fix GitHub CI build

Added Elestio as a deployment option

.dockerignore

@@ -1,5 +1,6 @@
 /db/*.sqlite3
 
+**/node_modules
 /node_modules
 /coverage
 /doc
@@ -27,3 +28,4 @@
 /attachments
 /docuseal
 .DS_Store
+.env

.erb-lint.yml

@@ -30,3 +30,5 @@ linters:
         Enabled: false
       Style/ZeroLengthPredicate:
         Enabled: false
+      Style/RedundantConstantBase:
+        Enabled: false

.gitattributes

@@ -0,0 +1 @@
+*.html linguist-detectable=false

.github/workflows/ci.yml

@@ -127,6 +127,7 @@ jobs:
           bundle config path vendor/bundle
           bundle install --jobs 4 --retry 4
           yarn install
+          sudo apt-get update
           sudo apt-get install libvips
       - name: Run
         env:
@@ -137,4 +138,5 @@ jobs:
         run: |
           bundle exec rake db:create
           bundle exec rake db:migrate
+          bundle exec rake assets:precompile
           bundle exec rspec

.gitignore

@@ -35,3 +35,4 @@ yarn-debug.log*
 /coverage
 /attachments
 /docuseal
+/ee

.rubocop.yml

@@ -26,8 +26,11 @@ Style/Documentation:
 Lint/MissingSuper:
   Enabled: false
 
+Metrics/ParameterLists:
+  Max: 10
+
 Metrics/MethodLength:
-  Max: 20
+  Max: 25
   Exclude:
     - 'db/migrate/**'
 
@@ -53,13 +56,19 @@ RSpec/NestedGroups:
   Max: 6
 
 RSpec/MultipleExpectations:
-  Max: 7
+  Max: 20
 
 RSpec/ExampleLength:
-  Max: 15
+  Max: 40
+
+RSpec/MultipleMemoizedHelpers:
+  Max: 6
 
 Rails/I18nLocaleTexts:
   Enabled: false
 
+Rails/SkipsModelValidations:
+  Enabled: false
+
 Rails/ApplicationController:
   Enabled: false

Dockerfile

@@ -31,13 +31,21 @@ ENV BUNDLE_WITHOUT="development:test"
 
 WORKDIR /app
 
-RUN apk add --no-cache build-base sqlite-dev libpq-dev mariadb-dev vips-dev vips-poppler vips-heif libc6-compat ttf-freefont
+RUN apk add --no-cache build-base sqlite-dev libpq-dev mariadb-dev vips-dev vips-poppler vips-heif libc6-compat ttf-freefont ttf-liberation && cp /usr/share/fonts/liberation/LiberationSans-Regular.ttf /usr/share/fonts/liberation/LiberationSans-Bold.ttf / && apk del ttf-liberation
 
 COPY ./Gemfile ./Gemfile.lock ./
 
 RUN bundle update --bundler && bundle install && rm -rf ~/.bundle
 
-COPY . ./
+COPY ./bin ./bin
+COPY ./app ./app
+COPY ./config ./config
+COPY ./db ./db
+COPY ./log ./log
+COPY ./lib ./lib
+COPY ./public ./public
+COPY ./tmp ./tmp
+COPY LICENSE README.md Rakefile config.ru ./
 
 COPY --from=webpack /app/public/packs ./public/packs
 

Gemfile

@@ -4,28 +4,41 @@ source 'https://rubygems.org'
 
 ruby '3.2.2'
 
-gem 'audited'
+gem 'aws-sdk-s3', require: false
-gem 'aws-sdk-s3'
+gem 'azure-storage-blob', require: false
-gem 'azure-storage-blob'
 gem 'bootsnap', require: false
+gem 'cancancan'
 gem 'devise'
+gem 'devise-two-factor'
 gem 'dotenv', require: false
+gem 'email_typo'
 gem 'faraday'
-gem 'google-cloud-storage'
+gem 'faraday-follow_redirects'
+gem 'google-cloud-storage', require: false
 gem 'hexapdf'
 gem 'image_processing'
+gem 'jwt'
 gem 'lograge'
-gem 'mysql2'
+gem 'mysql2', require: false
 gem 'oj'
+gem 'omniauth-google-oauth2'
+gem 'omniauth-rails_csrf_protection'
 gem 'pagy'
-gem 'pg'
+gem 'pdf-reader'
+gem 'pg', require: false
 gem 'premailer-rails'
 gem 'puma'
 gem 'rails'
+gem 'rails_autolink'
 gem 'rails-i18n'
+gem 'rollbar', require: ENV.key?('ROLLBAR_ACCESS_TOKEN')
+gem 'rotp'
+gem 'rqrcode'
 gem 'ruby-vips'
+gem 'rubyXL'
 gem 'shakapacker'
-gem 'sqlite3'
+gem 'sidekiq', require: ENV.key?('REDIS_URL')
+gem 'sqlite3', require: false
 gem 'strip_attributes'
 gem 'turbo-rails'
 gem 'tzinfo-data'

Gemfile.lock

@@ -1,95 +1,94 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.0.5)
+    Ascii85 (1.1.0)
-      actionpack (= 7.0.5)
+    actioncable (7.0.7)
-      activesupport (= 7.0.5)
+      actionpack (= 7.0.7)
+      activesupport (= 7.0.7)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.5)
+    actionmailbox (7.0.7)
-      actionpack (= 7.0.5)
+      actionpack (= 7.0.7)
-      activejob (= 7.0.5)
+      activejob (= 7.0.7)
-      activerecord (= 7.0.5)
+      activerecord (= 7.0.7)
-      activestorage (= 7.0.5)
+      activestorage (= 7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
       mail (>= 2.7.1)
       net-imap
       net-pop
       net-smtp
-    actionmailer (7.0.5)
+    actionmailer (7.0.7)
-      actionpack (= 7.0.5)
+      actionpack (= 7.0.7)
-      actionview (= 7.0.5)
+      actionview (= 7.0.7)
-      activejob (= 7.0.5)
+      activejob (= 7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
       mail (~> 2.5, >= 2.5.4)
       net-imap
       net-pop
       net-smtp
       rails-dom-testing (~> 2.0)
-    actionpack (7.0.5)
+    actionpack (7.0.7)
-      actionview (= 7.0.5)
+      actionview (= 7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
       rack (~> 2.0, >= 2.2.4)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.5)
+    actiontext (7.0.7)
-      actionpack (= 7.0.5)
+      actionpack (= 7.0.7)
-      activerecord (= 7.0.5)
+      activerecord (= 7.0.7)
-      activestorage (= 7.0.5)
+      activestorage (= 7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.0.5)
+    actionview (7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (7.0.5)
+    activejob (7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
       globalid (>= 0.3.6)
-    activemodel (7.0.5)
+    activemodel (7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
-    activerecord (7.0.5)
+    activerecord (7.0.7)
-      activemodel (= 7.0.5)
+      activemodel (= 7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
-    activestorage (7.0.5)
+    activestorage (7.0.7)
-      actionpack (= 7.0.5)
+      actionpack (= 7.0.7)
-      activejob (= 7.0.5)
+      activejob (= 7.0.7)
-      activerecord (= 7.0.5)
+      activerecord (= 7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
       marcel (~> 1.0)
       mini_mime (>= 1.1.0)
-    activesupport (7.0.5)
+    activesupport (7.0.7)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-    addressable (2.8.4)
+    addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
+    afm (0.2.2)
     annotate (3.2.0)
       activerecord (>= 3.2, < 8.0)
       rake (>= 10.4, < 14.0)
     ast (2.4.2)
-    audited (5.3.3)
-      activerecord (>= 5.0, < 7.1)
-      request_store (~> 1.2)
     aws-eventstream (1.2.0)
-    aws-partitions (1.781.0)
+    aws-partitions (1.807.0)
-    aws-sdk-core (3.175.0)
+    aws-sdk-core (3.180.3)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.67.0)
+    aws-sdk-kms (1.71.0)
-      aws-sdk-core (~> 3, >= 3.174.0)
+      aws-sdk-core (~> 3, >= 3.177.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.126.0)
+    aws-sdk-s3 (1.132.1)
-      aws-sdk-core (~> 3, >= 3.174.0)
+      aws-sdk-core (~> 3, >= 3.179.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.4)
+      aws-sigv4 (~> 1.6)
-    aws-sigv4 (1.5.2)
+    aws-sigv4 (1.6.0)
       aws-eventstream (~> 1, >= 1.0.2)
     azure-storage-blob (2.0.3)
       azure-storage-common (~> 2.0)
@@ -99,8 +98,9 @@ GEM
       faraday_middleware (~> 1.0, >= 1.0.0.rc1)
       net-http-persistent (~> 4.0)
       nokogiri (~> 1, >= 1.10.8)
+    base64 (0.1.1)
     bcrypt (3.1.19)
-    better_html (2.0.1)
+    better_html (2.0.2)
       actionview (>= 6.0)
       activesupport (>= 6.0)
       ast (~> 2.0)
@@ -108,12 +108,13 @@ GEM
       parser (>= 2.4)
       smart_properties
     bindex (0.8.1)
-    bootsnap (1.15.0)
+    bootsnap (1.16.0)
       msgpack (~> 1.2)
     builder (3.2.4)
     bullet (7.0.7)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
+    cancancan (3.5.0)
     capybara (3.39.2)
       addressable
       matrix
@@ -123,6 +124,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    chunky_png (1.4.0)
     cmdparse (3.0.7)
     coderay (1.1.3)
     concurrent-ruby (1.2.2)
@@ -146,11 +148,17 @@ GEM
       railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
+    devise-two-factor (5.0.0)
+      activesupport (~> 7.0)
+      devise (~> 4.0)
+      railties (~> 7.0)
+      rotp (~> 6.0)
     diff-lcs (1.5.0)
-    digest-crc (0.6.4)
+    digest-crc (0.6.5)
       rake (>= 12.0.0, < 14.0.0)
     docile (1.4.0)
     dotenv (2.8.1)
+    email_typo (0.2.3)
     erb_lint (0.4.0)
       activesupport
       better_html (>= 2.0.1)
@@ -164,7 +172,7 @@ GEM
     factory_bot_rails (6.2.0)
       factory_bot (~> 6.2.0)
       railties (>= 5.0.0)
-    faker (3.2.0)
+    faker (3.2.1)
       i18n (>= 1.8.11, < 2)
     faraday (1.10.3)
       faraday-em_http (~> 1.0)
@@ -181,6 +189,8 @@ GEM
     faraday-em_http (1.0.0)
     faraday-em_synchrony (1.0.0)
     faraday-excon (1.1.0)
+    faraday-follow_redirects (0.3.0)
+      faraday (>= 1, < 3)
     faraday-httpclient (1.0.1)
     faraday-multipart (1.0.4)
       multipart-post (~> 2)
@@ -197,10 +207,10 @@ GEM
       webrick (~> 1.7)
       websocket-driver (>= 0.6, < 0.8)
     ffi (1.15.5)
-    geom2d (0.3.1)
+    geom2d (0.4.1)
     globalid (1.1.0)
       activesupport (>= 5.0)
-    google-apis-core (0.11.0)
+    google-apis-core (0.11.1)
       addressable (~> 2.5, >= 2.5.1)
       googleauth (>= 0.16.2, < 2.a)
       httpclient (>= 2.8.1, < 3.a)
@@ -227,7 +237,7 @@ GEM
       google-cloud-core (~> 1.6)
       googleauth (>= 0.16.2, < 2.a)
       mini_mime (~> 1.0)
-    googleauth (1.6.0)
+    googleauth (1.7.0)
       faraday (>= 0.17.3, < 3.a)
       jwt (>= 1.4, < 3.0)
       memoist (~> 0.16)
@@ -235,9 +245,11 @@ GEM
       os (>= 0.9, < 2.0)
       signet (>= 0.16, < 2.a)
     hashdiff (1.0.1)
-    hexapdf (0.32.2)
+    hashery (2.1.2)
+    hashie (5.0.0)
+    hexapdf (0.33.0)
       cmdparse (~> 3.0, >= 3.0.3)
-      geom2d (~> 0.3)
+      geom2d (~> 0.4, >= 0.4.1)
       openssl (>= 2.2.1)
     htmlentities (4.3.4)
     httpclient (2.8.3)
@@ -247,8 +259,8 @@ GEM
       mini_magick (>= 4.9.5, < 5)
       ruby-vips (>= 2.0.17, < 3)
     io-console (0.6.0)
-    irb (1.7.0)
+    irb (1.7.4)
-      reline (>= 0.3.0)
+      reline (>= 0.3.6)
     jmespath (1.6.2)
     json (2.6.3)
     jwt (2.7.1)
@@ -262,7 +274,7 @@ GEM
       letter_opener (~> 1.7)
       railties (>= 5.2)
       rexml
-    lograge (0.12.0)
+    lograge (0.13.0)
       actionpack (>= 4)
       activesupport (>= 4)
       railties (>= 4)
@@ -280,16 +292,17 @@ GEM
     memoist (0.16.2)
     method_source (1.0.0)
     mini_magick (4.12.0)
-    mini_mime (1.1.2)
+    mini_mime (1.1.5)
-    mini_portile2 (2.8.2)
+    mini_portile2 (2.8.4)
-    minitest (5.18.1)
+    minitest (5.19.0)
-    msgpack (1.7.1)
+    msgpack (1.7.2)
     multi_json (1.15.0)
+    multi_xml (0.6.0)
     multipart-post (2.3.0)
     mysql2 (0.5.5)
     net-http-persistent (4.0.2)
       connection_pool (~> 2.2)
-    net-imap (0.3.6)
+    net-imap (0.3.7)
       date
       net-protocol
     net-pop (0.1.2)
@@ -299,9 +312,34 @@ GEM
     net-smtp (0.3.3)
       net-protocol
     nio4r (2.5.9)
-    nokogiri (1.15.2-arm64-darwin)
+    nokogiri (1.15.4)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    oj (3.15.0)
+    nokogiri (1.15.4-arm64-darwin)
+      racc (~> 1.4)
+    oauth2 (2.0.9)
+      faraday (>= 0.17.3, < 3.0)
+      jwt (>= 1.0, < 3.0)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 4)
+      snaky_hash (~> 2.0)
+      version_gem (~> 1.1)
+    oj (3.16.0)
+    omniauth (2.1.1)
+      hashie (>= 3.4.6)
+      rack (>= 2.2.3)
+      rack-protection
+    omniauth-google-oauth2 (1.1.1)
+      jwt (>= 2.0)
+      oauth2 (~> 2.0.6)
+      omniauth (~> 2.0)
+      omniauth-oauth2 (~> 1.8.0)
+    omniauth-oauth2 (1.8.0)
+      oauth2 (>= 1.4, < 3)
+      omniauth (~> 2.0)
+    omniauth-rails_csrf_protection (1.0.1)
+      actionpack (>= 4.2)
+      omniauth (~> 2.0)
     openssl (3.1.0)
     orm_adapter (0.5.0)
     os (1.1.4)
@@ -310,6 +348,12 @@ GEM
     parser (3.2.2.3)
       ast (~> 2.4.1)
       racc
+    pdf-reader (2.11.0)
+      Ascii85 (~> 1.0)
+      afm (~> 0.2.1)
+      hashery (~> 2.0)
+      ruby-rc4
+      ttfunk
     pg (1.5.3)
     premailer (1.21.0)
       addressable
@@ -324,49 +368,58 @@ GEM
       method_source (~> 1.0)
     pry-rails (0.3.9)
       pry (>= 0.10.4)
-    public_suffix (5.0.1)
+    public_suffix (5.0.3)
-    puma (6.3.0)
+    puma (6.3.1)
       nio4r (~> 2.0)
     racc (1.7.1)
-    rack (2.2.7)
+    rack (2.2.8)
+    rack-protection (3.1.0)
+      rack (~> 2.2, >= 2.2.4)
     rack-proxy (0.7.6)
       rack
     rack-test (2.1.0)
       rack (>= 1.3)
-    rails (7.0.5)
+    rails (7.0.7)
-      actioncable (= 7.0.5)
+      actioncable (= 7.0.7)
-      actionmailbox (= 7.0.5)
+      actionmailbox (= 7.0.7)
-      actionmailer (= 7.0.5)
+      actionmailer (= 7.0.7)
-      actionpack (= 7.0.5)
+      actionpack (= 7.0.7)
-      actiontext (= 7.0.5)
+      actiontext (= 7.0.7)
-      actionview (= 7.0.5)
+      actionview (= 7.0.7)
-      activejob (= 7.0.5)
+      activejob (= 7.0.7)
-      activemodel (= 7.0.5)
+      activemodel (= 7.0.7)
-      activerecord (= 7.0.5)
+      activerecord (= 7.0.7)
-      activestorage (= 7.0.5)
+      activestorage (= 7.0.7)
-      activesupport (= 7.0.5)
+      activesupport (= 7.0.7)
       bundler (>= 1.15.0)
-      railties (= 7.0.5)
+      railties (= 7.0.7)
-    rails-dom-testing (2.0.3)
+    rails-dom-testing (2.2.0)
-      activesupport (>= 4.2.0)
+      activesupport (>= 5.0.0)
+      minitest
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.6.0)
       loofah (~> 2.21)
       nokogiri (~> 1.14)
-    rails-i18n (7.0.7)
+    rails-i18n (7.0.8)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 8)
-    railties (7.0.5)
+    rails_autolink (1.1.8)
-      actionpack (= 7.0.5)
+      actionview (> 3.1)
-      activesupport (= 7.0.5)
+      activesupport (> 3.1)
+      railties (> 3.1)
+    railties (7.0.7)
+      actionpack (= 7.0.7)
+      activesupport (= 7.0.7)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
       zeitwerk (~> 2.5)
     rainbow (3.1.1)
     rake (13.0.6)
+    redis-client (0.16.0)
+      connection_pool
     regexp_parser (2.8.1)
-    reline (0.3.5)
+    reline (0.3.8)
       io-console (~> 0.5)
     representable (3.2.0)
       declarative (< 0.1.0)
@@ -378,13 +431,19 @@ GEM
       actionpack (>= 5.2)
       railties (>= 5.2)
     retriable (3.1.2)
-    rexml (3.2.5)
+    rexml (3.2.6)
+    rollbar (3.4.0)
+    rotp (6.3.0)
+    rqrcode (2.2.0)
+      chunky_png (~> 1.0)
+      rqrcode_core (~> 1.0)
+    rqrcode_core (1.2.0)
     rspec-core (3.12.2)
       rspec-support (~> 3.12.0)
     rspec-expectations (3.12.3)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.12.0)
-    rspec-mocks (3.12.5)
+    rspec-mocks (3.12.6)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.12.0)
     rspec-rails (6.0.3)
@@ -395,8 +454,9 @@ GEM
       rspec-expectations (~> 3.12)
       rspec-mocks (~> 3.12)
       rspec-support (~> 3.12)
-    rspec-support (3.12.0)
+    rspec-support (3.12.1)
-    rubocop (1.53.0)
+    rubocop (1.56.1)
+      base64 (~> 0.1.1)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
@@ -404,7 +464,7 @@ GEM
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
       rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.28.0, < 2.0)
+      rubocop-ast (>= 1.28.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 3.0)
     rubocop-ast (1.29.0)
@@ -413,27 +473,37 @@ GEM
       rubocop (~> 1.41)
     rubocop-factory_bot (2.23.1)
       rubocop (~> 1.33)
-    rubocop-performance (1.18.0)
+    rubocop-performance (1.19.0)
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
     rubocop-rails (2.20.2)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 1.33.0, < 2.0)
-    rubocop-rspec (2.22.0)
+    rubocop-rspec (2.23.2)
       rubocop (~> 1.33)
       rubocop-capybara (~> 2.17)
       rubocop-factory_bot (~> 2.22)
     ruby-progressbar (1.13.0)
+    ruby-rc4 (0.1.5)
     ruby-vips (2.1.4)
       ffi (~> 1.12)
     ruby2_keywords (0.0.5)
+    rubyXL (3.4.25)
+      nokogiri (>= 1.10.8)
+      rubyzip (>= 1.3.0)
+    rubyzip (2.3.2)
     semantic_range (3.0.0)
-    shakapacker (7.0.0)
+    shakapacker (7.0.3)
       activesupport (>= 5.2)
       rack-proxy (>= 0.6.1)
       railties (>= 5.2)
       semantic_range (>= 2.3.0)
+    sidekiq (7.1.2)
+      concurrent-ruby (< 2)
+      connection_pool (>= 2.3.0)
+      rack (>= 2.2.4)
+      redis-client (>= 0.14.0)
     signet (0.17.0)
       addressable (~> 2.8)
       faraday (>= 0.17.5, < 3.a)
@@ -446,13 +516,18 @@ GEM
     simplecov-html (0.12.3)
     simplecov_json_formatter (0.1.4)
     smart_properties (1.17.0)
-    sqlite3 (1.5.4)
+    snaky_hash (2.0.1)
+      hashie
+      version_gem (~> 1.1, >= 1.1.1)
+    sqlite3 (1.6.3)
       mini_portile2 (~> 2.8.0)
+    sqlite3 (1.6.3-arm64-darwin)
     strip_attributes (1.13.0)
       activemodel (>= 3.0, < 8.0)
     thor (1.2.2)
     timeout (0.4.0)
     trailblazer-option (0.1.2)
+    ttfunk (1.7.0)
     turbo-rails (1.4.0)
       actionpack (>= 6.0.0)
       activejob (>= 6.0.0)
@@ -464,6 +539,7 @@ GEM
     uber (0.1.0)
     unicode-display_width (2.4.2)
     uniform_notifier (1.16.0)
+    version_gem (1.1.3)
     warden (1.2.9)
       rack (>= 2.0.9)
     web-console (4.2.0)
@@ -476,54 +552,68 @@ GEM
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.8.1)
-    websocket-driver (0.7.5)
+    websocket-driver (0.7.6)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.6.8)
+    zeitwerk (2.6.11)
 
 PLATFORMS
   arm64-darwin-22
+  ruby
 
 DEPENDENCIES
   annotate
-  audited
   aws-sdk-s3
   azure-storage-blob
   better_html
   bootsnap
   bullet
+  cancancan
   capybara
   cuprite
   debug
   devise
+  devise-two-factor
   dotenv
+  email_typo
   erb_lint
   factory_bot_rails
   faker
   faraday
+  faraday-follow_redirects
   google-cloud-storage
   hexapdf
   image_processing
+  jwt
   letter_opener_web
   lograge
   mysql2
   oj
+  omniauth-google-oauth2
+  omniauth-rails_csrf_protection
   pagy
+  pdf-reader
   pg
   premailer-rails
   pry-rails
   puma
   rails
   rails-i18n
+  rails_autolink
+  rollbar
+  rotp
+  rqrcode
   rspec-rails
   rubocop
   rubocop-performance
   rubocop-rails
   rubocop-rspec
   ruby-vips
+  rubyXL
   shakapacker
+  sidekiq
   simplecov
   sqlite3
   strip_attributes

README.md

@@ -1,24 +1,89 @@
-# README
+<h1 align="center" style="border-bottom: none">
+  <div>
+    <a href="https://www.docuseal.co">
+      <img  alt="DocuSeal" src="https://github.com/docusealco/docuseal/assets/5418788/c12cd051-81cd-4402-bc3a-92f2cfdc1b06" width="80" />
+      <br>
+    </a>
+    DocuSeal
+  </div>
+</h1>
+<h3 align="center">
+  Open source document filling and signing
+</h3>
+<p align="center">
+  <a href="https://hub.docker.com/r/docuseal/docuseal">
+    <img alt="Docker releases" src="https://img.shields.io/docker/v/docuseal/docuseal">
+  </a>
+  <a href="https://discord.gg/qygYCDGck9">
+    <img src="https://img.shields.io/discord/1125112641170448454?logo=discord"/>
+  </a>
+  <a href="https://twitter.com/intent/follow?screen_name=docusealco">
+    <img src="https://img.shields.io/twitter/follow/docusealco?style=social" alt="Follow @docusealco" />
+  </a>
+</p>
+<p>
+DocuSeal is an open source platform that provides secure and efficient digital document signing and processing. Create PDF forms to have them filled and signed online on any device with an easy-to-use, mobile-optimized web tool.
+</p>
+<h2 align="center">
+  <a href="https://demo.docuseal.co">✨ Live Demo</a>
+  <span>|</span>
+  <a href="https://docuseal.co/sign_up">☁️ Try in Cloud</a>
+</h2>
 
-This README would normally document whatever steps are necessary to get the
+[![Demo](https://github.com/docusealco/docuseal/assets/5418788/d8703ea3-361a-423f-8bfe-eff1bd9dbe14)](https://demo.docuseal.co)
-application up and running.
 
-Things you may want to cover:
+## Features
+- [x] PDF form fields builder (WYSIWYG)
+- [x] 10 field types available (Signature, Date, File, Checkbox etc.)
+- [x] Multiple submitters per document
+- [x] Automated emails via SMTP
+- [x] Files storage on AWS S3, Google Storage, or Azure
+- [x] Automatic PDF eSignature
+- [x] PDF signature verification
+- [x] Users management
+- [x] Mobile-optimized
+- [x] API and Webhooks for integrations
+- [x] Easy to deploy in minutes
 
-* Ruby version
+## Deploy
 
-* System dependencies
+|Heroku|Railway|
+|:--:|:---:|
+| [<img alt="Deploy on Heroku" src="https://www.herokucdn.com/deploy/button.svg" height="40">](https://heroku.com/deploy?template=https://github.com/docusealco/docuseal-heroku) | [<img alt="Deploy on Railway" src="https://railway.app/button.svg" height="40">](https://railway.app/template/IGoDnc?referralCode=ruU7JR)|
+|**DigitalOcean**|**Render**|
+| [<img alt="Deploy on DigitalOcean" src="https://www.deploytodo.com/do-btn-blue.svg" height="40">](https://cloud.digitalocean.com/apps/new?repo=https://github.com/docusealco/docuseal-digitalocean/tree/master&refcode=421d50f53990) | [<img alt="Deploy to Render" src="https://render.com/images/deploy-to-render-button.svg" height="40">](https://render.com/deploy?repo=https://github.com/docusealco/docuseal-render)
+|**Koyeb**|**Elestio**|
+| [<img alt="Deploy on Koyeb" src="https://www.koyeb.com/static/images/deploy/button.svg" height="40">](https://app.koyeb.com/deploy?name=docuseal&type=docker&image=docker.io/docuseal/docuseal&env[PORT]=8000&env[DATABASE_URL]=CHANGE_ME&env[SECRET_KEY_BASE]=CHANGE_ME&ports=8000;http;/) | [<img alt="Deploy on Elestio" src="https://pub-da36157c854648669813f3f76c526c2b.r2.dev/deploy-on-elestio-black.png">](https://dash.elest.io/deploy?soft=DocuSeal&id=339) |
 
-* Configuration
 
-* Database creation
+#### Docker
 
-* Database initialization
+```sh
+docker run --name docuseal -p 3000:3000 -v.:/data docuseal/docuseal
+```
 
-* How to run the test suite
+By default DocuSeal docker container uses an SQLite database to store data and configurations. Alternatively, it is possible use PostgreSQL or MySQL databases by specifying the `DATABASE_URL` env variable.
 
