Merge from docusealco/wip

This reverts commit 910490528d.

.rubocop.yml

@@ -66,7 +66,7 @@ RSpec/ExampleLength:
   Max: 40
 
 RSpec/MultipleMemoizedHelpers:
-  Max: 6
+  Max: 9
 
 Metrics/BlockNesting:
   Max: 4

Dockerfile

@@ -41,7 +41,7 @@ ENV OPENSSL_CONF=/app/openssl_legacy.cnf
 
 WORKDIR /app
 
-RUN apk add --no-cache sqlite-dev libpq-dev mariadb-dev vips-dev vips-poppler poppler-utils redis vips-heif gcompat ttf-freefont && mkdir /fonts && rm /usr/share/fonts/freefont/FreeSans.otf
+RUN echo '@edge https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories && apk add --no-cache sqlite-dev libpq-dev mariadb-dev vips-dev vips-poppler poppler-utils redis libheif@edge vips-heif gcompat ttf-freefont && mkdir /fonts && rm /usr/share/fonts/freefont/FreeSans.otf
 
 RUN echo $'.include = /etc/ssl/openssl.cnf\n\
 \n\
@@ -57,7 +57,7 @@ activate = 1' >> /app/openssl_legacy.cnf
 
 COPY ./Gemfile ./Gemfile.lock ./
 
-RUN apk add --no-cache build-base && bundle install && apk del build-base && rm -rf ~/.bundle /usr/local/bundle/cache && ruby -e "puts Dir['/usr/local/bundle/**/{spec,rdoc,resources/shared,resources/collation,resources/locales}']" | xargs rm -rf
+RUN apk add --no-cache build-base && bundle install && apk del --no-cache build-base && rm -rf ~/.bundle /usr/local/bundle/cache && ruby -e "puts Dir['/usr/local/bundle/**/{spec,rdoc,resources/shared,resources/collation,resources/locales}']" | xargs rm -rf
 
