ensure template account is set

Gemfile

@@ -7,8 +7,11 @@ ruby '3.2.2'
 gem 'aws-sdk-s3', require: false
 gem 'azure-storage-blob', require: false
 gem 'bootsnap', require: false
+gem 'cancancan'
 gem 'devise'
+gem 'devise-two-factor'
 gem 'dotenv', require: false
+gem 'email_typo'
 gem 'faraday'
 gem 'google-cloud-storage', require: false
 gem 'hexapdf'
@@ -28,6 +31,8 @@ gem 'rails'
 gem 'rails_autolink'
 gem 'rails-i18n'
 gem 'rollbar', require: ENV.key?('ROLLBAR_ACCESS_TOKEN')
+gem 'rotp'
+gem 'rqrcode'
 gem 'ruby-vips'
 gem 'rubyXL'
 gem 'shakapacker'

Gemfile.lock

@@ -114,6 +114,7 @@ GEM
     bullet (7.0.7)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
+    cancancan (3.5.0)
     capybara (3.39.2)
       addressable
       matrix
@@ -123,6 +124,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    chunky_png (1.4.0)
     cmdparse (3.0.7)
     coderay (1.1.3)
     concurrent-ruby (1.2.2)
@@ -146,11 +148,17 @@ GEM
       railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
+    devise-two-factor (5.0.0)
+      activesupport (~> 7.0)
+      devise (~> 4.0)
+      railties (~> 7.0)
+      rotp (~> 6.0)
     diff-lcs (1.5.0)
     digest-crc (0.6.5)
       rake (>= 12.0.0, < 14.0.0)
     docile (1.4.0)
     dotenv (2.8.1)
+    email_typo (0.2.3)
     erb_lint (0.4.0)
       activesupport
       better_html (>= 2.0.1)
@@ -423,6 +431,11 @@ GEM
     retriable (3.1.2)
     rexml (3.2.6)
     rollbar (3.4.0)
+    rotp (6.3.0)
+    rqrcode (2.2.0)
+      chunky_png (~> 1.0)
+      rqrcode_core (~> 1.0)
+    rqrcode_core (1.2.0)
     rspec-core (3.12.2)
       rspec-support (~> 3.12.0)
     rspec-expectations (3.12.3)
@@ -555,11 +568,14 @@ DEPENDENCIES
   better_html
   bootsnap
   bullet
+  cancancan
   capybara
   cuprite
   debug
   devise
+  devise-two-factor
   dotenv
+  email_typo
   erb_lint
   factory_bot_rails
   faker
@@ -584,6 +600,8 @@ DEPENDENCIES
   rails-i18n
   rails_autolink
   rollbar
+  rotp
+  rqrcode
   rspec-rails
   rubocop
   rubocop-performance

app/controllers/accounts_controller.rb

@@ -9,6 +9,9 @@ class AccountsController < ApplicationController
     'de-DE' => 'German (Germany)'
   }.freeze
 
+  before_action :load_account
+  authorize_resource :account
+
   def show; end
 
   def update
@@ -35,6 +38,10 @@ class AccountsController < ApplicationController
 
   private
 
+  def load_account
+    @account = current_account
+  end
+
   def account_params
     params.require(:account).permit(:name, :timezone, :locale)
   end

app/controllers/api/api_base_controller.rb

@@ -5,6 +5,15 @@ module Api
     include ActiveStorage::SetCurrent
 
     before_action :authenticate_user!
+    check_authorization
+
+    if Rails.env.production?
+      rescue_from CanCan::AccessDenied do |e|
+        Rollbar.error(e) if defined?(Rollbar)
+
+        render json: { error: e.message }, status: :forbidden
+      end
+    end
 
     private
 

app/controllers/api/attachments_controller.rb

@@ -3,6 +3,7 @@
 module Api
   class AttachmentsController < ApiBaseController
     skip_before_action :authenticate_user!
+    skip_authorization_check
 
     def create
       submitter = Submitter.find_by!(slug: params[:submitter_slug])

app/controllers/api/submissions_controller.rb

@@ -5,21 +5,25 @@ module Api
     UnknownFieldName = Class.new(StandardError)
     UnknownSubmitterName = Class.new(StandardError)
 
-    def create
-      template = current_account.templates.find(params[:template_id])
+    load_and_authorize_resource :template
 
+    before_action do
+      authorize!(:create, Submission)
+    end
+
+    def create
       submissions =
         if (emails = (params[:emails] || params[:email]).presence)
-          Submissions.create_from_emails(template:,
+          Submissions.create_from_emails(template: @template,
                                          user: current_user,
                                          source: :api,
                                          mark_as_sent: params[:send_email] != 'false',
                                          emails:)
         else
-          submissions_attrs = normalize_submissions_params!(submissions_params[:submission], template)
+          submissions_attrs = normalize_submissions_params!(submissions_params[:submission], @template)
 
           Submissions.create_from_submitters(
-            template:,
+            template: @template,
             user: current_user,
             source: :api,
             mark_as_sent: params[:send_email] != 'false',

app/controllers/api/submitter_email_clicks_controller.rb

@@ -3,6 +3,7 @@
 module Api
   class SubmitterEmailClicksController < ApiBaseController
     skip_before_action :authenticate_user!
+    skip_authorization_check
 
     def create
       submitter = Submitter.find_by!(slug: params[:submitter_slug])

app/controllers/api/submitter_form_views_controller.rb

@@ -3,12 +3,15 @@
 module Api
   class SubmitterFormViewsController < ApiBaseController
     skip_before_action :authenticate_user!
+    skip_authorization_check
 
     def create
       submitter = Submitter.find_by!(slug: params[:submitter_slug])
 
       SubmissionEvents.create_with_tracking_data(submitter, 'view_form', request)
 
+      SendFormViewedWebhookRequestJob.perform_later(submitter)
+
       render json: {}
     end
   end

app/controllers/api/templates_controller.rb

@@ -2,10 +2,10 @@
 
 module Api
   class TemplatesController < ApiBaseController
-    before_action :load_template, only: %i[show update]
+    load_and_authorize_resource :template
 
     def index
-      render json: current_account.templates
+      render json: @templates
     end
 
     def show
@@ -28,9 +28,5 @@ module Api
                                        fields: [[:uuid, :submitter_uuid, :name, :type, :required,
                                                  { options: [], areas: [%i[x y w h cell_w attachment_uuid page]] }]])
     end
-
-    def load_template
-      @template = current_account.templates.find(params[:id])
-    end
   end
 end

app/controllers/api/templates_documents_controller.rb

@@ -2,11 +2,11 @@
 
 module Api
   class TemplatesDocumentsController < ApiBaseController
+    load_and_authorize_resource :template
+
     def create
       return head :unprocessable_entity if params[:blobs].blank? && params[:files].blank?
 
-      @template = current_account.templates.find(params[:template_id])
-
       documents = Templates::CreateAttachments.call(@template, params)
 
       schema = documents.map do |doc|

app/controllers/api_settings_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
 class ApiSettingsController < ApplicationController
-  def index; end
+  def index
+    authorize!(:read, current_user.access_token)
+  end
 end

app/controllers/application_controller.rb

@@ -4,6 +4,8 @@ class ApplicationController < ActionController::Base
   include ActiveStorage::SetCurrent
   include Pagy::Backend
 
+  check_authorization unless: :devise_controller?
+
   before_action :sign_in_for_demo, if: -> { Docuseal.demo? }
   before_action :maybe_redirect_to_setup, unless: :signed_in?
   before_action :authenticate_user!, unless: :devise_controller?
@@ -16,6 +18,14 @@ class ApplicationController < ActionController::Base
     redirect_to request.path
   end
 
+  if Rails.env.production?
+    rescue_from CanCan::AccessDenied do |e|
+      Rollbar.error(e) if defined?(Rollbar)
+
+      redirect_back(fallback_location: root_path, alert: e.message)
+    end
+  end
+
   def default_url_options
     Docuseal.default_url_options
   end

app/controllers/console_redirect_controller.rb

@@ -2,6 +2,7 @@
 
 class ConsoleRedirectController < ApplicationController
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   def index
     return redirect_to(new_user_session_path({ redir: params[:redir] }.compact)) if current_user.blank?

app/controllers/dashboard_controller.rb

@@ -3,12 +3,29 @@
 class DashboardController < ApplicationController
   skip_before_action :authenticate_user!, only: %i[index]
 
+  before_action :maybe_redirect_product_url
+  before_action :maybe_render_landing
+
+  load_and_authorize_resource :template, parent: false
+
   def index
-    return redirect_to Docuseal::PRODUCT_URL, allow_other_host: true if Docuseal.multitenant? && !signed_in?
-    return render 'pages/landing' unless signed_in?
+    @templates = @templates.active.preload(:author).order(id: :desc)
+    @templates = Templates.search(@templates, params[:q])
 
-    templates = current_account.templates.active.preload(:author).order(id: :desc)
+    @pagy, @templates = pagy(@templates, items: 12)
+  end
 
-    @pagy, @templates = pagy(templates, items: 12)
+  private
+
+  def maybe_redirect_product_url
+    return if !Docuseal.multitenant? || signed_in?
+
+    redirect_to Docuseal::PRODUCT_URL, allow_other_host: true
+  end
+
+  def maybe_render_landing
+    return if signed_in?
+
+    render 'pages/landing'
   end
 end

app/controllers/email_smtp_settings_controller.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
-class EmailSettingsController < ApplicationController
+class EmailSmtpSettingsController < ApplicationController
   before_action :load_encrypted_config
+  authorize_resource :encrypted_config, only: :index
+  authorize_resource :encrypted_config, parent: false, only: :create
 
   def index; end
 

app/controllers/esign_settings_controller.rb

@@ -11,9 +11,12 @@ class EsignSettingsController < ApplicationController
     end
   end
 
+  before_action :load_encrypted_config
+  authorize_resource :encrypted_config, parent: false, only: %i[new create]
+  authorize_resource :encrypted_config, only: %i[update destroy show]
+
   def show
-    cert_data = EncryptedConfig.find_by(account: current_account,
-                                        key: EncryptedConfig::ESIGN_CERTS_KEY)&.value || {}
+    cert_data = @encrypted_config.value || {}
 
     default_pkcs = GenerateCertificate.load_pkcs(cert_data) if cert_data['cert'].present?
 