-* Services (job queues, cache servers, search engines, etc.)
+#### Docker Compose
 
-* Deployment instructions
+Download docker-compose.yml into your private server:
+```sh
+curl https://raw.githubusercontent.com/docusealco/docuseal/master/docker-compose.yml > docker-compose.yml
+```
 
-* ...
+Run the app under a custom domain over https using docker compose (make sure your DNS points to the server to automatically issue ssl certs with Caddy):
+```sh
+HOST=your-domain-name.com docker-compose up
+```
+
+## For Companies
+### Integrate seamless document signing into your web or mobile apps with DocuSeal!
+
+At DocuSeal we have expertise and technologies to make documents creation, filling, signing and processing seamlessly integrated with your product. We specialize in working with various industries, including **Banking, Healthcare, Transport, Real Estate, eCommerce, KYC, CRM, and other software products** that require bulk document signing. By leveraging DocuSeal, we can assist in reducing the overall cost of developing and processing electronic documents while ensuring security and compliance with local electronic document laws.
+
+[![Book an Integration Demo](https://cal.com/book-with-cal-dark.svg)](https://cal.com/docuseal)
+
+## License
+
+Distributed under the AGPLv3 License. See [LICENSE](https://github.com/docusealco/docuseal/blob/master/LICENSE) for more information.
+Unless otherwise noted, all files © 2023 Oleksandr Turchyn.

app/controllers/accounts_controller.rb

@@ -9,6 +9,9 @@ class AccountsController < ApplicationController
     'de-DE' => 'German (Germany)'
   }.freeze
 
+  before_action :load_account
+  authorize_resource :account
+
   def show; end
 
   def update
@@ -35,11 +38,17 @@ class AccountsController < ApplicationController
 
   private
 
+  def load_account
+    @account = current_account
+  end
+
   def account_params
     params.require(:account).permit(:name, :timezone, :locale)
   end
 
   def app_url_params
+    return {} if params[:encrypted_config].blank?
+
     params.require(:encrypted_config).permit(:value)
   end
 end

app/controllers/api/api_base_controller.rb

@@ -5,6 +5,15 @@ module Api
     include ActiveStorage::SetCurrent
 
     before_action :authenticate_user!
+    check_authorization
+
+    if Rails.env.production?
+      rescue_from CanCan::AccessDenied do |e|
+        Rollbar.error(e) if defined?(Rollbar)
+
+        render json: { error: e.message }, status: :forbidden
+      end
+    end
 
     private
 

app/controllers/api/attachments_controller.rb

@@ -3,24 +3,12 @@
 module Api
   class AttachmentsController < ApiBaseController
     skip_before_action :authenticate_user!
+    skip_authorization_check
 
     def create
       submitter = Submitter.find_by!(slug: params[:submitter_slug])
 
-      blob =
+      attachment = Submitters.create_attachment!(submitter, params)
-        if (file = params[:file])
-          ActiveStorage::Blob.create_and_upload!(io: file.open,
-                                                 filename: file.original_filename,
-                                                 content_type: file.content_type)
-        else
-          ActiveStorage::Blob.find_signed(params[:blob_signed_id])
-        end
-
-      attachment = ActiveStorage::Attachment.create!(
-        blob:,
-        name: params[:name],
-        record: submitter
-      )
 
       render json: attachment.as_json(only: %i[uuid], methods: %i[url filename content_type])
     end

app/controllers/api/submissions_controller.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Api
+  class SubmissionsController < ApiBaseController
+    load_and_authorize_resource :template
+
+    before_action do
+      authorize!(:create, Submission)
+    end
+
+    def create
+      is_send_email = !params[:send_email].in?(['false', false])
+
+      submissions =
+        if (emails = (params[:emails] || params[:email]).presence)
+          Submissions.create_from_emails(template: @template,
+                                         user: current_user,
+                                         source: :api,
+                                         mark_as_sent: is_send_email,
+                                         emails:)
+        else
+          submissions_attrs, attachments = normalize_submissions_params!(submissions_params[:submission], @template)
+
+          Submissions.create_from_submitters(
+            template: @template,
+            user: current_user,
+            source: :api,
+            mark_as_sent: is_send_email,
+            submitters_order: params[:submitters_order] || 'preserved',
+            submissions_attrs:
+          )
+        end
+
+      Submissions.send_signature_requests(submissions, send_email: is_send_email)
+
+      submitters = submissions.flat_map(&:submitters)
+
+      save_default_value_attachments!(attachments, submitters)
+
+      render json: submitters
+    rescue Submitters::NormalizeValues::UnknownFieldName, Submitters::NormalizeValues::UnknownSubmitterName => e
+      render json: { error: e.message }, status: :unprocessable_entity
+    end
+
+    private
+
+    def submissions_params
+      params.permit(submission: [{
+                      submitters: [[:uuid, :name, :email, :role, :completed, :phone, { values: {} }]]
+                    }])
+    end
+
+    def normalize_submissions_params!(submissions_params, template)
+      attachments = []
+
+      Array.wrap(submissions_params).each do |submission|
+        submission[:submitters].each_with_index do |submitter, index|
+          next if submitter[:values].blank?
+
+          values, new_attachments =
+            Submitters::NormalizeValues.call(template,
+                                             submitter[:values],
+                                             submitter[:role] || template.submitters[index]['name'])
+
+          attachments.push(*new_attachments)
+
+          submitter[:values] = values
+        end
+      end
+
+      [submissions_params, attachments]
+    end
+
+    def save_default_value_attachments!(attachments, submitters)
+      return if attachments.blank?
+
+      attachments_index = attachments.index_by(&:uuid)
+
+      submitters.each do |submitter|
+        submitter.values.to_a.each do |_, value|
+          attachment = attachments_index[value]
+
+          next unless attachment
+
+          attachment.record = submitter
+
+          attachment.save!
+        end
+      end
+    end
+  end
+end

app/controllers/api/submitter_email_clicks_controller.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Api
+  class SubmitterEmailClicksController < ApiBaseController
+    skip_before_action :authenticate_user!
+    skip_authorization_check
+
+    def create
+      submitter = Submitter.find_by!(slug: params[:submitter_slug])
+
+      if params[:t] == SubmissionEvents.build_tracking_param(submitter, 'click_email')
+        SubmissionEvents.create_with_tracking_data(submitter, 'click_email', request)
+      end
+
+      render json: {}
+    end
+  end
+end

app/controllers/api/submitter_form_views_controller.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Api
+  class SubmitterFormViewsController < ApiBaseController
+    skip_before_action :authenticate_user!
+    skip_authorization_check
+
+    def create
+      submitter = Submitter.find_by!(slug: params[:submitter_slug])
+
+      SubmissionEvents.create_with_tracking_data(submitter, 'view_form', request)
+
+      SendFormViewedWebhookRequestJob.perform_later(submitter)
+
+      render json: {}
+    end
+  end
+end

app/controllers/api/submitters_autocomplete_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Api
+  class SubmittersAutocompleteController < ApiBaseController
+    load_and_authorize_resource :submitter, parent: false
+
+    SELECT_COLUMNS = %w[email phone name].freeze
+    LIMIT = 100
+
+    def index
+      submitters = search_submitters(@submitters)
+
+      values = submitters.limit(LIMIT).group(SELECT_COLUMNS.join(', ')).pluck(SELECT_COLUMNS.join(', '))
+
+      attrs = values.map { |row| SELECT_COLUMNS.zip(row).to_h }
+      attrs = attrs.uniq { |e| e[params[:field]] } if params[:field].present?
+
+      render json: attrs
+    end
+
+    private
+
+    def search_submitters(submitters)
+      if SELECT_COLUMNS.include?(params[:field])
+        column = Submitter.arel_table[params[:field].to_sym]
+
+        term = "%#{params[:q].downcase}%"
+
+        submitters.where(column.lower.matches(term))
+      else
+        Submitters.search(submitters, params[:q])
+      end
+    end
+  end
+end

app/controllers/api/template_folders_autocomplete_controller.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Api
+  class TemplateFoldersAutocompleteController < ApiBaseController
+    load_and_authorize_resource :template_folder, parent: false
+
+    LIMIT = 100
+
+    def index
+      template_folders = @template_folders.joins(:templates).where(templates: { deleted_at: nil }).distinct
+      template_folders = TemplateFolders.search(template_folders, params[:q]).limit(LIMIT)
+
+      render json: template_folders.as_json(only: %i[name deleted_at])
+    end
+  end
+end

app/controllers/api/templates_controller.rb

@@ -2,9 +2,18 @@
 
 module Api
   class TemplatesController < ApiBaseController
-    def update
+    load_and_authorize_resource :template
-      @template = current_account.templates.find(params[:id])
 
+    def index
+      render json: @templates
+    end
+
+    def show
+      render json: @template.as_json(include: { author: { only: %i[id email first_name last_name] },
+                                                documents: { only: %i[id uuid], methods: %i[url filename] } })
+    end
+
+    def update
       @template.update!(template_params)
 
       render :ok

app/controllers/api/templates_documents_controller.rb

@@ -2,15 +2,12 @@
 
 module Api
   class TemplatesDocumentsController < ApiBaseController
+    load_and_authorize_resource :template
+
     def create
-      @template = current_account.templates.find(params[:template_id])
+      return head :unprocessable_entity if params[:blobs].blank? && params[:files].blank?
 
-      documents =
+      documents = Templates::CreateAttachments.call(@template, params)
-        find_or_create_blobs.map do |blob|
-          document = @template.documents.create!(blob:)
-
-          Templates::ProcessDocument.call(document)
-        end
 
       schema = documents.map do |doc|
         { attachment_uuid: doc.uuid, name: doc.filename.base }
@@ -25,19 +22,5 @@ module Api
         )
       }
     end
-
-    private
-
-    def find_or_create_blobs
-      blobs = params[:blobs]&.map do |attrs|
-        ActiveStorage::Blob.find_signed(attrs[:signed_id])
-      end
-
-      blobs || params[:files].map do |file|
-        ActiveStorage::Blob.create_and_upload!(io: file.open,
-                                               filename: file.original_filename,
-                                               content_type: file.content_type)
-      end
-    end
   end
 end

app/controllers/api_settings_controller.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class ApiSettingsController < ApplicationController
+  def index
+    authorize!(:read, current_user.access_token)
+  end
+end

app/controllers/application_controller.rb

@@ -4,6 +4,8 @@ class ApplicationController < ActionController::Base
   include ActiveStorage::SetCurrent
   include Pagy::Backend
 
+  check_authorization unless: :devise_controller?
+
   before_action :sign_in_for_demo, if: -> { Docuseal.demo? }
   before_action :maybe_redirect_to_setup, unless: :signed_in?
   before_action :authenticate_user!, unless: :devise_controller?
@@ -16,6 +18,14 @@ class ApplicationController < ActionController::Base
     redirect_to request.path
   end
 
+  if Rails.env.production?
+    rescue_from CanCan::AccessDenied do |e|
+      Rollbar.error(e) if defined?(Rollbar)
+
+      redirect_back(fallback_location: root_path, alert: e.message)
+    end
+  end
+
   def default_url_options
     Docuseal.default_url_options
   end
@@ -23,7 +33,7 @@ class ApplicationController < ActionController::Base
   private
 
   def sign_in_for_demo
-    sign_in(User.first) unless signed_in?
+    sign_in(User.order('random()').take) unless signed_in?
   end
 
   def current_account
@@ -34,8 +44,8 @@ class ApplicationController < ActionController::Base
     redirect_to setup_index_path unless User.exists?
   end
 
-  def button_title(title: 'Submit', disabled_with: 'Submitting', icon: nil)
+  def button_title(title: 'Submit', disabled_with: 'Submitting', icon: nil, icon_disabled: nil)
-    render_to_string(partial: 'shared/button_title', locals: { title:, disabled_with:, icon: })
+    render_to_string(partial: 'shared/button_title', locals: { title:, disabled_with:, icon:, icon_disabled: })
   end
 
   def svg_icon(icon_name, class: '')

app/controllers/console_redirect_controller.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class ConsoleRedirectController < ApplicationController
+  skip_before_action :authenticate_user!
+  skip_authorization_check
+
+  def index
+    return redirect_to(new_user_session_path({ redir: params[:redir] }.compact)) if current_user.blank?
+
+    auth = JsonWebToken.encode(uuid: current_user.uuid,
+                               scope: :console,
+                               exp: 1.minute.from_now.to_i)
+
+    path = Addressable::URI.parse(params[:redir]).path if params[:redir].to_s.starts_with?(Docuseal::CONSOLE_URL)
+
+    redirect_to("#{Docuseal::CONSOLE_URL}#{path}?#{{ auth: }.to_query}", allow_other_host: true)
+  end
+end

app/controllers/dashboard_controller.rb

@@ -3,11 +3,68 @@
 class DashboardController < ApplicationController
   skip_before_action :authenticate_user!, only: %i[index]
 
+  before_action :maybe_redirect_product_url
+  before_action :maybe_render_landing
+
+  load_and_authorize_resource :template_folder, parent: false
+  load_and_authorize_resource :template, parent: false
+
+  SHOW_TEMPLATES_FOLDERS_THRESHOLD = 9
+  TEMPLATES_PER_PAGE = 12
+  FOLDERS_PER_PAGE = 18
+
   def index
-    return render 'pages/landing' unless signed_in?
+    @template_folders = filter_template_folders(@template_folders)
 
-    templates = current_account.templates.active.preload(:author).order(id: :desc)
+    @pagy, @template_folders = pagy(
+      @template_folders,
+      items: FOLDERS_PER_PAGE,
+      page: @template_folders.count > SHOW_TEMPLATES_FOLDERS_THRESHOLD ? params[:page] : 1
+    )
 
-    @pagy, @templates = pagy(templates, items: 12)
+    if @pagy.count > SHOW_TEMPLATES_FOLDERS_THRESHOLD
+      @templates = @templates.none
+    else
+      @template_folders = @template_folders.reject { |e| e.name == TemplateFolder::DEFAULT_NAME }
+      @templates = filter_templates(@templates)
+
+      items =
+        if @template_folders.size < 4
+          TEMPLATES_PER_PAGE
+        else
+          (@template_folders.size < 7 ? 9 : 6)
+        end
+
+      @pagy, @templates = pagy(@templates, items:)
+    end
+  end
+
+  private
+
+  def filter_template_folders(template_folders)
+    rel = template_folders.joins(:active_templates)
+                          .order(id: :desc)
+                          .distinct
+
+    TemplateFolders.search(rel, params[:q])
+  end
+
+  def filter_templates(templates)
+    rel = templates.active.preload(:author).order(id: :desc)
+    rel = rel.where(folder_id: current_account.default_template_folder.id) if params[:q].blank?
+
+    Templates.search(rel, params[:q])
+  end
+
+  def maybe_redirect_product_url
+    return if !Docuseal.multitenant? || signed_in?
+
+    redirect_to Docuseal::PRODUCT_URL, allow_other_host: true
+  end
+
+  def maybe_render_landing
+    return if signed_in?
+
+    render 'pages/landing'
   end
 end

app/controllers/email_smtp_settings_controller.rb

@@ -1,16 +1,24 @@
 # frozen_string_literal: true
 
-class EmailSettingsController < ApplicationController
+class EmailSmtpSettingsController < ApplicationController
   before_action :load_encrypted_config
+  authorize_resource :encrypted_config, only: :index
+  authorize_resource :encrypted_config, parent: false, only: :create
 
   def index; end
 
   def create
-    if @encrypted_config.update(storage_configs)
+    if @encrypted_config.update(email_configs)
+      SettingsMailer.smtp_successful_setup(@encrypted_config.value['from_email']).deliver_now!
+
       redirect_to settings_email_index_path, notice: 'Changes have been saved'
     else
       render :index, status: :unprocessable_entity
     end
+  rescue StandardError => e
+    flash[:alert] = e.message
+
+    render :index, status: :unprocessable_entity
   end
 
   private
@@ -20,7 +28,7 @@ class EmailSettingsController < ApplicationController
       EncryptedConfig.find_or_initialize_by(account: current_account, key: EncryptedConfig::EMAIL_SMTP_KEY)
   end
 
-  def storage_configs
+  def email_configs
     params.require(:encrypted_config).permit(value: {}).tap do |e|
       e[:value].compact_blank!
     end

app/controllers/esign_settings_controller.rb

@@ -1,19 +1,113 @@
 # frozen_string_literal: true
 
 class EsignSettingsController < ApplicationController
+  DEFAULT_CERT_NAME = 'DocuSeal Self-Host Autogenerated'
+
+  CertFormRecord = Struct.new(:name, :file, :password, keyword_init: true) do
+    include ActiveModel::Validations
+
+    def to_key
+      []
+    end
+  end
+
+  before_action :load_encrypted_config
+  authorize_resource :encrypted_config, parent: false, only: %i[new create]
+  authorize_resource :encrypted_config, only: %i[update destroy show]
+
+  def show
+    cert_data = @encrypted_config.value || {}
+
+    default_pkcs = GenerateCertificate.load_pkcs(cert_data) if cert_data['cert'].present?
+
+    custom_pkcs_list = (cert_data['custom'] || []).map do |e|
+      { 'pkcs' => OpenSSL::PKCS12.new(Base64.urlsafe_decode64(e['data']), e['password'].to_s),
+        'name' => e['name'],
+        'status' => e['status'] }
+    end
+
+    @pkcs_list = [
+      if default_pkcs
+        {
+          'pkcs' => default_pkcs,
+          'name' => DEFAULT_CERT_NAME,
+          'status' => custom_pkcs_list.any? { |e| e['status'] == 'default' } ? 'validate' : 'default'
+        }
+      end,
+      *custom_pkcs_list
+    ].compact.reverse
+  end
+
+  def new
+    @cert_record = CertFormRecord.new
+  end
+
   def create
-    pdfs =
+    @cert_record = CertFormRecord.new(**cert_params)
-      params[:files].map do |file|
-        HexaPDF::Document.new(io: file.open)
-      end
 
-    certs = Accounts.load_signing_certs(current_account)
+    if (@encrypted_config.value && @encrypted_config.value['custom']&.any? { |e| e['name'] == @cert_record.name }) ||
+       @cert_record.name == DEFAULT_CERT_NAME
 
-    trusted_certs = [certs[:cert], certs[:sub_ca], certs[:root_ca]]
+      @cert_record.errors.add(:name, 'already exists')
 
-    render turbo_stream: turbo_stream.replace('result', partial: 'result',
+      return render turbo_stream: turbo_stream.replace(:modal, template: 'esign_settings/new'),
-                                                        locals: { pdfs:, files: params[:files], trusted_certs: })
+                    status: :unprocessable_entity
-  rescue HexaPDF::MalformedPDFError
+    end
-    render turbo_stream: turbo_stream.replace('result', html: helpers.tag.div('Invalid PDF', id: 'result'))
+
+    save_new_cert!(@encrypted_config, @cert_record)
+
+    redirect_to settings_esign_path, notice: 'Certificate has been successfully added!'
+  rescue OpenSSL::PKCS12::PKCS12Error
+    @cert_record.errors.add(:password, "is invalid. Make sure you're uploading a valid .p12 file")
+
+    render turbo_stream: turbo_stream.replace(:modal, template: 'esign_settings/new'), status: :unprocessable_entity
+  end
+
+  def update
+    @encrypted_config.value['custom'].each { |e| e['status'] = 'validate' }
+
+    custom_cert_data = @encrypted_config.value['custom'].find { |e| e['name'] == params[:name] }
+    custom_cert_data['status'] = 'default' if custom_cert_data
+
+    @encrypted_config.save!
+
+    redirect_to settings_esign_path, notice: 'Default certificate has been selected'
+  end
+
+  def destroy
+    @encrypted_config.value['custom'].reject! { |e| e['name'] == params[:name] }
+
+    @encrypted_config.save!
+
+    redirect_to settings_esign_path, notice: 'Certificate has been removed'
+  end
+
+  private
+
+  def load_encrypted_config
+    @encrypted_config = EncryptedConfig.find_or_initialize_by(account: current_account,
+                                                              key: EncryptedConfig::ESIGN_CERTS_KEY)
+  end
+
+  def save_new_cert!(cert_configs, cert_record)
+    pkcs = OpenSSL::PKCS12.new(cert_record.file.read, cert_record.password)
+
+    cert_configs.value ||= {}
+    cert_configs.value['custom'] ||= []
+    cert_configs.value['custom'].each { |e| e['status'] = 'validate' }
+    cert_configs.value['custom'] << {
+      data: Base64.urlsafe_encode64(pkcs.to_der),
+      password: cert_record.password,
+      name: cert_record.name,
+      status: 'default'
+    }
+
+    cert_configs.save!
+  end
+
+  def cert_params
+    return {} if params[:esign_settings_controller_cert_form_record].blank?
+
+    params.require(:esign_settings_controller_cert_form_record).permit(:name, :file, :password)
   end
 end

app/controllers/mfa_setup_controller.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+class MfaSetupController < ApplicationController
+  before_action do
+    authorize!(:update, current_user)
+  end
+
+  def new
+    current_user.otp_secret ||= User.generate_otp_secret
+
+    current_user.save!
+
+    @provision_url = current_user.otp_provisioning_uri(current_user.email, issuer: Docuseal::PRODUCT_NAME)
+  end
+
+  def edit; end
+
+  def create
+    if current_user.validate_and_consume_otp!(params[:otp_attempt])
+      current_user.otp_required_for_login = true
+      current_user.save!
+
+      redirect_to settings_profile_index_path, notice: '2FA has been configured'
+    else
+      @provision_url = current_user.otp_provisioning_uri(current_user.email, issuer: Docuseal::PRODUCT_NAME)
+
+      @error_message = 'Code is invalid'
+
+      render turbo_stream: turbo_stream.replace(:modal, template: 'mfa_setup/new'), status: :unprocessable_entity
+    end
+  end
+
+  def destroy
+    if current_user.validate_and_consume_otp!(params[:otp_attempt])
+      current_user.update!(otp_required_for_login: false, otp_secret: nil)
+
+      redirect_to settings_profile_index_path, notice: '2FA has been removed'
+    else
+      @error_message = 'Code is invalid'
+
+      render turbo_stream: turbo_stream.replace(:modal, template: 'mfa_setup/edit'), status: :unprocessable_entity
+    end
+  end
+end

app/controllers/newsletters_controller.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class NewslettersController < ApplicationController
+  skip_authorization_check
+
   def show; end
 
   def update

app/controllers/notifications_settings_controller.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+class NotificationsSettingsController < ApplicationController
+  before_action :load_bcc_config, only: :index
+  before_action :load_reminder_config, only: :index
+  authorize_resource :bcc_config, only: :index
+  authorize_resource :reminder_config, only: :index
+
+  before_action :build_account_config, only: :create
+  authorize_resource :account_config, only: :create
+
+  def index; end
+
+  def create
+    if @account_config.save
+      redirect_back fallback_location: settings_notifications_path, notice: 'Changes have been saved'
+    else
+      redirect_back fallback_location: settings_notifications_path, alert: 'Unable to save'
+    end
+  end
+
+  private
+
+  def build_account_config
+    @account_config =
+      AccountConfig.find_or_initialize_by(account: current_account, key: email_config_params[:key])
+
+    @account_config.assign_attributes(email_config_params)
+  end
+
+  def load_bcc_config
+    @bcc_config =
+      AccountConfig.find_or_initialize_by(account: current_account, key: AccountConfig::BCC_EMAILS)
+  end
+
+  def load_reminder_config
+    @reminder_config =
+      AccountConfig.find_or_initialize_by(account: current_account, key: AccountConfig::SUBMITTER_REMAILERS)
+  end
+
+  def email_config_params
+    params.require(:account_config).permit!.tap do |attrs|
+      attrs[:key] = nil unless attrs[:key].in?([AccountConfig::BCC_EMAILS, AccountConfig::SUBMITTER_REMAILERS])
+    end
+  end
+end

app/controllers/omniauth_callbacks_controller.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class OmniauthCallbacksController < Devise::OmniauthCallbacksController
+  def google_oauth2
+    @user = Users.from_omniauth(request.env['omniauth.auth'])
+
+    if @user.persisted?
+      flash[:notice] = I18n.t('devise.omniauth_callbacks.success', kind: 'Google')
+
+      sign_in_and_redirect @user, event: :authentication
+    else
+      redirect_to new_registration_path(oauth_callback: true, user: @user.slice(:email, :first_name, :last_name)),
+                  notice: 'Please complete registration with Google auth'
+    end
+  end
+end

app/controllers/personalization_settings_controller.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class PersonalizationSettingsController < ApplicationController
+  def show
+    authorize!(:read, AccountConfig)
+  end
+
+  def create
+    account_config =
+      current_account.account_configs.find_or_initialize_by(key: encrypted_config_params[:key])
+
+    authorize!(:create, account_config)
+
+    account_config.update!(encrypted_config_params)
+
+    redirect_back(fallback_location: settings_personalization_path, notice: 'Settings have been saved.')
+  end
+
+  private
+
+  def encrypted_config_params
+    params.require(:account_config).permit!
+  end
+end

app/controllers/profile_controller.rb

@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 
 class ProfileController < ApplicationController
+  before_action do
+    authorize!(:manage, current_user)
+  end
+
   def index; end
 
   def update_contact

app/controllers/registrations_controller.rb

@@ -1,24 +1,62 @@
 # frozen_string_literal: true
 
 class RegistrationsController < Devise::RegistrationsController
+  prepend_before_action :require_no_authentication, only: [:show]
+  prepend_before_action :maybe_redirect_if_signed_in, only: [:show]
+
+  def show; end
+
+  def create
+    super
+
+    Accounts.create_default_template(resource.account) if resource.account.persisted?
+  end
+
   private
 
+  def after_sign_up_path_for(...)
+    if params[:redir].present?
+      return console_redirect_index_path(redir: params[:redir]) if params[:redir].starts_with?(Docuseal::CONSOLE_URL)
+
+      return params[:redir]
+    end
+
+    super
+  end
+
+  def maybe_redirect_if_signed_in
+    return unless signed_in?
+    return if params[:redir].blank?
+
+    redirect_to after_sign_up_path_for(current_user), allow_other_host: true
+  end
+
+  def require_no_authentication
+    super
+
+    flash.clear
+  end
+
   def build_resource(_hash = {})
     account = Account.new(account_params)
     account.timezone = Accounts.normalize_timezone(account.timezone)
 
     self.resource = account.users.new(user_params)
+
+    account.name ||= "#{resource.full_name}'s Company" if params[:action] == 'create'
   end
 
   def user_params
     return {} if params[:user].blank?
 
-    params.require(:user).permit(:first_name, :last_name, :email, :password)
+    params.require(:user).permit(:first_name, :last_name, :email, :password).compact_blank.tap do |attrs|
+      attrs[:password] ||= SecureRandom.hex if params[:action] == 'create'
+    end
   end
 
   def account_params
     return {} if params[:account].blank?
 
