fix GitHub CI

.dockerignore

@@ -27,3 +27,4 @@
 /attachments
 /docuseal
 .DS_Store
+.env

.github/workflows/ci.yml

@@ -127,6 +127,7 @@ jobs:
           bundle config path vendor/bundle
           bundle install --jobs 4 --retry 4
           yarn install
+          sudo apt-get update
           sudo apt-get install libvips
       - name: Run
         env:

.rubocop.yml

@@ -27,7 +27,7 @@ Lint/MissingSuper:
   Enabled: false
 
 Metrics/MethodLength:
-  Max: 20
+  Max: 25
   Exclude:
     - 'db/migrate/**'
 

Gemfile

@@ -13,6 +13,7 @@ gem 'faraday'
 gem 'google-cloud-storage', require: false
 gem 'hexapdf'
 gem 'image_processing'
+gem 'jwt'
 gem 'lograge'
 gem 'mysql2', require: false
 gem 'oj'

Gemfile.lock

@@ -540,6 +540,7 @@ DEPENDENCIES
   google-cloud-storage
   hexapdf
   image_processing
+  jwt
   letter_opener_web
   lograge
   mysql2

README.md

@@ -42,6 +42,7 @@ DocuSeal is an open source platform that provides secure and efficient digital d
 - [x] PDF signature verification
 - [x] Users management
 - [x] Mobile-optimized
+- [x] API and Webhooks for integrations
 - [x] Easy to deploy in minutes
 
 ## Deploy
@@ -76,10 +77,11 @@ HOST=your-domain-name.com docker-compose up
 ## For Companies
 ### Integrate seamless document signing into your web or mobile apps with DocuSeal!
 
-At DocuSeal we have expertise and technologies to make documents creation, filling, signing and processing seamlessly integrated with your product. We specialize in working with various industries, including **Banking, Healthcare, Transport, eCommerce, KYC, CRM, and other software products** that require bulk document signing. By leveraging DocuSeal, we can assist in reducing the overall cost of developing and processing electronic documents while ensuring security and compliance with local electronic document laws.
+At DocuSeal we have expertise and technologies to make documents creation, filling, signing and processing seamlessly integrated with your product. We specialize in working with various industries, including **Banking, Healthcare, Transport, Real Estate, eCommerce, KYC, CRM, and other software products** that require bulk document signing. By leveraging DocuSeal, we can assist in reducing the overall cost of developing and processing electronic documents while ensuring security and compliance with local electronic document laws.
 
 [![Book an Integration Demo](https://cal.com/book-with-cal-dark.svg)](https://cal.com/docuseal)
 
 ## License
 
-DocuSeal is released under the GNU Affero General Public License v3.0.
+Distributed under the AGPLv3 License. See [LICENSE](https://github.com/docusealco/docuseal/blob/master/LICENSE) for more information.
+Unless otherwise noted, all files © 2023 Oleksandr Turchyn.

app/controllers/api/submissions_controller.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Api
+  class SubmissionsController < ApiBaseController
+    def create
+      template = current_account.templates.find(params[:template_id])
+
+      submissions =
+        if params[:emails].present?
+          Submissions.create_from_emails(template:,
+                                         user: current_user,
+                                         source: :api,
+                                         send_email: params[:send_email] != 'false',
+                                         emails: params[:emails] || params[:email])
+        else
+          Submissions.create_from_submitters(template:,
+                                             user: current_user,
+                                             source: :api,
+                                             send_email: params[:send_email] != 'false',
+                                             submissions_attrs: submissions_params[:submission])
+        end
+
+      submitters = submissions.flat_map(&:submitters)
+
+      if params[:send_email] != 'false'
+        submitters.each do |submitter|
+          SubmitterMailer.invitation_email(submitter, message: params[:message]).deliver_later!
+        end
+      end
+
+      render json: submitters
+    end
+
+    private
+
+    def submissions_params
+      params.permit(submission: [{ submitters: [%i[uuid name email]] }])
+    end
+  end
+end

app/controllers/api/templates_controller.rb

@@ -2,6 +2,10 @@
 
 module Api
   class TemplatesController < ApiBaseController
+    def index
+      render json: current_account.templates
+    end
+
     def update
       @template = current_account.templates.find(params[:id])
 

app/controllers/api_settings_controller.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class ApiSettingsController < ApplicationController
+  def index; end
+end

app/controllers/application_controller.rb

@@ -34,8 +34,8 @@ class ApplicationController < ActionController::Base
     redirect_to setup_index_path unless User.exists?
   end
 