@@ -42,10 +45,7 @@ class EsignSettingsController < ApplicationController
   def create
     @cert_record = CertFormRecord.new(**cert_params)
 
-    cert_configs = EncryptedConfig.find_or_initialize_by(account: current_account,
-                                                         key: EncryptedConfig::ESIGN_CERTS_KEY)
-
-    if (cert_configs.value && cert_configs.value['custom']&.any? { |e| e['name'] == @cert_record.name }) ||
+    if (@encrypted_config.value && @encrypted_config.value['custom']&.any? { |e| e['name'] == @cert_record.name }) ||
        @cert_record.name == DEFAULT_CERT_NAME
 
       @cert_record.errors.add(:name, 'already exists')
@@ -54,7 +54,7 @@ class EsignSettingsController < ApplicationController
                     status: :unprocessable_entity
     end
 
-    save_new_cert!(cert_configs, @cert_record)
+    save_new_cert!(@encrypted_config, @cert_record)
 
     redirect_to settings_esign_path, notice: 'Certificate has been successfully added!'
   rescue OpenSSL::PKCS12::PKCS12Error
@@ -64,29 +64,31 @@ class EsignSettingsController < ApplicationController
   end
 
   def update
-    cert_configs = EncryptedConfig.find_by(account: current_account, key: EncryptedConfig::ESIGN_CERTS_KEY)
+    @encrypted_config.value['custom'].each { |e| e['status'] = 'validate' }
 
-    cert_configs.value['custom'].each { |e| e['status'] = 'validate' }
-    custom_cert_data = cert_configs.value['custom'].find { |e| e['name'] == params[:name] }
+    custom_cert_data = @encrypted_config.value['custom'].find { |e| e['name'] == params[:name] }
     custom_cert_data['status'] = 'default' if custom_cert_data
 
-    cert_configs.save!
+    @encrypted_config.save!
 
     redirect_to settings_esign_path, notice: 'Default certificate has been selected'
   end
 
   def destroy
-    cert_configs = EncryptedConfig.find_by(account: current_account, key: EncryptedConfig::ESIGN_CERTS_KEY)
+    @encrypted_config.value['custom'].reject! { |e| e['name'] == params[:name] }
 
-    cert_configs.value['custom'].reject! { |e| e['name'] == params[:name] }
-
-    cert_configs.save!
+    @encrypted_config.save!
 
     redirect_to settings_esign_path, notice: 'Certificate has been removed'
   end
 
   private
 
+  def load_encrypted_config
+    @encrypted_config = EncryptedConfig.find_or_initialize_by(account: current_account,
+                                                              key: EncryptedConfig::ESIGN_CERTS_KEY)
+  end
+
   def save_new_cert!(cert_configs, cert_record)
     pkcs = OpenSSL::PKCS12.new(cert_record.file.read, cert_record.password)
 

app/controllers/mfa_setup_controller.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+class MfaSetupController < ApplicationController
+  before_action do
+    authorize!(:update, current_user)
+  end
+
+  def new
+    current_user.otp_secret ||= User.generate_otp_secret
+
+    current_user.save!
+
+    @provision_url = current_user.otp_provisioning_uri(current_user.email, issuer: Docuseal::PRODUCT_NAME)
+  end
+
+  def edit; end
+
+  def create
+    if current_user.validate_and_consume_otp!(params[:otp_attempt])
+      current_user.otp_required_for_login = true
+      current_user.save!
+
+      redirect_to settings_profile_index_path, notice: '2FA has been configured'
+    else
+      @provision_url = current_user.otp_provisioning_uri(current_user.email, issuer: Docuseal::PRODUCT_NAME)
+
+      @error_message = 'Code is invalid'
+
+      render turbo_stream: turbo_stream.replace(:modal, template: 'mfa_setup/new'), status: :unprocessable_entity
+    end
+  end
+
+  def destroy
+    if current_user.validate_and_consume_otp!(params[:otp_attempt])
+      current_user.update!(otp_required_for_login: false, otp_secret: nil)
+
+      redirect_to settings_profile_index_path, notice: '2FA has been removed'
+    else
+      @error_message = 'Code is invalid'
+
+      render turbo_stream: turbo_stream.replace(:modal, template: 'mfa_setup/edit'), status: :unprocessable_entity
+    end
+  end
+end

app/controllers/newsletters_controller.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class NewslettersController < ApplicationController
+  skip_authorization_check
+
   def show; end
 
   def update

app/controllers/notifications_settings_controller.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+class NotificationsSettingsController < ApplicationController
+  before_action :load_bcc_config, only: :index
+  before_action :load_reminder_config, only: :index
+  authorize_resource :bcc_config, only: :index
+  authorize_resource :reminder_config, only: :index
+
+  before_action :build_account_config, only: :create
+  authorize_resource :account_config, only: :create
+
+  def index; end
+
+  def create
+    if @account_config.save
+      redirect_back fallback_location: settings_notifications_path, notice: 'Changes have been saved'
+    else
+      redirect_back fallback_location: settings_notifications_path, alert: 'Unable to save'
+    end
+  end
+
+  private
+
+  def build_account_config
+    @account_config =
+      AccountConfig.find_or_initialize_by(account: current_account, key: email_config_params[:key])
+
+    @account_config.assign_attributes(email_config_params)
+  end
+
+  def load_bcc_config
+    @bcc_config =
+      AccountConfig.find_or_initialize_by(account: current_account, key: AccountConfig::BCC_EMAILS)
+  end
+
+  def load_reminder_config
+    @reminder_config =
+      AccountConfig.find_or_initialize_by(account: current_account, key: AccountConfig::SUBMITTER_REMAILERS)
+  end
+
+  def email_config_params
+    params.require(:account_config).permit!.tap do |attrs|
+      attrs[:key] = nil unless attrs[:key].in?([AccountConfig::BCC_EMAILS, AccountConfig::SUBMITTER_REMAILERS])
+    end
+  end
+end

app/controllers/personalization_settings_controller.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
 class PersonalizationSettingsController < ApplicationController
-  def show; end
+  def show
+    authorize!(:read, AccountConfig)
+  end
 
   def create
     account_config =
       current_account.account_configs.find_or_initialize_by(key: encrypted_config_params[:key])
 
+    authorize!(:create, account_config)
+
     account_config.update!(encrypted_config_params)
 
     redirect_back(fallback_location: settings_personalization_path, notice: 'Settings have been saved.')

app/controllers/profile_controller.rb

@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 
 class ProfileController < ApplicationController
+  before_action do
+    authorize!(:manage, current_user)
+  end
+
   def index; end
 
   def update_contact

app/controllers/send_submission_email_controller.rb

@@ -5,6 +5,7 @@ class SendSubmissionEmailController < ApplicationController
 
   skip_before_action :authenticate_user!
   skip_before_action :verify_authenticity_token
+  skip_authorization_check
 
   def success; end
 

app/controllers/sessions_controller.rb

@@ -1,12 +1,18 @@
 # frozen_string_literal: true
 
 class SessionsController < Devise::SessionsController
+  before_action :configure_permitted_parameters
+
   def create
     if Docuseal.multitenant? && !User.exists?(email: sign_in_params[:email])
       return redirect_to new_registration_path(sign_up: true, user: sign_in_params.slice(:email)),
                          notice: 'Create a new account'
     end
 
+    if User.exists?(email: sign_in_params[:email], otp_required_for_login: true) && sign_in_params[:otp_attempt].blank?
+      return render :otp, locals: { resource: User.new(sign_in_params) }, status: :unprocessable_entity
+    end
+
     super
   end
 
@@ -22,6 +28,10 @@ class SessionsController < Devise::SessionsController
     super
   end
 
+  def configure_permitted_parameters
+    devise_parameter_sanitizer.permit(:sign_in, keys: [:otp_attempt])
+  end
+
   def require_no_authentication
     super
 

app/controllers/setup_controller.rb

@@ -3,6 +3,7 @@
 class SetupController < ApplicationController
   skip_before_action :maybe_redirect_to_setup
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   before_action :redirect_to_root_if_signed, if: :signed_in?
   before_action :ensure_first_user_not_created!

app/controllers/sms_settings_controller.rb

@@ -1,5 +1,16 @@
 # frozen_string_literal: true
 
 class SmsSettingsController < ApplicationController
+  before_action :load_encrypted_config
+  authorize_resource :encrypted_config, only: :index
+  authorize_resource :encrypted_config, parent: false, except: :index
+
   def index; end
+
+  private
+
+  def load_encrypted_config
+    @encrypted_config =
+      EncryptedConfig.find_or_initialize_by(account: current_account, key: 'sms_configs')
+  end
 end

app/controllers/start_form_controller.rb

@@ -4,6 +4,7 @@ class StartFormController < ApplicationController
   layout 'form'
 
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   before_action :load_template
 
@@ -25,7 +26,9 @@ class StartFormController < ApplicationController
         ua: request.user_agent
       )
 
-      @submitter.submission ||= Submission.new(template: @template, source: :link)
+      @submitter.submission ||= Submission.new(template: @template,
+                                               template_submitters: @template.submitters,
+                                               source: :link)
 
       if @submitter.save
         redirect_to submit_form_path(@submitter.slug)
@@ -44,7 +47,9 @@ class StartFormController < ApplicationController
   private
 
   def submitter_params
-    params.require(:submitter).permit(:email)
+    params.require(:submitter).permit(:email).tap do |attrs|
+      attrs[:email] = Submissions.normalize_email(attrs[:email])
+    end
   end
 
   def load_template

app/controllers/storage_settings_controller.rb

@@ -2,6 +2,8 @@
 
 class StorageSettingsController < ApplicationController
   before_action :load_encrypted_config
+  authorize_resource :encrypted_config, only: :index
+  authorize_resource :encrypted_config, parent: false, only: :create
 
   def index; end
 

app/controllers/submissions_controller.rb

@@ -2,19 +2,26 @@
 
 class SubmissionsController < ApplicationController
   before_action :load_template, only: %i[new create]
+  authorize_resource :template, only: %i[new create]
+
+  load_and_authorize_resource :submission, only: %i[show destroy]
 
   def show
-    @submission =
-      Submission.joins(:template).where(template: { account_id: current_account.id })
-                .preload(:template, template_schema_documents: [:blob, { preview_images_attachments: :blob }])
-                .find(params[:id])
+    ActiveRecord::Associations::Preloader.new(
+      records: [@submission],
+      associations: [:template, { template_schema_documents: [:blob, { preview_images_attachments: :blob }] }]
+    ).call
 
     render :show, layout: 'plain'
   end
 
-  def new; end
+  def new
+    authorize!(:new, Submission)
+  end
 
   def create
+    authorize!(:create, Submission)
+
     submissions =
       if params[:emails].present?
         Submissions.create_from_emails(template: @template,
@@ -37,12 +44,9 @@ class SubmissionsController < ApplicationController
   end
 
   def destroy
-    submission = Submission.joins(:template).where(template: { account_id: current_account.id })
-                           .find(params[:id])
+    @submission.update!(deleted_at: Time.current)
 
-    submission.update!(deleted_at: Time.current)
-
-    redirect_back(fallback_location: template_path(submission.template), notice: 'Submission has been archived')
+    redirect_back(fallback_location: template_path(@submission.template), notice: 'Submission has been archived')
   end
 
   private

app/controllers/submissions_debug_controller.rb

@@ -4,6 +4,7 @@ class SubmissionsDebugController < ApplicationController
   layout 'plain'
 
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   def index
     @submitter = Submitter.preload({ attachments_attachments: :blob },

app/controllers/submissions_download_controller.rb

@@ -2,6 +2,7 @@
 
 class SubmissionsDownloadController < ApplicationController
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   def index
     submitter = Submitter.find_by(slug: params[:submitter_slug])

app/controllers/submissions_export_controller.rb

@@ -1,13 +1,14 @@
 # frozen_string_literal: true
 
 class SubmissionsExportController < ApplicationController
-  before_action :load_template
+  load_and_authorize_resource :template
+  load_and_authorize_resource :submission, through: :template, parent: false, only: :index
 
   def index
-    submissions = @template.submissions.active
-                           .preload(submitters: { documents_attachments: :blob,
-                                                  attachments_attachments: :blob })
-                           .order(id: :asc)
+    submissions = @submissions.active
+                              .preload(submitters: { documents_attachments: :blob,
+                                                     attachments_attachments: :blob })
+                              .order(id: :asc)
 
     if params[:format] == 'csv'
       send_data Submissions::GenerateExportFiles.call(submissions, format: params[:format]),
@@ -19,10 +20,4 @@ class SubmissionsExportController < ApplicationController
   end
 
   def new; end
-
-  private
-
-  def load_template
-    @template = current_account.templates.find(params[:template_id])
-  end
 end

app/controllers/submit_form_controller.rb

@@ -4,6 +4,7 @@ class SubmitFormController < ApplicationController
   layout 'form'
 
   skip_before_action :authenticate_user!
+  skip_authorization_check
 
   def show
     @submitter =

app/controllers/submitters_send_email_controller.rb

@@ -1,18 +1,16 @@
 # frozen_string_literal: true
 
 class SubmittersSendEmailController < ApplicationController
+  load_and_authorize_resource :submitter, id_param: :submitter_slug, find_by: :slug
+
   def create
-    submitter = Submitter.joins(:template)
-                         .where(template: { account_id: current_account.id })
-                         .find_by!(slug: params[:submitter_slug])
+    SubmitterMailer.invitation_email(@submitter).deliver_later!
 