-    params.require(:account).permit(:name, :timezone)
+    params.require(:account).permit(:name, :timezone).compact_blank
   end
 end

app/controllers/send_submission_email_controller.rb

@@ -5,6 +5,7 @@ class SendSubmissionEmailController < ApplicationController
 
   skip_before_action :authenticate_user!
   skip_before_action :verify_authenticity_token
+  skip_authorization_check
 
   def success; end
 

app/controllers/sessions_controller.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+class SessionsController < Devise::SessionsController
+  before_action :configure_permitted_parameters
+
+  def create
+    if Docuseal.multitenant? && !User.exists?(email: sign_in_params[:email])
+      return redirect_to new_registration_path(sign_up: true, user: sign_in_params.slice(:email)),
+                         notice: 'Create a new account'
+    end
+
+    if User.exists?(email: sign_in_params[:email], otp_required_for_login: true) && sign_in_params[:otp_attempt].blank?
+      return render :otp, locals: { resource: User.new(sign_in_params) }, status: :unprocessable_entity
+    end
+
+    super
+  end
+
+  private
+
+  def after_sign_in_path_for(...)
+    if params[:redir].present?
+      return console_redirect_index_path(redir: params[:redir]) if params[:redir].starts_with?(Docuseal::CONSOLE_URL)
+
+      return params[:redir]
+    end
+
+    super
+  end
+
+  def configure_permitted_parameters
+    devise_parameter_sanitizer.permit(:sign_in, keys: [:otp_attempt])
+  end
+
+  def require_no_authentication
+    super
+
+    flash.clear
+  end
+end

app/controllers/setup_controller.rb

@@ -3,6 +3,7 @@
 class SetupController < ApplicationController
   skip_before_action :maybe_redirect_to_setup
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   before_action :redirect_to_root_if_signed, if: :signed_in?
   before_action :ensure_first_user_not_created!
@@ -16,16 +17,17 @@ class SetupController < ApplicationController
   def create
     @account = Account.new(account_params)
     @account.timezone = Accounts.normalize_timezone(@account.timezone)
-
     @user = @account.users.new(user_params)
+    @encrypted_config = EncryptedConfig.new(encrypted_config_params)
 
     unless URI.parse(encrypted_config_params[:value].to_s).class.in?([URI::HTTP, URI::HTTPS])
-      @encrypted_config = EncryptedConfig.new(encrypted_config_params)
       @encrypted_config.errors.add(:value, 'should be a valid URL')
 
       return render :index, status: :unprocessable_entity
     end
 
+    return render :index, status: :unprocessable_entity unless @account.valid?
+
     if @user.save
       encrypted_configs = [
         { key: EncryptedConfig::APP_URL_KEY, value: encrypted_config_params[:value] },

app/controllers/sms_settings_controller.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class SmsSettingsController < ApplicationController
+  before_action :load_encrypted_config
+  authorize_resource :encrypted_config, only: :index
+  authorize_resource :encrypted_config, parent: false, except: :index
+
+  def index; end
+
+  private
+
+  def load_encrypted_config
+    @encrypted_config =
+      EncryptedConfig.find_or_initialize_by(account: current_account, key: 'sms_configs')
+  end
+end

app/controllers/start_form_controller.rb

@@ -4,6 +4,7 @@ class StartFormController < ApplicationController
   layout 'form'
 
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   before_action :load_template
 
@@ -20,12 +21,13 @@ class StartFormController < ApplicationController
     else
       @submitter.assign_attributes(
         uuid: @template.submitters.first['uuid'],
-        opened_at: Time.current,
         ip: request.remote_ip,
         ua: request.user_agent
       )
 
-      @submitter.submission ||= Submission.new(template: @template)
+      @submitter.submission ||= Submission.new(template: @template,
+                                               template_submitters: @template.submitters,
+                                               source: :link)
 
       if @submitter.save
         redirect_to submit_form_path(@submitter.slug)
@@ -36,13 +38,17 @@ class StartFormController < ApplicationController
   end
 
   def completed
-    @submitter = Submitter.where(submission: @template.submissions).find_by!(email: params[:email])
+    @submitter = Submitter.where(submission: @template.submissions)
+                          .where.not(completed_at: nil)
+                          .find_by!(email: params[:email])
   end
 
   private
 
   def submitter_params
-    params.require(:submitter).permit(:email)
+    params.require(:submitter).permit(:email).tap do |attrs|
+      attrs[:email] = Submissions.normalize_email(attrs[:email])
+    end
   end
 
   def load_template

app/controllers/storage_settings_controller.rb

@@ -2,6 +2,8 @@
 
 class StorageSettingsController < ApplicationController
   before_action :load_encrypted_config
+  authorize_resource :encrypted_config, only: :index
+  authorize_resource :encrypted_config, parent: false, only: :create
 
   def index; end
 

app/controllers/submissions_controller.rb

@@ -2,73 +2,57 @@
 
 class SubmissionsController < ApplicationController
   before_action :load_template, only: %i[new create]
+  authorize_resource :template, only: %i[new create]
+
+  load_and_authorize_resource :submission, only: %i[show destroy]
 
   def show
-    @submission =
+    ActiveRecord::Associations::Preloader.new(
-      Submission.joins(:template).where(template: { account_id: current_account.id })
+      records: [@submission],
-                .preload(template: { documents_attachments: { preview_images_attachments: :blob } })
+      associations: [:template, { template_schema_documents: [:blob, { preview_images_attachments: :blob }] }]
-                .find(params[:id])
+    ).call
 
     render :show, layout: 'plain'
   end
 
-  def new; end
+  def new
+    authorize!(:new, Submission)
+  end
 
   def create
+    authorize!(:create, Submission)
+
     submissions =
       if params[:emails].present?
-        create_submissions_from_emails
+        Submissions.create_from_emails(template: @template,
+                                       user: current_user,
+                                       source: :invite,
+                                       mark_as_sent: params[:send_email] == '1',
+                                       emails: params[:emails])
       else
-        create_submissions_from_submitters
+        Submissions.create_from_submitters(template: @template,
+                                           user: current_user,
+                                           source: :invite,
+                                           submitters_order: params[:preserve_order] == '1' ? 'preserved' : 'random',
+                                           mark_as_sent: params[:send_email] == '1',
+                                           submissions_attrs: submissions_params[:submission].to_h.values)
       end
 
-    if params[:send_email] == '1'
+    Submissions.send_signature_requests(submissions, params)
-      submissions.flat_map(&:submitters).each do |submitter|
-        SubmitterMailer.invitation_email(submitter, message: params[:message]).deliver_later!
-      end
-    end
 
-    redirect_to template_path(@template),
+    redirect_to template_path(@template), notice: 'New recipients have been added'
-                notice: "#{submissions.size} #{'recipient'.pluralize(submissions.size)} added"
   end
 
   def destroy
-    submission = Submission.joins(:template).where(template: { account_id: current_account.id })
+    @submission.update!(deleted_at: Time.current)
-                           .find(params[:id])
 
-    submission.update!(deleted_at: Time.current)
+    redirect_back(fallback_location: template_path(@submission.template), notice: 'Submission has been archived')
-
-    redirect_back(fallback_location: template_path(submission.template), notice: 'Submission has been archived')
   end
 
   private
 
-  def create_submissions_from_emails
-    emails = params[:emails].to_s.scan(User::EMAIL_REGEXP)
-
-    emails.map do |email|
-      submission = @template.submissions.new(created_by_user: current_user)
-      submission.submitters.new(email:, uuid: @template.submitters.first['uuid'],
-                                sent_at: params[:send_email] == '1' ? Time.current : nil)
-
-      submission.tap(&:save!)
-    end
-  end
-
-  def create_submissions_from_submitters
-    submissions_params[:submission].to_h.map do |_, attrs|
-      submission = @template.submissions.new(created_by_user: current_user)
-
-      attrs[:submitters].each do |submitter_attrs|
-        submission.submitters.new(**submitter_attrs, sent_at: params[:send_email] == '1' ? Time.current : nil)
-      end
-
-      submission.tap(&:save!)
-    end
-  end
-
   def submissions_params
-    params.permit(submission: { submitters: [%i[uuid email]] })
+    params.permit(submission: { submitters: [%i[uuid email phone name]] })
   end
 
   def load_template

app/controllers/submissions_debug_controller.rb

@@ -4,6 +4,7 @@ class SubmissionsDebugController < ApplicationController
   layout 'plain'
 
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   def index
     @submitter = Submitter.preload({ attachments_attachments: :blob },
@@ -15,9 +16,13 @@ class SubmissionsDebugController < ApplicationController
         render 'submit_form/show'
       end
       f.pdf do
-        Submissions::GenerateResultAttachments.call(@submitter)
+        if params[:audit]
+          Submissions::GenerateAuditTrail.call(@submitter.submission)
+        else
+          Submissions::GenerateResultAttachments.call(@submitter)
+        end
 
-        send_data ActiveStorage::Attachment.where(name: :documents).last.download,
+        send_data ActiveStorage::Attachment.where(name: params[:audit] ? :audit_trail : :documents).last.download,
                   filename: 'debug.pdf',
                   disposition: 'inline',
                   type: 'application/pdf'

app/controllers/submissions_download_controller.rb

@@ -2,14 +2,19 @@
 
 class SubmissionsDownloadController < ApplicationController
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   def index
     submitter = Submitter.find_by(slug: params[:submitter_slug])
 
     Submissions::EnsureResultGenerated.call(submitter)
 
+    last_submitter = submitter.submission.submitters.where.not(completed_at: nil).order(:completed_at).last
+
+    Submissions::EnsureResultGenerated.call(last_submitter)
+
     urls =
-      Submitters.select_attachments_for_download(submitter).map do |attachment|
+      Submitters.select_attachments_for_download(last_submitter).map do |attachment|
         helpers.rails_blob_url(attachment)
       end
 

app/controllers/submissions_export_controller.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class SubmissionsExportController < ApplicationController
+  load_and_authorize_resource :template
+  load_and_authorize_resource :submission, through: :template, parent: false, only: :index
+
+  def index
+    submissions = @submissions.active
+                              .preload(submitters: { documents_attachments: :blob,
+                                                     attachments_attachments: :blob })
+                              .order(id: :asc)
+
+    if params[:format] == 'csv'
+      send_data Submissions::GenerateExportFiles.call(submissions, format: params[:format]),
+                filename: "#{@template.name}.csv"
+    elsif params[:format] == 'xlsx'
+      send_data Submissions::GenerateExportFiles.call(submissions, format: params[:format]),
+                filename: "#{@template.name}.xlsx"
+    end
+  end
+
+  def new; end
+end

app/controllers/submit_form_controller.rb

@@ -4,49 +4,33 @@ class SubmitFormController < ApplicationController
   layout 'form'
 
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   def show
     @submitter =
-      Submitter.preload(submission: { template: { documents_attachments: { preview_images_attachments: :blob } } })
+      Submitter.preload(submission: [
+                          :template, { template_schema_documents: [:blob, { preview_images_attachments: :blob }] }
+                        ])
                .find_by!(slug: params[:slug])
 
-    cookies.signed[:submitter_sid] = @submitter.signed_id
+    return redirect_to submit_form_completed_path(@submitter.slug) if @submitter.completed_at?
 
-    redirect_to submit_form_completed_path(@submitter.slug) if @submitter.completed_at?
+    Submitters::MaybeUpdateDefaultValues.call(@submitter, current_user)
+
+    cookies[:submitter_sid] = @submitter.signed_id
   end
 
   def update
     submitter = Submitter.find_by!(slug: params[:slug])
-    submitter.values.merge!(normalized_values)
-    submitter.completed_at = Time.current if params[:completed] == 'true'
-    submitter.opened_at ||= Time.current
 
-    submitter.save!
+    Submitters::SubmitValues.call(submitter, params, request)
-
-    if submitter.completed_at?
-      GenerateSubmitterResultAttachmentsJob.perform_later(submitter)
-
-      submitter.submission.template.account.users.active.each do |user|
-        SubmitterMailer.completed_email(submitter, user).deliver_later!
-      end
-    end
 
     head :ok
+  rescue Submitters::SubmitValues::ValidationError => e
+    render json: { error: e.message }, status: :unprocessable_entity
   end
 
   def completed
     @submitter = Submitter.find_by!(slug: params[:submit_form_slug])
   end
-
-  private
-
-  def normalized_values
-    params[:values].to_unsafe_h.transform_values do |v|
-      if params[:cast_boolean] == 'true'
-        v == 'true'
-      else
-        v.is_a?(Array) ? v.compact_blank : v
-      end
-    end
-  end
 end

app/controllers/submitters_send_email_controller.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class SubmittersSendEmailController < ApplicationController
+  load_and_authorize_resource :submitter, id_param: :submitter_slug, find_by: :slug
+
+  def create
+    SubmitterMailer.invitation_email(@submitter).deliver_later!
+
+    SubmissionEvent.create!(submitter: @submitter, event_type: 'send_email')
+
+    @submitter.sent_at ||= Time.current
+    @submitter.save!
+
+    redirect_back(fallback_location: submission_path(@submitter.submission), notice: 'Email has been sent')
+  end
+end

app/controllers/template_folders_controller.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class TemplateFoldersController < ApplicationController
+  load_and_authorize_resource :template_folder
+
+  def show
+    @templates = @template_folder.templates.active.preload(:author).order(id: :desc)
+    @templates = Templates.search(@templates, params[:q])
+
+    @pagy, @templates = pagy(@templates, items: 12)
+  end
+
+  def edit; end
+
+  def update
+    if @template_folder != current_account.default_template_folder &&
+       @template_folder.update(template_folder_params)
+      redirect_to folder_path(@template_folder), notice: 'Folder name has been updated'
+    else
+      redirect_to folder_path(@template_folder), alert: 'Unable to rename folder'
+    end
+  end
+
+  private
+
+  def template_folder_params
+    params.require(:template_folder).permit(:name)
+  end
+end

app/controllers/templates_archived_controller.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+class TemplatesArchivedController < ApplicationController
+  load_and_authorize_resource :template, parent: false
+
+  def index
+    @templates = @templates.where.not(deleted_at: nil).preload(:author, :folder).order(id: :desc)
+    @templates = Templates.search(@templates, params[:q])
+
+    @pagy, @templates = pagy(@templates, items: 12)
+  end
+end

app/controllers/templates_archived_submissions_controller.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class TemplatesArchivedSubmissionsController < ApplicationController
+  load_and_authorize_resource :template
+  load_and_authorize_resource :submission, through: :template, parent: false
+
+  def index
+    @submissions = @submissions.where.not(deleted_at: nil)
+    @submissions = Submissions.search(@submissions, params[:q])
+
+    @pagy, @submissions = pagy(@submissions.preload(:submitters).order(id: :desc))
+  rescue ActiveRecord::RecordNotFound
+    redirect_to root_path
+  end
+end

app/controllers/templates_controller.rb

@@ -1,31 +1,37 @@
 # frozen_string_literal: true
 
 class TemplatesController < ApplicationController
+  load_and_authorize_resource :template
+
   before_action :load_base_template, only: %i[new create]
 
   def show
-    @template = current_account.templates.active.find(params[:id])
+    submissions = @template.submissions
+    submissions = submissions.active if @template.deleted_at.blank?
+    submissions = Submissions.search(submissions, params[:q])
 
-    @pagy, @submissions = pagy(@template.submissions.active.preload(:submitters).order(id: :desc))
+    @pagy, @submissions = pagy(submissions.preload(:submitters).order(id: :desc))
   rescue ActiveRecord::RecordNotFound
     redirect_to root_path
   end
 
   def new
-    @template = current_account.templates.new
     @template.name = "#{@base_template.name} (Clone)" if @base_template
   end
 
   def edit
-    @template = current_account.templates.preload(documents_attachments: { preview_images_attachments: :blob })
+    ActiveRecord::Associations::Preloader.new(
-                               .find(params[:id])
+      records: [@template],
+      associations: [schema_documents: { preview_images_attachments: :blob }]
+    ).call
 
     render :edit, layout: 'plain'
   end
 
   def create
-    @template = current_account.templates.new(template_params)
+    @template.account = current_account
     @template.author = current_user
+    @template.folder = TemplateFolders.find_or_create_by_name(current_user, params[:folder_name])
     @template.assign_attributes(@base_template.slice(:fields, :schema, :submitters)) if @base_template
 
     if @template.save
@@ -38,7 +44,6 @@ class TemplatesController < ApplicationController
   end
 
   def destroy
-    @template = current_account.templates.find(params[:id])
     @template.update!(deleted_at: Time.current)
 
     redirect_back(fallback_location: root_path, notice: 'Template has been archived.')
@@ -53,8 +58,6 @@ class TemplatesController < ApplicationController
   def load_base_template
     return if params[:base_template_id].blank?
 
-    @base_template = current_account.templates
+    @base_template = current_account.templates.find_by(id: params[:base_template_id])
-                                    .preload(documents_attachments: :preview_images_attachments)
-                                    .find_by(id: params[:base_template_id])
   end
 end

app/controllers/templates_folders_controller.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class TemplatesFoldersController < ApplicationController
+  load_and_authorize_resource :template
+
+  def edit; end
+
+  def update
+    @template.folder = TemplateFolders.find_or_create_by_name(current_user, params[:name])
+
+    if @template.save
+      redirect_back(fallback_location: template_path(@template), notice: 'Document template has been moved')
+    else
+      redirect_back(fallback_location: template_path(@template), notice: 'Unable to move template into folder')
+    end
+  end
+
+  private
+
+  def template_folder_params
+    params.require(:template_folder).permit(:name)
+  end
+end

app/controllers/templates_restore_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class TemplatesRestoreController < ApplicationController
+  load_and_authorize_resource :template
+
+  def create
+    @template.update!(deleted_at: nil)
+
+    redirect_to template_path(@template), notice: 'Template has been unarchived'
+  end
+end

app/controllers/templates_uploads_controller.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class TemplatesUploadsController < ApplicationController
+  load_and_authorize_resource :template, parent: false
+
+  def create
+    @template.account = current_account
+    @template.author = current_user
+    @template.folder = TemplateFolders.find_or_create_by_name(current_user, params[:folder_name])
+    @template.name = File.basename(params[:files].first.original_filename, '.*')
+
+    @template.save!
+
+    documents = Templates::CreateAttachments.call(@template, params)
+
+    schema = documents.map { |doc| { attachment_uuid: doc.uuid, name: doc.filename.base } }
+
+    @template.update!(schema:)
+
+    redirect_to edit_template_path(@template)
+  end
+end

app/controllers/user_signatures_controller.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+class UserSignaturesController < ApplicationController
+  before_action :load_user_config
+  authorize_resource :user_config
+
+  def edit; end
+
+  def update
+    file = params[:file]
+
+    return redirect_to settings_profile_index_path, notice: 'Unable to save signature' if file.blank?
+
+    blob = ActiveStorage::Blob.create_and_upload!(io: file.open,
+                                                  filename: file.original_filename,
+                                                  content_type: file.content_type)
+
+    attachment = ActiveStorage::Attachment.create!(
+      blob:,
+      name: 'signature',
+      record: current_user
+    )
+
+    if @user_config.update(value: attachment.uuid)
+      redirect_to settings_profile_index_path, notice: 'Signature has been saved'
+    else
+      redirect_to settings_profile_index_path, notice: 'Unable to save signature'
+    end
+  end
+
+  private
+
+  def load_user_config
+    @user_config =
+      UserConfig.find_or_initialize_by(user: current_user, key: UserConfig::SIGNATURE_KEY)
+  end
+end

app/controllers/users_controller.rb

@@ -1,19 +1,52 @@
 # frozen_string_literal: true
 
 class UsersController < ApplicationController
-  before_action :load_user, only: %i[edit update destroy]
+  load_and_authorize_resource :user, only: %i[index edit new update destroy]
+
+  before_action :build_user, only: :create
+  authorize_resource :user, only: :create
 
   def index
-    @pagy, @users = pagy(current_account.users.active.order(id: :desc))
+    @pagy, @users = pagy(@users.active.order(id: :desc))
   end
 
-  def new
+  def new; end
-    @user = current_account.users.new
-  end
 
   def edit; end
 
   def create
+    if @user.save
+      UserMailer.invitation_email(@user).deliver_later!
+
+      redirect_to settings_users_path, notice: 'User has been invited'
+    else
+      render turbo_stream: turbo_stream.replace(:modal, template: 'users/new'), status: :unprocessable_entity
+    end
+  end
+
+  def update
+    return redirect_to settings_users_path, notice: 'Unable to update user.' if Docuseal.demo?
+
+    if @user.update(user_params.compact_blank.except(current_user == @user ? :role : nil))
+      redirect_to settings_users_path, notice: 'User has been updated'
+    else
+      render turbo_stream: turbo_stream.replace(:modal, template: 'users/edit'), status: :unprocessable_entity
+    end
+  end
+
+  def destroy
+    if Docuseal.demo? || @user.id == current_user.id
+      return redirect_to settings_users_path, notice: 'Unable to remove user'
+    end
+
+    @user.update!(deleted_at: Time.current)
+
+    redirect_to settings_users_path, notice: 'User has been removed'
+  end
+
+  private
+
+  def build_user
     @user = current_account.users.find_by(email: user_params[:email])&.tap do |user|
       user.assign_attributes(user_params)
       user.deleted_at = nil
@@ -21,36 +54,10 @@ class UsersController < ApplicationController
 
     @user ||= current_account.users.new(user_params)
 
-    if @user.save
+    @user
-      UserMailer.invitation_email(@user).deliver_later!
-
-      redirect_to settings_users_path, notice: 'User has been invited.'
-    else
-      render turbo_stream: turbo_stream.replace(:modal, template: 'users/new'), status: :unprocessable_entity
-    end
-  end
-
-  def update
-    if @user.update(user_params.compact_blank)
-      redirect_to settings_users_path, notice: 'User has been updated.'
-    else
-      render turbo_stream: turbo_stream.replace(:modal, template: 'users/edit'), status: :unprocessable_entity
-    end
-  end
-
-  def destroy
-    @user.update!(deleted_at: Time.current)
-
-    redirect_to settings_users_path, notice: 'User has been removed.'
-  end
-
-  private
-
-  def load_user
-    @user = current_account.users.find(params[:id])
   end
 
   def user_params
-    params.require(:user).permit(:email, :first_name, :last_name, :password)
+    params.require(:user).permit(:email, :first_name, :last_name, :password, :role)
   end
 end

app/controllers/verify_pdf_signature_controller.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+class VerifyPdfSignatureController < ApplicationController
+  skip_authorization_check
+
+  def create
+    pdfs =
+      params[:files].map do |file|
+        HexaPDF::Document.new(io: file.open)
+      end
+
+    cert_data = if Docuseal.multitenant?
+                  Docuseal::CERTS
+                else
+                  EncryptedConfig.find_by(account: current_account, key: EncryptedConfig::ESIGN_CERTS_KEY)&.value || {}
+                end
+
+    default_pkcs = GenerateCertificate.load_pkcs(cert_data)
+
+    custom_certs = cert_data.fetch('custom', []).map do |e|
+      OpenSSL::PKCS12.new(Base64.urlsafe_decode64(e['data']), e['password'].to_s)
+    end
+
+    trusted_certs = [default_pkcs.certificate,
+                     *default_pkcs.ca_certs,
+                     *custom_certs.map(&:certificate),
+                     *custom_certs.flat_map(&:ca_certs).compact]
+
+    render turbo_stream: turbo_stream.replace('result', partial: 'result',
+                                                        locals: { pdfs:, files: params[:files], trusted_certs: })
+  rescue HexaPDF::MalformedPDFError
+    render turbo_stream: turbo_stream.replace('result', html: helpers.tag.div('Invalid PDF', id: 'result'))
+  end
+end

app/controllers/webhook_settings_controller.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+class WebhookSettingsController < ApplicationController
+  before_action :load_encrypted_config
+  authorize_resource :encrypted_config, parent: false
+
+  def show; end
+
+  def create
+    @encrypted_config.update!(encrypted_config_params)
+
+    redirect_back(fallback_location: settings_webhooks_path, notice: 'Webhook URL has been saved.')
+  end
+
+  def update
+    submitter = current_account.submitters.where.not(completed_at: nil).order(:id).last
+
+    SendFormCompletedWebhookRequestJob.perform_later(submitter)
+
+    redirect_back(fallback_location: settings_webhooks_path, notice: 'Webhook request has been sent.')
+  end
+
+  private
+
+  def load_encrypted_config
+    @encrypted_config =
+      current_account.encrypted_configs.find_or_initialize_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+  end
+
+  def encrypted_config_params
+    params.require(:encrypted_config).permit(:value)
+  end
+end

app/javascript/application.js

@@ -15,6 +15,9 @@ import DownloadButton from './elements/download_button'
 import SetOriginUrl from './elements/set_origin_url'
 import SetTimezone from './elements/set_timezone'
 import AutoresizeTextarea from './elements/autoresize_textarea'
+import SubmittersAutocomplete from './elements/submitter_autocomplete'
+import FolderAutocomplete from './elements/folder_autocomplete'
+import SignatureForm from './elements/signature_form'
 
 import * as TurboInstantClick from './lib/turbo_instant_click'
 
@@ -43,15 +46,43 @@ window.customElements.define('download-button', DownloadButton)
 window.customElements.define('set-origin-url', SetOriginUrl)
 window.customElements.define('set-timezone', SetTimezone)
 window.customElements.define('autoresize-textarea', AutoresizeTextarea)
+window.customElements.define('submitters-autocomplete', SubmittersAutocomplete)
+window.customElements.define('folder-autocomplete', FolderAutocomplete)
+window.customElements.define('signature-form', SignatureForm)
 
 document.addEventListener('turbo:before-fetch-request', encodeMethodIntoRequestBody)
+document.addEventListener('turbo:submit-end', async (event) => {
+  const resp = event.detail?.formSubmission?.result?.fetchResponse?.response
+
+  if (!resp?.headers?.get('content-disposition')?.includes('attachment')) {
+    return
+  }
+
+  const url = URL.createObjectURL(await resp.blob())
+  const link = document.createElement('a')
+
+  link.href = url
+  link.setAttribute('download', decodeURIComponent(resp.headers.get('content-disposition').split('"')[1]))
+
+  document.body.appendChild(link)
+
+  link.click()
+
+  document.body.removeChild(link)
+
+  URL.revokeObjectURL(url)
+})
 
 window.customElements.define('template-builder', class extends HTMLElement {
   connectedCallback () {
     this.appElem = document.createElement('div')
+    this.appElem.classList.add('max-h-screen')
 
     this.app = createApp(TemplateBuilder, {
       template: reactive(JSON.parse(this.dataset.template)),
+      backgroundColor: '#faf7f5',
+      withPhone: this.dataset.withPhone === 'true',
+      acceptFileTypes: this.dataset.acceptFileTypes,
       isDirectUpload: this.dataset.isDirectUpload === 'true'
     })
 

app/javascript/application.scss

@@ -70,3 +70,51 @@ button[disabled] .enabled {
 .base-radio {
   @apply radio bg-white radio-sm no-animation;
 }
+
+.base-select {
+  @apply select base-input w-full font-normal;
+}
+
+.tooltip-bottom-end:before {
+  transform: translateX(-95%);
+  top: var(--tooltip-offset);
+  left: 100%;
+  right: auto;
+  bottom: auto;
+}
+
+.tooltip-bottom-end:after {
+  transform: translateX(-25%);
+  border-color: transparent transparent var(--tooltip-color) transparent;
+  top: var(--tooltip-tail-offset);
+  left: 50%;
+  right: auto;
+  bottom: auto;
+}
+
+.autocomplete {
+  background: white;
+  z-index: 1000;
+  font: 14px/22px "-apple-system", BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  overflow: auto;
+  box-sizing: border-box;
+  @apply border border-base-300 mt-1 rounded-md;
+}
+
+.autocomplete * {
+  font: inherit;
+}
+
+.autocomplete > div {
+  @apply px-2 py-1 font-normal text-sm;
+}
+
+.autocomplete .group {
+  background: #eee;
+}
+
+.autocomplete > div:hover:not(.group),
+.autocomplete > div.selected {
+  @apply bg-base-300;
+  cursor: pointer;
+}

app/javascript/elements/file_dropzone.js

@@ -38,7 +38,11 @@ export default actionable(targetable(class extends HTMLElement {
     this.uploadFiles(this.input.files)
   }
 