-  def button_title(title: 'Submit', disabled_with: 'Submitting', icon: nil)
+  def button_title(title: 'Submit', disabled_with: 'Submitting', icon: nil, icon_disabled: nil)
-    render_to_string(partial: 'shared/button_title', locals: { title:, disabled_with:, icon: })
+    render_to_string(partial: 'shared/button_title', locals: { title:, disabled_with:, icon:, icon_disabled: })
   end
 
   def svg_icon(icon_name, class: '')

app/controllers/console_redirect_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class ConsoleRedirectController < ApplicationController
+  def index
+    auth = JsonWebToken.encode(uuid: current_user.uuid,
+                               scope: :console,
+                               exp: 1.minute.from_now.to_i)
+
+    redirect_to("#{Docuseal::CONSOLE_URL}?#{{ auth: }.to_query}", allow_other_host: true)
+  end
+end

app/controllers/start_form_controller.rb

@@ -25,7 +25,7 @@ class StartFormController < ApplicationController
         ua: request.user_agent
       )
 
-      @submitter.submission ||= Submission.new(template: @template)
+      @submitter.submission ||= Submission.new(template: @template, source: :link)
 
       if @submitter.save
         redirect_to submit_form_path(@submitter.slug)

app/controllers/submissions_controller.rb

@@ -17,9 +17,17 @@ class SubmissionsController < ApplicationController
   def create
     submissions =
       if params[:emails].present?
-        create_submissions_from_emails
+        Submissions.create_from_emails(template: @template,
+                                       user: current_user,
+                                       source: :invite,
+                                       send_email: params[:send_email] == '1',
+                                       emails: params[:emails])
       else
-        create_submissions_from_submitters
+        Submissions.create_from_submitters(template: @template,
+                                           user: current_user,
+                                           source: :invite,
+                                           send_email: params[:send_email] == '1',
+                                           submissions_attrs: submissions_params[:submission].to_h.values)
       end
 
     submitters = submissions.flat_map(&:submitters)
@@ -45,30 +53,6 @@ class SubmissionsController < ApplicationController
 
   private
 
-  def create_submissions_from_emails
-    emails = params[:emails].to_s.scan(User::EMAIL_REGEXP)
-
-    emails.map do |email|
-      submission = @template.submissions.new(created_by_user: current_user)
-      submission.submitters.new(email:, uuid: @template.submitters.first['uuid'],
-                                sent_at: params[:send_email] == '1' ? Time.current : nil)
-
-      submission.tap(&:save!)
-    end
-  end
-
-  def create_submissions_from_submitters
-    submissions_params[:submission].to_h.map do |_, attrs|
-      submission = @template.submissions.new(created_by_user: current_user)
-
-      attrs[:submitters].each do |submitter_attrs|
-        submission.submitters.new(**submitter_attrs, sent_at: params[:send_email] == '1' ? Time.current : nil)
-      end
-
-      submission.tap(&:save!)
-    end
-  end
-
   def submissions_params
     params.permit(submission: { submitters: [%i[uuid email]] })
   end

app/controllers/submit_form_controller.rb

@@ -17,11 +17,8 @@ class SubmitFormController < ApplicationController
 
   def update
     submitter = Submitter.find_by!(slug: params[:slug])
-    submitter.values.merge!(normalized_values)
-    submitter.completed_at = Time.current if params[:completed] == 'true'
-    submitter.opened_at ||= Time.current
 
-    submitter.save!
+    update_submitter!(submitter)
 
     Submissions.update_template_fields!(submitter.submission) if submitter.submission.template_fields.blank?
 
@@ -30,6 +27,10 @@ class SubmitFormController < ApplicationController
     if submitter.completed_at?
       GenerateSubmitterResultAttachmentsJob.perform_later(submitter)
 
+      if submitter.account.encrypted_configs.exists?(key: EncryptedConfig::WEBHOOK_URL_KEY)
+        SendWebhookRequestJob.perform_later(submitter)
+      end
+
       submitter.submission.template.account.users.active.each do |user|
         SubmitterMailer.completed_email(submitter, user).deliver_later!
       end
@@ -44,6 +45,16 @@ class SubmitFormController < ApplicationController
 
   private
 
+  def update_submitter!(submitter)
+    submitter.values.merge!(normalized_values)
+    submitter.completed_at = Time.current if params[:completed] == 'true'
+    submitter.opened_at ||= Time.current
+
+    submitter.save!
+
+    submitter
+  end
+
   def normalized_values
     params.fetch(:values, {}).to_unsafe_h.transform_values do |v|
       if params[:cast_boolean] == 'true'

app/controllers/webhook_settings_controller.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class WebhookSettingsController < ApplicationController
+  def show
+    @encrypted_config =
+      current_account.encrypted_configs.find_or_initialize_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+  end
+
+  def create
+    @encrypted_config =
+      current_account.encrypted_configs.find_or_initialize_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+
+    @encrypted_config.update!(encrypted_config_params)
+
+    redirect_back(fallback_location: settings_webhooks_path, notice: 'Webhook URL has been saved.')
+  end
+
+  def update
+    submitter = current_account.submitters.where.not(completed_at: nil).order(:id).last
+
+    SendWebhookRequestJob.perform_later(submitter)
+
+    redirect_back(fallback_location: settings_webhooks_path, notice: 'Webhook request has been sent.')
+  end
+
+  private
+
+  def encrypted_config_params
+    params.require(:encrypted_config).permit(:value)
+  end
+end