-    SubmitterMailer.invitation_email(submitter).deliver_later!
+    SubmissionEvent.create!(submitter: @submitter, event_type: 'send_email')
 
-    SubmissionEvent.create!(submitter:, event_type: 'send_email')
+    @submitter.sent_at ||= Time.current
+    @submitter.save!
 
-    submitter.sent_at ||= Time.current
-    submitter.save!
-
-    redirect_back(fallback_location: submission_path(submitter.submission), notice: 'Email has been sent')
+    redirect_back(fallback_location: submission_path(@submitter.submission), notice: 'Email has been sent')
   end
 end

app/controllers/templates_archived_controller.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+class TemplatesArchivedController < ApplicationController
+  load_and_authorize_resource :template, parent: false
+
+  def index
+    @templates = @templates.where.not(deleted_at: nil).preload(:author).order(id: :desc)
+    @templates = Templates.search(@templates, params[:q])
+
+    @pagy, @templates = pagy(@templates, items: 12)
+  end
+end

app/controllers/templates_archived_submissions_controller.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class TemplatesArchivedSubmissionsController < ApplicationController
+  load_and_authorize_resource :template
+  load_and_authorize_resource :submission, through: :template, parent: false
+
+  def index
+    @submissions = @submissions.where.not(deleted_at: nil)
+    @submissions = Submissions.search(@submissions, params[:q])
+
+    @pagy, @submissions = pagy(@submissions.preload(:submitters).order(id: :desc))
+  rescue ActiveRecord::RecordNotFound
+    redirect_to root_path
+  end
+end

app/controllers/templates_controller.rb

@@ -1,30 +1,35 @@
 # frozen_string_literal: true
 
 class TemplatesController < ApplicationController
+  load_and_authorize_resource :template
+
   before_action :load_base_template, only: %i[new create]
 
   def show
-    @template = current_account.templates.active.find(params[:id])
+    submissions = @template.submissions
+    submissions = submissions.active if @template.deleted_at.blank?
+    submissions = Submissions.search(submissions, params[:q])
 
-    @pagy, @submissions = pagy(@template.submissions.active.preload(:submitters).order(id: :desc))
+    @pagy, @submissions = pagy(submissions.preload(:submitters).order(id: :desc))
   rescue ActiveRecord::RecordNotFound
     redirect_to root_path
   end
 
   def new
-    @template = current_account.templates.new
     @template.name = "#{@base_template.name} (Clone)" if @base_template
   end
 
   def edit
-    @template = current_account.templates.preload(schema_documents: { preview_images_attachments: :blob })
-                               .find(params[:id])
+    ActiveRecord::Associations::Preloader.new(
+      records: [@template],
+      associations: [schema_documents: { preview_images_attachments: :blob }]
+    ).call
 
     render :edit, layout: 'plain'
   end
 
   def create
-    @template = current_account.templates.new(template_params)
+    @template.account = current_account
     @template.author = current_user
     @template.assign_attributes(@base_template.slice(:fields, :schema, :submitters)) if @base_template
 
@@ -38,7 +43,6 @@ class TemplatesController < ApplicationController
   end
 
   def destroy
-    @template = current_account.templates.find(params[:id])
     @template.update!(deleted_at: Time.current)
 
     redirect_back(fallback_location: root_path, notice: 'Template has been archived.')
@@ -53,8 +57,6 @@ class TemplatesController < ApplicationController
   def load_base_template
     return if params[:base_template_id].blank?
 
-    @base_template = current_account.templates
-                                    .preload(documents_attachments: :preview_images_attachments)
-                                    .find_by(id: params[:base_template_id])
+    @base_template = current_account.templates.find_by(id: params[:base_template_id])
   end
 end

app/controllers/templates_restore_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class TemplatesRestoreController < ApplicationController
+  load_and_authorize_resource :template
+
+  def create
+    @template.update!(deleted_at: nil)
+
+    redirect_to template_path(@template), notice: 'Template has been unarchived'
+  end
+end

app/controllers/templates_uploads_controller.rb

@@ -1,18 +1,20 @@
 # frozen_string_literal: true
 
 class TemplatesUploadsController < ApplicationController
+  load_and_authorize_resource :template, parent: false
+
   def create
-    template = current_account.templates.new(author: current_user)
-    template.name = File.basename(params[:files].first.original_filename, '.*')
+    @template.author = current_user
+    @template.name = File.basename(params[:files].first.original_filename, '.*')
 
-    template.save!
+    @template.save!
 
-    documents = Templates::CreateAttachments.call(template, params)
+    documents = Templates::CreateAttachments.call(@template, params)
 
     schema = documents.map { |doc| { attachment_uuid: doc.uuid, name: doc.filename.base } }
 
-    template.update!(schema:)
+    @template.update!(schema:)
 
-    redirect_to edit_template_path(template)
+    redirect_to edit_template_path(@template)
   end
 end

app/controllers/users_controller.rb

@@ -1,26 +1,20 @@
 # frozen_string_literal: true
 
 class UsersController < ApplicationController
-  before_action :load_user, only: %i[edit update destroy]
+  load_and_authorize_resource :user, only: %i[index edit new update destroy]
+
+  before_action :build_user, only: :create
+  authorize_resource :user, only: :create
 
   def index
-    @pagy, @users = pagy(current_account.users.active.order(id: :desc))
+    @pagy, @users = pagy(@users.active.order(id: :desc))
   end
 
-  def new
-    @user = current_account.users.new
-  end
+  def new; end
 
   def edit; end
 
   def create
-    @user = current_account.users.find_by(email: user_params[:email])&.tap do |user|
-      user.assign_attributes(user_params)
-      user.deleted_at = nil
-    end
-
-    @user ||= current_account.users.new(user_params)
-
     if @user.save
       UserMailer.invitation_email(@user).deliver_later!
 
@@ -33,7 +27,7 @@ class UsersController < ApplicationController
   def update
     return redirect_to settings_users_path, notice: 'Unable to update user.' if Docuseal.demo?
 
-    if @user.update(user_params.compact_blank)
+    if @user.update(user_params.compact_blank.except(current_user == @user ? :role : nil))
       redirect_to settings_users_path, notice: 'User has been updated'
     else
       render turbo_stream: turbo_stream.replace(:modal, template: 'users/edit'), status: :unprocessable_entity
@@ -52,11 +46,18 @@ class UsersController < ApplicationController
 
   private
 
-  def load_user
-    @user = current_account.users.find(params[:id])
+  def build_user
+    @user = current_account.users.find_by(email: user_params[:email])&.tap do |user|
+      user.assign_attributes(user_params)
+      user.deleted_at = nil
+    end
+
+    @user ||= current_account.users.new(user_params)
+
+    @user
   end
 
   def user_params
-    params.require(:user).permit(:email, :first_name, :last_name, :password)
+    params.require(:user).permit(:email, :first_name, :last_name, :password, :role)
   end
 end

app/controllers/verify_pdf_signature_controller.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class VerifyPdfSignatureController < ApplicationController
+  skip_authorization_check
+
   def create
     pdfs =
       params[:files].map do |file|

app/controllers/webhook_settings_controller.rb

@@ -1,15 +1,12 @@
 # frozen_string_literal: true
 
 class WebhookSettingsController < ApplicationController
-  def show
-    @encrypted_config =
-      current_account.encrypted_configs.find_or_initialize_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
-  end
+  before_action :load_encrypted_config
+  authorize_resource :encrypted_config, parent: false
+
+  def show; end
 
   def create
-    @encrypted_config =
-      current_account.encrypted_configs.find_or_initialize_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
-
     @encrypted_config.update!(encrypted_config_params)
 
     redirect_back(fallback_location: settings_webhooks_path, notice: 'Webhook URL has been saved.')
@@ -18,13 +15,18 @@ class WebhookSettingsController < ApplicationController
   def update
     submitter = current_account.submitters.where.not(completed_at: nil).order(:id).last
 
-    SendWebhookRequestJob.perform_later(submitter)
+    SendFormCompletedWebhookRequestJob.perform_later(submitter)
 
     redirect_back(fallback_location: settings_webhooks_path, notice: 'Webhook request has been sent.')
   end
 
   private
 
+  def load_encrypted_config
+    @encrypted_config =
+      current_account.encrypted_configs.find_or_initialize_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+  end
+
   def encrypted_config_params
     params.require(:encrypted_config).permit(:value)
   end

app/jobs/process_submitter_completion_job.rb

@@ -11,7 +11,7 @@ class ProcessSubmitterCompletionJob < ApplicationJob
     Submissions::EnsureResultGenerated.call(submitter)
 
     if submitter.account.encrypted_configs.exists?(key: EncryptedConfig::WEBHOOK_URL_KEY)
-      SendWebhookRequestJob.perform_later(submitter)
+      SendFormCompletedWebhookRequestJob.perform_later(submitter)
     end
 
     return unless is_all_completed
@@ -26,7 +26,8 @@ class ProcessSubmitterCompletionJob < ApplicationJob
     user = submitter.submission.created_by_user || submitter.template.author
 
     if submitter.template.account.users.exists?(id: user.id)
-      bcc = submitter.submission.template.account.account_configs.find_by(key: 'bcc_emails')&.value
+      bcc = submitter.submission.template.account.account_configs
+                     .find_by(key: AccountConfig::BCC_EMAILS)&.value
 
       SubmitterMailer.completed_email(submitter, user, bcc:).deliver_later!
     end

app/jobs/send_form_completed_webhook_request_job.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-class SendWebhookRequestJob < ApplicationJob
+class SendFormCompletedWebhookRequestJob < ApplicationJob
   USER_AGENT = 'DocuSeal.co Webhook'
 
   def perform(submitter)
@@ -14,7 +14,7 @@ class SendWebhookRequestJob < ApplicationJob
 
     Faraday.post(config.value,
                  {
-                   event_type: 'form.submitted',
+                   event_type: 'form.completed',
                    timestamp: Time.current.iso8601,
                    data: Submitters::SerializeForWebhook.call(submitter)
                  }.to_json,

app/jobs/send_form_started_webhook_request_job.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class SendFormStartedWebhookRequestJob < ApplicationJob
+  USER_AGENT = 'DocuSeal.co Webhook'
+
+  def perform(submitter)
+    config = submitter.submission.account.encrypted_configs.find_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+
+    return if config.blank? || config.value.blank?
+
+    ActiveStorage::Current.url_options = Docuseal.default_url_options
+
+    Faraday.post(config.value,
+                 {
+                   event_type: 'form.started',
+                   timestamp: Time.current.iso8601,
+                   data: Submitters::SerializeForWebhook.call(submitter)
+                 }.to_json,
+                 'Content-Type' => 'application/json',
+                 'User-Agent' => USER_AGENT)
+  end
+end

app/jobs/send_form_viewed_webhook_request_job.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class SendFormViewedWebhookRequestJob < ApplicationJob
+  USER_AGENT = 'DocuSeal.co Webhook'
+
+  def perform(submitter)
+    config = submitter.submission.account.encrypted_configs.find_by(key: EncryptedConfig::WEBHOOK_URL_KEY)
+
+    return if config.blank? || config.value.blank?
+
+    ActiveStorage::Current.url_options = Docuseal.default_url_options
+
+    Faraday.post(config.value,
+                 {
+                   event_type: 'form.viewed',
+                   timestamp: Time.current.iso8601,
+                   data: Submitters::SerializeForWebhook.call(submitter)
+                 }.to_json,
+                 'Content-Type' => 'application/json',
+                 'User-Agent' => USER_AGENT)
+  end
+end

app/jobs/send_submitter_invitation_email_job.rb

@@ -1,8 +1,10 @@
 # frozen_string_literal: true
 
 class SendSubmitterInvitationEmailJob < ApplicationJob
-  def perform(submitter)
-    SubmitterMailer.invitation_email(submitter).deliver_now!
+  def perform(params = {})
+    submitter = Submitter.find(params['submitter_id'])
+
+    SubmitterMailer.invitation_email(submitter, subject: params['subject'], body: params['body']).deliver_now!
 