-  toggleLoading = () => {
+  toggleLoading = (e) => {
+    if (e && e.target && !e.target.contains(this)) {
+      return
+    }
+
     this.loading.classList.toggle('hidden')
     this.icon.classList.toggle('hidden')
     this.classList.toggle('opacity-50')

app/javascript/elements/folder_autocomplete.js

@@ -0,0 +1,43 @@
+import autocomplete from 'autocompleter'
+
+export default class extends HTMLElement {
+  connectedCallback () {
+    autocomplete({
+      input: this.input,
+      preventSubmit: this.dataset.submitOnSelect === 'true' ? 0 : 1,
+      minLength: 0,
+      showOnFocus: true,
+      onSelect: this.onSelect,
+      render: this.render,
+      fetch: this.fetch
+    })
+  }
+
+  onSelect = (item) => {
+    this.input.value = item.name
+  }
+
+  fetch = (text, resolve) => {
+    const queryParams = new URLSearchParams({ q: text })
+
+    fetch('/api/template_folders_autocomplete?' + queryParams).then(async (resp) => {
+      const items = await resp.json()
+
+      resolve(items)
+    }).catch(() => {
+      resolve([])
+    })
+  }
+
+  render = (item) => {
+    const div = document.createElement('div')
+
+    div.textContent = item.name
+
+    return div
+  }
+
+  get input () {
+    return this.querySelector('input')
+  }
+}

app/javascript/elements/menu_active.js

@@ -1,7 +1,7 @@
 export default class extends HTMLElement {
   connectedCallback () {
     this.querySelectorAll('a').forEach((link) => {
-      if (document.location.pathname.startsWith(link.pathname)) {
+      if (document.location.pathname.startsWith(link.pathname) && !link.getAttribute('href').startsWith('http')) {
         link.classList.add('bg-base-300')
       }
     })

app/javascript/elements/signature_form.js

@@ -0,0 +1,46 @@
+import { target, targetable } from '@github/catalyst/lib/targetable'
+import { cropCanvasAndExportToPNG } from '../submission_form/crop_canvas'
+
+export default targetable(class extends HTMLElement {
+  static [target.static] = ['canvas', 'input', 'clear', 'button']
+
+  async connectedCallback () {
+    this.canvas.width = this.canvas.parentNode.parentNode.clientWidth
+    this.canvas.height = this.canvas.parentNode.parentNode.clientWidth / 3
+
+    const { default: SignaturePad } = await import('signature_pad')
+
+    this.pad = new SignaturePad(this.canvas)
+
+    this.clear.addEventListener('click', (e) => {
+      e.preventDefault()
+
+      this.pad.clear()
+    })
+
+    this.button.addEventListener('click', (e) => {
+      e.preventDefault()
+
+      this.button.disabled = true
+
+      this.submit()
+    })
+  }
+
+  async submit () {
+    const blob = await cropCanvasAndExportToPNG(this.canvas)
+    const file = new File([blob], 'signature.png', { type: 'image/png' })
+
+    const dataTransfer = new DataTransfer()
+
+    dataTransfer.items.add(file)
+
+    this.input.files = dataTransfer.files
+
+    if (this.input.webkitEntries.length) {
+      this.input.dataset.file = `${dataTransfer.files[0].name}`
+    }
+
+    this.closest('form').requestSubmit()
+  }
+})

app/javascript/elements/submitter_autocomplete.js

@@ -0,0 +1,67 @@
+import autocomplete from 'autocompleter'
+
+export default class extends HTMLElement {
+  connectedCallback () {
+    autocomplete({
+      input: this.input,
+      preventSubmit: 1,
+      minLength: 1,
+      showOnFocus: true,
+      onSelect: this.onSelect,
+      render: this.render,
+      fetch: this.fetch
+    })
+  }
+
+  onSelect = (item) => {
+    const fields = ['email', 'name', 'phone']
+    const submitterItemEl = this.closest('submitter-item')
+
+    fields.forEach((field) => {
+      const input = submitterItemEl.querySelector(`submitters-autocomplete[data-field="${field}"] input`)
+      const textarea = submitterItemEl.querySelector(`submitters-autocomplete[data-field="${field}"] textarea`)
+
+      if (input && item[field]) {
+        input.value = item[field]
+      }
+
+      if (textarea && item[field]) {
+        textarea.value = textarea.value.replace(/[^;,\s]+$/, item[field] + ' ')
+      }
+    })
+  }
+
+  fetch = (text, resolve) => {
+    const q = text.split(/[;,\s]+/).pop().trim()
+
+    if (q) {
+      const queryParams = new URLSearchParams({ q, field: this.dataset.field })
+
+      fetch('/api/submitters_autocomplete?' + queryParams).then(async (resp) => {
+        const items = await resp.json()
+
+        if (q.length < 3) {
+          resolve(items.filter((e) => e[this.dataset.field].startsWith(q)))
+        } else {
+          resolve(items)
+        }
+      }).catch(() => {
+        resolve([])
+      })
+    } else {
+      resolve([])
+    }
+  }
+
+  render = (item) => {
+    const div = document.createElement('div')
+
+    div.textContent = item[this.dataset.field]
+
+    return div
+  }
+
+  get input () {
+    return this.querySelector('input') || this.querySelector('textarea')
+  }
+}

app/javascript/elements/turbo_modal.js

@@ -5,15 +5,19 @@ export default actionable(class extends HTMLElement {
     document.body.classList.add('overflow-hidden')
 
     document.addEventListener('keyup', this.onEscKey)
-    document.addEventListener('turbo:submit-end', this.onSubmit)
+
     document.addEventListener('turbo:before-cache', this.close)
+
+    if (this.dataset.closeAfterSubmit !== 'false') {
+      document.addEventListener('turbo:submit-end', this.onSubmit)
+    }
   }
 
   disconnectedCallback () {
     document.body.classList.remove('overflow-hidden')
 
     document.removeEventListener('keyup', this.onEscKey)
-    document.removeEventListener('turbo:submit-end', this.handleSubmit)
+    document.removeEventListener('turbo:submit-end', this.onSubmit)
     document.removeEventListener('turbo:before-cache', this.close)
   }
 

app/javascript/form.js

@@ -9,11 +9,14 @@ window.customElements.define('submission-form', class extends HTMLElement {
     this.appElem = document.createElement('div')
 
     this.app = createApp(Form, {
-      submitterSlug: this.dataset.submitterSlug,
+      submitter: JSON.parse(this.dataset.submitter),
-      submitterUuid: this.dataset.submitterUuid,
       authenticityToken: this.dataset.authenticityToken,
       canSendEmail: this.dataset.canSendEmail === 'true',
       isDirectUpload: this.dataset.isDirectUpload === 'true',
+      goToLast: this.dataset.goToLast === 'true',
+      isDemo: this.dataset.isDemo === 'true',
+      attribution: this.dataset.attribution !== 'false',
+      withConfetti: true,
       values: reactive(JSON.parse(this.dataset.values)),
       attachments: reactive(JSON.parse(this.dataset.attachments)),
       fields: JSON.parse(this.dataset.fields)

app/javascript/submission_form/area.vue

@@ -21,14 +21,14 @@
       </span>
     </div>
     <div
-      v-if="isActive"
+      v-if="isActive && withLabel"
       class="absolute -top-7 rounded bg-base-content text-base-100 px-2 text-sm whitespace-nowrap"
     >
       {{ field.name || fieldNames[field.type] }}
-      <template v-if="field.type === 'checkbox'">
+      <template v-if="field.type === 'checkbox' && !field.name">
         {{ fieldIndex + 1 }}
       </template>
-      <template v-else-if="!field.required">
+      <template v-else-if="!field.required && field.type !== 'checkbox'">
         (optional)
       </template>
     </div>
@@ -47,6 +47,11 @@
       class="object-contain mx-auto"
       :src="signature.url"
     >
+    <img
+      v-else-if="field.type === 'initials' && initials"
+      class="object-contain mx-auto"
+      :src="initials.url"
+    >
     <div
       v-else-if="field.type === 'file'"
       class="px-0.5 flex flex-col justify-center"
@@ -113,7 +118,7 @@
 </template>
 
 <script>
-import { IconTextSize, IconWritingSign, IconCalendarEvent, IconPhoto, IconCheckbox, IconPaperclip, IconSelect, IconCircleDot, IconChecks, IconCheck, IconColumns3 } from '@tabler/icons-vue'
+import { IconTextSize, IconWritingSign, IconCalendarEvent, IconPhoto, IconCheckbox, IconPaperclip, IconSelect, IconCircleDot, IconChecks, IconCheck, IconColumns3, IconPhoneCheck, IconLetterCaseUpper } from '@tabler/icons-vue'
 
 export default {
   name: 'FieldArea',
@@ -146,6 +151,11 @@ export default {
       required: false,
       default: false
     },
+    withLabel: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
     fieldIndex: {
       type: Number,
       required: false,
@@ -170,11 +180,13 @@ export default {
         signature: 'Signature',
         date: 'Date',
         image: 'Image',
+        initials: 'Initials',
         file: 'File',
         select: 'Select',
         checkbox: 'Checkbox',
         radio: 'Radio',
-        multiple: 'Multiple Select'
+        multiple: 'Multiple Select',
+        phone: 'Phone'
       }
     },
     fieldIcons () {
@@ -183,12 +195,14 @@ export default {
         signature: IconWritingSign,
         date: IconCalendarEvent,
         image: IconPhoto,
+        initials: IconLetterCaseUpper,
         file: IconPaperclip,
         select: IconSelect,
         checkbox: IconCheckbox,
         radio: IconCircleDot,
         cells: IconColumns3,
-        multiple: IconChecks
+        multiple: IconChecks,
+        phone: IconPhoneCheck
       }
     },
     image () {
@@ -205,9 +219,16 @@ export default {
         return null
       }
     },
+    initials () {
+      if (this.field.type === 'initials') {
+        return this.attachmentsIndex[this.modelValue]
+      } else {
+        return null
+      }
+    },
     formattedDate () {
       if (this.field.type === 'date' && this.modelValue) {
-        return new Intl.DateTimeFormat([], { year: 'numeric', month: 'long', day: 'numeric' }).format(new Date(this.modelValue))
+        return new Intl.DateTimeFormat([], { year: 'numeric', month: 'long', day: 'numeric', timeZone: 'UTC' }).format(new Date(this.modelValue))
       } else {
         return ''
       }

app/javascript/submission_form/areas.vue

@@ -11,7 +11,9 @@
         v-for="(area, areaIndex) in field.areas"
         :key="areaIndex"
       >
-        <Teleport :to="`#page-${area.attachment_uuid}-${area.page}`">
+        <Teleport
+          :to="findPageElementForArea(area)"
+        >
           <FieldArea
             :ref="setAreaRef"
             v-model="values[field.uuid]"
@@ -20,6 +22,7 @@
             :submittable="true"
             :field-index="fieldIndex"
             :is-active="currentStep === step"
+            :with-label="withLabel"
             :is-value-set="step.some((f) => f.uuid in values)"
             :attachments-index="attachmentsIndex"
             @click="$emit('focus-step', step)"
@@ -54,6 +57,11 @@ export default {
       required: false,
       default: () => ({})
     },
+    withLabel: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
     currentStep: {
       type: Array,
       required: false,
@@ -70,10 +78,16 @@ export default {
     this.areaRefs = []
   },
   methods: {
+    findPageElementForArea (area) {
+      return (this.$root.$el?.parentNode?.getRootNode() || document).getElementById(`page-${area.attachment_uuid}-${area.page}`)
+    },
     scrollIntoField (field) {
       this.areaRefs.find((area) => {
         if (area.field === field) {
-          if (document.body.style.overflow === 'hidden') {
+          const root = this.$root.$el.parentNode.getRootNode()
+          const container = root.body || root.querySelector('div')
+
+          if (container.style.overflow === 'hidden') {
             this.scrollInContainer(area.$el)
           } else {
             area.$refs.scrollToElem.scrollIntoView({ behavior: 'smooth', block: 'start' })
@@ -86,13 +100,19 @@ export default {
       })
     },
     scrollInContainer (target) {
+      const root = this.$root.$el.parentNode.getRootNode()
+
+      const scrollbox = root.getElementById('scrollbox')
+      const formContainer = root.getElementById('form_container')
+      const container = root.body || root.querySelector('div')
+
       const padding = 64
-      const boxRect = window.scrollbox.children[0].getBoundingClientRect()
+      const boxRect = scrollbox.children[0].getBoundingClientRect()
       const targetRect = target.getBoundingClientRect()
 
       const targetTopRelativeToBox = targetRect.top - boxRect.top
 
-      window.scrollbox.scrollTop = targetTopRelativeToBox - document.body.offsetHeight + window.form_container.offsetHeight + target.offsetHeight + padding
+      scrollbox.scrollTop = targetTopRelativeToBox - container.offsetHeight + formContainer.offsetHeight + target.offsetHeight + padding
     },
     setAreaRef (el) {
       if (el) {

app/javascript/submission_form/completed.vue

@@ -7,13 +7,13 @@
         :height="30"
       />
       <span>
-        Form has been completed!
+        {{ t('form_has_been_completed') }}
       </span>
     </p>
     <div class="space-y-3 mt-5">
       <button
-        v-if="canSendEmail"
+        v-if="canSendEmail && !isDemo"
-        class="white-button flex items-center space-x-1 w-full"
+        class="white-button !h-auto flex items-center space-x-1 w-full"
         :disabled="isSendingCopy"
         @click.prevent="sendCopyToEmail"
       >
@@ -23,10 +23,11 @@
         />
         <IconMail v-else />
         <span>
-          Send copy via email
+          {{ t('send_copy_via_email') }}
         </span>
       </button>
       <button
+        v-if="!isWebView"
         class="base-button flex items-center space-x-1 w-full"
         :disabled="isDownloading"
         @click.prevent="download"
@@ -37,29 +38,79 @@
         />
         <IconDownload v-else />
         <span>
-          Download
+          {{ t('download') }}
         </span>
       </button>
+      <a
+        v-if="isDemo"
+        target="_blank"
+        href="https://github.com/docusealco/docuseal"
+        class="white-button flex items-center space-x-1 w-full"
+      >
+        <IconBrandGithub />
+        <span>
+          Star on Github
+        </span>
+      </a>
+      <a
+        v-if="isDemo"
+        href="https://docuseal.co/sign_up"
+        class="white-button flex items-center space-x-1 w-full"
+      >
+        <IconLogin />
+        <span>
+          {{ t('create_a_free_account') }}
+        </span>
+      </a>
+    </div>
+    <div
+      v-if="attribution"
+      class="text-center mt-4"
+    >
+      {{ t('signed_with') }}
+      <a
+        href="https://www.docuseal.co"
+        target="_blank"
+        class="underline"
+      >DocuSeal</a> - {{ t('open_source_documents_software') }}
     </div>
   </div>
 </template>
 
 <script>
-import { IconCircleCheck, IconMail, IconDownload, IconInnerShadowTop } from '@tabler/icons-vue'
+import { IconCircleCheck, IconBrandGithub, IconMail, IconDownload, IconInnerShadowTop, IconLogin } from '@tabler/icons-vue'
 
 export default {
   name: 'FormCompleted',
   components: {
     IconCircleCheck,
     IconInnerShadowTop,
+    IconBrandGithub,
     IconMail,
+    IconLogin,
     IconDownload
   },
+  inject: ['baseUrl', 't'],
   props: {
     submitterSlug: {
       type: String,
       required: true
     },
+    isDemo: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
+    attribution: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
+    withConfetti: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
     canSendEmail: {
       type: Boolean,
       required: false,
@@ -72,23 +123,30 @@ export default {
       isDownloading: false
     }
   },
+  computed: {
+    isWebView () {
+      return /webview|wv|ip((?!.*Safari)|(?=.*like Safari))/i.test(window.navigator.userAgent)
+    }
+  },
   async mounted () {
-    const { default: confetti } = await import('canvas-confetti')
+    if (this.withConfetti) {
+      const { default: confetti } = await import('canvas-confetti')
 
-    confetti({
+      confetti({
-      particleCount: 50,
+        particleCount: 50,
-      startVelocity: 30,
+        startVelocity: 30,
-      spread: 140
+        spread: 140
-    })
+      })
+    }
   },
   methods: {
     sendCopyToEmail () {
       this.isSendingCopy = true
 
-      fetch(`/send_submission_email.json?submitter_slug=${this.submitterSlug}`, {
+      fetch(this.baseUrl + `/send_submission_email.json?submitter_slug=${this.submitterSlug}`, {
         method: 'POST'
       }).then(() => {
-        alert('Email has been sent')
+        alert(this.t('email_has_been_sent'))
       }).finally(() => {
         this.isSendingCopy = false
       })
@@ -96,7 +154,7 @@ export default {
     download () {
       this.isDownloading = true
 
-      fetch(`/submitters/${this.submitterSlug}/download`).then((response) => response.json()).then((urls) => {
+      fetch(this.baseUrl + `/submitters/${this.submitterSlug}/download`).then((response) => response.json()).then((urls) => {
         const fileRequests = urls.map((url) => {
           return () => {
             return fetch(url).then(async (resp) => {

app/javascript/submission_form/crop_canvas.js

@@ -0,0 +1,49 @@
+function cropCanvasAndExportToPNG (canvas) {
+  const ctx = canvas.getContext('2d')
+
+  const width = canvas.width
+  const height = canvas.height
+
+  let topmost = height
+  let bottommost = 0
+  let leftmost = width
+  let rightmost = 0
+
+  const imageData = ctx.getImageData(0, 0, width, height)
+  const pixels = imageData.data
+
+  for (let y = 0; y < height; y++) {
+    for (let x = 0; x < width; x++) {
+      const pixelIndex = (y * width + x) * 4
+      const alpha = pixels[pixelIndex + 3]
+      if (alpha !== 0) {
+        topmost = Math.min(topmost, y)
+        bottommost = Math.max(bottommost, y)
+        leftmost = Math.min(leftmost, x)
+        rightmost = Math.max(rightmost, x)
+      }
+    }
+  }
+
+  const croppedWidth = rightmost - leftmost + 1
+  const croppedHeight = bottommost - topmost + 1
+
+  const croppedCanvas = document.createElement('canvas')
+  croppedCanvas.width = croppedWidth
+  croppedCanvas.height = croppedHeight
+  const croppedCtx = croppedCanvas.getContext('2d')
+
+  croppedCtx.drawImage(canvas, leftmost, topmost, croppedWidth, croppedHeight, 0, 0, croppedWidth, croppedHeight)
+
+  return new Promise((resolve, reject) => {
+    croppedCanvas.toBlob((blob) => {
+      if (blob) {
+        resolve(blob)
+      } else {
+        reject(new Error('Failed to create a PNG blob.'))
+      }
+    }, 'image/png')
+  })
+}
+
+export { cropCanvasAndExportToPNG }

app/javascript/submission_form/dropzone.vue

@@ -29,7 +29,7 @@
             {{ message }}
           </div>
           <div class="text-xs">
-            <span class="font-medium">Click to upload</span> or drag and drop
+            <span class="font-medium">{{ t('click_to_upload') }}</span> {{ t('or_drag_and_drop_files') }}
           </div>
         </div>
       </div>
@@ -55,6 +55,7 @@ export default {
     IconCloudUpload,
     IconInnerShadowTop
   },
+  inject: ['baseUrl', 't'],
   props: {
     message: {
       type: String,
@@ -141,7 +142,7 @@ export default {
 
         return await Promise.all(
           blobs.map((blob) => {
-            return fetch('/api/attachments', {
+            return fetch(this.baseUrl + '/api/attachments', {
               method: 'POST',
               body: JSON.stringify({
                 name: 'attachments',
@@ -166,7 +167,7 @@ export default {
             formData.append('submitter_slug', this.submitterSlug)
             formData.append('name', 'attachments')
 
-            return fetch('/api/attachments', {
+            return fetch(this.baseUrl + '/api/attachments', {
               method: 'POST',
               body: formData
             }).then(resp => resp.json()).then((data) => {