app/javascript/elements/menu_active.js

@@ -1,7 +1,7 @@
 export default class extends HTMLElement {
   connectedCallback () {
     this.querySelectorAll('a').forEach((link) => {
-      if (document.location.pathname.startsWith(link.pathname)) {
+      if (document.location.pathname.startsWith(link.pathname) && !link.getAttribute('href').startsWith('http')) {
         link.classList.add('bg-base-300')
       }
     })

app/javascript/submission_form/area.vue

@@ -212,7 +212,7 @@ export default {
     },
     formattedDate () {
       if (this.field.type === 'date' && this.modelValue) {
-        return new Intl.DateTimeFormat([], { year: 'numeric', month: 'long', day: 'numeric' }).format(new Date(this.modelValue))
+        return new Intl.DateTimeFormat([], { year: 'numeric', month: 'long', day: 'numeric', timeZone: 'UTC' }).format(new Date(this.modelValue))
       } else {
         return ''
       }

app/javascript/template_builder/dropzone.vue

@@ -101,9 +101,13 @@ export default {
   methods: {
     upload: Upload.methods.upload,
     onDropFiles (e) {
-      this.$refs.input.files = e.dataTransfer.files
+      if ([...e.dataTransfer.files].every((f) => f.type.match(/(?:image\/)|(?:application\/pdf)/))) {
+        this.$refs.input.files = e.dataTransfer.files
 
-      this.upload()
+        this.upload()
+      } else {
+        alert('Only PDF and images are supported.')
+      }
     }
   }
 }

app/javascript/template_builder/fields.vue

@@ -76,7 +76,7 @@
         Draw a text field on the page with a mouse
       </li>
       <li>
-        Single click of the page to add a checkbox
+        Single click on the page to add a checkbox
       </li>
       <li>
         Drag &amp; drop any other field type on the page

app/jobs/send_webhook_request_job.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class SendWebhookRequestJob < ApplicationJob
+  USER_AGENT = 'DocuSeal.co Webhook'
+
+  def perform(submitter)
+    config = submitter.submission.account.encrypted_configs.find_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+
+    return if config.blank? || config.value.blank?
+
+    Submissions::EnsureResultGenerated.call(submitter)
+
+    ActiveStorage::Current.url_options = Docuseal.default_url_options
+
+    Faraday.post(config.value,
+                 {
+                   event_type: 'form.submitted',
+                   timestamp: Time.current.iso8601,
+                   data: Submitters::SerializeForWebhook.call(submitter)
+                 }.to_json,
+                 'Content-Type' => 'application/json',
+                 'User-Agent' => USER_AGENT)
+  end
+end

app/mailers/submitter_mailer.rb

@@ -3,12 +3,13 @@
 class SubmitterMailer < ApplicationMailer
   DEFAULT_MESSAGE = %(You have been invited to submit the "%<name>s" form:)
 
-  def invitation_email(submitter, message: format(DEFAULT_MESSAGE, name: submitter.submission.template.name))
+  def invitation_email(submitter, message: '')
     @submitter = submitter
-    @message = message
+    @message = message.presence || format(DEFAULT_MESSAGE, name: submitter.submission.template.name)
 
     mail(to: @submitter.email,
-         subject: 'You have been invited to submit a form')
+         subject: 'You have been invited to submit a form',
+         reply_to: submitter.submission.created_by_user&.friendly_name)
   end
 
   def completed_email(submitter, user)

app/models/access_token.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+# == Schema Information
+#
+# Table name: access_tokens
+#
+#  id         :bigint           not null, primary key
+#  sha256     :text             not null
+#  token      :text             not null
+#  created_at :datetime         not null
+#  updated_at :datetime         not null
+#  user_id    :bigint           not null
+#
+# Indexes
+#
+#  index_access_tokens_on_sha256   (sha256) UNIQUE
+#  index_access_tokens_on_user_id  (user_id)
+#
+# Foreign Keys
+#
+#  fk_rails_...  (user_id => users.id)
+#
+class AccessToken < ApplicationRecord
+  TOKEN_LENGTH = 22
+
+  belongs_to :user
+
+  before_validation :set_sha256, on: :create
+
+  attribute :token, :string, default: -> { SecureRandom.base58(TOKEN_LENGTH) }
+
+  encrypts :token
+
+  private
+
+  def set_sha256
+    self.sha256 = Digest::SHA256.hexdigest(token)
+  end
+end

app/models/account.rb

@@ -15,6 +15,8 @@ class Account < ApplicationRecord
   has_many :users, dependent: :destroy
   has_many :encrypted_configs, dependent: :destroy
   has_many :templates, dependent: :destroy
+  has_many :submissions, through: :templates
+  has_many :submitters, through: :submissions
   has_many :active_users, -> { active }, dependent: :destroy,
                                          inverse_of: :account, class_name: 'User'
 