     SubmissionEvent.create!(submitter:, event_type: 'send_email')
 

app/mailers/submitter_mailer.rb

@@ -1,18 +1,16 @@
 # frozen_string_literal: true
 
 class SubmitterMailer < ApplicationMailer
-  DEFAULT_MESSAGE = %(You have been invited to submit the "%<name>s" form:)
-
-  def invitation_email(submitter, message: '')
+  def invitation_email(submitter, body: nil, subject: nil)
     @current_account = submitter.submission.template.account
     @submitter = submitter
-    @message = message.presence || format(DEFAULT_MESSAGE, name: submitter.submission.template.name)
+    @body = body.presence
 
     @email_config = @current_account.account_configs.find_by(key: AccountConfig::SUBMITTER_INVITATION_EMAIL_KEY)
 
     subject =
-      if @email_config
-        ReplaceEmailVariables.call(@email_config.value['subject'], submitter:)
+      if @email_config || subject.present?
+        ReplaceEmailVariables.call(subject.presence || @email_config.value['subject'], submitter:)
       else
         'You have been invited to submit a form'
       end

app/models/account_config.rb

@@ -24,6 +24,8 @@ class AccountConfig < ApplicationRecord
   SUBMITTER_INVITATION_EMAIL_KEY = 'submitter_invitation_email'
   SUBMITTER_COMPLETED_EMAIL_KEY = 'submitter_completed_email'
   SUBMITTER_DOCUMENTS_COPY_EMAIL_KEY = 'submitter_documents_copy_email'
+  BCC_EMAILS = 'bcc_emails'
+  SUBMITTER_REMAILERS = 'submitter_reminders'
 
   DEFAULT_VALUES = {
     SUBMITTER_INVITATION_EMAIL_KEY => {

app/models/submission_event.rb

@@ -25,6 +25,7 @@
 #
 class SubmissionEvent < ApplicationRecord
   belongs_to :submission
+  has_one :account, through: :submission
   belongs_to :submitter, optional: true
 
   attribute :data, :string, default: -> { {} }
@@ -36,6 +37,7 @@ class SubmissionEvent < ApplicationRecord
 
   enum :event_type, {
     send_email: 'send_email',
+    send_reminder_email: 'send_reminder_email',
     send_sms: 'send_sms',
     open_email: 'open_email',
     click_email: 'click_email',

app/models/submitter.rb

@@ -59,7 +59,7 @@ class Submitter < ApplicationRecord
   end
 
   def friendly_name
-    if name.present?
+    if name.present? && email.present? && email.exclude?(',')
       "#{name} <#{email}>"
     else
       email

app/models/user.rb

@@ -5,6 +5,7 @@
 # Table name: users
 #
 #  id                     :bigint           not null, primary key
+#  consumed_timestep      :integer
 #  current_sign_in_at     :datetime
 #  current_sign_in_ip     :string
 #  deleted_at             :datetime
@@ -16,6 +17,8 @@
 #  last_sign_in_at        :datetime
 #  last_sign_in_ip        :string
 #  locked_at              :datetime
+#  otp_required_for_login :boolean          default(FALSE), not null
+#  otp_secret             :string
 #  remember_created_at    :datetime
 #  reset_password_sent_at :datetime
 #  reset_password_token   :string
@@ -44,13 +47,13 @@ class User < ApplicationRecord
     ADMIN_ROLE = 'admin'
   ].freeze
 
-  EMAIL_REGEXP = /[^@,\s]+@[^@,\s]+/
+  EMAIL_REGEXP = /[^@;,<>\s]+@[^@;,<>\s]+/
 
   belongs_to :account
   has_one :access_token, dependent: :destroy
   has_many :templates, dependent: :destroy, foreign_key: :author_id, inverse_of: :author
 
-  devise :database_authenticatable, :recoverable, :rememberable, :validatable, :trackable
+  devise :two_factor_authenticatable, :recoverable, :rememberable, :validatable, :trackable
   devise :registerable, :omniauthable, omniauth_providers: [:google_oauth2] if Docuseal.multitenant?
 
   attribute :role, :string, default: ADMIN_ROLE

app/views/accounts/show.html.erb

@@ -29,9 +29,11 @@
           </div>
         <% end %>
       <% end %>
-      <div class="form-control pt-2">
-        <%= f.button button_title(title: 'Update', disabled_with: 'Updating'), class: 'base-button' %>
-      </div>
+      <% if can?(:update, current_account) %>
+        <div class="form-control pt-2">
+          <%= f.button button_title(title: 'Update', disabled_with: 'Updating'), class: 'base-button' %>
+        </div>
+      <% end %>
     <% end %>
   </div>
   <div class="w-0 md:w-52"></div>

app/views/dashboard/index.html.erb

@@ -1,49 +1,45 @@
 <% if Docuseal.demo? %><%= render 'shared/demo_alert' %><% end %>
-<% if @templates.any? %>
+<% if @pagy.count > 0 || params[:q].present? %>
   <div class="flex justify-between mb-4 items-center">
     <h1 class="text-4xl font-bold"><span class="hidden md:inline">Document</span> Templates</h1>
     <div class="flex space-x-2">
-      <%= render 'templates/upload_button' %>
-      <%= link_to new_template_path, class: 'btn btn-primary text-base btn-md gap-2', data: { turbo_frame: :modal } do %>
-        <%= svg_icon('plus', class: 'w-6 h-6 stroke-2') %>
-        <span class="hidden md:block">Create</span>
+      <% if params[:q].present? || @pagy.pages > 1 %>
+        <%= render 'shared/search_input' %>
+      <% end %>
+      <% if can?(:create, ::Template) %>
+        <%= render 'templates/upload_button' %>
+        <%= link_to new_template_path, class: 'btn btn-primary text-base btn-md gap-2', data: { turbo_frame: :modal } do %>
+          <%= svg_icon('plus', class: 'w-6 h-6 stroke-2') %>
+          <span class="hidden md:block">Create</span>
+        <% end %>
       <% end %>
     </div>
   </div>
-  <div class="grid gap-4 md:grid-cols-3">
-    <% @templates.each do |template| %>
-      <div class="h-36 relative group">
-        <a href="<%= template_path(template) %>" class="flex h-full flex-col justify-between rounded-2xl pt-6 px-7 w-full bg-base-200 peer">
-          <div class="pb-4 text-xl font-semibold" style="overflow: hidden; display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 2;">
-            <%= template.name %>
-          </div>
-          <div class="pb-6 pt-1 space-y-1">
-            <p class="flex items-center space-x-1 text-xs text-base-content/60">
-              <%= svg_icon('user', class: 'w-4 h-4') %>
-              <span><%= template.author.full_name.presence || template.author.email %></span>
-            </p>
-            <p class="flex items-center space-x-1 text-xs text-base-content/60">
-              <%= svg_icon('calendar', class: 'w-4 h-4') %>
-              <span><%= l(template.created_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %></span>
-            </p>
-          </div>
-        </a>
-        <div class="absolute top-0 bottom-0 w-0 pt-7 space-y-1.5 hidden md:group-hover:block" style="right: 40px">
-          <a href="<%= edit_template_path(template) %>" class="btn btn-xs hover:btn-outline bg-base-200 btn-circle">
-            <%= svg_icon('pencil', class: 'w-4 h-4') %>
-          </a>
-          <a href="<%= new_template_path(base_template_id: template.id) %>" data-turbo-frame="modal" class="btn btn-xs hover:btn-outline bg-base-200 btn-circle">
-            <%= svg_icon('copy', class: 'w-4 h-4') %>
-          </a>
-          <%= button_to template_path(template), data: { turbo_confirm: 'Are you sure?' }, method: :delete, class: 'btn btn-xs hover:btn-outline bg-base-200 btn-circle' do %>
-            <%= svg_icon('trash', class: 'w-4 h-4 enabled') %>
-            <%= svg_icon('loader', class: 'w-4 h-4 animate-spin disabled') %>
-          <% end %>
+  <% if @pagy.count > 0 %>
+    <div class="grid gap-4 md:grid-cols-3">
+      <%= render partial: 'templates/template', collection: @templates %>
+    </div>
+    <% view_archived_html = capture do %>
+      <% if current_account.templates.where.not(deleted_at: nil).exists? %>
+        <div>
+          <a href="<%= templates_archived_index_path %>" class="link text-sm">View Archived</a>
         </div>
+      <% end %>
+    <% end %>
+    <% if @pagy.pages > 1 %>
+      <%= render 'shared/pagination', pagy: @pagy, items_name: 'templates', left_additional_html: view_archived_html %>
+    <% else %>
+      <div class="mt-2">
+        <%= view_archived_html %>
       </div>
     <% end %>
-  </div>
-  <%= render 'shared/pagination', pagy: @pagy, items_name: 'templates' %>
+  <% elsif params[:q].present? %>
+    <div class="text-center">
+      <div class="mt-16 text-3xl font-semibold">
+        Templates not Found
+      </div>
+    </div>
+  <% end %>
 <% else %>
   <div class="card bg-base-200 h-96 mb-2">
     <div class="card-body text-center">

app/views/devise/passwords/edit.html.erb

@@ -1,5 +1,5 @@
-<div class="max-w-xl mx-auto px-2">
-  <h1 class="text-4xl font-bold text-center my-8">Change your password</h1>
+<div class="max-w-lg mx-auto px-2">
+  <h1 class="text-4xl font-bold text-center mt-8">Change your password</h1>
   <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put, class: 'space-y-6' }) do |f| %>
     <div class="space-y-2">
       <%= render 'devise/shared/error_messages', resource: %>

app/views/devise/passwords/new.html.erb

@@ -1,5 +1,5 @@
-<div class="max-w-xl mx-auto px-2">
-  <h1 class="text-4xl font-bold text-center my-8">Forgot your password?</h1>
+<div class="max-w-lg mx-auto px-2">
+  <h1 class="text-4xl font-bold text-center mt-8">Forgot your password?</h1>
   <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :post, class: 'space-y-6' }) do |f| %>
     <div class="space-y-2">
       <%= render 'devise/shared/error_messages', resource: %>

app/views/devise/registrations/new.html.erb

@@ -1,5 +1,5 @@
-<div class="max-w-xl mx-auto px-2">
-  <h1 class="text-3xl font-bold text-center my-8">Profile Details</h1>
+<div class="max-w-lg mx-auto px-2">
+  <h1 class="text-3xl font-bold text-center mt-8">Profile Details</h1>
   <%= form_for('', as: resource_name, html: { class: 'space-y-6' }, data: { turbo: params[:redir].blank? }, url: new_registration_path) do |f| %>
     <% if params[:redir].present? %>
       <%= hidden_field_tag :redir, params[:redir] %>
@@ -21,7 +21,7 @@
       <%= f.fields_for resource do |ff| %>
         <div class="form-control <%= 'hidden' if (params[:oauth_callback] || params[:sign_up]) && resource.email? %>">
           <%= ff.label :email, class: 'label' %>
-          <%= ff.email_field :email, required: true, class: 'base-input' %>
+          <%= ff.email_field :email, value: EmailTypo.call(resource.email), required: true, class: 'base-input' %>
         </div>
       <% end %>
       <%= f.fields_for resource.account do |ff| %>