app/javascript/submission_form/form.vue

@@ -4,267 +4,334 @@
     :steps="stepFields"
     :values="values"
     :attachments-index="attachmentsIndex"
+    :with-label="!isAnonymousChecboxes"
     :current-step="currentStepFields"
-    @focus-step="[saveStep(), goToStep($event, false, true)]"
+    @focus-step="[saveStep(), goToStep($event, false, true), currentField.type !== 'checkbox' ? isFormVisible = true : '']"
   />
-  <div>
+  <button
-    <form
+    v-if="!isFormVisible"
+    class="btn btn-neutral flex text-white absolute rounded-none border-x-0 md:border md:rounded-full bottom-0 w-full md:mb-4 text-base"
+    @click.prevent="isFormVisible = true"
+  >
+    {{ t('submit_form') }}
+    <IconArrowsDiagonal
+      class="absolute right-0 mr-4"
+      :width="20"
+      :height="20"
+    />
+  </button>
+  <div
+    v-show="isFormVisible"
+    id="form_container"
+    class="shadow-md bg-base-100 absolute bottom-0 md:bottom-4 w-full border-base-200 border p-4 rounded"
+    :style="{ backgroundColor: backgroundColor }"
+  >
+    <button
       v-if="!isCompleted"
-      ref="form"
+      class="absolute right-0 mr-2 mt-2 top-0 hidden md:block"
-      :action="submitPath"
+      title="Minimize"
-      method="post"
+      @click.prevent="isFormVisible = false"
-      class="md:mx-16"
-      @submit.prevent="submitStep"
     >
-      <input
+      <IconArrowsDiagonalMinimize2
-        type="hidden"
+        :width="20"
-        name="authenticity_token"
+        :height="20"
-        :value="authenticityToken"
+      />
+    </button>
+    <div>
+      <form
+        v-if="!isCompleted"
+        ref="form"
+        :action="submitPath"
+        method="post"
+        class="md:mx-16"
+        @submit.prevent="submitStep"
       >
-      <input
+        <input
-        v-if="currentStep === stepFields.length - 1"
+          type="hidden"
-        type="hidden"
+          name="authenticity_token"
-        name="completed"
+          :value="authenticityToken"
-        value="true"
+        >
-      >
+        <input
-      <input
+          value="put"
-        value="put"
+          name="_method"
-        name="_method"
+          type="hidden"
-        type="hidden"
+        >
-      >
+        <div class="md:mt-4">
-      <div class="mt-4">
+          <div v-if="['cells', 'text'].includes(currentField.type)">
-        <div v-if="['cells', 'text'].includes(currentField.type)">
+            <label
-          <label
+              v-if="currentField.name"
-            v-if="currentField.name"
+              :for="currentField.uuid"
-            :for="currentField.uuid"
+              class="label text-2xl mb-2"
-            class="label text-2xl mb-2"
+            >{{ currentField.name }}
-          >{{ currentField.name }}
+              <template v-if="!currentField.required">({{ t('optional') }})</template>
-            <template v-if="!currentField.required">(optional)</template>
+            </label>
-          </label>
+            <div
-          <div
+              v-else
-            v-else
+              class="py-1"
-            class="py-1"
+            />
-          />
+            <div>
-          <div>
+              <input
-            <input
+                :id="currentField.uuid"
+                v-model="values[currentField.uuid]"
+                class="base-input !text-2xl w-full"
+                :required="currentField.required"
+                :placeholder="`${t('type_here')}...${currentField.required ? '' : ` (${t('optional')})`}`"
+                type="text"
+                :name="`values[${currentField.uuid}]`"
+                @focus="$refs.areas.scrollIntoField(currentField)"
+              >
+            </div>
+          </div>
+          <div v-else-if="currentField.type === 'date'">
+            <label
+              v-if="currentField.name"
+              :for="currentField.uuid"
+              class="label text-2xl mb-2"
+            >{{ currentField.name }}
+              <template v-if="!currentField.required">({{ t('optional') }})</template>
+            </label>
+            <div
+              v-else
+              class="py-1"
+            />
+            <div class="text-center">
+              <input
+                :id="currentField.uuid"
+                v-model="values[currentField.uuid]"
+                class="base-input !text-2xl text-center w-full"
+                :required="currentField.required"
+                type="date"
+                :name="`values[${currentField.uuid}]`"
+                @focus="$refs.areas.scrollIntoField(currentField)"
+              >
+            </div>
+          </div>
+          <div v-else-if="currentField.type === 'select'">
+            <label
+              v-if="currentField.name"
+              :for="currentField.uuid"
+              class="label text-2xl mb-2"
+            >{{ currentField.name }}
+              <template v-if="!currentField.required">({{ t('optional') }})</template>
+            </label>
+            <div
+              v-else
+              class="py-1"
+            />
+            <select
               :id="currentField.uuid"
-              v-model="values[currentField.uuid]"
-              class="base-input !text-2xl w-full"
               :required="currentField.required"
-              :placeholder="`Type here...${currentField.required ? '' : ' (optional)'}`"
+              class="select base-input !text-2xl w-full text-center font-normal"
-              type="text"
               :name="`values[${currentField.uuid}]`"
+              @change="values[currentField.uuid] = $event.target.value"
               @focus="$refs.areas.scrollIntoField(currentField)"
             >
-          </div>
+              <option
-        </div>
+                value=""
-        <div v-else-if="currentField.type === 'date'">
+                :selected="!values[currentField.uuid]"
-          <label
+              >
-            v-if="currentField.name"
+                {{ t('select_your_option') }}
-            :for="currentField.uuid"
+              </option>
-            class="label text-2xl mb-2"
+              <option
-          >{{ currentField.name }}
-            <template v-if="!currentField.required">(optional)</template>
-          </label>
-          <div
-            v-else
-            class="py-1"
-          />
-          <div class="text-center">
-            <input
-              :id="currentField.uuid"
-              v-model="values[currentField.uuid]"
-              class="base-input !text-2xl text-center w-full"
-              :required="currentField.required"
-              type="date"
-              :name="`values[${currentField.uuid}]`"
-              @focus="$refs.areas.scrollIntoField(currentField)"
-            >
-          </div>
-        </div>
-        <div v-else-if="currentField.type === 'select'">
-          <label
-            v-if="currentField.name"
-            :for="currentField.uuid"
-            class="label text-2xl mb-2"
-          >{{ currentField.name }}
-            <template v-if="!currentField.required">(optional)</template>
-          </label>
-          <div
-            v-else
-            class="py-1"
-          />
-          <select
-            :id="currentField.uuid"
-            :required="currentField.required"
-            class="select base-input !text-2xl w-full text-center font-normal"
-            :name="`values[${currentField.uuid}]`"
-            @change="values[currentField.uuid] = $event.target.value"
-            @focus="$refs.areas.scrollIntoField(currentField)"
-          >
-            <option
-              value=""
-              :selected="!values[currentField.uuid]"
-            >
-              Select your option
-            </option>
-            <option
-              v-for="(option, index) in currentField.options"
-              :key="index"
-              :selected="values[currentField.uuid] == option"
-              :value="option"
-            >
-              {{ option }}
-            </option>
-          </select>
-        </div>
-        <div v-else-if="currentField.type === 'radio'">
-          <label
-            v-if="currentField.name"
-            :for="currentField.uuid"
-            class="label text-2xl mb-2"
-          >{{ currentField.name }}
-            <template v-if="!currentField.required">(optional)</template>
-          </label>
-          <div class="flex w-full">
-            <div class="space-y-3.5 mx-auto">
-              <div
                 v-for="(option, index) in currentField.options"
                 :key="index"
+                :selected="values[currentField.uuid] == option"
+                :value="option"
               >
-                <label
+                {{ option }}
-                  :for="currentField.uuid + option"
+              </option>
-                  class="flex items-center space-x-3"
+            </select>
+          </div>
+          <div v-else-if="currentField.type === 'radio'">
+            <label
+              v-if="currentField.name"
+              :for="currentField.uuid"
+              class="label text-2xl mb-2"
+            >{{ currentField.name }}
+              <template v-if="!currentField.required">({{ t('optional') }})</template>
+            </label>
+            <div class="flex w-full">
+              <div class="space-y-3.5 mx-auto">
+                <div
+                  v-for="(option, index) in currentField.options"
+                  :key="index"
                 >
-                  <input
+                  <label
-                    :id="currentField.uuid + option"
+                    :for="currentField.uuid + option"
-                    v-model="values[currentField.uuid]"
+                    class="flex items-center space-x-3"
-                    type="radio"
-                    class="base-radio !h-7 !w-7"
-                    :name="`values[${currentField.uuid}]`"
-                    :value="option"
-                    :required="currentField.required"
                   >
-                  <span class="text-xl">
+                    <input
-                    {{ option }}
+                      :id="currentField.uuid + option"
-                  </span>
+                      v-model="values[currentField.uuid]"
-                </label>
+                      type="radio"
+                      class="base-radio !h-7 !w-7"
+                      :name="`values[${currentField.uuid}]`"
+                      :value="option"
+                      :required="currentField.required"
+                    >
+                    <span class="text-xl">
+                      {{ option }}
+                    </span>
+                  </label>
+                </div>
               </div>
             </div>
           </div>
-        </div>
+          <MultiSelectStep
-        <MultiSelectStep
+            v-else-if="currentField.type === 'multiple'"
-          v-else-if="currentField.type === 'multiple'"
+            v-model="values[currentField.uuid]"
-          v-model="values[currentField.uuid]"
+            :field="currentField"
-          :field="currentField"
+          />
-        />
-        <div
-          v-else-if="currentField.type === 'checkbox'"
-          class="flex w-full"
-        >
-          <input
-            type="hidden"
-            name="cast_boolean"
-            value="true"
-          >
           <div
-            class="space-y-3.5 mx-auto"
+            v-else-if="currentField.type === 'checkbox'"
+            class="flex w-full max-h-44 overflow-y-auto"
           >
-            <div
+            <input
-              v-for="(field, index) in currentStepFields"
+              type="hidden"
-              :key="field.uuid"
+              name="cast_boolean"
+              value="true"
             >
-              <label
+            <div
-                :for="field.uuid"
+              class="space-y-3.5 mx-auto"
-                class="flex items-center space-x-3"
+            >
-              >
+              <template v-if="isAnonymousChecboxes">
+                <span class="text-xl">
+                  {{ t('complete_hightlighted_checkboxes_and_click') }} <span class="font-semibold">{{ stepFields.length === currentStep + 1 ? t('submit') : t('next') }}</span>.
+                </span>
                 <input
+                  v-for="field in currentStepFields"
+                  :key="field.uuid"
                   type="hidden"
                   :name="`values[${field.uuid}]`"
                   :value="!!values[field.uuid]"
                 >
-                <input
+              </template>
-                  :id="field.uuid"
+              <template v-else>
-                  type="checkbox"
+                <div
-                  class="base-checkbox !h-7 !w-7"
+                  v-for="(field, index) in currentStepFields"
-                  :checked="!!values[field.uuid]"
+                  :key="field.uuid"
-                  @click="[$refs.areas.scrollIntoField(field), values[field.uuid] = !values[field.uuid]]"
                 >
-                <span class="text-xl">
+                  <label
-                  {{ currentField.name || currentField.type + ' ' + (index + 1) }}
+                    :for="field.uuid"
-                </span>
+                    class="flex items-center space-x-3"
-              </label>
+                  >
+                    <input
+                      type="hidden"
+                      :name="`values[${field.uuid}]`"
+                      :value="!!values[field.uuid]"
+                    >
+                    <input
+                      :id="field.uuid"
+                      type="checkbox"
+                      class="base-checkbox !h-7 !w-7"
+                      :checked="!!values[field.uuid]"
+                      @click="[$refs.areas.scrollIntoField(field), values[field.uuid] = !values[field.uuid]]"
+                    >
+                    <span class="text-xl">
+                      {{ field.name || field.type + ' ' + (index + 1) }}
+                    </span>
+                  </label>
+                </div>
+              </template>
             </div>
           </div>
+          <ImageStep
+            v-else-if="currentField.type === 'image'"
+            v-model="values[currentField.uuid]"
+            :field="currentField"
+            :is-direct-upload="isDirectUpload"
+            :attachments-index="attachmentsIndex"
+            :submitter-slug="submitterSlug"
+            @attached="[attachments.push($event), $refs.areas.scrollIntoField(currentField)]"
+          />
+          <SignatureStep
+            v-else-if="currentField.type === 'signature'"
+            ref="currentStep"
+            v-model="values[currentField.uuid]"
+            :field="currentField"
+            :is-direct-upload="isDirectUpload"
+            :attachments-index="attachmentsIndex"
+            :submitter-slug="submitterSlug"
+            @attached="attachments.push($event)"
+            @start="$refs.areas.scrollIntoField(currentField)"
+            @minimize="isFormVisible = false"
+          />
+          <InitialsStep
+            v-else-if="currentField.type === 'initials'"
+            ref="currentStep"
+            v-model="values[currentField.uuid]"
+            :field="currentField"
+            :is-direct-upload="isDirectUpload"
+            :attachments-index="attachmentsIndex"
+            :submitter-slug="submitterSlug"
+            @attached="attachments.push($event)"
+            @start="$refs.areas.scrollIntoField(currentField)"
+            @focus="$refs.areas.scrollIntoField(currentField)"
+            @minimize="isFormVisible = false"
+          />
+          <AttachmentStep
+            v-else-if="currentField.type === 'file'"
+            v-model="values[currentField.uuid]"
+            :is-direct-upload="isDirectUpload"
+            :field="currentField"
+            :attachments-index="attachmentsIndex"
+            :submitter-slug="submitterSlug"
+            @attached="[attachments.push($event), $refs.areas.scrollIntoField(currentField)]"
+          />
+          <PhoneStep
+            v-else-if="currentField.type === 'phone'"
+            ref="currentStep"
+            v-model="values[currentField.uuid]"
+            :field="currentField"
+            :default-value="submitter.phone"
+            :submitter-slug="submitterSlug"
+            @focus="$refs.areas.scrollIntoField(currentField)"
+            @submit="submitStep"
+          />
         </div>
-        <ImageStep
+        <div class="mt-6 md:mt-8">
-          v-else-if="currentField.type === 'image'"
+          <button
-          v-model="values[currentField.uuid]"
+            type="submit"
-          :field="currentField"
+            class="base-button w-full flex justify-center"
-          :is-direct-upload="isDirectUpload"
+            :disabled="isButtonDisabled"
-          :attachments-index="attachmentsIndex"
+          >
-          :submitter-slug="submitterSlug"
+            <span class="flex">
-          @attached="[attachments.push($event), $refs.areas.scrollIntoField(currentField)]"
+              <IconInnerShadowTop
-        />
+                v-if="isSubmitting"
-        <SignatureStep
+                class="mr-1 animate-spin"
-          v-else-if="currentField.type === 'signature'"
+              />
-          ref="currentStep"
+              <span v-if="stepFields.length === currentStep + 1">
-          v-model="values[currentField.uuid]"
+                {{ t('submit') }}
-          :field="currentField"
+              </span>
-          :is-direct-upload="isDirectUpload"
+              <span v-else>
-          :attachments-index="attachmentsIndex"
+                {{ t('next') }}
-          :submitter-slug="submitterSlug"
+              </span><span
-          @attached="attachments.push($event)"
+                v-if="isSubmitting"
-        />
+                class="w-6 flex justify-start mr-1"
-        <AttachmentStep
+              ><span>...</span></span>
-          v-else-if="currentField.type === 'file'"
-          v-model="values[currentField.uuid]"
-          :is-direct-upload="isDirectUpload"
-          :field="currentField"
-          :attachments-index="attachmentsIndex"
-          :submitter-slug="submitterSlug"
-          @attached="[attachments.push($event), $refs.areas.scrollIntoField(currentField)]"
-        />
-      </div>
-      <div class="mt-8">
-        <button
-          type="submit"
-          class="base-button w-full flex justify-center"
-          :disabled="isButtonDisabled"
-        >
-          <span class="flex">
-            <IconInnerShadowTop
-              v-if="isSubmitting"
-              class="mr-1 animate-spin"
-            />
-            <span v-if="stepFields.length === currentStep + 1">
-              Submit
             </span>
-            <span v-else>
+          </button>
-              Next
+        </div>
-            </span><span
+      </form>
-              v-if="isSubmitting"
+      <FormCompleted
-              class="w-6 flex justify-start mr-1"
+        v-else
-            ><span>...</span></span>
+        :is-demo="isDemo"
-          </span>
+        :attribution="attribution"
-        </button>
+        :with-confetti="withConfetti"
-      </div>
+        :can-send-email="canSendEmail && !!submitter.email"
-    </form>
+        :submitter-slug="submitterSlug"
-    <FormCompleted
+      />
-      v-else
+      <div class="flex justify-center">
-      :can-send-email="canSendEmail"
+        <div class="flex items-center mt-5 mb-1">
-      :submitter-slug="submitterSlug"
+          <a
-    />
+            v-for="(step, index) in stepFields"
-    <div class="flex justify-center">
+            :key="step[0].uuid"
-      <div class="flex items-center mt-5 mb-1">
+            href="#"
-        <a
+            class="inline border border-base-300 h-3 w-3 rounded-full mx-1"
-          v-for="(step, index) in stepFields"
+            :class="{ 'bg-base-300': index === currentStep, 'bg-base-content': index < currentStep || isCompleted, 'bg-white': index > currentStep }"
-          :key="step[0].uuid"
+            @click.prevent="isCompleted ? '' : [saveStep(), goToStep(step, true)]"
-          href="#"
+          />
-          class="inline border border-base-300 h-3 w-3 rounded-full mx-1"
+        </div>
-          :class="{ 'bg-base-300': index === currentStep, 'bg-base-content': index < currentStep || isCompleted, 'bg-white': index > currentStep }"
-          @click.prevent="isCompleted ? '' : goToStep(step, true)"
-        />
       </div>
     </div>
   </div>
@@ -274,10 +341,13 @@
 import FieldAreas from './areas'
 import ImageStep from './image_step'
 import SignatureStep from './signature_step'
+import InitialsStep from './initials_step'
 import AttachmentStep from './attachment_step'
 import MultiSelectStep from './multi_select_step'
+import PhoneStep from './phone_step'
 import FormCompleted from './completed'
-import { IconInnerShadowTop } from '@tabler/icons-vue'
+import { IconInnerShadowTop, IconArrowsDiagonal, IconArrowsDiagonalMinimize2 } from '@tabler/icons-vue'
+import { t } from './i18n'
 
 export default {
   name: 'SubmissionForm',
@@ -286,13 +356,23 @@ export default {
     ImageStep,
     SignatureStep,
     AttachmentStep,
+    InitialsStep,
     MultiSelectStep,
     IconInnerShadowTop,
+    IconArrowsDiagonal,
+    PhoneStep,
+    IconArrowsDiagonalMinimize2,
     FormCompleted
   },
+  provide () {
+    return {
+      baseUrl: this.baseUrl,
+      t: this.t
+    }
+  },
   props: {
-    submitterSlug: {
+    submitter: {
-      type: String,
+      type: Object,
       required: true
     },
     canSendEmail: {
@@ -300,15 +380,21 @@ export default {
       required: false,
       default: false
     },
-    submitterUuid: {
-      type: String,
-      required: true
-    },
     attachments: {
       type: Array,
       required: false,
       default: () => []
     },
+    withConfetti: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
+    baseUrl: {
+      type: String,
+      required: false,
+      default: ''
+    },
     fields: {
       type: Array,
       required: false,
@@ -316,13 +402,34 @@ export default {
     },
     authenticityToken: {
       type: String,
-      required: true
+      required: false,
+      default: ''
+    },
+    backgroundColor: {
+      type: String,
+      required: false,
+      default: ''
     },
     isDirectUpload: {
       type: Boolean,
-      required: true,
+      required: false,
       default: false
     },
+    goToLast: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
+    isDemo: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
+    attribution: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
     values: {
       type: Object,
       required: false,
@@ -332,18 +439,31 @@ export default {
   data () {
     return {
       isCompleted: false,
+      isFormVisible: true,
       currentStep: 0,
-      isSubmitting: false
+      isSubmitting: false,
+      recalculateButtonDisabledKey: ''
     }
   },
   computed: {
     currentStepFields () {
       return this.stepFields[this.currentStep]
     },
+    submitterSlug () {
+      return this.submitter.slug
+    },
+    isAnonymousChecboxes () {
+      return this.currentField.type === 'checkbox' && this.currentStepFields.every((e) => !e.name) && this.currentStepFields.length > 4
+    },
     isButtonDisabled () {
-      return this.isSubmitting ||
+      if (this.recalculateButtonDisabledKey) {
+        return this.isSubmitting ||
         (this.currentField.required && ['image', 'file'].includes(this.currentField.type) && !this.values[this.currentField.uuid]?.length) ||
-        (this.currentField.required && this.currentField.type === 'signature' && !this.values[this.currentField.uuid]?.length && this.$refs.currentStep && !this.$refs.currentStep.isSignatureStarted)
+        (this.currentField.required && this.currentField.type === 'signature' && !this.values[this.currentField.uuid]?.length && this.$refs.currentStep && !this.$refs.currentStep.isSignatureStarted) ||
+        (this.currentField.required && this.currentField.type === 'initials' && !this.values[this.currentField.uuid]?.length && this.$refs.currentStep && !this.$refs.currentStep.isInitialsStarted)
+      } else {
+        return false
+      }
     },
     currentField () {
       return this.currentStepFields[0]
@@ -373,63 +493,136 @@ export default {
     }
   },
   mounted () {
-    this.currentStep = Math.min(
+    if (this.goToLast) {
-      this.stepFields.indexOf([...this.stepFields].reverse().find((fields) => fields.some((f) => !!this.values[f.uuid]))) + 1,
+      this.currentStep = Math.min(
-      this.stepFields.length - 1
+        this.stepFields.indexOf([...this.stepFields].reverse().find((fields) => fields.some((f) => !!this.values[f.uuid]))) + 1,
-    )
+        this.stepFields.length - 1
+      )
+    }
 
     if (/iPhone|iPad|iPod/i.test(navigator.userAgent)) {
-      document.body.style.overflow = 'hidden'
+      this.$nextTick(() => {
+        const root = this.$root.$el.parentNode.getRootNode()
+        const scrollbox = root.getElementById('scrollbox')
+        const parent = root.body || root.querySelector('div')
 
-      window.scrollbox.classList.add('h-full', 'overflow-y-auto')
+        parent.style.overflow = 'hidden'
-      window.scrollbox.parentNode.classList.add('h-screen', 'overflow-y-auto')
+
+        scrollbox.classList.add('h-full', 'overflow-y-auto')
+        scrollbox.parentNode.classList.add('h-screen', 'overflow-y-auto')
+        scrollbox.parentNode.style.maxHeight = '-webkit-fill-available'
+      })
     }
+
+    this.$nextTick(() => {
+      this.recalculateButtonDisabledKey = Math.random()
+
+      this.maybeTrackEmailClick().finally(() => {
+        this.trackViewForm()
+      })
+    })
   },
   methods: {
+    t,
+    maybeTrackEmailClick () {
+      const queryParams = new URLSearchParams(window.location.search)
+
+      if (queryParams.has('t')) {
+        const t = queryParams.get('t')
+
+        queryParams.delete('t')
+        const newUrl = [window.location.pathname, queryParams.toString()].filter(Boolean).join('?')
+        window.history.replaceState({}, document.title, newUrl)
+
+        return fetch(this.baseUrl + '/api/submitter_email_clicks', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json'
+          },
+          body: JSON.stringify({
+            t,
+            submitter_slug: this.submitterSlug
+          })
+        })
+      } else {
+        return Promise.resolve({})
+      }
+    },
+    trackViewForm () {
+      fetch(this.baseUrl + '/api/submitter_form_views', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json'
+        },
+        body: JSON.stringify({
+          submitter_slug: this.submitterSlug
+        })
+      })
+    },
     goToStep (step, scrollToArea = false, clickUpload = false) {
       this.currentStep = this.stepFields.indexOf(step)
 
       this.$nextTick(() => {
+        this.recalculateButtonDisabledKey = Math.random()
+
         if (scrollToArea) {
           this.$refs.areas.scrollIntoField(step[0])
         }
 
         this.$refs.form.querySelector('input[type="date"], input[type="text"], select')?.focus()
 
-        if (clickUpload && !this.values[this.currentField.uuid]) {
+        if (clickUpload && !this.values[this.currentField.uuid] && ['file', 'image'].includes(this.currentField.type)) {
           this.$refs.form.querySelector('input[type="file"]')?.click()
         }
       })
     },
-    saveStep () {
+    saveStep (formData) {
       if (this.isCompleted) {
         return Promise.resolve({})
       } else {
-        return fetch(this.submitPath, {
+        return fetch(this.baseUrl + this.submitPath, {
           method: 'POST',
-          body: new FormData(this.$refs.form)
+          body: formData || new FormData(this.$refs.form)
         })
       }
     },
     async submitStep () {
       this.isSubmitting = true
 
-      const stepPromise = this.currentField.type === 'signature'
+      const stepPromise = ['signature', 'phone', 'initials'].includes(this.currentField.type)
         ? this.$refs.currentStep.submit
         : () => Promise.resolve({})
 
-      await stepPromise()
+      stepPromise().then(async () => {
+        const formData = new FormData(this.$refs.form)
 
-      this.saveStep().then(response => {
+        if (this.currentStep === this.stepFields.length - 1) {
-        const nextStep = this.stepFields[this.currentStep + 1]
+          formData.append('completed', 'true')
-
-        if (nextStep) {
-          this.goToStep(this.stepFields[this.currentStep + 1], true)
-        } else {
-          this.isCompleted = true
         }
+
+        await this.saveStep(formData).then(async (response) => {
+          if (response.status === 422) {
+            const data = await response.json()
+
+            alert(data.error || 'Value is invalid')
+
+            return Promise.reject(new Error(data.error))
+          }
+
+          const nextStep = this.stepFields[this.currentStep + 1]
+
+          if (nextStep) {
+            this.goToStep(this.stepFields[this.currentStep + 1], true)
+          } else {
+            this.isCompleted = true
+          }
+        }).catch(error => {
+          console.error('Error submitting form:', error)
+        }).finally(() => {
+          this.isSubmitting = false
+        })
       }).catch(error => {
-        console.error('Error submitting form:', error)
+        console.log(error)
       }).finally(() => {
         this.isSubmitting = false
       })

app/javascript/submission_form/i18n.js

@@ -0,0 +1,305 @@
+const en = {
+  submit_form: 'Submit Form',
+  type_here: 'Type here',
+  optional: 'optional',
+  select_your_option: 'Select your option',
+  complete_hightlighted_checkboxes_and_click: 'Complete hightlighted checkboxes and click',
+  submit: 'submit',
+  next: 'next',
+  click_to_upload: 'Click to upload',
+  or_drag_and_drop_files: 'or drag and drop files',
+  send_copy_via_email: 'Send copy via email',
+  download: 'Download',
+  signature: 'Signature',
+  initials: 'Initials',
+  clear: 'Clear',
+  redraw: 'Redraw',
+  draw_initials: 'Draw initials',
+  type_signature_here: 'Type signature here',
+  type_initial_here: 'Type initials here',
+  form_has_been_completed: 'Form has been completed!',
+  create_a_free_account: 'Create a Free Account',
+  signed_with: 'Signed with',
+  open_source_documents_software: 'open source documents software',
+  verified_phone_number: 'Verify Phone Number',
+  use_international_format: 'Use internatioanl format: +1xxx',
+  six_digits_code: '6-digit code',
+  change_phone_number: 'Change phone number',
+  sending: 'Sending...',
+  resend_code: 'Re-send code',
+  verification_code_has_been_resent: 'Verification code has been re-sent via SMS',
+  email_has_been_sent: 'Email has been sent'
+}
+
+const es = {
+  submit_form: 'Enviar Formulario',
+  type_here: 'Escribe aquí',
+  optional: 'opcional',
+  select_your_option: 'Selecciona tu opción',
+  complete_hightlighted_checkboxes_and_click: 'Completa las casillas resaltadas y haz clic',
+  submit: 'enviar',
+  next: 'siguiente',
+  click_to_upload: 'Haz clic para cargar',
+  or_drag_and_drop_files: 'o arrastra y suelta archivos',
+  send_copy_via_email: 'Enviar copia por correo electrónico',
+  download: 'Descargar',
+  signature: 'Firma',
+  initials: 'Iniciales',
+  clear: 'Borrar',
+  redraw: 'Redibujar',
+  draw_initials: 'Dibujar iniciales',
+  type_signature_here: 'Escribe la firma aquí',
+  type_initial_here: 'Escribe las iniciales aquí',
+  form_has_been_completed: '¡El formulario ha sido completado!',
+  create_a_free_account: 'Crear una Cuenta Gratuita',
+  signed_with: 'Firmado con',
+  open_source_documents_software: 'software de documentos de código abierto',
+  verified_phone_number: 'Verificar número de teléfono',
+  use_international_format: 'Usar formato internacional: +1xxx',
+  six_digits_code: 'Código de 6 dígitos',
+  change_phone_number: 'Cambiar número de teléfono',
+  sending: 'Enviando...',
+  resend_code: 'Reenviar código',
+  verification_code_has_been_resent: 'El código de verificación ha sido reenviado por SMS',
+  email_has_been_sent: 'El correo electrónico ha sido enviado'
+}
+
+const it = {
+  submit_form: 'Invia Modulo',
+  type_here: 'Digita qui',
+  optional: 'opzionale',
+  select_your_option: 'Seleziona la tua opzione',
+  complete_hightlighted_checkboxes_and_click: 'Completa le caselle evidenziate e fai clic',
+  submit: 'invia',
+  next: 'avanti',
+  click_to_upload: 'Clicca per caricare',
+  or_drag_and_drop_files: 'oppure trascina e rilascia i file',
+  send_copy_via_email: 'Invia copia via email',
+  download: 'Scarica',
+  signature: 'Firma',
+  initials: 'Iniziali',
+  clear: 'Cancella',
+  redraw: 'Ridisegna',
+  draw_initials: 'Disegna iniziali',
+  type_signature_here: 'Scrivi la firma qui',
+  type_initial_here: 'Scrivi le iniziali qui',
+  form_has_been_completed: 'Il modulo è stato completato!',
+  create_a_free_account: 'Crea un Account Gratuito',
+  signed_with: 'Firmato con',
+  open_source_documents_software: 'software di documenti open source',
+  verified_phone_number: 'Verifica numero di telefono',
+  use_international_format: 'Usa formato internazionale: +1xxx',
+  six_digits_code: 'Codice a 6 cifre',
+  change_phone_number: 'Cambia numero di telefono',
+  sending: 'Invio in corso...',
+  resend_code: 'Rinvia codice',
+  verification_code_has_been_resent: 'Il codice di verifica è stato rinviato tramite SMS',
+  email_has_been_sent: "L'email è stata inviata"
+}
+
+const de = {
+  submit_form: 'Formular absenden',
+  type_here: 'Hier eingeben',
+  optional: 'optional',
+  select_your_option: 'Wähle deine Option',
+  complete_hightlighted_checkboxes_and_click: 'Markierte Kontrollkästchen ausfüllen und klicken',
+  submit: 'absenden',
+  next: 'weiter',
+  click_to_upload: 'Klicken zum Hochladen',
+  or_drag_and_drop_files: 'oder Dateien hierher ziehen und ablegen',
+  send_copy_via_email: 'Kopie per E-Mail senden',
+  download: 'Herunterladen',
+  signature: 'Unterschrift',
+  initials: 'Initialen',
+  clear: 'Löschen',
+  redraw: 'Neu zeichnen',
+  draw_initials: 'Initialen zeichnen',
+  type_signature_here: 'Unterschrift hier eingeben',
+  type_initial_here: 'Initialen hier eingeben',
+  form_has_been_completed: 'Formular wurde ausgefüllt!',
+  create_a_free_account: 'Kostenloses Konto erstellen',
+  signed_with: 'Unterschrieben mit',
+  open_source_documents_software: 'Open-Source-Dokumentensoftware',
+  verified_phone_number: 'Telefonnummer überprüfen',
+  use_international_format: 'Internationales Format verwenden: +1xxx',
+  six_digits_code: '6-stelliger Code',
+  change_phone_number: 'Telefonnummer ändern',
+  sending: 'Senden...',
+  resend_code: 'Code erneut senden',
+  verification_code_has_been_resent: 'Die Verifizierungscode wurde erneut per SMS gesendet',
+  email_has_been_sent: 'Die E-Mail wurde gesendet'
+}
+
+const fr = {
+  submit_form: 'Envoyer le Formulaire',
+  type_here: 'Tapez ici',
+  optional: 'facultatif',
+  select_your_option: 'Sélectionnez votre option',
+  complete_hightlighted_checkboxes_and_click: 'Complétez les cases à cocher en surbrillance et cliquez',
+  submit: 'envoyer',
+  next: 'suivant',
+  click_to_upload: 'Cliquez pour télécharger',
+  or_drag_and_drop_files: 'ou faites glisser-déposer les fichiers',
+  send_copy_via_email: 'Envoyer une copie par e-mail',
+  download: 'Télécharger',
+  signature: 'Signature',
+  initials: 'Initiales',
+  clear: 'Effacer',
+  redraw: 'Redessiner',
+  draw_initials: 'Dessiner les initiales',
+  type_signature_here: 'Tapez la signature ici',
+  type_initial_here: 'Tapez les initiales ici',
+  form_has_been_completed: 'Le formulaire a été complété !',
+  create_a_free_account: 'Créer un Compte Gratuit',
+  signed_with: 'Signé avec',
+  open_source_documents_software: 'logiciel de documents open source',
+  verified_phone_number: 'Vérifier le numéro de téléphone',
+  use_international_format: 'Utiliser le format international : +1xxx',
+  six_digits_code: 'Code à 6 chiffres',
+  change_phone_number: 'Changer le numéro de téléphone',
+  sending: 'Envoi en cours...',
+  resend_code: 'Renvoyer le code',
+  verification_code_has_been_resent: 'Le code de vérification a été renvoyé par SMS',
+  email_has_been_sent: "L'email a été envoyé"
+}
+
+const pl = {
+  submit_form: 'Wyślij Formularz',
+  type_here: 'Wpisz tutaj',
+  optional: 'opcjonalny',
+  select_your_option: 'Wybierz swoją opcję',
+  complete_hightlighted_checkboxes_and_click: 'Wypełnij zaznaczone pola wyboru i kliknij',
+  submit: 'wyślij',
+  next: 'dalej',
+  click_to_upload: 'Kliknij, aby przesłać',
+  or_drag_and_drop_files: 'lub przeciągnij i upuść pliki',
+  send_copy_via_email: 'Wyślij kopię drogą mailową',
+  download: 'Pobierz',
+  signature: 'Podpis',
+  initials: 'Inicjały',
+  clear: 'Wyczyść',
+  redraw: 'Przerysuj',
+  draw_initials: 'Narysuj inicjały',
+  type_signature_here: 'Wpisz podpis tutaj',
+  type_initial_here: 'Wpisz inicjały tutaj',
+  form_has_been_completed: 'Formularz został wypełniony!',
+  create_a_free_account: 'Utwórz darmowe konto',
+  signed_with: 'Podpisane za pomocą',
+  open_source_documents_software: 'oprogramowanie do dokumentów open source',
+  verified_phone_number: 'Zweryfikuj numer telefonu',
+  use_international_format: 'Użyj międzynarodowego formatu: +1xxx',
+  six_digits_code: '6-cyfrowy kod',
+  change_phone_number: 'Zmień numer telefonu',
+  sending: 'Wysyłanie...',
+  resend_code: 'Ponownie wyślij kod',
+  verification_code_has_been_resent: 'Kod weryfikacyjny został ponownie wysłany',
+  email_has_been_sent: 'E-mail został wysłany'
+}
+
+const uk = {
+  submit_form: 'Надіслати Форму',
+  type_here: 'Введіть тут',
+  optional: 'необов’язково',
+  select_your_option: 'Виберіть варіант',
+  complete_hightlighted_checkboxes_and_click: 'Заповніть позначені прапорці та натисніть',
+  submit: 'надіслати',
+  next: 'далі',
+  click_to_upload: 'Клацніть, щоб завантажити',
+  or_drag_and_drop_files: 'або перетягніть файли сюди',
+  send_copy_via_email: 'Надіслати копію електронною поштою',
+  download: 'Завантажити',
+  signature: 'Підпис',
+  initials: 'Ініціали',
+  clear: 'Очистити',
+  redraw: 'Перемалювати',
+  draw_initials: 'Намалювати ініціали',
+  type_signature_here: 'Введіть підпис тут',
+  type_initial_here: 'Введіть ініціали тут',
+  form_has_been_completed: 'Форму заповнено!',
+  create_a_free_account: 'Створити безкоштовний обліковий запис',
+  signed_with: 'Підписано за допомогою',
+  open_source_documents_software: 'відкритий програмний засіб для документів',
+  verified_phone_number: 'Підтвердіть номер телефону',
+  use_international_format: 'Використовуйте міжнародний формат: +1xxx',
+  six_digits_code: '6-значний код',
+  change_phone_number: 'Змінити номер телефону',
+  sending: 'Надсилаю...',
+  resend_code: 'Повторно відправити код',
+  verification_code_has_been_resent: 'Код підтвердження був повторно надісланий',
+  email_has_been_sent: 'Електронний лист був відправлений'
+}
+
+const cs = {
+  submit_form: 'Odeslat formulář',
+  type_here: 'Zadejte zde',
+  optional: 'volitelné',
+  select_your_option: 'Vyberte svou volbu',
+  complete_hightlighted_checkboxes_and_click: 'Označte zvýrazněné zaškrtávací políčka a klikněte na',
+  submit: 'odeslat',
+  next: 'další',
+  click_to_upload: 'Klikněte pro nahrání',
+  or_drag_and_drop_files: 'nebo přetáhněte soubory sem',
+  send_copy_via_email: 'Odeslat kopii e-mailem',
+  download: 'Stáhnout',
+  signature: 'Podpis',
+  initials: 'Iniciály',
+  clear: 'Smazat',
+  redraw: 'Překreslit',
+  draw_initials: 'Nakreslit iniciály',
+  type_signature_here: 'Sem zadejte podpis',
+  type_initial_here: 'Sem zadejte iniciály',
+  form_has_been_completed: 'Formulář byl dokončen!',
+  create_a_free_account: 'Vytvořit bezplatný účet',
+  signed_with: 'Podepsáno pomocí',
+  open_source_documents_software: 'open source software pro dokumenty',
+  verified_phone_number: 'Ověřte telefonní číslo',
+  use_international_format: 'Použijte mezinárodní formát: +1xxx',
+  six_digits_code: '6-místný kód',
+  change_phone_number: 'Změnit telefonní číslo',
+  sending: 'Odesílání...',
+  resend_code: 'Znovu odeslat kód',
+  verification_code_has_been_resent: 'Ověřovací kód byl znovu odeslán',
+  email_has_been_sent: 'E-mail byl odeslán'
+}
+
+const pt = {
+  submit_form: 'Enviar Formulário',
+  type_here: 'Digite aqui',
+  optional: 'opcional',
+  select_your_option: 'Selecione sua opção',
+  complete_hightlighted_checkboxes_and_click: 'Complete as caixas de seleção destacadas e clique',
+  submit: 'enviar',
+  next: 'próximo',
+  click_to_upload: 'Clique para fazer o upload',
+  or_drag_and_drop_files: 'ou arraste e solte arquivos',
+  send_copy_via_email: 'Enviar cópia por e-mail',
+  download: 'Baixar',
+  signature: 'Assinatura',
+  initials: 'Iniciais',
+  clear: 'Limpar',
+  redraw: 'Redesenhar',
+  draw_initials: 'Desenhar iniciais',
+  type_signature_here: 'Digite a assinatura aqui',
+  type_initial_here: 'Digite as iniciais aqui',
+  form_has_been_completed: 'O formulário foi concluído!',
+  create_a_free_account: 'Criar uma Conta Gratuita',
+  signed_with: 'Assinado com',
+  open_source_documents_software: 'software de documentos de código aberto',
+  verified_phone_number: 'Verificar Número de Telefone',
+  use_international_format: 'Use formato internacional: +1xxx',
+  six_digits_code: 'Código de 6 dígitos',
+  change_phone_number: 'Alterar número de telefone',
+  sending: 'Enviando...',
+  resend_code: 'Reenviar código',
+  verification_code_has_been_resent: 'O código de verificação foi reenviado via SMS',
+  email_has_been_sent: 'Email enviado'
+}
+
+const i18n = { en, es, it, de, fr, pl, uk, cs, pt }
+
+const browserLanguage = (navigator.language || navigator.userLanguage || 'en').split('-')[0]
+
+const t = (key) => i18n[browserLanguage]?.[key] || i18n.en[key] || key
+
+export default i18n
+export { t }