app/models/encrypted_config.rb

@@ -25,6 +25,7 @@ class EncryptedConfig < ApplicationRecord
   EMAIL_SMTP_KEY = 'action_mailer_smtp'
   ESIGN_CERTS_KEY = 'esign_certs'
   APP_URL_KEY = 'app_url'
+  WEBHOOK_URL_KEY = 'webhook_url'
 
   belongs_to :account
 

app/models/submission.rb

@@ -6,6 +6,7 @@
 #
 #  id                  :bigint           not null, primary key
 #  deleted_at          :datetime
+#  source              :text             not null
 #  template_fields     :text
 #  template_schema     :text
 #  template_submitters :text
@@ -26,6 +27,7 @@
 #
 class Submission < ApplicationRecord
   belongs_to :template
+  has_one :account, through: :template
   belongs_to :created_by_user, class_name: 'User', optional: true
 
   has_many :submitters, dependent: :destroy
@@ -34,5 +36,14 @@ class Submission < ApplicationRecord
   serialize :template_schema, JSON
   serialize :template_submitters, JSON
 
+  attribute :source, :string, default: 'link'
+
   scope :active, -> { where(deleted_at: nil) }
+
+  enum :source, {
+    invite: 'invite',
+    api: 'api',
+    embed: 'embed',
+    link: 'link'
+  }, scope: false, prefix: true
 end

app/models/submitter.rb

@@ -30,6 +30,8 @@
 #
 class Submitter < ApplicationRecord
   belongs_to :submission
+  has_one :template, through: :submission
+  has_one :account, through: :template
 
   attribute :values, :string, default: -> { {} }
   attribute :slug, :string, default: -> { SecureRandom.base58(14) }

app/models/user.rb

@@ -22,6 +22,7 @@
 #  role                   :string           not null
 #  sign_in_count          :integer          default(0), not null
 #  unlock_token           :string
+#  uuid                   :text             not null
 #  created_at             :datetime         not null
 #  updated_at             :datetime         not null
 #  account_id             :bigint           not null
@@ -32,6 +33,7 @@
 #  index_users_on_email                 (email) UNIQUE
 #  index_users_on_reset_password_token  (reset_password_token) UNIQUE
 #  index_users_on_unlock_token          (unlock_token) UNIQUE
+#  index_users_on_uuid                  (uuid) UNIQUE
 #
 # Foreign Keys
 #
@@ -40,18 +42,23 @@
 class User < ApplicationRecord
   ROLES = %w[admin].freeze
 
-  EMAIL_REGEXP =
+  EMAIL_REGEXP = /[^@,\s]+@[^@,\s]+/
-    /[a-z0-9][.']?(?:(?:[a-z0-9_-]++[.'])*[a-z0-9_-]++)*@(?:[a-z0-9]++[.-])*[a-z0-9]++\.[a-z]{2,}/i
 
   belongs_to :account
+  has_one :access_token, dependent: :destroy
 
   devise :database_authenticatable, :recoverable, :rememberable, :validatable, :trackable
   devise :registerable, :omniauthable, omniauth_providers: [:google_oauth2] if Docuseal.multitenant?
 
   attribute :role, :string, default: 'admin'
+  attribute :uuid, :string, default: -> { SecureRandom.uuid }
 
   scope :active, -> { where(deleted_at: nil) }
 
+  def access_token
+    super || build_access_token.tap(&:save!)
+  end
+
   def active_for_authentication?
     !deleted_at?
   end