app/views/devise/registrations/show.html.erb

@@ -1,6 +1,6 @@
-<div class="max-w-xl mx-auto px-2">
+<div class="max-w-lg mx-auto px-2">
   <%= render 'devise/shared/select_server' if Docuseal.multitenant? %>
-  <h1 class="text-3xl font-bold text-center my-8">Create Free Account</h1>
+  <h1 class="text-3xl font-bold text-center mt-8 mb-6">Create Free Account</h1>
   <%= form_for(User.new, html: { class: 'space-y-6' }, url: new_registration_path, data: { turbo: params[:redir].blank? }, method: :get) do |f| %>
     <% if params[:redir].present? %>
       <%= hidden_field_tag :redir, params[:redir] %>

app/views/devise/sessions/new.html.erb

@@ -1,6 +1,6 @@
-<div class="max-w-xl mx-auto px-2">
+<div class="max-w-lg mx-auto px-2">
   <%= render 'devise/shared/select_server' if Docuseal.multitenant? %>
-  <h1 class="text-4xl font-bold text-center my-8">Log In</h1>
+  <h1 class="text-4xl font-bold text-center mt-8">Log In</h1>
   <%= form_for(resource, as: resource_name, html: { class: 'space-y-6' }, data: { turbo: params[:redir].blank? }, url: session_path(resource_name)) do |f| %>
     <% if params[:redir].present? %>
       <%= hidden_field_tag :redir, params[:redir] %>

app/views/devise/sessions/otp.html.erb

@@ -0,0 +1,19 @@
+<div class="max-w-lg mx-auto px-2">
+  <h1 class="text-4xl font-bold text-center mt-8">Log In</h1>
+  <%= form_for(resource, as: resource_name, html: { class: 'space-y-6' }, data: { turbo: params[:redir].blank? }, url: session_path(resource_name)) do |f| %>
+    <%= f.hidden_field :email %>
+    <%= f.hidden_field :password %>
+    <% if params[:redir].present? %>
+      <%= hidden_field_tag :redir, params[:redir] %>
+    <% end %>
+    <div class="space-y-2">
+      <div class="form-control">
+        <%= f.label :otp_attempt, 'Two-Factor Code', class: 'label' %>
+        <%= f.text_field :otp_attempt, autofocus: true, placeholder: 'XXX-XXX', required: true, class: 'base-input' %>
+      </div>
+    </div>
+    <div class="form-control">
+      <%= f.button button_title(title: 'Log In', disabled_with: 'Logging In'), class: 'base-button' %>
+    </div>
+  <% end %>
+</div>

app/views/esign_settings/new.html.erb

@@ -14,7 +14,7 @@
       </div>
       <div class="form-control">
         <%= f.label :password, 'Password (optional)', class: 'label' %>
-        <%= f.text_field :password, class: 'base-input' %>
+        <%= f.password_field :password, class: 'base-input' %>
       </div>
     </div>
     <div class="form-control pt-2">

app/views/esign_settings/show.html.erb

@@ -40,9 +40,11 @@
     </div>
     <div class="flex justify-between items-end mb-4 mt-8">
       <h2 class="text-3xl font-bold">Signing Certificates</h2>
-      <%= link_to new_settings_esign_path, class: 'btn btn-primary btn-md', data: { turbo_frame: 'modal' } do %>
-        <%= svg_icon('plus', class: 'w-6 h-6') %>
-        <span>Upload Cert</span>
+      <% if can?(:create, @encrypted_config) %>
+        <%= link_to new_settings_esign_path, class: 'btn btn-primary btn-md', data: { turbo_frame: 'modal' } do %>
+          <%= svg_icon('plus', class: 'w-6 h-6') %>
+          <span>Upload Cert</span>
+        <% end %>
       <% end %>
     </div>
     <%= render 'alert' %>
@@ -77,14 +79,14 @@
                   <span class="badge badge-lg badge-info badge-outline">
                     <%= item['status'] %>
                   </span>
-                <% else %>
+                <% elsif can?(:update, @encrypted_config) %>
                   <%= button_to settings_esign_path, method: :put, params: { name: item['name'] }, class: 'btn btn-outline btn-neutral btn-xs whitespace-nowrap', title: 'Delete', data: { turbo_confirm: 'Are you sure?' } do %>
                     Make Default
                   <% end %>
                 <% end %>
               </td>
               <td>
-                <% if item['name'] != EsignSettingsController::DEFAULT_CERT_NAME && item['status'] != 'default' %>
+                <% if item['name'] != EsignSettingsController::DEFAULT_CERT_NAME && item['status'] != 'default' &&  can?(:destroy, @encrypted_config) %>
                   <%= button_to settings_esign_path, params: { name: item['name'] }, method: :delete, class: 'btn btn-outline btn-error btn-xs', title: 'Delete', data: { turbo_confirm: 'Are you sure?' } do %>
                     Remove
                   <% end %>

app/views/icons/_rotate.html.erb

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="<%= local_assigns[:class] %>" width="44" height="44" viewBox="0 0 24 24" stroke-width="1.5" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round">
+  <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+  <path d="M19.95 11a8 8 0 1 0 -.5 4m.5 5v-5h-5"></path>
+</svg>

app/views/icons/_search.html.erb

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="<%= local_assigns[:class] %>" width="44" height="44" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
+  <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+  <path d="M10 10m-7 0a7 7 0 1 0 14 0a7 7 0 1 0 -14 0"></path>
+  <path d="M21 21l-6 -6"></path>
+</svg>

app/views/mfa_setup/edit.html.erb

@@ -0,0 +1,13 @@
+<%= render 'shared/turbo_modal', title: 'Remove 2FA' do %>
+  <%= form_for '', url: mfa_setup_path, method: :delete, data: { turbo_frame: :_top } do |f| %>
+    <div class="form-control my-6 space-y-2">
+      <%= f.text_field :otp_attempt, required: true, placeholder: 'XXX-XXX', class: 'base-input text-center' %>
+      <span>
+        <%= @error_message %>
+      </span>
+    </div>
+    <div class="form-control mt-4">
+      <%= f.button button_title(title: 'Remove 2FA'), class: 'base-button' %>
+    </div>
+  <% end %>
+<% end %>

app/views/mfa_setup/new.html.erb

@@ -0,0 +1,19 @@
+<%= render 'shared/turbo_modal', title: 'Setup 2FA' do %>
+  <%= form_for '', url: mfa_setup_path, data: { turbo_frame: :_top } do |f| %>
+    <p class="text-center">
+      Use an authenticator mobile app like Google Authenticator or 1Password to scan the QR code below.
+    </p>
+    <div>
+      <%== RQRCode::QRCode.new(@provision_url).as_svg(viewbox: true, svg_attributes: { class: 'w-80 h-80 my-4 mx-auto' }) %>
+    </div>
+    <div class="form-control my-6 space-y-2">
+      <%= f.text_field :otp_attempt, required: true, placeholder: 'XXX-XXX', class: 'base-input text-center' %>
+      <span>
+        <%= @error_message %>
+      </span>
+    </div>
+    <div class="form-control mt-4">
+      <%= f.button button_title(title: 'Save'), class: 'base-button' %>
+    </div>
+  <% end %>
+<% end %>

app/views/notifications_settings/_bcc_form.html.erb

@@ -0,0 +1,19 @@
+<%= form_for config, url: settings_notifications_path, method: :post, html: { autocomplete: 'off', class: 'space-y-4' } do |f| %>
+  <%= f.hidden_field :key %>
+  <div class="form-control">
+    <%= f.label :value, class: 'label' do %>
+      <span class="flex items-center space-x-1">
+        <span>
+          Completed documents BCC address
+        </span>
+        <span class="tooltip" data-tip="Send email copy with completed documents to a specified BCC address.">
+          <%= svg_icon('info_circle', class: 'w-4 h-4') %>
+        </span>
+      </span>
+    <% end %>
+    <%= f.email_field :value, autocomplete: 'off', class: 'base-input' %>
+  </div>
+  <div class="form-control pt-2">
+    <%= f.button button_title(title: 'Save', disabled_with: 'Updating'), class: 'base-button' %>
+  </div>
+<% end %>

app/views/notifications_settings/_reminder_banner.html.erb

@@ -0,0 +1 @@
+<%= render 'reminder_placeholder' %>

app/views/notifications_settings/_reminder_form.html.erb

@@ -0,0 +1,29 @@
+<%= form_for config, url: settings_notifications_path, method: :post, html: { autocomplete: 'off', class: 'space-y-4' } do |f| %>
+  <%= f.hidden_field :key %>
+  <div class="form-control">
+    <% record = Struct.new(:first_duration, :second_duration, :third_duration).new(*(f.object.value || {}).values_at('first_duration', 'second_duration', 'third_duration')) %>
+    <div class="flex space-x-4">
+      <div class="w-full">
+        <%= f.fields_for :value, record  do |ff| %>
+          <%= ff.label :first_duration, 'First reminder in', class: 'label' %>
+          <%= ff.select :first_duration, AccountConfigs::REMINDER_DURATIONS.invert, { include_blank: 'None' }, class: 'base-select' %>
+        <% end %>
+      </div>
+      <div class="w-full">
+        <%= f.fields_for :value, record  do |ff| %>
+          <%= ff.label :second_duration, 'Second reminder in', class: 'label' %>
+          <%= ff.select :second_duration, AccountConfigs::REMINDER_DURATIONS.invert, { include_blank: 'None' }, class: 'base-select' %>
+        <% end %>
+      </div>
+      <div class="w-full">
+        <%= f.fields_for :value, record  do |ff| %>
+          <%= ff.label :third_duration, 'Third reminder in', class: 'label' %>
+          <%= ff.select :third_duration, AccountConfigs::REMINDER_DURATIONS.invert, { include_blank: 'None' }, class: 'base-select' %>
+        <% end %>
+      </div>
+    </div>
+  </div>
+  <div class="form-control pt-4">
+    <%= f.button button_title(title: 'Save', disabled_with: 'Updating'), class: 'base-button' %>
+  </div>
+<% end %>

app/views/notifications_settings/_reminder_placeholder.html.erb

@@ -0,0 +1,11 @@
+<div class="alert my-4">
+  <%= svg_icon('info_circle', class: 'w-6 h-6') %>
+  <div>
+    <p class="font-bold">Unlock with DocuSeal Pro</p>
+    <p>
+      Send automatic email reminders to your recipients.
+      <br>
+      <a class="link font-medium" target="_blank" href="<%= "#{Docuseal::CONSOLE_URL}/#{Docuseal.multitenant? ? 'plans' : 'on_premise'}" %>">Learn More</a>
+    </p>
+  </div>
+</div>

app/views/notifications_settings/index.html.erb

@@ -0,0 +1,14 @@
+<div class="flex flex-wrap space-y-4 md:flex-nowrap md:space-y-0">
+  <%= render 'shared/settings_nav' %>
+  <div class="flex-grow max-w-xl mx-auto">
+    <h1 class="text-4xl font-bold mb-4">Email Notifications</h1>
+    <%= render 'email_stats' %>
+    <%= render 'bcc_form', config: @bcc_config %>
+    <div class="flex justify-between items-end mb-4 mt-8">
+      <h2 class="text-3xl font-bold">Signature Email Reminders</h2>
+    </div>
+    <%= render 'reminder_banner' %>
+    <%= render 'reminder_form', config: @reminder_config %>
+  </div>
+  <div class="w-0 md:w-52"></div>
+</div>