app/javascript/submission_form/initials_step.vue

@@ -0,0 +1,244 @@
+<template>
+  <div>
+    <div class="flex justify-between items-center w-full mb-2">
+      <label
+        class="label text-2xl"
+      >{{ field.name || t('initials') }}</label>
+      <div class="space-x-2 flex">
+        <span
+          class="tooltip"
+          :data-tip="t('draw_initials')"
+        >
+          <button
+            id="type_text_button"
+            class="btn btn-sm btn-circle"
+            :class="{ 'btn-neutral': isDrawInitials, 'btn-outline': !isDrawInitials }"
+            @click.prevent="toggleTextInput"
+          >
+            <IconSignature :width="16" />
+          </button>
+        </span>
+        <button
+          v-if="modelValue"
+          class="btn btn-outline btn-sm"
+          @click.prevent="remove"
+        >
+          <IconReload :width="16" />
+          {{ t('clear') }}
+        </button>
+        <button
+          v-else
+          class="btn btn-outline btn-sm"
+          @click.prevent="clear"
+        >
+          <IconReload :width="16" />
+          {{ t('clear') }}
+        </button>
+        <button
+          title="Minimize"
+          class="py-1.5 inline md:hidden"
+          @click.prevent="$emit('minimize')"
+        >
+          <IconArrowsDiagonalMinimize2
+            :width="20"
+            :height="20"
+          />
+        </button>
+      </div>
+    </div>
+    <input
+      :value="modelValue"
+      type="hidden"
+      :name="`values[${field.uuid}]`"
+    >
+    <img
+      v-if="modelValue"
+      :src="attachmentsIndex[modelValue].url"
+      class="mx-auto bg-white border border-base-300 rounded max-h-72"
+    >
+    <canvas
+      v-show="!modelValue"
+      ref="canvas"
+      class="bg-white border border-base-300 rounded"
+    />
+    <input
+      v-if="!isDrawInitials"
+      id="initials_text_input"
+      ref="textInput"
+      class="base-input !text-2xl w-full mt-6 text-center"
+      :required="field.required && !isInitialsStarted"
+      :placeholder="`${t('type_initial_here')}...`"
+      type="text"
+      @focus="$emit('focus')"
+      @input="updateWrittenInitials"
+    >
+  </div>
+</template>
+
+<script>
+import { cropCanvasAndExportToPNG } from './crop_canvas'
+import { IconReload, IconSignature, IconArrowsDiagonalMinimize2 } from '@tabler/icons-vue'
+
+export default {
+  name: 'InitialsStep',
+  components: {
+    IconReload,
+    IconSignature,
+    IconArrowsDiagonalMinimize2
+  },
+  inject: ['baseUrl', 't'],
+  props: {
+    field: {
+      type: Object,
+      required: true
+    },
+    submitterSlug: {
+      type: String,
+      required: true
+    },
+    isDirectUpload: {
+      type: Boolean,
+      required: true,
+      default: false
+    },
+    attachmentsIndex: {
+      type: Object,
+      required: false,
+      default: () => ({})
+    },
+    modelValue: {
+      type: String,
+      required: false,
+      default: ''
+    }
+  },
+  emits: ['attached', 'update:model-value', 'start', 'minimize', 'focus'],
+  data () {
+    return {
+      isInitialsStarted: false,
+      isDrawInitials: false
+    }
+  },
+  async mounted () {
+    this.$nextTick(() => {
+      if (this.$refs.canvas) {
+        this.$refs.canvas.width = this.$refs.canvas.parentNode.clientWidth
+        this.$refs.canvas.height = this.$refs.canvas.parentNode.clientWidth / 5
+      }
+
+      this.$refs.textInput?.focus()
+    })
+
+    if (this.isDirectUpload) {
+      import('@rails/activestorage')
+    }
+
+    const { default: SignaturePad } = await import('signature_pad')
+
+    if (this.$refs.canvas) {
+      this.pad = new SignaturePad(this.$refs.canvas)
+
+      this.pad.addEventListener('beginStroke', () => {
+        this.isInitialsStarted = true
+
+        this.$emit('start')
+      })
+    }
+  },
+  methods: {
+    remove () {
+      this.$emit('update:model-value', '')
+    },
+    clear () {
+      this.pad.clear()
+
+      this.isInitialsStarted = false
+
+      if (this.$refs.textInput) {
+        this.$refs.textInput.value = ''
+      }
+    },
+    updateWrittenInitials (e) {
+      this.isInitialsStarted = true
+
+      const canvas = this.$refs.canvas
+      const context = canvas.getContext('2d')
+
+      const fontFamily = 'Arial'
+      const fontSize = '44px'
+      const fontStyle = 'italic'
+      const fontWeight = ''
+
+      context.font = fontStyle + ' ' + fontWeight + ' ' + fontSize + ' ' + fontFamily
+      context.textAlign = 'center'
+
+      context.clearRect(0, 0, canvas.width, canvas.height)
+      context.fillText(e.target.value, canvas.width / 2, canvas.height / 2 + 11)
+    },
+    toggleTextInput () {
+      this.remove()
+      this.clear()
+      this.isDrawInitials = !this.isDrawInitials
+
+      if (!this.isDrawInitials) {
+        this.$nextTick(() => {
+          this.$refs.textInput.focus()
+
+          this.$emit('start')
+        })
+      }
+    },
+    async submit () {
+      if (this.modelValue) {
+        return Promise.resolve({})
+      }
+
+      return new Promise((resolve) => {
+        cropCanvasAndExportToPNG(this.$refs.canvas).then(async (blob) => {
+          const file = new File([blob], 'initials.png', { type: 'image/png' })
+
+          if (this.isDirectUpload) {
+            const { DirectUpload } = await import('@rails/activestorage')
+
+            new DirectUpload(
+              file,
+              '/direct_uploads'
+            ).create((_error, data) => {
+              fetch(this.baseUrl + '/api/attachments', {
+                method: 'POST',
+                body: JSON.stringify({
+                  submitter_slug: this.submitterSlug,
+                  blob_signed_id: data.signed_id,
+                  name: 'attachments'
+                }),
+                headers: { 'Content-Type': 'application/json' }
+              }).then((resp) => resp.json()).then((attachment) => {
+                this.$emit('update:model-value', attachment.uuid)
+                this.$emit('attached', attachment)
+
+                return resolve(attachment)
+              })
+            })
+          } else {
+            const formData = new FormData()
+
+            formData.append('file', file)
+            formData.append('submitter_slug', this.submitterSlug)
+            formData.append('name', 'attachments')
+
+            return fetch(this.baseUrl + '/api/attachments', {
+              method: 'POST',
+              body: formData
+            }).then((resp) => resp.json()).then((attachment) => {
+              this.$emit('attached', attachment)
+              this.$emit('update:model-value', attachment.uuid)
+
+              return resolve(attachment)
+            })
+          }
+        })
+      })
+    }
+  }
+}
+</script>

app/javascript/submission_form/phone_step.vue

@@ -0,0 +1,155 @@
+<template>
+  <div>
+    <label
+      :for="isCodeSent ? 'one_time_code' : field.uuid"
+      class="label text-2xl mb-2"
+    >{{ field.name || t('verified_phone_number') }}
+      <template v-if="!field.required">({{ t('optional') }})</template>
+    </label>
+    <div>
+      <input
+        type="hidden"
+        name="normalize_phone"
+        value="true"
+      >
+      <div v-if="isCodeSent">
+        <input
+          id="one_time_code"
+          class="base-input !text-2xl w-full text-center"
+          name="one_time_code"
+          type="text"
+          autocomplete="one-time-code"
+          :placeholder="t('six_digits_code')"
+          required
+          maxlength="6"
+          autofocus
+          inputmode="decimal"
+          @input="onInputCode"
+        >
+        <div class="flex justify-between mt-2 -mb-2 md:-mb-4">
+          <a
+            href="#"
+            class="link"
+            @click.prevent="isCodeSent = false"
+          >
+            {{ t('change_phone_number') }}
+          </a>
+          <a
+            href="#"
+            class="link"
+            @click.prevent="resendCode"
+          >
+            {{ isResendLoading ? t('sending') : t('resend_code') }}
+          </a>
+        </div>
+      </div>
+      <input
+        v-show="!isCodeSent"
+        :id="field.uuid"
+        ref="phone"
+        :value="modelValue || defaultValue"
+        class="base-input !text-2xl w-full"
+        autocomplete="tel"
+        pattern="^\+[0-9\s\-]+$"
+        :oninvalid="`this.value ? this.setCustomValidity('${t('use_international_format')}...') : ''`"
+        oninput="this.setCustomValidity('')"
+        type="tel"
+        inputmode="tel"
+        :required="field.required"
+        placeholder="+1 234 567-8900"
+        :name="`values[${field.uuid}]`"
+        @input="$emit('update:model-value', $event.target.value)"
+        @focus="$emit('focus')"
+      >
+    </div>
+  </div>
+</template>
+
+<script>
+function throttle (func, delay) {
+  let lastCallTime = 0
+
+  return function (...args) {
+    const now = Date.now()
+
+    if (now - lastCallTime >= delay) {
+      func.apply(this, args)
+      lastCallTime = now
+    }
+  }
+}
+
+export default {
+  name: 'PhoneStep',
+  inject: ['t', 'baseUrl'],
+  props: {
+    field: {
+      type: Object,
+      required: true
+    },
+    submitterSlug: {
+      type: String,
+      required: true
+    },
+    modelValue: {
+      type: String,
+      required: false,
+      default: ''
+    },
+    defaultValue: {
+      type: String,
+      required: false,
+      default: ''
+    }
+  },
+  emits: ['update:model-value', 'focus', 'submit'],
+  data () {
+    return {
+      isCodeSent: false,
+      isResendLoading: false
+    }
+  },
+  methods: {
+    emitSubmit: throttle(function (e) {
+      this.$emit('submit')
+    }, 1000),
+    onInputCode (e) {
+      if (e.target.value.length === 6) {
+        this.emitSubmit()
+      }
+    },
+    resendCode () {
+      this.isResendLoading = true
+
+      this.sendVerificationCode().finally(() => {
+        alert(this.t('verification_code_has_been_resent'))
+
+        this.isResendLoading = false
+      })
+    },
+    sendVerificationCode () {
+      return fetch(this.baseUrl + '/api/send_phone_verification_code', {
+        method: 'POST',
+        body: JSON.stringify({
+          submitter_slug: this.submitterSlug,
+          phone: this.$refs.phone.value
+        }),
+        headers: { 'Content-Type': 'application/json' }
+      })
+    },
+    async submit () {
+      if (!this.isCodeSent) {
+        this.sendVerificationCode()
+
+        this.$emit('update:model-value', this.$refs.phone.value)
+
+        this.isCodeSent = true
+
+        return Promise.reject(new Error('verify with code'))
+      } else {
+        return Promise.resolve({})
+      }
+    }
+  }
+}
+</script>

app/javascript/submission_form/signature_step.vue

@@ -3,23 +3,64 @@
     <div class="flex justify-between items-center w-full mb-2">
       <label
         class="label text-2xl"
-      >{{ field.name || 'Signature' }}</label>
+      >{{ field.name || t('signature') }}</label>
-      <button
+      <div class="space-x-2 flex">
-        v-if="modelValue"
+        <span
-        class="btn btn-outline btn-sm"
+          class="tooltip"
-        @click.prevent="remove"
+          data-tip="Type text"
-      >
+        >
-        <IconReload :width="16" />
+          <button
-        Redraw
+            id="type_text_button"
-      </button>
+            class="btn btn-sm btn-circle"
-      <button
+            :class="{ 'btn-neutral': isTextSignature, 'btn-outline': !isTextSignature }"
-        v-else
+            @click.prevent="toggleTextInput"
-        class="btn btn-outline btn-sm"
+          >
-        @click.prevent="clear"
+            <IconTextSize :width="16" />
-      >
+          </button>
-        <IconReload :width="16" />
+        </span>
-        Clear
+        <span
-      </button>
+          class="tooltip"
+          data-tip="Take photo"
+        >
+          <label
+            class="btn btn-outline btn-sm btn-circle"
+          >
+            <IconCamera :width="16" />
+            <input
+              type="file"
+              hidden
+              accept="image/*"
+              @change="drawImage"
+            >
+          </label>
+        </span>
+        <button
+          v-if="modelValue"
+          class="btn btn-outline btn-sm"
+          @click.prevent="remove"
+        >
+          <IconReload :width="16" />
+          {{ t('redraw') }}
+        </button>
+        <button
+          v-else
+          class="btn btn-outline btn-sm"
+          @click.prevent="clear"
+        >
+          <IconReload :width="16" />
+          {{ t('clear') }}
+        </button>
+        <button
+          title="Minimize"
+          class="py-1.5 inline md:hidden"
+          @click.prevent="$emit('minimize')"
+        >
+          <IconArrowsDiagonalMinimize2
+            :width="20"
+            :height="20"
+          />
+        </button>
+      </div>
     </div>
     <input
       :value="modelValue"
@@ -29,24 +70,39 @@
     <img
       v-if="modelValue"
       :src="attachmentsIndex[modelValue].url"
-      class="w-full bg-white border border-base-300 rounded"
+      class="mx-auto bg-white border border-base-300 rounded max-h-72"
     >
     <canvas
       v-show="!modelValue"
       ref="canvas"
       class="bg-white border border-base-300 rounded"
     />
+    <input
+      v-if="isTextSignature"
+      id="signature_text_input"
+      ref="textInput"
+      class="base-input !text-2xl w-full mt-6"
+      :required="field.required"
+      :placeholder="`${t('type_signature_here')}...`"
+      type="text"
+      @input="updateWrittenSignature"
+    >
   </div>
 </template>
 
 <script>
-import { IconReload } from '@tabler/icons-vue'
+import { IconReload, IconCamera, IconTextSize, IconArrowsDiagonalMinimize2 } from '@tabler/icons-vue'
+import { cropCanvasAndExportToPNG } from './crop_canvas'
 
 export default {
   name: 'SignatureStep',
   components: {
-    IconReload
+    IconReload,
+    IconCamera,
+    IconTextSize,
+    IconArrowsDiagonalMinimize2
   },
+  inject: ['baseUrl', 't'],
   props: {
     field: {
       type: Object,
@@ -72,16 +128,19 @@ export default {
       default: ''
     }
   },
-  emits: ['attached', 'update:model-value'],
+  emits: ['attached', 'update:model-value', 'start', 'minimize'],
   data () {
     return {
-      isSignatureStarted: false
+      isSignatureStarted: false,
+      isTextSignature: false
     }
   },
   async mounted () {
     this.$nextTick(() => {
-      this.$refs.canvas.width = this.$refs.canvas.parentNode.clientWidth
+      if (this.$refs.canvas) {
-      this.$refs.canvas.height = this.$refs.canvas.parentNode.clientWidth / 3
+        this.$refs.canvas.width = this.$refs.canvas.parentNode.clientWidth
+        this.$refs.canvas.height = this.$refs.canvas.parentNode.clientWidth / 3
+      }
     })
 
     if (this.isDirectUpload) {
@@ -90,11 +149,15 @@ export default {
 
     const { default: SignaturePad } = await import('signature_pad')
 
-    this.pad = new SignaturePad(this.$refs.canvas)
+    if (this.$refs.canvas) {
+      this.pad = new SignaturePad(this.$refs.canvas)
 
-    this.pad.addEventListener('beginStroke', () => {
+      this.pad.addEventListener('beginStroke', () => {
-      this.isSignatureStarted = true
+        this.isSignatureStarted = true
-    })
+
+        this.$emit('start')
+      })
+    }
   },
   methods: {
     remove () {
@@ -104,6 +167,87 @@ export default {
       this.pad.clear()
 
       this.isSignatureStarted = false
+
+      if (this.$refs.textInput) {
+        this.$refs.textInput.value = ''
+      }
+    },
+    updateWrittenSignature (e) {
+      this.isSignatureStarted = true
+
+      const canvas = this.$refs.canvas
+      const context = canvas.getContext('2d')
+
+      const fontFamily = 'Arial'
+      const fontSize = '44px'
+      const fontStyle = 'italic'
+      const fontWeight = ''
+
+      context.font = fontStyle + ' ' + fontWeight + ' ' + fontSize + ' ' + fontFamily
+      context.textAlign = 'center'
+
+      context.clearRect(0, 0, canvas.width, canvas.height)
+      context.fillText(e.target.value, canvas.width / 2, canvas.height / 2 + 11)
+    },
+    toggleTextInput () {
+      this.remove()
+      this.isTextSignature = !this.isTextSignature
+
+      if (this.isTextSignature) {
+        this.$nextTick(() => {
+          this.$refs.textInput.focus()
+
+          this.$emit('start')
+        })
+      }
+    },
+    drawImage (event) {
+      this.remove()
+      this.isSignatureStarted = true
+
+      const file = event.target.files[0]
+
+      if (file && file.type.match('image.*')) {
+        const reader = new FileReader()
+
+        reader.onload = (event) => {
+          const img = new Image()
+
+          img.src = event.target.result
+
+          img.onload = () => {
+            const canvas = this.$refs.canvas
+            const context = canvas.getContext('2d')
+
+            const aspectRatio = img.width / img.height
+
+            let targetWidth = canvas.width
+            let targetHeight = canvas.height
+
+            if (canvas.width / canvas.height > aspectRatio) {
+              targetWidth = canvas.height * aspectRatio
+            } else {
+              targetHeight = canvas.width / aspectRatio
+            }
+
+            if (targetHeight > targetWidth) {
+              const scale = targetHeight / targetWidth
+              targetWidth = targetWidth * scale
+              targetHeight = targetHeight * scale
+            }
+
+            const x = (canvas.width - targetWidth) / 2
+            const y = (canvas.height - targetHeight) / 2
+
+            context.clearRect(0, 0, canvas.width, canvas.height)
+            context.drawImage(img, x, y, targetWidth, targetHeight)
+
+            this.$emit('start')
+          }
+        }
+
+        reader.readAsDataURL(file)
+      }
     },
     async submit () {
       if (this.modelValue) {
@@ -111,7 +255,7 @@ export default {
       }
 
       return new Promise((resolve) => {
-        this.$refs.canvas.toBlob(async (blob) => {
+        cropCanvasAndExportToPNG(this.$refs.canvas).then(async (blob) => {
           const file = new File([blob], 'signature.png', { type: 'image/png' })
 
           if (this.isDirectUpload) {
@@ -121,7 +265,7 @@ export default {
               file,
               '/direct_uploads'
             ).create((_error, data) => {
-              fetch('/api/attachments', {
+              fetch(this.baseUrl + '/api/attachments', {
                 method: 'POST',
                 body: JSON.stringify({
                   submitter_slug: this.submitterSlug,
@@ -143,17 +287,17 @@ export default {
             formData.append('submitter_slug', this.submitterSlug)
             formData.append('name', 'attachments')
 
-            return fetch('/api/attachments', {
+            return fetch(this.baseUrl + '/api/attachments', {
               method: 'POST',
               body: formData
             }).then((resp) => resp.json()).then((attachment) => {
-              this.$emit('update:model-value', attachment.uuid)
               this.$emit('attached', attachment)
+              this.$emit('update:model-value', attachment.uuid)
 
               return resolve(attachment)
             })
           }
-        }, 'image/png')
+        })
       })
     }
   }

app/javascript/template_builder/area.vue

@@ -65,7 +65,7 @@
         @blur="onNameBlur"
       >{{ field.name || defaultName }}</span>
       <div
-        v-if="isNameFocus"
+        v-if="isNameFocus && field.type !== 'checkbox'"
         class="flex items-center ml-1.5"
       >
         <input
@@ -226,14 +226,14 @@ export default {
       }
     },
     startResizeCell (e) {
-      document.addEventListener('mousemove', this.onResizeCell)
+      this.$el.getRootNode().addEventListener('mousemove', this.onResizeCell)
-      document.addEventListener('mouseup', this.stopResizeCell)
+      this.$el.getRootNode().addEventListener('mouseup', this.stopResizeCell)
 
       this.$emit('start-resize', 'ew')
     },
     stopResizeCell (e) {
-      document.removeEventListener('mousemove', this.onResizeCell)
+      this.$el.getRootNode().removeEventListener('mousemove', this.onResizeCell)
-      document.removeEventListener('mouseup', this.stopResizeCell)
+      this.$el.getRootNode().removeEventListener('mouseup', this.stopResizeCell)
 
       this.$emit('stop-resize')
 