 COPY ./bin ./bin
 COPY ./app ./app

Gemfile.lock

@@ -1,29 +1,29 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.2.1)
-      actionpack (= 7.2.1)
-      activesupport (= 7.2.1)
+    actioncable (7.2.1.1)
+      actionpack (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.2.1)
-      actionpack (= 7.2.1)
-      activejob (= 7.2.1)
-      activerecord (= 7.2.1)
-      activestorage (= 7.2.1)
-      activesupport (= 7.2.1)
+    actionmailbox (7.2.1.1)
+      actionpack (= 7.2.1.1)
+      activejob (= 7.2.1.1)
+      activerecord (= 7.2.1.1)
+      activestorage (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       mail (>= 2.8.0)
-    actionmailer (7.2.1)
-      actionpack (= 7.2.1)
-      actionview (= 7.2.1)
-      activejob (= 7.2.1)
-      activesupport (= 7.2.1)
+    actionmailer (7.2.1.1)
+      actionpack (= 7.2.1.1)
+      actionview (= 7.2.1.1)
+      activejob (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.2.1)
-      actionview (= 7.2.1)
-      activesupport (= 7.2.1)
+    actionpack (7.2.1.1)
+      actionview (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       nokogiri (>= 1.8.5)
       racc
       rack (>= 2.2.4, < 3.2)
@@ -32,35 +32,35 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (7.2.1)
-      actionpack (= 7.2.1)
-      activerecord (= 7.2.1)
-      activestorage (= 7.2.1)
-      activesupport (= 7.2.1)
+    actiontext (7.2.1.1)
+      actionpack (= 7.2.1.1)
+      activerecord (= 7.2.1.1)
+      activestorage (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.2.1)
-      activesupport (= 7.2.1)
+    actionview (7.2.1.1)
+      activesupport (= 7.2.1.1)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.2.1)
-      activesupport (= 7.2.1)
+    activejob (7.2.1.1)
+      activesupport (= 7.2.1.1)
       globalid (>= 0.3.6)
-    activemodel (7.2.1)
-      activesupport (= 7.2.1)
-    activerecord (7.2.1)
-      activemodel (= 7.2.1)
-      activesupport (= 7.2.1)
+    activemodel (7.2.1.1)
+      activesupport (= 7.2.1.1)
+    activerecord (7.2.1.1)
+      activemodel (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       timeout (>= 0.4.0)
-    activestorage (7.2.1)
-      actionpack (= 7.2.1)
-      activejob (= 7.2.1)
-      activerecord (= 7.2.1)
-      activesupport (= 7.2.1)
+    activestorage (7.2.1.1)
+      actionpack (= 7.2.1.1)
+      activejob (= 7.2.1.1)
+      activerecord (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       marcel (~> 1.0)
-    activesupport (7.2.1)
+    activesupport (7.2.1.1)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -320,7 +320,7 @@ GEM
     mysql2 (0.5.6)
     net-http-persistent (4.0.4)
       connection_pool (~> 2.2)
-    net-imap (0.4.16)
+    net-imap (0.4.17)
       date
       net-protocol
     net-pop (0.1.2)
@@ -372,7 +372,7 @@ GEM
     puma (6.4.3)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.1.7)
+    rack (3.1.8)
     rack-proxy (0.7.7)
       rack
     rack-session (2.0.0)
@@ -382,20 +382,20 @@ GEM
     rackup (2.1.0)
       rack (>= 3)
       webrick (~> 1.8)
-    rails (7.2.1)
-      actioncable (= 7.2.1)
-      actionmailbox (= 7.2.1)
-      actionmailer (= 7.2.1)
-      actionpack (= 7.2.1)
-      actiontext (= 7.2.1)
-      actionview (= 7.2.1)
-      activejob (= 7.2.1)
-      activemodel (= 7.2.1)
-      activerecord (= 7.2.1)
-      activestorage (= 7.2.1)
-      activesupport (= 7.2.1)
+    rails (7.2.1.1)
+      actioncable (= 7.2.1.1)
+      actionmailbox (= 7.2.1.1)
+      actionmailer (= 7.2.1.1)
+      actionpack (= 7.2.1.1)
+      actiontext (= 7.2.1.1)
+      actionview (= 7.2.1.1)
+      activejob (= 7.2.1.1)
+      activemodel (= 7.2.1.1)
+      activerecord (= 7.2.1.1)
+      activestorage (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       bundler (>= 1.15.0)
-      railties (= 7.2.1)
+      railties (= 7.2.1.1)
     rails-dom-testing (2.2.0)
       activesupport (>= 5.0.0)
       minitest
@@ -410,9 +410,9 @@ GEM
       actionview (> 3.1)
       activesupport (> 3.1)
       railties (> 3.1)
-    railties (7.2.1)
-      actionpack (= 7.2.1)
-      activesupport (= 7.2.1)
+    railties (7.2.1.1)
+      actionpack (= 7.2.1.1)
+      activesupport (= 7.2.1.1)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -559,7 +559,7 @@ GEM
     websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.6.18)
+    zeitwerk (2.7.0)
 
 PLATFORMS
   aarch64-linux

README.md

@@ -25,12 +25,12 @@
 DocuSeal is an open source platform that provides secure and efficient digital document signing and processing. Create PDF forms to have them filled and signed online on any device with an easy-to-use, mobile-optimized web tool.
 </p>
 <h2 align="center">
-  <a href="https://demo.docuseal.co">✨ Live Demo</a>
+  <a href="https://demo.docuseal.tech">✨ Live Demo</a>
   <span>|</span>
-  <a href="https://docuseal.co/sign_up">☁️ Try in Cloud</a>
+  <a href="https://docuseal.com/sign_up">☁️ Try in Cloud</a>
 </h2>
 
-[![Demo](https://github.com/docusealco/docuseal/assets/5418788/d8703ea3-361a-423f-8bfe-eff1bd9dbe14)](https://demo.docuseal.co)
+[![Demo](https://github.com/docusealco/docuseal/assets/5418788/d8703ea3-361a-423f-8bfe-eff1bd9dbe14)](https://demo.docuseal.tech)
 
 ## Features
 - PDF form fields builder (WYSIWYG)

SECURITY.md

@@ -1,6 +1,6 @@
 # Reporting a Vulnerability
 
-If you come across any security concern or vulnarability, please report the information via email to security@docuseal.co instead of opening a GitHub issue. We will promptly respond and will collaborate with you to validate the issue, and resolve it ASAP.
+If you come across any security concern or vulnarability, please report the information via email to security@docuseal.com instead of opening a GitHub issue. We will promptly respond and will collaborate with you to validate the issue, and resolve it ASAP.
 