app/views/profile/index.html.erb

@@ -35,6 +35,26 @@
         <%= f.button button_title(title: 'Update', disabled_with: 'Updating'), class: 'base-button' %>
       </div>
     <% end %>
+    <p class="text-2xl font-bold mt-8 mb-4">Two-Factor Authentication</p>
+    <div class="space-y-4">
+      <% if current_user.otp_required_for_login %>
+        <p class="flex items-center space-x-1">
+          <%= svg_icon('circle_check', class: 'stroke-success inline flex-none w-5 h-5') %>
+          <span>
+            2FA has been configured.
+          </span>
+        </p>
+        <a href="<%= edit_mfa_setup_path %>" data-turbo-frame="modal" class="white-button w-full !px-8">🔓 Remove 2FA</a>
+      <% else %>
+        <p class="flex items-center space-x-1">
+          <%= svg_icon('info_circle', class: 'stroke-warning inline flex-none w-5 h-5') %>
+          <span>
+            2FA is not configured.
+          </span>
+        </p>
+        <a href="<%= new_mfa_setup_path %>" data-turbo-frame="modal" class="base-button w-full !px-8">🔒 Set up 2FA</a>
+      <% end %>
+    </div>
   </div>
   <div class="w-0 md:w-52"></div>
 </div>

app/views/shared/_pagination.html.erb

@@ -3,6 +3,7 @@
   <div class="flex my-6 justify-center md:justify-between">
     <div class="hidden md:block text-sm">
       <%= @pagy.from %>-<%= @pagy.to %> of <%= @pagy.count %> <%= local_assigns[:items_name] || 'items' %>
+      <%= local_assigns[:left_additional_html] %>
     </div>
     <div class="join">
       <% if @pagy.prev %>

app/views/shared/_search_input.html.erb

@@ -0,0 +1,11 @@
+<form action="<%= request.path %>" method="get" class="items-center hidden md:flex">
+  <input id="search" name="q" value="<%= params[:q] %>" class="input input-ghost text-lg pr-10 -mr-12">
+  <button type="submit" title="Search" class="btn btn-ghost btn-circle" onclick="window.search.value || document.activeElement === window.search ? null : [event.preventDefault(), window.search.focus()]">
+    <span class="enabled">
+      <%= svg_icon('search', class: 'w-6 h-6 stroke-2') %>
+    </span>
+    <span class="disabled">
+      <%= svg_icon('loader', class: 'w-5 h-5 animate-spin') %>
+    </span>
+  </button>
+</form>

app/views/shared/_settings_nav.html.erb

@@ -10,33 +10,54 @@
         <%= link_to 'Account', settings_account_path, class: 'text-base hover:bg-base-300' %>
       </li>
       <% unless Docuseal.multitenant? %>
+        <% if can?(:read, EncryptedConfig.new(key: EncryptedConfig::EMAIL_SMTP_KEY, account: current_account)) %>
+          <li>
+            <%= link_to 'Email', settings_email_index_path, class: 'text-base hover:bg-base-300' %>
+          </li>
+        <% end %>
+        <% if can?(:read, EncryptedConfig.new(key: EncryptedConfig::FILES_STORAGE_KEY, account: current_account)) %>
+          <li>
+            <%= link_to 'Storage', settings_storage_index_path, class: 'text-base hover:bg-base-300' %>
+          </li>
+        <% end %>
+        <% if can?(:read, EncryptedConfig.new(key: 'submitter_invitation_sms', account: current_account)) %>
+          <li>
+            <%= link_to 'SMS', settings_sms_path, class: 'text-base hover:bg-base-300' %>
+          </li>
+        <% end %>
+      <% end %>
+      <% if can?(:read, AccountConfig) %>
         <li>
-          <%= link_to 'Email', settings_email_index_path, class: 'text-base hover:bg-base-300' %>
+          <%= link_to 'Notifications', settings_notifications_path, class: 'text-base hover:bg-base-300' %>
         </li>
+      <% end %>
+      <% if can?(:read, EncryptedConfig.new(key: EncryptedConfig::ESIGN_CERTS_KEY, account: current_account)) %>
         <li>
-          <%= link_to 'Storage', settings_storage_index_path, class: 'text-base hover:bg-base-300' %>
+          <%= link_to 'E-Signature', settings_esign_path, class: 'text-base hover:bg-base-300' %>
         </li>
+      <% end %>
+      <% if can?(:read, User) %>
         <li>
-          <%= link_to 'SMS', settings_sms_path, class: 'text-base hover:bg-base-300' %>
+          <%= link_to 'Team', settings_users_path, class: 'text-base hover:bg-base-300' %>
         </li>
       <% end %>
-      <li>
-        <%= link_to 'E-Signature', settings_esign_path, class: 'text-base hover:bg-base-300' %>
-      </li>
-      <li>
-        <%= link_to 'Team', settings_users_path, class: 'text-base hover:bg-base-300' %>
-      </li>
       <% if Docuseal.demo? || !Docuseal.multitenant? %>
+        <% if can?(:read, AccessToken) %>
+          <li>
+            <%= link_to 'API', settings_api_index_path, class: 'text-base hover:bg-base-300' %>
+          </li>
+        <% end %>
+        <% if can?(:read, EncryptedConfig.new(key: EncryptedConfig::WEBHOOK_URL_KEY, account: current_account)) %>
+          <li>
+            <%= link_to 'Webhooks', settings_webhooks_path, class: 'text-base hover:bg-base-300' %>
+          </li>
+        <% end %>
+      <% end %>
+      <% if can?(:read, AccountConfig) %>
         <li>
-          <%= link_to 'API', settings_api_index_path, class: 'text-base hover:bg-base-300' %>
-        </li>
-        <li>
-          <%= link_to 'Webhooks', settings_webhooks_path, class: 'text-base hover:bg-base-300' %>
+          <%= link_to 'Personalization', settings_personalization_path, class: 'text-base hover:bg-base-300' %>
         </li>
       <% end %>
-      <li>
-        <%= link_to 'Personalization', settings_personalization_path, class: 'text-base hover:bg-base-300' %>
-      </li>
       <% unless Docuseal.demo? %>
         <li>
           <%= link_to Docuseal.multitenant? ? console_redirect_index_path : Docuseal::CONSOLE_URL, class: 'text-base hover:bg-base-300', data: { prefetch: false } do %>

app/views/submissions/_detailed_form.html.erb

@@ -19,7 +19,7 @@
                 <input type="hidden" name="submission[1][submitters][][uuid]" value="<%= item['uuid'] %>">
                 <input type="text" name="submission[1][submitters][][name]" autocomplete="off" class="input input-sm input-bordered" placeholder="Name" required>
                 <div class="grid <%= 'md:grid-cols-2 gap-1' if template.submitters.size == 1 %>">
-                  <input type="email" name="submission[1][submitters][][email]" autocomplete="off" class="input input-sm input-bordered mt-1.5" placeholder="Email (optional)">
+                  <input type="email" multiple name="submission[1][submitters][][email]" autocomplete="off" class="input input-sm input-bordered mt-1.5" placeholder="Email (optional)">
                   <input type="tel" pattern="^\+[0-9\s\-]+$" oninvalid="this.value ? this.setCustomValidity('Use internatioanl format: +1xxx...') : ''" oninput="this.setCustomValidity('')" name="submission[1][submitters][][phone]" autocomplete="off" class="input input-sm input-bordered mt-1.5" placeholder="Phone (optional)">
                 </div>
               </div>

app/views/submissions/_email_form.html.erb

@@ -22,7 +22,7 @@
                     <span class="label-text"> <%= item['name'] %></span>
                   </label>
                   <input type="hidden" name="submission[1][submitters][][uuid]" value="<%= item['uuid'] %>">
-                  <input type="email" name="submission[1][submitters][][email]" autocomplete="off" class="input input-sm input-bordered" placeholder="Email" required>
+                  <input type="email" multiple name="submission[1][submitters][][email]" autocomplete="off" class="input input-sm input-bordered" placeholder="Email" required>
                 </div>
               <% end %>
             </div>

app/views/submissions/_send_email.html.erb

@@ -1,9 +1,18 @@
 <div class="form-control">
   <% is_smtp_configured = Accounts.can_send_emails?(current_account) %>
-  <%= f.label :send_email, for: uuid = SecureRandom.uuid, class: 'flex items-center cursor-pointer' do %>
-    <%= f.check_box :send_email, id: uuid, class: 'base-checkbox', disabled: !is_smtp_configured, checked: is_smtp_configured %>
-    <span class="label">Send emails</span>
-  <% end %>
+  <div class="flex justify-between items-center">
+    <%= f.label :send_email, for: uuid = SecureRandom.uuid, class: 'flex items-center cursor-pointer' do %>
+      <%= f.check_box :send_email, id: uuid, class: 'base-checkbox', disabled: !is_smtp_configured, checked: is_smtp_configured %>
+      <span class="label">Send emails</span>
+    <% end %>
+    <div>
+      <label>
+        <%= f.check_box :is_custom_message, onchange: "[this.form.querySelector('#message_field').classList.toggle('hidden', !event.currentTarget.checked)]", checked: false, class: 'hidden peer' %>
+        <span class="link peer-checked:hidden">Edit message</span>
+      </label>
+      <%= render 'email_stats' %>
+    </div>
+  </div>
   <% unless is_smtp_configured %>
     <div class="alert my-4">
       <%= svg_icon('info_circle', class: 'w-6 h-6') %>
@@ -18,3 +27,20 @@
     </div>
   <% end %>
 </div>
+<% config = AccountConfigs.find_or_initialize_for_key(current_account, AccountConfig::SUBMITTER_INVITATION_EMAIL_KEY) %>
+<div id="message_field" class="card card-compact bg-base-200 hidden">
+  <div class="card-body">
+    <div class="form-control space-y-2">
+      <div class="form-control">
+        <%= f.label :subject, class: 'label' %>
+        <%= f.text_field :subject, value: config.value['subject'], required: true, class: '!text-sm base-input w-full' %>
+      </div>
+      <div class="form-control">
+        <%= f.label :message, 'Body', class: 'label' %>
+        <autoresize-textarea>
+          <%= f.text_area :body, value: config.value['body'], required: true, class: 'base-textarea w-full', rows: 10 %>
+        </autoresize-textarea>
+      </div>
+    </div>
+  </div>
+</div>

app/views/submissions/show.html.erb

@@ -108,15 +108,15 @@
                 <%= submitter&.completed_at? ? l(submitter.completed_at.in_time_zone(current_account.timezone), format: :long, locale: current_account.locale) : 'Not completed yet' %>
               </span>
             </div>
-            <% if submitter && submitter.email && !submitter.completed_at %>
+            <% if submitter && submitter.email && !submitter.completed_at && can?(:update, submitter) %>
               <div class="mt-2 mb-1">
                 <%= button_to button_title(title: submitter.sent_at? ? 'Re-send Email' : 'Send Email', disabled_with: 'Sending'), submitter_send_email_index_path(submitter_slug: submitter.slug), class: 'btn btn-sm btn-primary w-full' %>
               </div>
             <% end %>
-            <% if submitter && submitter.phone && !submitter.completed_at %>
+            <% if submitter && submitter.phone && !submitter.completed_at && can?(:update, submitter) %>
               <%= render 'send_sms_button', submitter: %>
             <% end %>
-            <% if submitter && !submitter.completed_at? %>
+            <% if submitter && !submitter.completed_at? && can?(:create, submitter) %>
               <div class="mt-2 mb-1">
                 <a class="btn btn-sm btn-primary w-full" target="_blank" href="<%= submit_form_path(slug: submitter.slug) %>">
                   Submit Form

app/views/submitter_mailer/invitation_email.html.erb

@@ -1,8 +1,8 @@
-<% if @email_config %>
-  <%= auto_link(simple_format(h(ReplaceEmailVariables.call(@email_config.value['body'], submitter: @submitter)))) %>
+<% if @email_config || @body.present? %>
+  <%= auto_link(simple_format(h(ReplaceEmailVariables.call(@body.presence || @email_config.value['body'], submitter: @submitter)))) %>
 <% else %>
   <p>Hi there,</p>
-  <%= simple_format(@message) %>
+  <p>You have been invited to submit the "<%= @submitter.submission.template.name %>" form</p>
   <p><%= link_to 'Submit Form', submit_form_url(slug: @submitter.slug, t: SubmissionEvents.build_tracking_param(@submitter, 'click_email')) %></p>
   <p>Please contact us by replying to this email if you didn't request this.</p>
   <p>