@@ -266,11 +266,13 @@ export default {
       })
     },
     onNameBlur (e) {
+      const text = this.$refs.name.innerText.trim()
+
       this.isNameFocus = false
       this.$refs.name.style.minWidth = ''
 
-      if (e.target.innerText.trim()) {
+      if (text) {
-        this.field.name = e.target.innerText.trim()
+        this.field.name = text
       } else {
         this.field.name = ''
         this.$refs.name.innerText = this.defaultName
@@ -302,14 +304,14 @@ export default {
 
       this.dragFrom = { x: e.clientX - rect.left, y: e.clientY - rect.top }
 
-      document.addEventListener('mousemove', this.drag)
+      this.$el.getRootNode().addEventListener('mousemove', this.drag)
-      document.addEventListener('mouseup', this.stopDrag)
+      this.$el.getRootNode().addEventListener('mouseup', this.stopDrag)
 
       this.$emit('start-drag')
     },
     stopDrag () {
-      document.removeEventListener('mousemove', this.drag)
+      this.$el.getRootNode().removeEventListener('mousemove', this.drag)
-      document.removeEventListener('mouseup', this.stopDrag)
+      this.$el.getRootNode().removeEventListener('mouseup', this.stopDrag)
 
       if (this.isDragged) {
         this.save()
@@ -322,14 +324,14 @@ export default {
     startResize () {
       this.selectedAreaRef.value = this.area
 
-      document.addEventListener('mousemove', this.resize)
+      this.$el.getRootNode().addEventListener('mousemove', this.resize)
-      document.addEventListener('mouseup', this.stopResize)
+      this.$el.getRootNode().addEventListener('mouseup', this.stopResize)
 
       this.$emit('start-resize', 'nwse')
     },
     stopResize () {
-      document.removeEventListener('mousemove', this.resize)
+      this.$el.getRootNode().removeEventListener('mousemove', this.resize)
-      document.removeEventListener('mouseup', this.stopResize)
+      this.$el.getRootNode().removeEventListener('mouseup', this.stopResize)
 
       this.$emit('stop-resize')
 

app/javascript/template_builder/builder.vue

@@ -1,13 +1,17 @@
 <template>
   <div
     style="max-width: 1600px"
-    class="mx-auto pl-4"
+    class="mx-auto pl-4 h-full"
   >
     <div class="flex justify-between py-1.5 items-center pr-4">
       <div class="flex space-x-3">
-        <a href="/">
+        <a
+          v-if="withLogoLink"
+          href="/"
+        >
           <Logo />
         </a>
+        <Logo v-else />
         <Contenteditable
           :model-value="template.name"
           class="text-3xl font-semibold focus:text-clip"
@@ -16,46 +20,53 @@
         />
       </div>
       <div class="space-x-3 flex items-center">
-        <a
+        <slot
-          :href="`/templates/${template.id}/submissions/new`"
+          v-if="$slots.buttons"
-          data-turbo-frame="modal"
+          name="buttons"
-          class="btn btn-primary"
+        />
-        >
+        <template v-else>
-          <IconUsersPlus
+          <a
-            width="20"
+            :href="`/templates/${template.id}/submissions/new`"
-            class="inline"
+            data-turbo-frame="modal"
-          />
+            class="btn btn-primary text-base"
-          <span class="hidden md:inline">
+          >
-            Recipients
+            <IconUsersPlus
-          </span>
+              width="20"
-        </a>
+              class="inline"
-        <button
+            />
-          class="base-button"
+            <span class="hidden md:inline">
-          :class="{ disabled: isSaving }"
+              Recipients
-          v-bind="isSaving ? { disabled: true } : {}"
+            </span>
-          @click.prevent="onSaveClick"
+          </a>
-        >
+          <button
-          <IconInnerShadowTop
+            class="base-button"
-            v-if="isSaving"
+            :class="{ disabled: isSaving }"
-            width="20"
+            v-bind="isSaving ? { disabled: true } : {}"
-            class="animate-spin"
+            @click.prevent="onSaveClick"
-          />
+          >
-          <IconDeviceFloppy
+            <IconInnerShadowTop
-            v-else
+              v-if="isSaving"
-            width="20"
+              width="22"
-          />
+              class="animate-spin"
-          <span class="hidden md:inline">
+            />
-            Save
+            <IconDeviceFloppy
-          </span>
+              v-else
-        </button>
+              width="22"
+            />
+            <span class="hidden md:inline">
+              Save
+            </span>
+          </button>
+        </template>
       </div>
     </div>
     <div
       class="flex"
-      style="max-height: calc(100vh - 60px)"
+      style="max-height: calc(100% - 60px)"
     >
       <div
         ref="previews"
+        :style="{ 'display': isBreakpointLg ? 'none' : 'initial' }"
         class="overflow-y-auto overflow-x-hidden w-52 flex-none pr-3 mt-0.5 pt-0.5 hidden lg:block"
       >
         <DocumentPreview
@@ -64,15 +75,23 @@
           :with-arrows="template.schema.length > 1"
           :item="item"
           :document="sortedDocuments[index]"
+          :accept-file-types="acceptFileTypes"
+          :template="template"
+          :is-direct-upload="isDirectUpload"
           @scroll-to="scrollIntoDocument(item)"
           @remove="onDocumentRemove"
+          @replace="onDocumentReplace"
           @up="moveDocument(item, -1)"
           @down="moveDocument(item, 1)"
           @change="save"
         />
-        <div class="sticky bottom-0 bg-base-100 py-2">
+        <div
+          class="sticky bottom-0 py-2"
+          :class="{ 'bg-base-100': withStickySubmitters }"
+        >
           <Upload
             v-if="sortedDocuments.length"
+            :accept-file-types="acceptFileTypes"
             :template-id="template.id"
             :is-direct-upload="isDirectUpload"
             @success="updateFromUpload"
@@ -87,23 +106,51 @@
           <Dropzone
             v-if="!sortedDocuments.length"
             :template-id="template.id"
+            :accept-file-types="acceptFileTypes"
             :is-direct-upload="isDirectUpload"
             @success="updateFromUpload"
           />
           <template v-else>
-            <Document
+            <template
               v-for="document in sortedDocuments"
               :key="document.uuid"
-              :ref="setDocumentRefs"
+            >
-              :areas-index="fieldAreasIndex[document.uuid]"
+              <Document
-              :selected-submitter="selectedSubmitter"
+                :ref="setDocumentRefs"
-              :document="document"
+                :areas-index="fieldAreasIndex[document.uuid]"
-              :is-drag="!!dragFieldType"
+                :selected-submitter="selectedSubmitter"
-              :draw-field="drawField"
+                :document="document"
-              @draw="onDraw"
+                :is-drag="!!dragFieldType"
-              @drop-field="onDropfield"
+                :draw-field="drawField"
-              @remove-area="removeArea"
+                @draw="onDraw"
-            />
+                @drop-field="onDropfield"
+                @remove-area="removeArea"
+              />
+              <DocumentControls
+                v-if="isBreakpointLg"
+                :with-arrows="template.schema.length > 1"
+                :item="template.schema.find((item) => item.attachment_uuid === document.uuid)"
+                :document="document"
+                :template="template"
+                :is-direct-upload="isDirectUpload"
+                class="pb-2 mb-2 border-b border-base-300 border-dashed"
+                @remove="onDocumentRemove"
+                @replace="onDocumentReplace"
+                @up="moveDocument(template.schema.find((item) => item.attachment_uuid === document.uuid), -1)"
+                @down="moveDocument(template.schema.find((item) => item.attachment_uuid === document.uuid), 1)"
+                @change="save"
+              />
+            </template>
+            <div
+              v-if="sortedDocuments.length && isBreakpointLg"
+              class="pb-4"
+            >
+              <Upload
+                :template-id="template.id"
+                :is-direct-upload="isDirectUpload"
+                @success="updateFromUpload"
+              />
+            </div>
           </template>
         </div>
         <div
@@ -119,7 +166,7 @@
         </div>
       </div>
       <div
-        class="relative w-80 flex-none pt-0.5 pr-4 pl-0.5 hidden md:block"
+        class="relative w-80 flex-none mt-1 pr-4 pl-0.5 hidden md:block"
         :class="drawField ? 'overflow-hidden' : 'overflow-auto'"
       >
         <div
@@ -133,7 +180,7 @@
             <p>
               <button
                 class="base-button"
-                @click="drawField = false"
+                @click="drawField = null"
               >
                 Cancel
               </button>
@@ -146,6 +193,7 @@
             :fields="template.fields"
             :submitters="template.submitters"
             :selected-submitter="selectedSubmitter"
+            :with-sticky-submitters="withStickySubmitters"
             @set-draw="drawField = $event"
             @set-drag="dragFieldType = $event"
             @change-submitter="selectedSubmitter = $event"
@@ -166,6 +214,7 @@ import Document from './document'
 import Logo from './logo'
 import Contenteditable from './contenteditable'
 import DocumentPreview from './preview'
+import DocumentControls from './controls'
 import { IconUsersPlus, IconDeviceFloppy, IconInnerShadowTop } from '@tabler/icons-vue'
 import { v4 } from 'uuid'
 import { ref, computed } from 'vue'
@@ -179,6 +228,7 @@ export default {
     Logo,
     Dropzone,
     DocumentPreview,
+    DocumentControls,
     IconInnerShadowTop,
     Contenteditable,
     IconUsersPlus,
@@ -188,6 +238,9 @@ export default {
     return {
       template: this.template,
       save: this.save,
+      baseFetch: this.baseFetch,
+      backgroundColor: this.backgroundColor,
+      withPhone: this.withPhone,
       selectedAreaRef: computed(() => this.selectedAreaRef)
     }
   },
@@ -198,13 +251,49 @@ export default {
     },
     isDirectUpload: {
       type: Boolean,
-      required: true,
+      required: false,
       default: false
+    },
+    backgroundColor: {
+      type: String,
+      required: false,
+      default: ''
+    },
+    acceptFileTypes: {
+      type: String,
+      required: false,
+      default: 'image/*, application/pdf'
+    },
+    baseUrl: {
+      type: String,
+      required: false,
+      default: ''
+    },
+    withLogoLink: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
+    withStickySubmitters: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
+    withPhone: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
+    fetchOptions: {
+      type: Object,
+      required: false,
+      default: () => ({ headers: {} })
     }
   },
   data () {
     return {
       documentRefs: [],
+      isBreakpointLg: false,
       isSaving: false,
       selectedSubmitter: null,
       drawField: null,
@@ -241,15 +330,28 @@ export default {
     this.selectedSubmitter = this.template.submitters[0]
   },
   mounted () {
+    this.$nextTick(() => {
+      this.onWindowResize()
+    })
+
     document.addEventListener('keyup', this.onKeyUp)
+
+    window.addEventListener('resize', this.onWindowResize)
   },
   unmounted () {
     document.removeEventListener('keyup', this.onKeyUp)
+
+    window.removeEventListener('resize', this.onWindowResize)
   },
   beforeUpdate () {
     this.documentRefs = []
   },
   methods: {
+    onWindowResize (e) {
+      const breakpointLg = 1024
+
+      this.isBreakpointLg = this.$el.getRootNode().querySelector('div[data-v-app]').offsetWidth < breakpointLg
+    },
     setDocumentRefs (el) {
       if (el) {
         this.documentRefs.push(el)
@@ -289,6 +391,10 @@ export default {
         this.drawField.areas.push(area)
 
         this.drawField = null
+
+        this.selectedAreaRef.value = area
+
+        this.save()
       } else {
         const documentRef = this.documentRefs.find((e) => e.document.uuid === area.attachment_uuid)
         const pageMask = documentRef.pageRefs[area.page].$refs.mask
@@ -299,33 +405,37 @@ export default {
           const previousField = [...this.template.fields].reverse().find((f) => f.type === type)
           const previousArea = previousField?.areas?.[previousField.areas.length - 1]
 
-          const areaW = previousArea?.w || (30 / pageMask.clientWidth)
+          if (previousArea || area.w) {
-          const areaH = previousArea?.h || (30 / pageMask.clientHeight)
+            const areaW = previousArea?.w || (30 / pageMask.clientWidth)
+            const areaH = previousArea?.h || (30 / pageMask.clientHeight)
 
-          if ((pageMask.clientWidth * area.w) < 5) {
+            if ((pageMask.clientWidth * area.w) < 5) {
-            area.x = area.x - (areaW / 2)
+              area.x = area.x - (areaW / 2)
-            area.y = area.y - (areaH / 2)
+              area.y = area.y - (areaH / 2)
+            }
+
+            area.w = areaW
+            area.h = areaH
+          }
+        }
+
+        if (area.w) {
+          const field = {
+            name: '',
+            uuid: v4(),
+            required: type !== 'checkbox',
+            type,
+            submitter_uuid: this.selectedSubmitter.uuid,
+            areas: [area]
           }
 
-          area.w = areaW
+          this.template.fields.push(field)
-          area.h = areaH
-        }
 
-        const field = {
+          this.selectedAreaRef.value = area
-          name: '',
-          uuid: v4(),
-          required: true,
-          type,
-          submitter_uuid: this.selectedSubmitter.uuid,
-          areas: [area]
-        }
 
-        this.template.fields.push(field)
+          this.save()
+        }
       }
-
-      this.selectedAreaRef.value = area
-
-      this.save()
     },
     onDropfield (area) {
       const field = {
@@ -333,7 +443,7 @@ export default {
         type: this.dragFieldType,
         uuid: v4(),
         submitter_uuid: this.selectedSubmitter.uuid,
-        required: true
+        required: this.dragFieldType !== 'checkbox'
       }
 
       if (['select', 'multiple', 'radio'].includes(this.dragFieldType)) {
@@ -353,7 +463,7 @@ export default {
 
       if (this.selectedField?.type === this.dragFieldType) {
         baseArea = this.selectedAreaRef.value
-      } else if (previousField?.areas) {
+      } else if (previousField?.areas?.length) {
         baseArea = previousField.areas[previousField.areas.length - 1]
       } else {
         if (['checkbox'].includes(this.dragFieldType)) {
@@ -371,6 +481,11 @@ export default {
             w: area.maskW / 5 / area.maskW,
             h: (area.maskW / 5 / area.maskW) * (area.maskW / area.maskH) / 2
           }
+        } else if (this.dragFieldType === 'initials') {
+          baseArea = {
+            w: area.maskW / 10 / area.maskW,
+            h: area.maskW / 35 / area.maskW
+          }
         } else {
           baseArea = {
             w: area.maskW / 5 / area.maskW,
@@ -417,6 +532,27 @@ export default {
         this.template.schema.splice(this.template.schema.indexOf(item), 1)
       }
 
+      this.template.fields.forEach((field) => {
+        [...(field.areas || [])].forEach((area) => {
+          if (area.attachment_uuid === item.attachment_uuid) {
+            field.areas.splice(field.areas.indexOf(area), 1)
+          }
+        })
+      })
+
+      this.save()
+    },
+    onDocumentReplace ({ replaceSchemaItem, schema, documents }) {
+      this.template.schema.splice(this.template.schema.indexOf(replaceSchemaItem), 1, schema[0])
+      this.template.documents.push(...documents)
+      this.template.fields.forEach((field) => {
+        (field.areas || []).forEach((area) => {
+          if (area.attachment_uuid === replaceSchemaItem.attachment_uuid) {
+            area.attachment_uuid = schema[0].attachment_uuid
+          }
+        })
+      })
+
       this.save()
     },
     moveDocument (item, direction) {
@@ -450,10 +586,18 @@ export default {
 
       this.selectedAreaRef.value = area
     },
+    baseFetch (path, options = {}) {
+      return fetch(this.baseUrl + path, {
+        ...options,
+        headers: { ...this.fetchOptions.headers, ...options.headers }
+      })
+    },
     save () {
-      this.$el.closest('template-builder').dataset.template = JSON.stringify(this.template)
+      if (this.$el.closest('template-builder')) {
+        this.$el.closest('template-builder').dataset.template = JSON.stringify(this.template)
+      }
 
-      return fetch(`/api/templates/${this.template.id}`, {
+      return this.baseFetch(`/api/templates/${this.template.id}`, {
         method: 'PUT',
         body: JSON.stringify({
           template: {

app/javascript/template_builder/contenteditable.vue

@@ -30,7 +30,7 @@
       :class="{ 'ml-1': !withRequired, 'absolute': !iconInline, 'inline align-bottom': iconInline }"
       :width="iconWidth"
       :stroke-width="iconStrokeWidth"
-      @click="focusContenteditable"
+      @click="[focusContenteditable(), selectOnEditClick && selectContent()]"
     />
   </div>
 </template>
@@ -64,6 +64,11 @@ export default {
       required: false,
       default: false
     },
+    selectOnEditClick: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
     iconStrokeWidth: {
       type: Number,
       required: false,
@@ -85,6 +90,19 @@ export default {
     }
   },
   methods: {
+    selectContent () {
+      const el = this.$refs.contenteditable
+
+      const range = document.createRange()
+
+      range.selectNodeContents(el)
+
+      const sel = window.getSelection()
+
+      sel.removeAllRanges()
+
+      sel.addRange(range)
+    },
     onBlur (e) {
       setTimeout(() => {
         this.value = this.$refs.contenteditable.innerText.trim() || this.modelValue

app/javascript/template_builder/controls.vue

@@ -0,0 +1,91 @@
+<template>
+  <div class="flex space-x-2">
+    <Contenteditable
+      class="w-full block mr-6"
+      :model-value="item.name"
+      :icon-width="16"
+      @update:model-value="onUpdateName"
+    />
+    <ReplaceButton
+      :is-direct-upload="isDirectUpload"
+      :template-id="template.id"
+      @click.stop
+      @success="$emit('replace', { replaceSchemaItem: item, ...$event })"
+    />
+    <button
+      v-if="withArrows"
+      class="btn border-base-200 bg-white text-base-content btn-xs rounded hover:text-base-100 hover:bg-base-content hover:border-base-content w-full transition-colors"
+      style="width: 24px; height: 24px"
+      @click.stop="$emit('up', item)"
+    >
+      &uarr;
+    </button>
+    <button
+      v-if="withArrows"
+      class="btn border-base-200 bg-white text-base-content btn-xs rounded hover:text-base-100 hover:bg-base-content hover:border-base-content w-full transition-colors"
+      style="width: 24px; height: 24px"
+      @click.stop="$emit('down', item)"
+    >
+      &darr;
+    </button>
+    <button
+      class="btn border-base-200 bg-white text-base-content btn-xs rounded hover:text-base-100 hover:bg-base-content hover:border-base-content w-full transition-colors"
+      style="width: 24px; height: 24px"
+      @click.stop="$emit('remove', item)"
+    >
+      &times;
+    </button>
+  </div>
+</template>
+
+<script>
+import Contenteditable from './contenteditable'
+import Upload from './upload'
+import ReplaceButton from './replace'
+
+export default {
+  name: 'DocumentControls',
+  components: {
+    Contenteditable,
+    ReplaceButton
+  },
+  props: {
+    item: {
+      type: Object,
+      required: true
+    },
+    template: {
+      type: Object,
+      required: true
+    },
+    document: {
+      type: Object,
+      required: true
+    },
+    isDirectUpload: {
+      type: Boolean,
+      required: true,
+      default: false
+    },
+    withArrows: {
+      type: Boolean,
+      required: false,
+      default: true
+    }
+  },
+  emits: ['change', 'remove', 'up', 'down', 'replace'],
+  mounted () {
+    if (this.isDirectUpload) {
+      import('@rails/activestorage')
+    }
+  },
+  methods: {
+    upload: Upload.methods.upload,
+    onUpdateName (value) {
+      this.item.name = value
+
+      this.$emit('change')
+    }
+  }
+}
+</script>

app/javascript/template_builder/dropzone.vue

@@ -29,7 +29,7 @@
             {{ message }}
           </div>
           <div class="text-sm">
-            <span class="font-medium">Click to upload</span> or drag and drop
+            <span class="font-medium">Click to upload</span> or drag and drop files
           </div>
         </div>
       </div>
@@ -42,7 +42,7 @@
           ref="input"
           type="file"
           name="files[]"
-          accept="image/*, application/pdf"
+          :accept="acceptFileTypes"
           multiple
           @change="upload"
         >
@@ -61,11 +61,17 @@ export default {
     IconCloudUpload,
     IconInnerShadowTop
   },
+  inject: ['baseFetch'],
   props: {
     templateId: {
       type: [Number, String],
       required: true
     },
+    acceptFileTypes: {
+      type: String,
+      required: false,
+      default: 'image/*, application/pdf'
+    },
     isDirectUpload: {
       type: Boolean,
       required: true,
@@ -88,17 +94,28 @@ export default {
         return 'Uploading...'
       } else if (this.isProcessing) {
         return 'Processing...'
-      } else {
+      } else if (this.acceptFileTypes === 'image/*, application/pdf') {
         return 'Add PDF documents or images'
+      } else {
+        return 'Add documents or images'
       }
     }
   },
+  mounted () {
+    if (this.isDirectUpload) {
+      import('@rails/activestorage')
+    }
+  },
   methods: {
     upload: Upload.methods.upload,
     onDropFiles (e) {
-      this.$refs.input.files = e.dataTransfer.files
+      if (this.acceptFileTypes !== 'image/*, application/pdf' || [...e.dataTransfer.files].every((f) => f.type.match(/(?:image\/)|(?:application\/pdf)/))) {
+        this.$refs.input.files = e.dataTransfer.files
 
-      this.upload()
+        this.upload()
+      } else {
+        alert('Only PDF and images are supported.')
+      }
     }
   }
 }

app/javascript/template_builder/field.vue

@@ -31,19 +31,21 @@
           v-if="isNameFocus"
           class="flex items-center relative"
         >
-          <input
+          <template v-if="field.type !== 'checkbox'">
-            :id="`required-checkbox-${field.uuid}`"
+            <input
-            v-model="field.required"
+              :id="`required-checkbox-${field.uuid}`"
-            type="checkbox"
+              v-model="field.required"
-            class="checkbox checkbox-xs no-animation rounded"
+              type="checkbox"
-            @mousedown.prevent
+              class="checkbox checkbox-xs no-animation rounded"
-          >
+              @mousedown.prevent
-          <label
+            >
-            :for="`required-checkbox-${field.uuid}`"
+            <label
-            class="label text-xs"
+              :for="`required-checkbox-${field.uuid}`"
-            @click.prevent="field.required = !field.required"
+              class="label text-xs"
-            @mousedown.prevent
+              @click.prevent="field.required = !field.required"
-          >Required</label>
+              @mousedown.prevent
+            >Required</label>
+          </template>
         </div>
         <div
           v-else
@@ -56,7 +58,7 @@
             <label
               tabindex="0"
               title="Areas"
-              class="cursor-pointer text-base-100 group-hover:text-base-content"
+              class="cursor-pointer text-transparent group-hover:text-base-content"
             >
               <IconShape
                 :width="18"
@@ -97,12 +99,25 @@
                   Draw New Area
                 </a>
               </li>
+              <li v-if="field.areas?.length === 1 && ['date', 'signature', 'initials', 'text', 'cells'].includes(field.type)">
+                <a
+                  href="#"
+                  class="text-sm py-1 px-2"
+                  @click.prevent="copyToAllPages(field)"
+                >
+                  <IconCopy
+                    :width="20"
+                    :stroke-width="1.6"
+                  />
+                  Copy to All Pages
+                </a>
+              </li>
             </ul>
           </span>
           <button
             v-else
             title="Areas"
-            class="relative cursor-pointer text-base-100 group-hover:text-base-content"
+            class="relative cursor-pointer text-transparent group-hover:text-base-content"
             @click="$emit('set-draw', field)"
           >
             <IconShape
@@ -111,7 +126,7 @@
             />
           </button>
           <button
-            class="relative text-base-100 group-hover:text-base-content"
+            class="relative text-transparent group-hover:text-base-content"
             title="Remove"
             @click="$emit('remove', field)"
           >
@@ -120,7 +135,7 @@
               :stroke-width="1.6"
             />
           </button>
-          <div class="flex flex-col pr-1 text-base-100 group-hover:text-base-content">
+          <div class="flex flex-col pr-1 text-transparent group-hover:text-base-content">
             <button
               title="Up"
               class="relative"
@@ -154,7 +169,7 @@
           </span>
           <input
             v-model="field.options[index]"
-            class="w-full input input-primary input-xs text-sm"
+            class="w-full input input-primary input-xs text-sm bg-transparent"
             type="text"
             required
             @blur="save"
@@ -181,7 +196,7 @@
 <script>
 import Contenteditable from './contenteditable'
 import FieldType from './field_type'
-import { IconShape, IconNewSection, IconTrashX } from '@tabler/icons-vue'
+import { IconShape, IconNewSection, IconTrashX, IconCopy } from '@tabler/icons-vue'
 
 export default {
   name: 'TemplateField',
@@ -190,6 +205,7 @@ export default {
     IconShape,
     IconNewSection,
     IconTrashX,
+    IconCopy,
     FieldType
   },
   inject: ['template', 'save'],
@@ -219,6 +235,23 @@ export default {
     }
   },
   methods: {
+    copyToAllPages (field) {
+      const areaString = JSON.stringify(field.areas[0])
+
+      this.template.documents.forEach((attachment) => {
+        attachment.preview_images.forEach((page) => {
+          if (!field.areas.find((area) => area.attachment_uuid === attachment.uuid && area.page === parseInt(page.filename))) {
+            field.areas.push({ ...JSON.parse(areaString), page: parseInt(page.filename) })
+          }
+        })
+      })
+
+      this.$nextTick(() => {
+        this.$emit('scroll-to', this.field.areas[this.field.areas.length - 1])
+      })
+
+      this.save()
+    },
     onNameFocus (e) {
       this.isNameFocus = true
 
@@ -252,8 +285,10 @@ export default {
       })
     },
     onNameBlur (e) {
-      if (e.target.innerText.trim()) {
+      const text = this.$refs.name.$refs.contenteditable.innerText.trim()
-        this.field.name = e.target.innerText.trim()
+
+      if (text) {
+        this.field.name = text
       } else {
         this.field.name = ''
         this.$refs.name.$refs.contenteditable.innerText = this.defaultName

app/javascript/template_builder/field_submitter.vue

@@ -25,12 +25,16 @@
           v-model="selectedSubmitter.name"
           class="cursor-text"
           :icon-inline="true"
+          :select-on-edit-click="true"
           :icon-width="18"
           @update:model-value="$emit('name-change', selectedSubmitter)"
         />
       </div>
-      <span>
+      <span class="flex items-center">
-        ▼
+        <IconPlus
+          width="18"
+          height="18"
+        />
       </span>
     </label>
     <ul
@@ -86,7 +90,7 @@
 </template>
 
 <script>
-import { IconUserPlus, IconTrashX } from '@tabler/icons-vue'
+import { IconUserPlus, IconTrashX, IconPlus } from '@tabler/icons-vue'
 import Contenteditable from './contenteditable'
 import { v4 } from 'uuid'
 