app/views/api_settings/index.html.erb

@@ -0,0 +1,76 @@
+<div class="flex flex-wrap space-y-4 md:flex-nowrap md:space-y-0 md:space-x-10">
+  <%= render 'shared/settings_nav' %>
+  <div class="flex-grow">
+    <h1 class="text-4xl font-bold mb-4">API</h1>
+    <div class="card bg-base-200">
+      <div class="card-body p-6">
+        <label for="api_key" class="text-sm font-semibold">X-Auth-Token</label>
+        <div class="flex flex-row space-x-4">
+          <input id="api_key" type="text" value="<%= current_user.access_token.token %>" class="input font-mono input-bordered w-full" autocomplete="off" readonly>
+          <%= render 'shared/clipboard_copy', icon: 'copy', text: current_user.access_token.token, class: 'base-button', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy', copied_title: 'Copied' %>
+        </div>
+      </div>
+    </div>
+    <div class="space-y-4 mt-4">
+      <div class="collapse collapse-plus bg-base-200 px-1">
+        <input type="checkbox">
+        <div class="collapse-title text-xl font-medium">
+          <div>
+            Request signature, single submitter
+          </div>
+          <div class="mt-1">
+            <div class="badge badge-warning badge-lg">POST</div>
+            <div class="badge badge-primary badge-lg"><%= api_submissions_path %></div>
+          </div>
+        </div>
+        <div class="collapse-content" style="display: inherit">
+          <div class="mockup-code overflow-hidden">
+            <% text = capture do %>curl --location '<%= api_submissions_url %>' \
+       --header 'X-Auth-Token: <%= current_user.access_token.token %>' \
+       --data-raw '{
+           "template_id": <%= current_account.templates.last&.id || 1 %>,
+           "emails":  "<%= current_user.email.sub('@', '+test@') %>, <%= current_user.email.sub('@', '+test2@') %>"
+       }'<% end.to_str %>
+            <span class="top-0 right-0 absolute">
+              <%= render 'shared/clipboard_copy', icon: 'copy', text:, class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy', copied_title: 'Copied' %>
+            </span>
+            <pre data-prefix="$"><code class="overflow-hidden w-full"><%= text %></code></pre>
+          </div>
+        </div>
+      </div>
+      <div class="collapse collapse-plus bg-base-200 px-1">
+        <input type="checkbox">
+        <div class="collapse-title text-xl font-medium">
+          <div>
+            Request signature, multiple submitters
+          </div>
+          <div class="mt-1">
+            <div class="badge badge-warning badge-lg">POST</div>
+            <div class="badge badge-primary badge-lg"><%= api_submissions_path %></div>
+          </div>
+        </div>
+        <div class="collapse-content" style="display: inherit">
+          <div class="mockup-code overflow-hidden">
+            <% text = capture do %>curl --location '<%= api_submissions_url %>' \
+       --header 'X-Auth-Token: <%= current_user.access_token.token %>' \
+       --data-raw '{
+         "template_id": <%= current_account.templates.last&.id || 1 %>,
+         "submission": [
+           {
+             "submitters": [
+               { "name": "<%= current_account.templates.last ? current_account.templates.last.submitters.first['name'] : 'First Submitter' %>", "email": "<%= current_user.email.sub('@', '+test@') %>" },
+               { "name": "Second Submitter", "email": "<%= current_user.email.sub('@', '+test2@') %>" }
+             ]
+           }
+         ]
+       }'<% end.to_str %>
+            <span class="top-0 right-0 absolute">
+              <%= render 'shared/clipboard_copy', icon: 'copy', text:, class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy', copied_title: 'Copied' %>
+            </span>
+            <pre data-prefix="$"><code class="overflow-hidden w-full"><%= text %></code></pre>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>

app/views/layouts/mailer.html.erb

@@ -12,7 +12,7 @@
       ---
     </p>
     <p>
-      Sent using <a href="<%= Docuseal::PRODUCT_URL %>"><%= Docuseal::PRODUCT_NAME %></a> documents software.
+      Sent using <a href="<%= Docuseal::PRODUCT_URL %>"><%= Docuseal::PRODUCT_NAME %></a> free document signing.
     </p>
   </body>
 </html>

app/views/shared/_button_title.html.erb

@@ -8,7 +8,7 @@
 </span>
 <span class="disabled">
   <span class="flex items-center justify-center space-x-2">
-    <%= svg_icon('loader', class: 'w-6 h-6 animate-spin') %>
+    <%= local_assigns[:icon_disabled] || svg_icon('loader', class: 'w-6 h-6 animate-spin') %>
     <span><%= disabled_with %>...</span>
   </span>
 </span>

app/views/shared/_clipboard_copy.html.erb

@@ -2,13 +2,13 @@
   <label class="<%= local_assigns[:class] %>">
     <input type="radio" class="peer hidden">
     <span class="peer-checked:hidden flex items-center space-x-2">
-      <%= svg_icon('link', class: local_assigns[:icon_class] || 'w-6 h-6 text-white') %>
+      <%= svg_icon(local_assigns[:icon] || 'link', class: local_assigns[:icon_class] || 'w-6 h-6 text-white') %>
       <span class="hidden md:inline">
         <%= local_assigns[:copy_title] || 'Copy' %>
       </span>
     </span>
     <span class="hidden peer-checked:flex items-center space-x-2">
-      <%= svg_icon('clipboard_copy', class: local_assigns[:icon_class] || 'w-6 h-6 text-white') %>
+      <%= svg_icon(local_assigns[:copied_icon] || 'clipboard_copy', class: local_assigns[:icon_class] || 'w-6 h-6 text-white') %>
       <span class="hidden md:inline">
         <%= local_assigns[:copied_title] || 'Copied' %>
       </span>