 **We have a bug bounty program to reward security researchers.**
 

app/controllers/account_configs_controller.rb

@@ -8,6 +8,7 @@ class AccountConfigsController < ApplicationController
     AccountConfig::ALLOW_TYPED_SIGNATURE,
     AccountConfig::FORCE_MFA,
     AccountConfig::ALLOW_TO_RESUBMIT,
+    AccountConfig::ALLOW_TO_DECLINE_KEY,
     AccountConfig::FORM_PREFILL_SIGNATURE_KEY,
     AccountConfig::ESIGNING_PREFERENCE_KEY,
     AccountConfig::FORM_WITH_CONFETTI_KEY,

app/controllers/api/api_base_controller.rb

@@ -25,9 +25,9 @@ module Api
       render json: { error: 'Too many requests' }, status: :too_many_requests
     end
 
-    if Rails.env.production?
+    unless Rails.env.development?
       rescue_from CanCan::AccessDenied do |e|
-        render json: { error: e.message }, status: :forbidden
+        render json: { error: access_denied_error_message(e) }, status: :forbidden
       end
 
       rescue_from JSON::ParserError do |e|
@@ -39,6 +39,33 @@ module Api
 
     private
 
+    def access_denied_error_message(error)
+      return 'Not authorized' if request.headers['X-Auth-Token'].blank?
+      return 'Not authorized' unless error.subject.is_a?(ActiveRecord::Base)
+      return 'Not authorized' unless error.subject.respond_to?(:account_id)
+
+      linked_account_record_exists =
+        if current_user.account.testing?
+          current_user.account.linked_account_accounts.where(account_type: 'testing')
+                      .exists?(account_id: error.subject.account_id)
+        else
+          current_user.account.testing_accounts.exists?(id: error.subject.account_id)
+        end
+
+      return 'Not authorized' unless linked_account_record_exists
+
+      object_name = error.subject.model_name.human
+      id = error.subject.id
+
+      if current_user.account.testing?
+        "#{object_name} #{id} not found using testing API key; Use production API key to " \
+          "access production #{object_name.downcase.pluralize}."
+      else
+        "#{object_name} #{id} not found using production API key; Use testing API key to " \
+          "access testing #{object_name.downcase.pluralize}."
+      end
+    end
+
     def paginate(relation, field: :id)
       result = relation.order(field => :desc)
                        .limit([params.fetch(:limit, DEFAULT_LIMIT).to_i, MAX_LIMIT].min)

app/controllers/api/submission_documents_controller.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Api
+  class SubmissionDocumentsController < ApiBaseController
+    load_and_authorize_resource :submission
+
+    def index
+      documents =
+        if @submission.submitters.all?(&:completed_at?)
+          last_submitter = @submission.submitters.max_by(&:completed_at)
+
+          if last_submitter.documents_attachments.blank?
+            last_submitter.documents_attachments = Submissions::EnsureResultGenerated.call(submitter)
+          end
+
+          last_submitter.documents_attachments
+        else
+          values_hash = Submissions::GeneratePreviewAttachments.build_values_hash(@submission)
+
+          if @submission.preview_documents.present? &&
+             @submission.preview_documents.all? { |s| s.metadata['values_hash'] == values_hash }
+            @submission.preview_documents
+          else
+            ApplicationRecord.no_touching do
+              @submission.preview_documents.each(&:destroy)
+            end
+
+            Submissions::GeneratePreviewAttachments.call(@submission, values_hash:)
+          end
+        end
+
+      ActiveRecord::Associations::Preloader.new(
+        records: documents,
+        associations: [:blob]
+      ).call
+
+      render json: {
+        id: @submission.id,
+        documents: documents.map do |attachment|
+          { name: attachment.filename.base, url: ActiveStorage::Blob.proxy_url(attachment.blob) }
+        end
+      }
+    end
+  end
+end