@@ -95,6 +99,7 @@ export default {
   components: {
     IconUserPlus,
     Contenteditable,
+    IconPlus,
     IconTrashX
   },
   props: {

app/javascript/template_builder/field_type.vue

@@ -18,33 +18,36 @@
       :class="menuClasses"
       @click="closeDropdown"
     >
-      <li
+      <template
         v-for="(icon, type) in fieldIcons"
         :key="type"
       >
-        <a
+        <li v-if="withPhone || type !== 'phone'">
-          href="#"
+          <a
-          class="text-sm py-1 px-2"
+            href="#"
-          :class="{ 'active': type === modelValue }"
+            class="text-sm py-1 px-2"
-          @click.prevent="$emit('update:model-value', type)"
+            :class="{ 'active': type === modelValue }"
-        >
+            @click.prevent="$emit('update:model-value', type)"
-          <component
+          >
-            :is="icon"
+            <component
-            :stroke-width="1.6"
+              :is="icon"
-            :width="20"
+              :stroke-width="1.6"
-          />
+              :width="20"
-          {{ fieldNames[type] }}
+            />
-        </a>
+            {{ fieldNames[type] }}
-      </li>
+          </a>
+        </li>
+      </template>
     </ul>
   </span>
 </template>
 
 <script>
-import { IconTextSize, IconWritingSign, IconCalendarEvent, IconPhoto, IconCheckbox, IconPaperclip, IconSelect, IconCircleDot, IconChecks, IconColumns3 } from '@tabler/icons-vue'
+import { IconTextSize, IconWritingSign, IconCalendarEvent, IconPhoto, IconCheckbox, IconPaperclip, IconSelect, IconCircleDot, IconChecks, IconColumns3, IconPhoneCheck, IconLetterCaseUpper } from '@tabler/icons-vue'
 
 export default {
   name: 'FiledTypeDropdown',
+  inject: ['withPhone'],
   props: {
     modelValue: {
       type: String,
@@ -72,6 +75,7 @@ export default {
       return {
         text: 'Text',
         signature: 'Signature',
+        initials: 'Initials',
         date: 'Date',
         image: 'Image',
         file: 'File',
@@ -79,21 +83,24 @@ export default {
         checkbox: 'Checkbox',
         multiple: 'Multiple',
         radio: 'Radio',
-        cells: 'Cells'
+        cells: 'Cells',
+        phone: 'Phone'
       }
     },
     fieldIcons () {
       return {
         text: IconTextSize,
         signature: IconWritingSign,
+        initials: IconLetterCaseUpper,
         date: IconCalendarEvent,
         image: IconPhoto,
         file: IconPaperclip,
         select: IconSelect,
         checkbox: IconCheckbox,
-        cells: IconColumns3,
+        radio: IconCircleDot,
         multiple: IconChecks,
-        radio: IconCircleDot
+        cells: IconColumns3,
+        phone: IconPhoneCheck
       }
     }
   },

app/javascript/template_builder/fields.vue

@@ -1,8 +1,9 @@
 <template>
-  <div class="sticky -top-1 bg-base-100 pt-1 -mt-1 z-10">
+  <div :class="withStickySubmitters ? 'sticky top-0 z-10' : ''">
     <FieldSubmitter
       :model-value="selectedSubmitter.uuid"
-      class="w-full bg-base-100"
+      class="w-full rounded-lg"
+      :class="{ 'bg-base-100': withStickySubmitters }"
       :submitters="submitters"
       @new-submitter="save"
       @remove="removeSubmitter"
@@ -24,48 +25,98 @@
     />
   </div>
   <div class="grid grid-cols-3 gap-1 pb-2">
-    <button
+    <template
       v-for="(icon, type) in fieldIcons"
       :key="type"
-      draggable="true"
-      class="flex items-center justify-center border border-dashed border-base-300 bg-base-100 w-full rounded relative"
-      @dragstart="onDragstart(type)"
-      @dragend="$emit('drag-end')"
-      @click="addField(type)"
     >
-      <div class="w-0 absolute left-0">
+      <button
-        <svg
+        v-if="withPhone || type != 'phone'"
-          xmlns="http://www.w3.org/2000/svg"
+        draggable="true"
-          class="cursor-grab"
+        class="flex items-center justify-center border border-dashed border-base-300 w-full rounded relative"
-          width="18"
+        :style="{ backgroundColor: backgroundColor }"
-          height="18"
+        @dragstart="onDragstart(type)"
-          viewBox="0 0 24 24"
+        @dragend="$emit('drag-end')"
-          stroke-width="1.5"
+        @click="addField(type)"
-          stroke="currentColor"
+      >
-          fill="none"
+        <div class="w-0 absolute left-0">
-          stroke-linecap="round"
+          <svg
-          stroke-linejoin="round"
+            xmlns="http://www.w3.org/2000/svg"
-        >
+            class="cursor-grab"
-          <path
+            width="18"
-            stroke="none"
+            height="18"
-            d="M0 0h24v24H0z"
+            viewBox="0 0 24 24"
+            stroke-width="1.5"
+            stroke="currentColor"
             fill="none"
-          />
+            stroke-linecap="round"
-          <path d="M9 5m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+            stroke-linejoin="round"
-          <path d="M9 12m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+          >
-          <path d="M9 19m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+            <path
-          <path d="M15 5m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+              stroke="none"
-          <path d="M15 12m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+              d="M0 0h24v24H0z"
-          <path d="M15 19m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+              fill="none"
-        </svg>
+            />
+            <path d="M9 5m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+            <path d="M9 12m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+            <path d="M9 19m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+            <path d="M15 5m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+            <path d="M15 12m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+            <path d="M15 19m-1 0a1 1 0 1 0 2 0a1 1 0 1 0 -2 0" />
+          </svg>
+        </div>
+        <div class="flex items-center flex-col px-2 py-2">
+          <component :is="icon" />
+          <span class="text-xs mt-1">
+            {{ fieldNames[type] }}
+          </span>
+        </div>
+      </button>
+      <div
+        v-else
+        class="tooltip tooltip-bottom-end flex"
+        data-tip="Unlock SMS-verified phone number field with paid plan. Use text field for phone numbers without verification."
+      >
+        <a
+          href="https://www.docuseal.co/pricing"
+          target="_blank"
+          class="opacity-50 flex items-center justify-center border border-dashed border-base-300 w-full rounded relative"
+          :style="{ backgroundColor: backgroundColor }"
+        >
+          <div class="w-0 absolute left-0">
+            <IconLock
+              width="18"
+              height="18"
+              stroke-width="1.5"
+            />
+          </div>
+          <div class="flex items-center flex-col px-2 py-2">
+            <component :is="icon" />
+            <span class="text-xs mt-1">
+              {{ fieldNames[type] }}
+            </span>
+          </div>
+        </a>
       </div>
-      <div class="flex items-center flex-col px-2 py-2">
+    </template>
-        <component :is="icon" />
+  </div>
-        <span class="text-xs mt-1">
+  <div
-          {{ fieldNames[type] }}
+    v-if="fields.length < 4"
-        </span>
+    class="text-xs p-2 border border-base-200 rounded"
-      </div>
+  >
-    </button>
+    <ul class="list-disc list-outside ml-3">
+      <li>
+        Draw a text field on the page with a mouse
+      </li>
+      <li>
+        Single click on the page to add a checkbox
+      </li>
+      <li>
+        Drag &amp; drop any other field type on the page
+      </li>
+      <li>
+        Click on the field type above to add it to the form without drawing it on the document
+      </li>
+    </ul>
   </div>
 </template>
 
@@ -74,19 +125,26 @@ import Field from './field'
 import { v4 } from 'uuid'
 import FieldType from './field_type'
 import FieldSubmitter from './field_submitter'
+import { IconLock } from '@tabler/icons-vue'
 
 export default {
   name: 'TemplateFields',
   components: {
     Field,
-    FieldSubmitter
+    FieldSubmitter,
+    IconLock
   },
-  inject: ['save'],
+  inject: ['save', 'backgroundColor', 'withPhone'],
   props: {
     fields: {
       type: Array,
       required: true
     },
+    withStickySubmitters: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
     submitters: {
       type: Array,
       required: true
@@ -152,7 +210,8 @@ export default {
       const field = {
         name: '',
         uuid: v4(),
-        required: true,
+        required: type !== 'checkbox',
+        areas: [],
         submitter_uuid: this.selectedSubmitter.uuid,
         type
       }

app/javascript/template_builder/page.vue

@@ -4,7 +4,7 @@
       ref="image"
       :src="image.url"
       :width="width"
-      class="shadow-md mb-4"
+      class="border rounded mb-4"
       :height="height"
       loading="lazy"
     >

app/javascript/template_builder/preview.vue

@@ -9,39 +9,52 @@
         loading="lazy"
       >
       <div
-        class="group flex justify-end cursor-pointer top-0 bottom-0 left-0 right-0 absolute"
+        class="group flex justify-end cursor-pointer top-0 bottom-0 left-0 right-0 absolute p-1"
         @click="$emit('scroll-to', item)"
       >
-        <div
+        <div class="flex justify-between w-full">
-          class="flex flex-col justify-between opacity-0 group-hover:opacity-100"
+          <div style="width: 26px" />
-        >
+          <div class="">
-          <div class="rounded-bl rounded-tr bg-white border">
+            <ReplaceButton
-            <button
+              :is-direct-upload="isDirectUpload"
-              class="rounded-bl rounded-tr hover:text-base-100 hover:bg-base-content w-full transition-colors"
+              :template-id="template.id"
-              style="width: 24px"
+              :accept-file-types="acceptFileTypes"
-              @click.stop="$emit('remove', item)"
+              class="opacity-0 group-hover:opacity-100"
-            >
+              @click.stop
-              &times;
+              @success="$emit('replace', { replaceSchemaItem: item, ...$event })"
-            </button>
+            />
           </div>
           <div
-            v-if="withArrows"
+            class="flex flex-col justify-between opacity-0 group-hover:opacity-100"
-            class="flex flex-col border rounded-br rounded-tl bg-white divide-y"
           >
-            <button
+            <div>
-              class="rounded-tl hover:text-base-100 hover:bg-base-content w-full transition-colors"
+              <button
-              style="width: 24px"
+                class="btn border-base-200 bg-white text-base-content btn-xs rounded hover:text-base-100 hover:bg-base-content hover:border-base-content w-full transition-colors"
-              @click.stop="$emit('up', item)"
+                style="width: 24px; height: 24px"
+                @click.stop="$emit('remove', item)"
+              >
+                &times;
+              </button>
+            </div>
+            <div
+              v-if="withArrows"
+              class="flex flex-col space-y-1"
             >
-              &uarr;
+              <button
-            </button>
+                class="btn border-base-200 bg-white text-base-content btn-xs rounded hover:text-base-100 hover:bg-base-content hover:border-base-content w-full transition-colors"
-            <button
+                style="width: 24px; height: 24px"
-              class="rounded-br hover:text-base-100 hover:bg-base-content w-full transition-colors"
+                @click.stop="$emit('up', item)"
-              style="width: 24px"
+              >
-              @click.stop="$emit('down', item)"
+                &uarr;
-            >
+              </button>
-              &darr;
+              <button
-            </button>
+                class="btn border-base-200 bg-white text-base-content btn-xs rounded hover:text-base-100 hover:bg-base-content hover:border-base-content w-full transition-colors"
+                style="width: 24px; height: 24px"
+                @click.stop="$emit('down', item)"
+              >
+                &darr;
+              </button>
+            </div>
           </div>
         </div>
       </div>
@@ -60,34 +73,57 @@
 
 <script>
 import Contenteditable from './contenteditable'
+import Upload from './upload'
+import ReplaceButton from './replace'
 
 export default {
   name: 'DocumentPreview',
   components: {
-    Contenteditable
+    Contenteditable,
+    ReplaceButton
   },
   props: {
     item: {
       type: Object,
       required: true
     },
+    template: {
+      type: Object,
+      required: true
+    },
     document: {
       type: Object,
       required: true
     },
+    acceptFileTypes: {
+      type: String,
+      required: false,
+      default: 'image/*, application/pdf'
+    },
+    isDirectUpload: {
+      type: Boolean,
+      required: true,
+      default: false
+    },
     withArrows: {
       type: Boolean,
       required: false,
       default: true
     }
   },
-  emits: ['scroll-to', 'change', 'remove', 'up', 'down'],
+  emits: ['scroll-to', 'change', 'remove', 'up', 'down', 'replace'],
   computed: {
     previewImage () {
       return this.document.preview_images[0]
     }
   },
+  mounted () {
+    if (this.isDirectUpload) {
+      import('@rails/activestorage')
+    }
+  },
   methods: {
+    upload: Upload.methods.upload,
     onUpdateName (value) {
       this.item.name = value
 

app/javascript/template_builder/replace.vue

@@ -0,0 +1,76 @@
+<template>
+  <label
+    :for="inputId"
+    class="btn btn-neutral btn-xs text-white transition-none"
+    :class="{ 'opacity-100': isLoading || isProcessing }"
+  >
+    {{ message }}
+    <form
+      ref="form"
+      class="hidden"
+    >
+      <input
+        :id="inputId"
+        ref="input"
+        name="files[]"
+        type="file"
+        :accept="acceptFileTypes"
+        @change="upload"
+      >
+    </form>
+  </label>
+</template>
+
+<script>
+import Upload from './upload'
+
+export default {
+  name: 'ReplaceDocument',
+  inject: ['baseFetch'],
+  props: {
+    templateId: {
+      type: [Number, String],
+      required: true
+    },
+    acceptFileTypes: {
+      type: String,
+      required: false,
+      default: 'image/*, application/pdf'
+    },
+    isDirectUpload: {
+      type: Boolean,
+      required: true,
+      default: false
+    }
+  },
+  emits: ['success'],
+  data () {
+    return {
+      isLoading: false,
+      isProcessing: false
+    }
+  },
+  computed: {
+    inputId () {
+      return 'el' + Math.random().toString(32).split('.')[1]
+    },
+    message () {
+      if (this.isLoading) {
+        return 'Uploading...'
+      } else if (this.isProcessing) {
+        return 'Processing...'
+      } else {
+        return 'Replace'
+      }
+    }
+  },
+  mounted () {
+    if (this.isDirectUpload) {
+      import('@rails/activestorage')
+    }
+  },
+  methods: {
+    upload: Upload.methods.upload
+  }
+}
+</script>

app/javascript/template_builder/upload.vue

@@ -33,7 +33,7 @@
         ref="input"
         name="files[]"
         type="file"
-        accept="image/*, application/pdf"
+        :accept="acceptFileTypes"
         multiple
         @change="upload"
       >
@@ -50,11 +50,17 @@ export default {
     IconUpload,
     IconInnerShadowTop
   },
+  inject: ['baseFetch'],
   props: {
     templateId: {
       type: [Number, String],
       required: true
     },
+    acceptFileTypes: {
+      type: String,
+      required: false,
+      default: 'image/*, application/pdf'
+    },
     isDirectUpload: {
       type: Boolean,
       required: true,
@@ -113,7 +119,7 @@ export default {
 
         this.isProcessing = true
 
-        fetch(`/api/templates/${this.templateId}/documents`, {
+        this.baseFetch(`/api/templates/${this.templateId}/documents`, {
           method: 'POST',
           body: JSON.stringify({ blobs }),
           headers: { 'Content-Type': 'application/json' }
@@ -124,7 +130,7 @@ export default {
           this.isProcessing = false
         })
       } else {
-        fetch(`/api/templates/${this.templateId}/documents`, {
+        this.baseFetch(`/api/templates/${this.templateId}/documents`, {
           method: 'POST',
           body: new FormData(this.$refs.form)
         }).then(resp => resp.json()).then((data) => {

app/jobs/generate_submitter_result_attachments_job.rb

@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-class GenerateSubmitterResultAttachmentsJob < ApplicationJob
-  def perform(submitter)
-    Submissions::EnsureResultGenerated.call(submitter)
-  end
-end

app/jobs/process_submitter_completion_job.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+class ProcessSubmitterCompletionJob < ApplicationJob
+  def perform(submitter)
+    is_all_completed = !submitter.submission.submitters.exists?(completed_at: nil)
+
+    if !is_all_completed && submitter.submission.submitters_order_preserved?
+      enqueue_next_submitter_request_notification(submitter)
+    end
+
+    Submissions::EnsureResultGenerated.call(submitter)
+
+    if submitter.account.encrypted_configs.exists?(key: EncryptedConfig::WEBHOOK_URL_KEY)
+      SendFormCompletedWebhookRequestJob.perform_later(submitter)
+    end
+
+    return unless is_all_completed
+    return if submitter.completed_at != submitter.submission.submitters.maximum(:completed_at)
+
+    Submissions::GenerateAuditTrail.call(submitter.submission)
+
+    enqueue_emails(submitter)
+  end
+
+  def enqueue_emails(submitter)
+    user = submitter.submission.created_by_user || submitter.template.author
+
+    if submitter.template.account.users.exists?(id: user.id)
+      bcc = submitter.submission.template.account.account_configs
+                     .find_by(key: AccountConfig::BCC_EMAILS)&.value
+
+      SubmitterMailer.completed_email(submitter, user, bcc:).deliver_later!
+    end
+
+    to = submitter.submission.submitters.sort_by(&:completed_at).select(&:email?).map(&:friendly_name).join(', ')
+
+    SubmitterMailer.documents_copy_email(submitter, to:).deliver_later! if to.present?
+  end
+
+  def enqueue_next_submitter_request_notification(submitter)
+    next_submitter_item =
+      submitter.submission.template_submitters.find do |e|
+        sub = submitter.submission.submitters.find { |s| s.uuid == e['uuid'] }
+
+        sub.completed_at.blank? && sub.sent_at.blank?
+      end
+
+    return unless next_submitter_item
+
+    next_submitter = submitter.submission.submitters.find { |s| s.uuid == next_submitter_item['uuid'] }
+
+    Submitters.send_signature_requests([next_submitter], send_email: true)
+  end
+end

app/jobs/send_form_completed_webhook_request_job.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class SendFormCompletedWebhookRequestJob < ApplicationJob
+  USER_AGENT = 'DocuSeal.co Webhook'
+
+  def perform(submitter)
+    config = submitter.submission.account.encrypted_configs.find_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+
+    return if config.blank? || config.value.blank?
+
+    Submissions::EnsureResultGenerated.call(submitter)
+
+    ActiveStorage::Current.url_options = Docuseal.default_url_options
+
+    Faraday.post(config.value,
+                 {
+                   event_type: 'form.completed',
+                   timestamp: Time.current.iso8601,
+                   data: Submitters::SerializeForWebhook.call(submitter)
+                 }.to_json,
+                 'Content-Type' => 'application/json',
+                 'User-Agent' => USER_AGENT)
+  end
+end

app/jobs/send_form_started_webhook_request_job.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class SendFormStartedWebhookRequestJob < ApplicationJob
+  USER_AGENT = 'DocuSeal.co Webhook'
+
+  def perform(submitter)
+    config = submitter.submission.account.encrypted_configs.find_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+
+    return if config.blank? || config.value.blank?
+
+    ActiveStorage::Current.url_options = Docuseal.default_url_options
+
+    Faraday.post(config.value,
+                 {
+                   event_type: 'form.started',
+                   timestamp: Time.current.iso8601,
+                   data: Submitters::SerializeForWebhook.call(submitter)
+                 }.to_json,
+                 'Content-Type' => 'application/json',
+                 'User-Agent' => USER_AGENT)
+  end
+end

app/jobs/send_form_viewed_webhook_request_job.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class SendFormViewedWebhookRequestJob < ApplicationJob
+  USER_AGENT = 'DocuSeal.co Webhook'
+
+  def perform(submitter)
+    config = submitter.submission.account.encrypted_configs.find_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+
+    return if config.blank? || config.value.blank?
+
+    ActiveStorage::Current.url_options = Docuseal.default_url_options
+
+    Faraday.post(config.value,
+                 {
+                   event_type: 'form.viewed',
+                   timestamp: Time.current.iso8601,
+                   data: Submitters::SerializeForWebhook.call(submitter)
+                 }.to_json,
+                 'Content-Type' => 'application/json',
+                 'User-Agent' => USER_AGENT)
+  end
+end

app/jobs/send_submitter_invitation_email_job.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class SendSubmitterInvitationEmailJob < ApplicationJob
+  def perform(params = {})
+    submitter = Submitter.find(params['submitter_id'])
+
+    SubmitterMailer.invitation_email(submitter, subject: params['subject'], body: params['body']).deliver_now!
+
+    SubmissionEvent.create!(submitter:, event_type: 'send_email')
+
+    submitter.sent_at ||= Time.current
+    submitter.save
+  end
+end

app/mailers/application_mailer.rb

@@ -6,6 +6,10 @@ class ApplicationMailer < ActionMailer::Base
 
   register_interceptor ActionMailerConfigsInterceptor
 
+  before_action do
+    ActiveStorage::Current.url_options = Docuseal.default_url_options
+  end
+
   def default_url_options
     Docuseal.default_url_options
   end

app/mailers/settings_mailer.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class SettingsMailer < ApplicationMailer
+  def smtp_successful_setup(email)
+    mail(to: email, subject: 'SMTP has been configured')
+  end
+end

app/mailers/submitter_mailer.rb

@@ -1,35 +1,92 @@
 # frozen_string_literal: true
 
 class SubmitterMailer < ApplicationMailer
-  DEFAULT_MESSAGE = %(You have been invited to submit the "%<name>s" form:)
+  def invitation_email(submitter, body: nil, subject: nil)
-
+    @current_account = submitter.submission.template.account
-  def invitation_email(submitter, message: format(DEFAULT_MESSAGE, name: submitter.submission.template.name))
     @submitter = submitter
-    @message = message
+    @body = body.presence
 
-    mail(to: @submitter.email,
+    @email_config = @current_account.account_configs.find_by(key: AccountConfig::SUBMITTER_INVITATION_EMAIL_KEY)
-         subject: 'You have been invited to submit a form')
+
+    subject =
+      if @email_config || subject.present?
+        ReplaceEmailVariables.call(subject.presence || @email_config.value['subject'], submitter:)
+      else
+        'You have been invited to submit a form'
+      end
+
+    mail(to: @submitter.friendly_name,
+         from: from_address_for_submitter(submitter),
+         subject:,
+         reply_to: (submitter.submission.created_by_user || submitter.template.author)&.friendly_name)
   end
 
-  def completed_email(submitter, user)
+  def completed_email(submitter, user, bcc: nil)
+    @current_account = submitter.submission.template.account
     @submitter = submitter
+    @submission = submitter.submission
     @user = user
 
-    mail(to: user.email,
+    Submissions::EnsureResultGenerated.call(submitter)
-         subject: %(#{submitter.email} has completed the "#{submitter.submission.template.name}" form))
+
+    @email_config = @current_account.account_configs.find_by(key: AccountConfig::SUBMITTER_COMPLETED_EMAIL_KEY)
+
+    add_completed_email_attachments!(submitter)
+
+    subject =
+      if @email_config
+        ReplaceEmailVariables.call(@email_config.value['subject'], submitter:)
+      else
+        submitters = submitter.submission.submitters.order(:completed_at)
+                              .map { |e| e.name || e.email || e.phone }.join(', ')
+        %(#{submitter.submission.template.name} has been completed by #{submitters})
+      end
+
+    mail(from: from_address_for_submitter(submitter),
+         to: user.friendly_name,
+         bcc:,
+         subject:)
   end
 
-  def documents_copy_email(submitter)
+  def documents_copy_email(submitter, to: nil)
+    @current_account = submitter.submission.template.account
     @submitter = submitter
 
     Submissions::EnsureResultGenerated.call(@submitter)
 
-    @documents = Submitters.select_attachments_for_download(submitter)
+    @documents = add_completed_email_attachments!(submitter)
 
-    @documents.each do |attachment|
+    @email_config = @current_account.account_configs.find_by(key: AccountConfig::SUBMITTER_DOCUMENTS_COPY_EMAIL_KEY)
+
+    subject =
+      if @email_config
+        ReplaceEmailVariables.call(@email_config.value['subject'], submitter:)
+      else
+        'Your copy of documents'
+      end
+
+    mail(from: from_address_for_submitter(submitter),
+         to: to || @submitter.friendly_name,
+         subject:)
+  end
+
+  private
+
+  def add_completed_email_attachments!(submitter)
+    documents = Submitters.select_attachments_for_download(submitter)
+
+    documents.each do |attachment|
       attachments[attachment.filename.to_s] = attachment.download
     end
 
-    mail(to: submitter.email, subject: 'Your copy of documents')
+    if submitter.submission.audit_trail.present?
+      attachments[submitter.submission.audit_trail.filename.to_s] = submitter.submission.audit_trail.download
+    end
+
+    documents
+  end
+
+  def from_address_for_submitter(submitter)
+    submitter.submission.created_by_user&.friendly_name || submitter.submission.template.author.friendly_name
   end
 end

app/mailers/user_mailer.rb

@@ -2,6 +2,7 @@
 
 class UserMailer < ApplicationMailer
   def invitation_email(user)
+    @current_account = user.account
     @user = user
     @token = @user.send(:set_reset_password_token)
 

app/models/access_token.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+# == Schema Information
+#
+# Table name: access_tokens
+#
+#  id         :bigint           not null, primary key
+#  sha256     :text             not null
+#  token      :text             not null
+#  created_at :datetime         not null
+#  updated_at :datetime         not null
+#  user_id    :bigint           not null
+#
+# Indexes
+#
+#  index_access_tokens_on_sha256   (sha256) UNIQUE
+#  index_access_tokens_on_user_id  (user_id)
+#
+# Foreign Keys
+#
+#  fk_rails_...  (user_id => users.id)
+#
+class AccessToken < ApplicationRecord
+  TOKEN_LENGTH = 22
+
+  belongs_to :user
+
+  before_validation :set_sha256, on: :create
+
+  attribute :token, :string, default: -> { SecureRandom.base58(TOKEN_LENGTH) }
+
+  encrypts :token
+
+  private
+
+  def set_sha256
+    self.sha256 = Digest::SHA256.hexdigest(token)
+  end
+end

app/models/account.rb

@@ -14,10 +14,21 @@
 class Account < ApplicationRecord
   has_many :users, dependent: :destroy
   has_many :encrypted_configs, dependent: :destroy
+  has_many :account_configs, dependent: :destroy
   has_many :templates, dependent: :destroy
+  has_many :template_folders, dependent: :destroy
+  has_one :default_template_folder, -> { where(name: TemplateFolder::DEFAULT_NAME) },
+          class_name: 'TemplateFolder', dependent: :destroy, inverse_of: :account
+  has_many :submissions, through: :templates
+  has_many :submitters, through: :submissions
   has_many :active_users, -> { active }, dependent: :destroy,
                                          inverse_of: :account, class_name: 'User'
 
   attribute :timezone, :string, default: 'UTC'
   attribute :locale, :string, default: 'en-US'
+
+  def default_template_folder
+    super || build_default_template_folder(name: TemplateFolder::DEFAULT_NAME,
+                                           author_id: users.minimum(:id)).tap(&:save!)
+  end
 end