Matsyburka	10fd624bec	add revisions	3 months ago
Pete Matsyburka	d828d79574	improve log	3 months ago
Pete Matsyburka	45ae954c0c	add hmac webhook secret	3 months ago
Pete Matsyburka	07b4ada5be	optimize edit json	3 months ago
Pete Matsyburka	a26aa0f411	remove log	3 months ago
Pete Matsyburka	1503375eed	respond to HEAD file proxy	3 months ago
Pete Matsyburka	a6e22adf2e	fix preview	3 months ago
Pete Matsyburka	6dec56198c	add require email 2fa to submitter update	3 months ago
Pete Matsyburka	d96d252df3	use post for test mode	3 months ago
Pete Matsyburka	e9c0b6a703	rate limit	3 months ago
Pete Matsyburka	ec7df08496	adjust send submission email	3 months ago
Pete Matsyburka	c7afe33c72	add time formats	3 months ago
Pete Matsyburka	7cdf263da1	add screen reader mode	4 months ago
Pete Matsyburka	5ea6289b7a	fix test mode modal	4 months ago
Pete Matsyburka	46cf1e3067	add log	4 months ago
Pete Matsyburka	f995e1864c	add shared link qr code	4 months ago
Pete Matsyburka	8b59c0aaa0	adjust normalize values	4 months ago
Pete Matsyburka	bb2fb7a0c2	refactor download	4 months ago
Pete Matsyburka	8f8b36617a	fix first party download from preview	4 months ago
Pete Matsyburka	2303c21cea	download users csv	4 months ago
Pete Matsyburka	89e797b95f	update message	4 months ago
Pete Matsyburka	339ceda18d	upload attachment if not completed	4 months ago
Pete Matsyburka	eaedaa96bb	fix rubocop	4 months ago
Pete Matsyburka	8d3f0b5b98	silence not found trace	4 months ago
Pete Matsyburka	407816b576	redirect delegate completed	4 months ago
Pete Matsyburka	3eb0b8a89f	allow to delegate	4 months ago
Pete Matsyburka	7309581b75	add template archived event	5 months ago
Pete Matsyburka	36d59c40a7	add template update event	5 months ago
Pete Matsyburka	3e250bfb28	error update if declined	5 months ago
Pete Matsyburka	b4d137c0de	remove flash	5 months ago
Alex Turchyn	62a969d8fe	add MCP support	5 months ago
Pete Matsyburka	37196ff89f	add dynamic documents	5 months ago
Alex Turchyn	ab9008b3be	fix brakeman SQL injection warning	5 months ago
Pete Matsyburka	65491936c3	fix archived export	5 months ago
Pete Matsyburka	f622ed168f	fix autocomplete	5 months ago
Pete Matsyburka	db3b80c96c	fix clone	5 months ago
Pete Matsyburka	ba84741a64	invite party via field	6 months ago
Pete Matsyburka	825322d489	adjust for custom domain	6 months ago
Pete Matsyburka	3b396f8421	fix redirect	6 months ago
Pete Matsyburka	12c5b909e0	use cancan	6 months ago
Pete Matsyburka	347be0137d	refactor 2fa	6 months ago
Pete Matsyburka	9377766e52	fix url download	6 months ago
Pete Matsyburka	c3f4480cdc	add submitter index	6 months ago