app/controllers/api/submissions_controller.rb

@@ -74,13 +74,14 @@ module Api
       Submissions.send_signature_requests(submissions)
 
       submissions.each do |submission|
-        if submission.submitters.all?(&:completed_at?) && submission.submitters.last
-          ProcessSubmitterCompletionJob.perform_async({ 'submitter_id' => submission.submitters.last.id })
+        submission.submitters.each do |submitter|
+          ProcessSubmitterCompletionJob.perform_async({ 'submitter_id' => submitter.id }) if submitter.completed_at?
         end
       end
 
       render json: build_create_json(submissions)
-    rescue Submitters::NormalizeValues::BaseError, DownloadUtils::UnableToDownload => e
+    rescue Submitters::NormalizeValues::BaseError, Submissions::CreateFromSubmitters::BaseError,
+           DownloadUtils::UnableToDownload => e
       Rollbar.warning(e) if defined?(Rollbar)
 
       render json: { error: e.message }, status: :unprocessable_entity

app/controllers/api/submitters_controller.rb

@@ -120,6 +120,7 @@ module Api
       end&.dig('uuid')
 
       submitter.email = Submissions.normalize_email(attrs[:email]) if attrs.key?(:email)
+      submitter.name = attrs[:name] if attrs.key?(:name)
 
       if attrs.key?(:phone)
         submitter.phone = attrs[:phone].to_s.gsub(/[^0-9+]/, '')

app/controllers/api/tools_controller.rb

@@ -20,10 +20,7 @@ module Api
       pdf = HexaPDF::Document.new(io: StringIO.new(file))
 
       trusted_certs = Accounts.load_trusted_certs(current_account)
-
-      is_checksum_found = ActiveStorage::Attachment.joins(:blob)
-                                                   .where(name: 'documents', record_type: 'Submitter')
-                                                   .exists?(blob: { checksum: Digest::MD5.base64digest(file) })
+      is_checksum_found = CompletedDocument.exists?(sha256: Base64.urlsafe_encode64(Digest::SHA256.digest(file)))
 
       render json: {
         checksum_status: is_checksum_found ? 'verified' : 'not_found',

app/controllers/application_controller.rb

@@ -38,6 +38,10 @@ class ApplicationController < ActionController::Base
   end
 
   def default_url_options
+    if request.domain == 'docuseal.com'
+      return { host: 'docuseal.com', protocol: ENV['FORCE_SSL'].present? ? 'https' : 'http' }
+    end
+
     Docuseal.default_url_options
   end
 

app/controllers/email_smtp_settings_controller.rb

@@ -9,7 +9,7 @@ class EmailSmtpSettingsController < ApplicationController
 
   def create
     if @encrypted_config.update(email_configs)
-      SettingsMailer.smtp_successful_setup(@encrypted_config.value['from_email']).deliver_now!
+      SettingsMailer.smtp_successful_setup(@encrypted_config.value['from_email'] || current_user.email).deliver_now!
 
       redirect_to settings_email_index_path, notice: I18n.t('changes_have_been_saved')
     else

app/controllers/preview_document_page_controller.rb

@@ -12,7 +12,8 @@ class PreviewDocumentPageController < ActionController::API
 
     return head :not_found unless attachment
 
-    preview_image = attachment.preview_images.joins(:blob).find_by(blob: { filename: "#{params[:id]}#{FORMAT}" })
+    preview_image = attachment.preview_images.joins(:blob)
+                              .find_by(blob: { filename: ["#{params[:id]}.png", "#{params[:id]}.jpg"] })
 
     return redirect_to preview_image.url, allow_other_host: true if preview_image
 

app/controllers/submissions_controller.rb

@@ -9,6 +9,13 @@ class SubmissionsController < ApplicationController
   def show
     @submission = Submissions.preload_with_pages(@submission)
 