app/views/shared/_settings_nav.html.erb

@@ -23,6 +23,22 @@
       <li>
         <%= link_to 'Team', settings_users_path, class: 'text-base hover:bg-base-300' %>
       </li>
+      <% if Docuseal.demo? || !Docuseal.multitenant? %>
+        <li>
+          <%= link_to 'API', settings_api_index_path, class: 'text-base hover:bg-base-300' %>
+        </li>
+        <li>
+          <%= link_to 'Webhooks', settings_webhooks_path, class: 'text-base hover:bg-base-300' %>
+        </li>
+      <% end %>
+      <% unless Docuseal.demo? %>
+        <li>
+          <%= link_to Docuseal.multitenant? ? console_redirect_index_path : Docuseal::CONSOLE_URL, class: 'text-base hover:bg-base-300' do %>
+            Console
+            <span class="badge badge-warning">New</span>
+          <% end %>
+        </li>
+      <% end %>
     </ul>
   </menu-active>
   <div class="mx-4 border-t border-base-300 hidden md:block">

app/views/webhook_settings/show.html.erb

@@ -0,0 +1,42 @@
+<div class="flex flex-wrap space-y-4 md:flex-nowrap md:space-y-0 md:space-x-10">
+  <%= render 'shared/settings_nav' %>
+  <div class="flex-grow">
+    <h1 class="text-4xl font-bold mb-4">Webhooks</h1>
+    <div class="card bg-base-200">
+      <div class="card-body p-6">
+        <%= form_for @encrypted_config, url: settings_webhooks_path, method: :post, html: { autocomplete: 'off' } do |f| %>
+          <%= f.label :value, 'Webhook URL', class: 'text-sm font-semibold' %>
+          <div class="flex flex-row space-x-4 mt-2">
+            <%= f.text_field :value, required: true, class: 'input font-mono input-bordered w-full', placeholder: 'https://example.com/hook' %>
+            <%= f.button button_title(title: 'Save', disabled_with: 'Saving'), class: 'base-button w-32' %>
+          </div>
+        <% end %>
+      </div>
+    </div>
+    <% submitter = current_account.submitters.where.not(completed_at: nil).order(:id).last %>
+    <% if submitter %>
+      <div class="space-y-4 mt-4">
+        <div class="collapse collapse-open bg-base-200 px-1">
+          <div class="p-4 text-xl font-medium">
+            <div class="flex items-center justify-between">
+              <span>
+                Submission example payload
+              </span>
+              <% if @encrypted_config.value.present? %>
+                <%= button_to button_title(title: 'Test Webhook', disabled_with: 'Sending', icon_disabled: svg_icon('loader', class: 'w-4 h-4 animate-spin')), settings_webhooks_path, class: 'btn btn-neutral btn-outline btn-sm', method: :put %>
+              <% end %>
+            </div>
+          </div>
+          <div class="collapse-content" style="display: inherit">
+            <div class="mockup-code overflow-hidden relative">
+              <span class="top-0 right-0 absolute">
+                <%= render 'shared/clipboard_copy', icon: 'copy', text: code = JSON.pretty_generate({ event_type: 'form.submitted', timestamp: Time.current.iso8601, data: Submitters::SerializeForWebhook.call(submitter) }).gsub(/^/, '  ').sub(/^\s+/, ''), class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy', copied_title: 'Copied' %>
+              </span>
+              <pre><code class="overflow-hidden w-full"><%= code %></code></pre>
+            </div>
+          </div>
+        </div>
+      </div>
+    <% end %>
+  </div>
+</div>

config/application.rb

@@ -9,6 +9,8 @@ require 'action_view/railtie'
 require 'action_mailer/railtie'
 require 'active_job/railtie'
 
+require_relative '../lib/api_path_consider_json_middleware'
+
 Bundler.require(*Rails.groups)
 
 module DocuSeal
@@ -26,5 +28,6 @@ module DocuSeal
     config.action_view.frozen_string_literal = true
 
     config.middleware.insert_before ActionDispatch::Static, Rack::Deflater
+    config.middleware.insert_before ActionDispatch::Static, ApiPathConsiderJsonMiddleware
   end
 end

config/initializers/devise.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+require_relative '../../lib/auth_with_token_strategy'
+
+Warden::Strategies.add(:auth_token, AuthWithTokenStrategy)
+
 # Assuming you have not yet modified this file, each configuration option below
 # is set to its default value. Note that some are commented out while others
 # are not: uncommented lines are intended to protect your configuration from
@@ -272,10 +276,10 @@ Devise.setup do |config|
   # If you want to use other strategies, that are not supported by Devise, or
   # change the failure app, you can configure them inside the config.warden block.
   #
-  # config.warden do |manager|
+  config.warden do |manager|
-  #   manager.intercept_401 = false
+    # manager.intercept_401 = false
-  #   manager.default_strategies(scope: :user).unshift :some_external_strategy
+    manager.default_strategies(scope: :user).unshift(:auth_token)
-  # end
+  end
 