app/views/templates/_submission.html.erb

@@ -38,7 +38,9 @@
         <%= render 'shared/clipboard_copy', text: submit_form_url(slug: submitter.slug), class: 'btn btn-sm btn-neutral text-white md:w-36 flex', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy Link', copy_title_md: 'Copy', copied_title_md: 'Copied' %>
       <% end %>
       <span class="btn btn-outline btn-sm w-20 md:w-24">View</span>
-      <%= button_to button_title(title: nil, disabled_with: 'Remov', icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm', title: 'Delete', method: :delete, data: { turbo_confirm: 'Are you sure?' }, onclick: 'event.stopPropagation()' %>
+      <% if !submission.deleted_at? && can?(:destroy, submission) %>
+        <%= button_to button_title(title: nil, disabled_with: 'Remov', icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm', title: 'Delete', method: :delete, data: { turbo_confirm: 'Are you sure?' }, onclick: 'event.stopPropagation()' %>
+      <% end %>
     </div>
   <% else %>
     <div class="space-y-1 w-full md:mr-2">
@@ -110,7 +112,9 @@
         </form>
       <% end %>
       <span class="btn btn-outline btn-sm w-20 md:w-24">View</span>
-      <%= button_to button_title(title: nil, disabled_with: 'Remov', icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm', title: 'Delete', method: :delete, data: { turbo_confirm: 'Are you sure?' }, onclick: 'event.stopPropagation()' %>
+      <% unless submission.deleted_at? %>
+        <%= button_to button_title(title: nil, disabled_with: 'Remov', icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm', title: 'Delete', method: :delete, data: { turbo_confirm: 'Are you sure?' }, onclick: 'event.stopPropagation()' %>
+      <% end %>
     </div>
   <% end %>
 </a>

app/views/templates/_template.html.erb

@@ -0,0 +1,40 @@
+<div class="h-36 relative group">
+  <a href="<%= template_path(template) %>" class="flex h-full flex-col justify-between rounded-2xl pt-6 px-7 w-full bg-base-200 peer">
+    <div class="pb-4 text-xl font-semibold" style="overflow: hidden; display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 2;">
+      <%= template.name %>
+    </div>
+    <div class="pb-6 pt-1 space-y-1">
+      <p class="flex items-center space-x-1 text-xs text-base-content/60">
+        <%= svg_icon('user', class: 'w-4 h-4') %>
+        <span><%= template.author.full_name.presence || template.author.email %></span>
+      </p>
+      <p class="flex items-center space-x-1 text-xs text-base-content/60">
+        <%= svg_icon('calendar', class: 'w-4 h-4') %>
+        <span><%= l(template.created_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %></span>
+      </p>
+    </div>
+  </a>
+  <div class="absolute top-0 bottom-0 w-0 pt-7 space-y-1.5 hidden md:group-hover:block" style="right: 40px">
+    <% if template.deleted_at? && can?(:update, template) %>
+      <%= button_to template_restore_index_path(template), class: 'btn btn-xs hover:btn-outline bg-base-200 btn-circle' do %>
+        <%= svg_icon('rotate', class: 'w-4 h-4 enabled') %>
+        <%= svg_icon('loader', class: 'w-4 h-4 animate-spin disabled') %>
+      <% end %>
+    <% elsif can?(:update, template) %>
+      <a href="<%= edit_template_path(template) %>" class="btn btn-xs hover:btn-outline bg-base-200 btn-circle">
+        <%= svg_icon('pencil', class: 'w-4 h-4') %>
+      </a>
+    <% end %>
+    <% if can?(:create, template) %>
+      <a href="<%= new_template_path(base_template_id: template.id) %>" data-turbo-frame="modal" class="btn btn-xs hover:btn-outline bg-base-200 btn-circle">
+        <%= svg_icon('copy', class: 'w-4 h-4') %>
+      </a>
+    <% end %>
+    <% if !template.deleted_at? && can?(:destroy, template) %>
+      <%= button_to template_path(template), data: { turbo_confirm: 'Are you sure?' }, method: :delete, class: 'btn btn-xs hover:btn-outline bg-base-200 btn-circle', aria_label: 'Restore' do %>
+        <%= svg_icon('trash', class: 'w-4 h-4 enabled') %>
+        <%= svg_icon('loader', class: 'w-4 h-4 animate-spin disabled') %>
+      <% end %>
+    <% end %>
+  </div>
+</div>

app/views/templates/_title.html.erb

@@ -0,0 +1,30 @@
+<div class="flex flex-col items-start md:flex-row space-y-2 md:space-y-0 md:justify-between md:items-center mb-8">
+  <h1 class="text-4xl font-semibold mr-4" style="overflow: hidden; display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 2;">
+    <%= template.name %>
+    <% if template.deleted_at? %>
+      <span class="badge badge-outline badge-lg align-middle">Archived</span>
+    <% end %>
+  </h1>
+  <div class="flex md:justify-between space-x-2 flex-none">
+    <% if !template.deleted_at? && can?(:destroy, template) %>
+      <%= button_to button_title(title: 'Remove', disabled_with: 'Removing', icon: svg_icon('trash', class: 'w-6 h-6')), template_path(template), class: 'btn btn-outline btn-sm', method: :delete, data: { turbo_confirm: 'Are you sure?' } %>
+    <% end %>
+    <% if can?(:create, template) %>
+      <%= link_to new_template_path(base_template_id: template.id), class: 'btn btn-outline btn-sm', data: { turbo_frame: :modal } do %>
+        <%= svg_icon('copy', class: 'w-6 h-6') %>
+        <span>Clone</span>
+      <% end %>
+    <% end %>
+    <% if !template.deleted_at? && can?(:update, template) %>
+      <%= link_to edit_template_path(template), class: 'btn btn-outline btn-sm' do %>
+        <span class="flex items-center justify-center space-x-2">
+          <%= svg_icon('pencil', class: 'w-6 h-6') %>
+          <span>Edit</span>
+        </span>
+      <% end %>
+    <% end %>
+    <% if template.deleted_at? && can?(:create, template) %>
+      <%= button_to button_title(title: 'Restore', disabled_with: 'Restoring', icon: svg_icon('rotate', class: 'w-6 h-6')), template_restore_index_path(template), class: 'btn btn-outline btn-sm' %>
+    <% end %>
+  </div>
+</div>

app/views/templates/show.html.erb

@@ -1,35 +1,21 @@
-<div class="flex flex-col items-start md:flex-row space-y-2 md:space-y-0 md:justify-between md:items-center mb-8">
-  <h1 class="text-4xl font-semibold mr-4" style="overflow: hidden; display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 2;">
-    <%= @template.name %>
-  </h1>
-  <div class="flex md:justify-between space-x-2 flex-none">
-    <%= button_to button_title(title: 'Remove', disabled_with: 'Removing', icon: svg_icon('trash', class: 'w-6 h-6')), template_path(@template), class: 'btn btn-outline btn-sm', method: :delete, data: { turbo_confirm: 'Are you sure?' } %>
-    <%= link_to new_template_path(base_template_id: @template.id), class: 'btn btn-outline btn-sm', data: { turbo_frame: :modal } do %>
-      <%= svg_icon('copy', class: 'w-6 h-6') %>
-      <span>Clone</span>
-    <% end %>
-    <%= link_to edit_template_path(@template), class: 'btn btn-outline btn-sm' do %>
-      <span class="flex items-center justify-center space-x-2">
-        <%= svg_icon('pencil', class: 'w-6 h-6') %>
-        <span>Edit</span>
-      </span>
-    <% end %>
-  </div>
-</div>
+<%= render 'title', template: @template %>
 <% if !@pagy.count.zero? || @template.submitters.to_a.size == 1 %>
   <div class="flex justify-between mb-6 md:items-end flex-col md:flex-row">
     <p class="text-3xl font-bold">Submissions</p>
     <div class="flex space-x-2 mt-3 md:mt-0">
+      <% if params[:q].present? || @pagy.pages > 1 %>
+        <%= render 'shared/search_input' %>
+      <% end %>
       <%= link_to new_template_submissions_export_path(@template), class: 'order-3 md:order-1 btn btn-ghost text-base', data: { turbo_frame: 'modal' } do %>
         <%= svg_icon('download', class: 'w-6 h-6 stroke-2') %>
         <span>Export</span>
       <% end %>
-      <% if @template.submitters.to_a.size == 1 %>
+      <% if @template.submitters.to_a.size == 1 && !@template.deleted_at? %>
         <span class="order-1">
           <%= render 'shared/clipboard_copy', text: start_form_url(slug: @template.slug), class: 'base-button', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy Share Link', copied_title: 'Copied to Clipboard', copy_title_md: 'Copy', copied_title_md: 'Copied' %>
         </span>
       <% end %>
-      <% unless @pagy.count.zero? %>
+      <% if !@template.deleted_at? && can?(:create, Submission) %>
         <%= link_to new_template_submission_path(@template), class: 'order-1 btn btn-primary text-base', data: { turbo_frame: 'modal' } do %>
           <%= svg_icon('plus', class: 'w-6 h-6 stroke-2') %>
           <span>Add <span class="hidden md:inline">Recipients</span></span>
@@ -42,21 +28,38 @@
   <div class="space-y-4">
     <%= render partial: 'submission', collection: @submissions %>
   </div>
-  <%= render 'shared/pagination', pagy: @pagy, items_name: 'submissions' %>
+  <% view_archived_html = capture do %>
+    <% if @template.submissions.where.not(deleted_at: nil).exists? && !@template.deleted_at? %>
+      <div>
+        <a href="<%= template_archived_index_path(@template) %>" class="link text-sm">View Archived</a>
+      </div>
+    <% end %>
+  <% end %>
+  <% if @pagy.pages > 1 %>
+    <%= render 'shared/pagination', pagy: @pagy, items_name: 'submissions', left_additional_html: view_archived_html %>
+  <% else %>
+    <div class="mt-2">
+      <%= view_archived_html %>
+    </div>
+  <% end %>
 <% else %>
   <div class="card bg-base-200">
     <div class="card-body text-center py-16">
       <div class="max-w-lg mx-auto">
         <p class="text-3xl font-bold text-base-content mb-4">There are no Submissions</p>
-        <p class="text-gray-600">Send an invitation to fill and complete the form</p>
-        <div class="space-x-2">
-          <%= link_to new_template_submission_path(@template), class: 'base-button mt-6', data: { turbo_frame: 'modal' } do %>
-            <%= svg_icon('plus', class: 'w-6 h-6 stroke-2') %>
-            <span class="mr-1">Add Recipients</span>
-          <% end %>
-          <%= link_to start_form_url(slug: @template.slug), class: 'white-button mt-6', target: '_blank', rel: 'noopener' do %>
-            <%= svg_icon('writing', class: 'w-6 h-6') %>
-            <span class="mr-1">Submit it Yourself</span>
+        <% if @template.deleted_at.blank? && params[:q].blank? %>
+          <p>Send an invitation to fill and complete the form</p>
+          <div class="space-y-2 flex flex-col">
+            <% if can?(:create, Submission) %>
+              <%= link_to new_template_submission_path(@template), class: 'base-button mt-6', data: { turbo_frame: 'modal' } do %>
+                <%= svg_icon('plus', class: 'w-6 h-6 stroke-2') %>
+                <span class="mr-1">Add Recipients</span>
+              <% end %>
+            <% end %>
+            <%= link_to start_form_url(slug: @template.slug), class: 'white-button mt-6', target: '_blank', rel: 'noopener' do %>
+              <%= svg_icon('writing', class: 'w-6 h-6') %>
+              <span class="mr-1">Sign it Yourself</span>
+            <% end %>
           <% end %>
         </div>
       </div>