+    unless @submission.submitters.all?(&:completed_at?)
+      ActiveRecord::Associations::Preloader.new(
+        records: [@submission],
+        associations: [submitters: :start_form_submission_events]
+      ).call
+    end
+
     render :show, layout: 'plain'
   end
 

app/controllers/submissions_dashboard_controller.rb

@@ -15,6 +15,6 @@ class SubmissionsDashboardController < ApplicationController
     @submissions = @submissions.pending if params[:status] == 'pending'
     @submissions = @submissions.completed if params[:status] == 'completed'
 
-    @pagy, @submissions = pagy(@submissions.preload(:submitters).order(id: :desc))
+    @pagy, @submissions = pagy(@submissions.preload(submitters: :start_form_submission_events).order(id: :desc))
   end
 end

app/controllers/submitters_controller.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+class SubmittersController < ApplicationController
+  load_and_authorize_resource :submitter, only: %i[edit update]
+
+  def edit
+    @submitter_email_message =
+      if @submitter.preferences['email_message_uuid'].present?
+        @submitter.account.email_messages.find_by(uuid: @submitter.preferences['email_message_uuid'])
+      end
+  end
+
+  def update
+    submission = @submitter.submission
+
+    if @submitter.submission_events.exists?(event_type: 'start_form') || submission.archived_at? || submission.expired?
+      return redirect_back fallback_location: submission_path(submission), alert: I18n.t('submitter_cannot_be_updated')
+    end
+
+    if submitter_params.values.all?(&:blank?)
+      return redirect_back fallback_location: submission_path(submission),
+                           alert: I18n.t('at_least_one_field_must_be_filled')
+    end
+
+    if params[:is_custom_message] != '1'
+      params.delete(:subject)
+      params.delete(:body)
+    end
+
+    submitter_preferences = Submitters.normalize_preferences(@submitter.account, current_user, params)
+
+    if submitter_preferences.key?('email_message_uuid')
+      @submitter.preferences['email_message_uuid'] = submitter_preferences['email_message_uuid']
+    end
+
+    assign_submitter_attrs(@submitter, submitter_params)
+
+    if @submitter.save
+      maybe_resend_email_sms(@submitter, params)
+
+      redirect_back fallback_location: submission_path(submission), notice: I18n.t('changes_have_been_saved')
+    else
+      redirect_back fallback_location: submission_path(submission), alert: I18n.t('unable_to_save')
+    end
+  end
+
+  private
+
+  def maybe_resend_email_sms(submitter, params)
+    if params[:send_email] == '1' && submitter.email.present?
+      is_sent_recently = Docuseal.multitenant? &&
+                         EmailEvent.exists?(email: submitter.email,
+                                            tag: 'submitter_invitation',
+                                            emailable: submitter,
+                                            event_type: 'send',
+                                            created_at: 4.hours.ago..Time.current)
+
+      SendSubmitterInvitationEmailJob.perform_async('submitter_id' => submitter.id) unless is_sent_recently
+    end
+
+    return if submitter.phone.blank?
+    return unless params[:send_sms] == '1'
+
+    SendSubmitterInvitationSmsJob.perform_async('submitter_id' => submitter.id)
+  end
+
+  def assign_submitter_attrs(submitter, attrs)
+    submitter.phone = attrs[:phone].to_s.gsub(/[^0-9+]/, '') if attrs.key?(:phone)
+
+    submitter.email = Submissions.normalize_email(attrs[:email]) if attrs.key?(:email)
+
+    submitter.name = attrs[:name] if attrs.key?(:name)
+
+    submitter
+  end
+
+  def submitter_params
+    params.require(:submitter).permit(:email, :name, :phone).transform_values(&:strip)
+  end
+end

app/controllers/templates_controller.rb

@@ -15,7 +15,7 @@ class TemplatesController < ApplicationController
     submissions = submissions.pending if params[:status] == 'pending'
     submissions = submissions.completed if params[:status] == 'completed'
 