   # ==> Mountable engine configurations
   # When using Devise inside an engine, let's call it `MyEngine`, and this engine

config/routes.rb

@@ -27,9 +27,11 @@ Rails.application.routes.draw do
     end
   end
 
-  namespace :api do
+  namespace :api, defaults: { format: :json } do
     resources :attachments, only: %i[create]
-    resources :templates, only: %i[update] do
+    resources :submissions, only: %i[create]
+    resources :templates, only: %i[update index] do
+      resources :submissions, only: %i[create]
       resources :documents, only: %i[create destroy], controller: 'templates_documents'
     end
   end
@@ -39,6 +41,7 @@ Rails.application.routes.draw do
   resource :newsletter, only: %i[show update]
   resources :users, only: %i[new create edit update destroy]
   resources :submissions, only: %i[show destroy]
+  resources :console_redirect, only: %i[index]
   resources :templates, only: %i[new create edit show destroy] do
     resources :submissions, only: %i[new create]
   end
@@ -67,6 +70,10 @@ Rails.application.routes.draw do
     end
     resources :esign, only: %i[index create], controller: 'esign_settings'
     resources :users, only: %i[index]
+    if !Docuseal.multitenant? || Docuseal.demo?
+      resources :api, only: %i[index], controller: 'api_settings'
+      resource :webhooks, only: %i[show create update], controller: 'webhook_settings'
+    end
     resource :account, only: %i[show update]
     resources :profile, only: %i[index] do
       collection do

db/migrate/20230803200825_add_uuid_to_users.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class AddUuidToUsers < ActiveRecord::Migration[7.0]
+  class MigrationUser < ApplicationRecord
+    self.table_name = 'users'
+  end
+
+  def up
+    add_column :users, :uuid, :text
+    add_index :users, :uuid, unique: true
+
+    MigrationUser.all.each do |user|
+      user.update_columns(uuid: SecureRandom.uuid)
+    end
+
+    change_column_null :users, :uuid, false
+  end
+
+  def down
+    drop_column :users, :uuid
+  end
+end

db/migrate/20230805124454_add_source_to_submissions.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class AddSourceToSubmissions < ActiveRecord::Migration[7.0]
+  class MigrationSubmission < ApplicationRecord
+    self.table_name = 'submissions'
+  end
+
+  def up
+    add_column :submissions, :source, :text
+
+    MigrationSubmission.where(source: nil).update_all(source: :invite)
+
+    change_column_null :submissions, :source, false
+  end
+
+  def down
+    drop_column :submissions, :source
+  end
+end

db/migrate/20230806140534_create_access_tokens.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class CreateAccessTokens < ActiveRecord::Migration[7.0]
+  def change
+    create_table :access_tokens do |t|
+      t.references :user, null: false, foreign_key: true, index: true
+      t.text :token, null: false
+      t.text :sha256, null: false, index: { unique: true }
+
+      t.timestamps
+    end
+  end
+end

db/schema.rb

@@ -10,10 +10,20 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.0].define(version: 2023_07_26_062428) do
+ActiveRecord::Schema[7.0].define(version: 2023_08_06_140534) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
+  create_table "access_tokens", force: :cascade do |t|
+    t.bigint "user_id", null: false
+    t.text "token", null: false
+    t.text "sha256", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["sha256"], name: "index_access_tokens_on_sha256", unique: true
+    t.index ["user_id"], name: "index_access_tokens_on_user_id"
+  end
+
   create_table "accounts", force: :cascade do |t|
     t.string "name", null: false
     t.string "timezone", null: false
@@ -80,6 +90,7 @@ ActiveRecord::Schema[7.0].define(version: 2023_07_26_062428) do
     t.text "template_fields"
     t.text "template_schema"
     t.text "template_submitters"
+    t.text "source", null: false
     t.index ["created_by_user_id"], name: "index_submissions_on_created_by_user_id"
     t.index ["template_id"], name: "index_submissions_on_template_id"
   end
@@ -139,12 +150,15 @@ ActiveRecord::Schema[7.0].define(version: 2023_07_26_062428) do
     t.datetime "deleted_at"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.text "uuid", null: false
     t.index ["account_id"], name: "index_users_on_account_id"
     t.index ["email"], name: "index_users_on_email", unique: true
     t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
     t.index ["unlock_token"], name: "index_users_on_unlock_token", unique: true
+    t.index ["uuid"], name: "index_users_on_uuid", unique: true
   end
 
+  add_foreign_key "access_tokens", "users"
   add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id"
   add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id"
   add_foreign_key "document_generation_events", "submitters"

lib/action_mailer_configs_interceptor.rb

@@ -25,7 +25,7 @@ module ActionMailerConfigsInterceptor
                                      port: email_configs.value['port'],
                                      tls: email_configs.value['port'].to_s == '465')
 