app/views/templates_archived/index.html.erb

@@ -0,0 +1,24 @@
+<div>
+  <%= link_to root_path(@template) do %>
+    &larr;
+    <span>Back to Active</span>
+  <% end %>
+</div>
+<div class="flex justify-between mb-4 items-center">
+  <h1 class="text-4xl font-bold"><span class="hidden md:inline">Document</span> Templates <span class="badge badge-outline badge-lg align-middle">Archived</span></h1>
+  <% if params[:q].present? || @pagy.pages > 1 %>
+    <%= render 'shared/search_input' %>
+  <% end %>
+</div>
+<% if @pagy.count > 0 %>
+  <div class="grid gap-4 md:grid-cols-3">
+    <%= render partial: 'templates/template', collection: @templates %>
+  </div>
+<% elsif params[:q].present? %>
+  <div class="text-center">
+    <div class="mt-16 text-3xl font-semibold">
+      Templates not Found
+    </div>
+  </div>
+<% end %>
+<%= render 'shared/pagination', pagy: @pagy, items_name: 'templates' %>

app/views/templates_archived_submissions/index.html.erb

@@ -0,0 +1,31 @@
+<%= render 'templates/title', template: @template %>
+<div>
+  <%= link_to template_path(@template) do %>
+    &larr;
+    <span>Back to Active</span>
+  <% end %>
+</div>
+<div class="flex justify-between mb-6 md:items-end flex-col md:flex-row">
+  <p class="text-3xl font-bold">Submissions <span class="badge badge-outline badge-lg align-middle">Archived</span></p>
+  <div class="flex space-x-2 mt-3 md:mt-0">
+    <% if params[:q].present? || @pagy.pages > 1 %>
+      <%= render 'shared/search_input' %>
+    <% end %>
+    <%= link_to new_template_submissions_export_path(@template), class: 'order-3 md:order-1 btn btn-ghost text-base', data: { turbo_frame: 'modal' } do %>
+      <%= svg_icon('download', class: 'w-6 h-6 stroke-2') %>
+      <span>Export</span>
+    <% end %>
+  </div>
+</div>
+<% if @pagy.count > 0 %>
+  <div class="space-y-4">
+    <%= render partial: 'templates/submission', collection: @submissions %>
+  </div>
+<% elsif params[:q].present? %>
+  <div class="text-center">
+    <div class="mt-16 text-3xl font-semibold">
+      Submissions not Found
+    </div>
+  </div>
+<% end %>
+<%= render 'shared/pagination', pagy: @pagy, items_name: 'submissions' %>

app/views/users/_form.html.erb

@@ -16,6 +16,9 @@
       <%= f.label :password, class: 'label' %>
       <%= f.password_field :password, required: user.new_record?, class: 'base-input' %>
     </div>
+    <% if f.object != current_user %>
+      <%= render 'role_select', f: %>
+    <% end %>
   </div>
   <div class="form-control pt-2">
     <%= f.button button_title, class: 'base-button' %>

app/views/users/_role_select.html.erb

@@ -0,0 +1,13 @@
+<div class="form-control">
+  <%= f.label :role, class: 'label' %>
+  <%= f.select :role, nil, {}, class: 'base-select' do %>
+    <option value="admin">Admin</option>
+    <option value="editor" disabled>Editor</option>
+    <option value="viewer" disabled>Viewer</option>
+  <% end %>
+  <a class="text-sm mt-3 px-4 py-2 bg-base-300 rounded-full block" target="_blank" href="<%= "#{Docuseal::CONSOLE_URL}/#{Docuseal.multitenant? ? 'plans' : 'on_premise'}" %>">
+    <%= svg_icon('info_circle', class: 'w-4 h-4 inline align-text-bottom') %>
+    Unlock more user roles with DocuSeal Enterprise.
+    <span class="link font-medium">Learn More</a>
+  </a>
+</div>

app/views/users/index.html.erb

@@ -3,9 +3,11 @@
   <div class="flex-grow">
     <div class="flex justify-between mb-4">
       <h1 class="text-4xl font-bold">Team</h1>
-      <%= link_to new_user_path, class: 'btn btn-primary btn-md gap-2', data: { turbo_frame: 'modal' } do %>
-        <%= svg_icon('plus', class: 'w-6 h-6') %>
-        <span>New User</span>
+      <% if can?(:create, User.new(account: current_account)) %>
+        <%= link_to new_user_path, class: 'btn btn-primary btn-md gap-2', data: { turbo_frame: 'modal' } do %>
+          <%= svg_icon('plus', class: 'w-6 h-6') %>
+          <span>New User</span>
+        <% end %>
       <% end %>
     </div>
     <div class="overflow-x-auto">
@@ -46,11 +48,15 @@
                 <%= user.last_sign_in_at ? l(user.last_sign_in_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) : '-' %>
               </td>
               <td class="flex items-center space-x-2 justify-end">
-                <%= link_to edit_user_path(user), class: 'btn btn-outline btn-xs', title: 'Edit', data: { turbo_frame: 'modal' } do %>
-                  Edit
+                <% if can?(:update, user) %>
+                  <%= link_to edit_user_path(user), class: 'btn btn-outline btn-xs', title: 'Edit', data: { turbo_frame: 'modal' } do %>
+                    Edit
+                  <% end %>
                 <% end %>
-                <%= button_to user_path(user), method: :delete, class: 'btn btn-outline btn-error btn-xs', title: 'Delete', data: { turbo_confirm: 'Are you sure?' } do %>
-                  Remove
+                <% if can?(:destroy, user) && user != current_user %>
+                  <%= button_to user_path(user), method: :delete, class: 'btn btn-outline btn-error btn-xs', title: 'Delete', data: { turbo_confirm: 'Are you sure?' } do %>
+                    Remove
+                  <% end %>
                 <% end %>
               </td>
             </tr>

app/views/webhook_settings/show.html.erb

@@ -30,7 +30,7 @@
           <div class="collapse-content" style="display: inherit">
             <div class="mockup-code overflow-hidden relative">
               <span class="top-0 right-0 absolute">
-                <%= render 'shared/clipboard_copy', icon: 'copy', text: code = JSON.pretty_generate({ event_type: 'form.submitted', timestamp: Time.current.iso8601, data: Submitters::SerializeForWebhook.call(submitter) }).gsub(/^/, '  ').sub(/^\s+/, ''), class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy', copied_title: 'Copied' %>
+                <%= render 'shared/clipboard_copy', icon: 'copy', text: code = JSON.pretty_generate({ event_type: 'form.completed', timestamp: Time.current.iso8601, data: Submitters::SerializeForWebhook.call(submitter) }).gsub(/^/, '  ').sub(/^\s+/, ''), class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy', copied_title: 'Copied' %>
               </span>
               <pre><code class="overflow-hidden w-full"><%= code %></code></pre>
             </div>

config/initializers/devise.rb

@@ -4,6 +4,8 @@ require_relative '../../lib/auth_with_token_strategy'
 
 Warden::Strategies.add(:auth_token, AuthWithTokenStrategy)
 
+Devise.otp_allowed_drift = 60.seconds
+
 # Assuming you have not yet modified this file, each configuration option below
 # is set to its default value. Note that some are commented out while others
 # are not: uncommented lines are intended to protect your configuration from
@@ -13,6 +15,10 @@ Warden::Strategies.add(:auth_token, AuthWithTokenStrategy)
 # Use this hook to configure devise mailer, warden hooks and so forth.
 # Many of these configuration options can be set straight in your model.
 Devise.setup do |config|
+  config.warden do |manager|
+    manager.default_strategies(scope: :user).unshift(:two_factor_authenticatable)
+  end
+
   # The secret key used by Devise. Devise uses this key to generate
   # random tokens. Changing this key will render invalid all existing
   # confirmation, reset password and unlock tokens in the database.

config/initializers/filter_parameter_logging.rb

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-Rails.application.config.filter_parameters += %i[password token]
+Rails.application.config.filter_parameters += %i[password token otp_attempt]

config/routes.rb

@@ -41,6 +41,7 @@ Rails.application.routes.draw do
   end
 
   resources :verify_pdf_signature, only: %i[create]
+  resource :mfa_setup, only: %i[new edit create destroy], controller: 'mfa_setup'
   resources :dashboard, only: %i[index]
   resources :setup, only: %i[index create]
   resource :newsletter, only: %i[show update]
@@ -48,7 +49,10 @@ Rails.application.routes.draw do
   resources :submissions, only: %i[show destroy]
   resources :console_redirect, only: %i[index]
   resource :templates_upload, only: %i[create]
+  resources :templates_archived, only: %i[index], path: 'archived'
   resources :templates, only: %i[new create edit show destroy] do
+    resources :restore, only: %i[create], controller: 'templates_restore'
+    resources :archived, only: %i[index], controller: 'templates_archived_submissions'
     resources :submissions, only: %i[new create]
     resources :submissions_export, only: %i[index new]
   end
@@ -74,9 +78,10 @@ Rails.application.routes.draw do
   scope '/settings', as: :settings do
     unless Docuseal.multitenant?
       resources :storage, only: %i[index create], controller: 'storage_settings'
-      resources :email, only: %i[index create], controller: 'email_settings'
+      resources :email, only: %i[index create], controller: 'email_smtp_settings'
       resources :sms, only: %i[index], controller: 'sms_settings'
     end
+    resources :notifications, only: %i[index create], controller: 'notifications_settings'
     resource :esign, only: %i[show create new update destroy], controller: 'esign_settings'
     resources :users, only: %i[index]
     resource :personalization, only: %i[show create], controller: 'personalization_settings'

config/sidekiq.yml

@@ -1,6 +1,7 @@
 queues:
   - [default, 1]
   - [mailers, 1]
+  - [recurrent, 1]
 
 production:
   :concurrency: 15

db/migrate/20230915200635_add_devise_two_factor_to_users.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddDeviseTwoFactorToUsers < ActiveRecord::Migration[7.0]
+  def change
+    add_column :users, :otp_secret, :string
+    add_column :users, :consumed_timestep, :integer
+    add_column :users, :otp_required_for_login, :boolean, default: false, null: false
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.0].define(version: 2023_09_10_084410) do
+ActiveRecord::Schema[7.0].define(version: 2023_09_15_200635) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -177,6 +177,9 @@ ActiveRecord::Schema[7.0].define(version: 2023_09_10_084410) do
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
     t.text "uuid", null: false
+    t.string "otp_secret"
+    t.integer "consumed_timestep"
+    t.boolean "otp_required_for_login", default: false, null: false
     t.index ["account_id"], name: "index_users_on_account_id"
     t.index ["email"], name: "index_users_on_email", unique: true
     t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true

docker-compose.yml

@@ -15,7 +15,7 @@ services:
       DATABASE_URL: postgresql://postgres:postgres@postgres:5432/docuseal
 
   postgres:
-    image: postgres:latest
+    image: postgres:15
     volumes:
       - './pg_data:/var/lib/postgresql/data'
     environment:

lib/ability.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class Ability
+  include CanCan::Ability
+
+  def initialize(user)
+    can :manage, Template, account_id: user.account_id
+    can :manage, Submission, template: { account_id: user.account_id }
+    can :manage, Submitter, template: { account_id: user.account_id }
+    can :manage, User, account_id: user.account_id
+    can :manage, EncryptedConfig, account_id: user.account_id
+    can :manage, AccountConfig, account_id: user.account_id
+    can :manage, Account, id: user.account_id
+    can :manage, AccessToken, user_id: user.id
+  end
+end