-    @pagy, @submissions = pagy(submissions.preload(:submitters).order(id: :desc))
+    @pagy, @submissions = pagy(submissions.preload(submitters: :start_form_submission_events).order(id: :desc))
   rescue ActiveRecord::RecordNotFound
     redirect_to root_path
   end

app/controllers/users_controller.rb

@@ -9,9 +9,11 @@ class UsersController < ApplicationController
   def index
     @users =
       if params[:status] == 'archived'
-        @users.archived
+        @users.archived.where.not(role: 'integration')
+      elsif params[:status] == 'integration'
+        @users.active.where(role: 'integration')
       else
-        @users.active
+        @users.active.where.not(role: 'integration')
       end
 
     @pagy, @users = pagy(@users.where(account: current_account).order(id: :desc))

app/javascript/application.js

@@ -29,6 +29,7 @@ import SearchInput from './elements/search_input'
 import ToggleAttribute from './elements/toggle_attribute'
 import LinkedInput from './elements/linked_input'
 import CheckboxGroup from './elements/checkbox_group'
+import MaskedInput from './elements/masked_input'
 
 import * as TurboInstantClick from './lib/turbo_instant_click'
 
@@ -95,6 +96,7 @@ safeRegisterElement('search-input', SearchInput)
 safeRegisterElement('toggle-attribute', ToggleAttribute)
 safeRegisterElement('linked-input', LinkedInput)
 safeRegisterElement('checkbox-group', CheckboxGroup)
+safeRegisterElement('masked-input', MaskedInput)
 
 safeRegisterElement('template-builder', class extends HTMLElement {
   connectedCallback () {

app/javascript/application.scss

@@ -130,7 +130,3 @@ button[disabled] .enabled {
   outline-offset: 3px;
   outline-color: hsl(var(--bc) / 0.2);
 }
-
-select:required:invalid {
-  color: gray !important;
-}

app/javascript/elements/masked_input.js

@@ -0,0 +1,18 @@
+export default class extends HTMLElement {
+  connectedCallback () {
+    const maskedToken = this.input.value
+
+    this.input.addEventListener('focus', () => {
+      this.input.value = this.dataset.token
+      this.input.select()
+    })
+
+    this.input.addEventListener('focusout', () => {
+      this.input.value = maskedToken
+    })
+  }
+
+  get input () {
+    return this.querySelector('input')
+  }
+}

app/javascript/form.js

@@ -28,6 +28,7 @@ safeRegisterElement('submission-form', class extends HTMLElement {
       requireSigningReason: this.dataset.requireSigningReason === 'true',
       withConfetti: this.dataset.withConfetti !== 'false',
       withDisclosure: this.dataset.withDisclosure === 'true',
+      reuseSignature: this.dataset.reuseSignature !== 'false',
       withTypedSignature: this.dataset.withTypedSignature !== 'false',
       authenticityToken: document.querySelector('meta[name="csrf-token"]')?.content,
       rememberSignature: this.dataset.rememberSignature === 'true',

app/javascript/form.scss

@@ -31,10 +31,6 @@ button[disabled] .enabled {
   display: none;
 }
 
-select:required:invalid {
-  @apply text-gray-300;
-}
-
 .input-bordered {
   @apply border-base-content/20;
 }

app/javascript/submission_form/area.vue

@@ -405,7 +405,8 @@ export default {
       }
 
       if (this.field.preferences?.font_size) {
-        style.fontSize = this.field.preferences.font_size + 'pt'
+        style.fontSize = `clamp(4pt, 1.6vw, ${this.field.preferences.font_size}pt)`
+        style.lineHeight = `clamp(6pt, 2.0vw, ${parseInt(this.field.preferences.font_size) + 3}pt)`
       }
 
       return style

app/javascript/submission_form/completed.vue

@@ -76,7 +76,7 @@
       </a>
       <a
         v-if="isDemo"
-        href="https://docuseal.co/sign_up"
+        href="https://docuseal.com/sign_up"
         class="white-button flex items-center space-x-1 w-full"
       >
         <IconLogin />