-      message.from = email_configs.value['from_email']
+      message.from = "#{email_configs.account.name} <#{email_configs.value['from_email']}>"
     else
       message.delivery_method(:test)
     end

lib/api_path_consider_json_middleware.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class ApiPathConsiderJsonMiddleware
+  def initialize(app)
+    @app = app
+  end
+
+  def call(env)
+    if env['PATH_INFO'].starts_with?('/api') &&
+       !env['PATH_INFO'].ends_with?('/documents') &&
+       !env['PATH_INFO'].ends_with?('/attachments')
+      env['CONTENT_TYPE'] = 'application/json'
+    end
+
+    @app.call(env)
+  end
+end

lib/auth_with_token_strategy.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class AuthWithTokenStrategy < Devise::Strategies::Base
+  def valid?
+    request.headers['X-Auth-Token'].present?
+  end
+
+  def authenticate!
+    sha256 = Digest::SHA256.hexdigest(request.headers['X-Auth-Token'])
+
+    user = User.joins(:access_token).find_by(access_token: { sha256: })
+
+    if user
+      success!(user)
+    else
+      fail!('Invalid token')
+    end
+  rescue JWT::VerificationError
+    fail!('Invalid token')
+  end
+end

lib/docuseal.rb

@@ -10,6 +10,11 @@ module Docuseal
   TWITTER_URL = 'https://twitter.com/docusealco'
   TWITTER_HANDLE = '@docusealco'
   SUPPORT_EMAIL = 'support@docuseal.co'
+  CONSOLE_URL = if Rails.env.development?
+                  'http://console.localhost.io:3001'
+                else
+                  'https://console.docuseal.co'
+                end
 
   CERTS = JSON.parse(ENV.fetch('CERTS', '{}'))
 

lib/json_web_token.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module JsonWebToken
+  module_function
+
+  def encode(payload)
+    JWT.encode(payload, Rails.application.secrets.secret_key_base)
+  end
+
+  def decode(token)
+    JWT.decode(token, Rails.application.secrets.secret_key_base)[0]
+  end
+end

lib/submissions.rb

@@ -10,4 +10,38 @@ module Submissions
 
     submission.save!
   end
+
+  def create_from_emails(template:, user:, emails:, source:, send_email: false)
+    emails = emails.to_s.scan(User::EMAIL_REGEXP)
+
+    emails.map do |email|
+      submission = template.submissions.new(created_by_user: user, source:)
+      submission.submitters.new(email:,
+                                uuid: template.submitters.first['uuid'],
+                                sent_at: send_email ? Time.current : nil)
+
+      submission.tap(&:save!)
+    end
+  end
+
+  def create_from_submitters(template:, user:, submissions_attrs:, source:, send_email: false)
+    submissions_attrs.map do |attrs|
+      submission = template.submissions.new(created_by_user: user, source:)
+
+      attrs[:submitters].each_with_index do |submitter_attrs, index|
+        uuid =
+          submitter_attrs[:uuid].presence ||
+          template.submitters.find { |e| e['name'] == submitter_attrs[:name] }&.dig('uuid') ||
+          template.submitters[index]&.dig('uuid')
+
+        next if uuid.blank?
+
+        submission.submitters.new(email: submitter_attrs[:email],
+                                  sent_at: send_email ? Time.current : nil,
+                                  uuid:)
+      end
+
+      submission.tap(&:save!)
+    end
+  end
 end

lib/submitters/serialize_for_webhook.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Submitters
+  module SerializeForWebhook
+    module_function
+
+    def call(submitter)
+      values = build_values_array(submitter)
+      documents = build_documents_array(submitter)
+
+      submitter_name = submitter.submission.template_submitters.find { |e| e['uuid'] == submitter.uuid }['name']
+
+      submitter.as_json(include: [template: { only: %i[id name created_at updated_at] }])
+               .except('uuid', 'values', 'slug')
+               .merge('values' => values,
+                      'documents' => documents,
+                      'submitter_name' => submitter_name)
+    end
+
+    def build_values_array(submitter)
+      fields_index = submitter.submission.template_fields.index_by { |e| e['uuid'] }
+      attachments_index = submitter.attachments.preload(:blob).index_by(&:uuid)
+      submitter_field_counters = Hash.new { 0 }
+
+      submitter.values.map do |uuid, value|
+        field = fields_index[uuid]
+        submitter_field_counters[field['type']] += 1
+
+        field_name =
+          field['name'].presence || "#{field['type'].titleize} Field #{submitter_field_counters[field['type']]}"
+
+        value = fetch_field_value(field, value, attachments_index)
+
+        { field: field_name, value: }
+      end
+    end
+
+    def build_documents_array(submitter)
+      submitter.documents.preload(:blob).map do |attachment|
+        { name: attachment.filename.base, url: attachment.url }
+      end
+    end
+
+    def fetch_field_value(field, value, attachments_index)
+      if field['type'].in?(%w[image signature])
+        attachments_index[value]&.url
+      elsif field['type'] == 'file'
+        Array.wrap(value).compact_blank.filter_map { |e| attachments_index[e]&.url }
+      else
+        value
+      end
+    end
+  end
+end