app/javascript/submission_form/date_step.vue

@@ -45,6 +45,7 @@
         :name="`values[${field.uuid}]`"
         @keydown.enter="onEnter"
         @focus="$emit('focus')"
+        @paste="onPaste"
       >
     </div>
   </div>
@@ -98,6 +99,25 @@ export default {
         this.$emit('submit')
       }
     },
+    onPaste (e) {
+      e.preventDefault()
+
+      let pasteData = e.clipboardData.getData('text').trim()
+
+      if (pasteData.match(/^\d{2}\.\d{2}\.\d{4}$/)) {
+        pasteData = pasteData.split('.').reverse().join('-')
+      }
+
+      const parsedDate = new Date(pasteData)
+
+      if (!isNaN(parsedDate)) {
+        const inputEl = this.$refs.input
+
+        inputEl.valueAsDate = new Date(parsedDate.getTime() - parsedDate.getTimezoneOffset() * 60000)
+
+        inputEl.dispatchEvent(new Event('input', { bubbles: true }))
+      }
+    },
     setCurrentDate () {
       const inputEl = this.$refs.input
 

app/javascript/submission_form/form.vue

@@ -115,7 +115,7 @@
             v-model="values[currentField.uuid]"
             :show-field-names="showFieldNames"
             :field="currentField"
-            @submit="submitStep"
+            @submit="!isSubmitting && submitStep()"
             @focus="scrollIntoField(currentField)"
           />
           <div v-else-if="currentField.type === 'select'">
@@ -152,6 +152,7 @@
               dir="auto"
               :required="currentField.required"
               class="select base-input !text-2xl w-full text-center font-normal"
+              :class="{ 'text-gray-300': !values[currentField.uuid] }"
               :name="`values[${currentField.uuid}]`"
               @change="values[currentField.uuid] = $event.target.value"
               @focus="scrollIntoField(currentField)"
@@ -159,6 +160,7 @@
               <option
                 value=""
                 :selected="!values[currentField.uuid]"
+                class="text-gray-300"
               >
                 {{ t('select_your_option') }}
               </option>
@@ -167,6 +169,7 @@
                 :key="option.uuid"
                 :selected="values[currentField.uuid] == option.value"
                 :value="option.value"
+                class="text-base-content"
               >
                 {{ option.value }}
               </option>
@@ -392,7 +395,7 @@
             :default-value="submitter.phone"
             :submitter-slug="submitterSlug"
             @focus="scrollIntoField(currentField)"
-            @submit="submitStep"
+            @submit="!isSubmitting && submitStep()"
           />
           <PaymentStep
             v-else-if="currentField.type === 'payment'"
@@ -404,7 +407,7 @@
             :values="values"
             @attached="attachments.push($event)"
             @focus="scrollIntoField(currentField)"
-            @submit="submitStep"
+            @submit="!isSubmitting && submitStep()"
           />
         </div>
         <div
@@ -1104,6 +1107,10 @@ export default {
       const currentFieldUuids = this.currentStepFields.map((f) => f.uuid)
       const currentFieldType = this.currentField.type
 
+      if (!formData && !this.$refs.form.checkValidity()) {
+        return
+      }
+
       if (this.dryRun) {
         currentFieldUuids.forEach((fieldUuid) => {
           this.submittedValues[fieldUuid] = this.values[fieldUuid]
@@ -1142,13 +1149,15 @@ export default {
     async submitStep () {
       this.isSubmitting = true
 
+      const submitStep = this.currentStep
+
       const stepPromise = ['signature', 'phone', 'initials', 'payment'].includes(this.currentField.type)
         ? this.$refs.currentStep.submit
         : () => Promise.resolve({})
 
       stepPromise().then(async () => {
         const emptyRequiredField = this.stepFields.find((fields, index) => {
-          if (index >= this.currentStep) {
+          if (index >= submitStep) {
             return false
           }
 
@@ -1158,7 +1167,7 @@ export default {
         })
 
         const formData = new FormData(this.$refs.form)
-        const isLastStep = this.currentStep === this.stepFields.length - 1
+        const isLastStep = submitStep === this.stepFields.length - 1
 
         if (isLastStep && !emptyRequiredField && !this.inviteSubmitters.length) {
           formData.append('completed', 'true')
@@ -1183,7 +1192,7 @@ export default {
             return Promise.reject(new Error(data.error))
           }
 
-          const nextStep = (isLastStep && emptyRequiredField) || this.stepFields[this.currentStep + 1]
+          const nextStep = (isLastStep && emptyRequiredField) || this.stepFields[submitStep + 1]
 
           if (nextStep) {
             if (this.alwaysMinimize) {

app/javascript/submission_form/phone_step.vue

@@ -61,30 +61,55 @@
           </a>
         </div>
       </div>
-      <input
+      <div
         v-show="!isCodeSent"
-        :id="field.uuid"
-        ref="phone"
-        :value="modelValue || defaultValue"
-        :readonly="!!defaultValue"
-        class="base-input !text-2xl w-full"
-        autocomplete="tel"
-        pattern="^\+[0-9\s\-]+$"
-        type="tel"
-        inputmode="tel"
-        :required="field.required"
-        placeholder="+1 234 567-8900"
-        :name="`values[${field.uuid}]`"
-        @invalid="$event.target.value ? $event.target.setCustomValidity(`${t('use_international_format')}...`) : ''"
-        @input="[$event.target.setCustomValidity(''), $emit('update:model-value', $event.target.value)]"
-        @focus="$emit('focus')"
+        class="flex w-full rounded-full outline-neutral-content outline-2 outline-offset-2 focus-within:outline"
       >
+        <div class="relative inline-block">
+          <div class="btn bg-base-200 border border-neutral-300 text-2xl whitespace-nowrap font-normal rounded-l-full">
+            {{ selectedCountry.flag }} +{{ selectedCountry.dial }}
+          </div>
+          <select
+            class="absolute top-0 bottom-0 right-0 left-0 opacity-0 w-full h-full cursor-pointer"
+            :disabled="!!defaultValue"
+            @change="onCountrySelect(countries.find((country) => country.flag === $event.target.value))"
+          >
+            <option
+              v-for="(country, index) in countries"
+              :key="index"
+              :value="country.flag"
+            >
+              {{ country.flag }} {{ country.name }}
+            </option>
+          </select>
+        </div>
+        <input
+          :name="`values[${field.uuid}]`"
+          :value="fullInternationalPhoneValue"
+          hidden
+        >
+        <input
+          :id="field.uuid"
+          ref="phone"
+          :value="phoneValue"
+          :readonly="!!defaultValue"
+          class="base-input !text-2xl !rounded-l-none !border-l-0 !outline-none w-full"
+          autocomplete="tel"
+          type="tel"
+          inputmode="tel"
+          :required="field.required"
+          placeholder="234 567-8900"
+          @input="onPhoneInput"
+          @focus="$emit('focus')"
+        >
+      </div>
     </div>
   </div>
 </template>
 
 <script>
 import MarkdownContent from './markdown_content'
+import phoneData from './phone_data'
 
 function throttle (func, delay) {
   let lastCallTime = 0
@@ -144,13 +169,73 @@ export default {
   data () {
     return {
       isCodeSent: false,
-      isResendLoading: false
+      isResendLoading: false,
+      phoneValue: this.modelValue || this.defaultValue || '',
+      selectedCountry: {}
+    }
+  },
+  computed: {
+    countries () {
+      return phoneData.map(([name, dial, flag, tz]) => {
+        return { name, dial, flag, tz }
+      })
+    },
+    countriesDialIndex () {
+      return this.countries.reduce((acc, item) => {
+        acc[item.dial] ||= item
+
+        return acc
+      }, {})
+    },
+    dialCodesRegexp () {
+      const dialCodes = this.countries.map((country) => country.dial).sort((a, b) => b.length - a.length)
+
+      return new RegExp(`^\\+(${dialCodes.join('|')})`)
+    },
+    detectedPhoneValueDialCode () {
+      return (this.phoneValue || '').replace(/[^\d+]/g, '').match(this.dialCodesRegexp)?.[1]
+    },
+    fullInternationalPhoneValue () {
+      if (this.detectedPhoneValueDialCode) {
+        return this.phoneValue
+      } else if (this.phoneValue) {
+        return ['+', this.selectedCountry.dial, this.phoneValue].filter(Boolean).join('')
+      } else {
+        return ''
+      }
+    }
+  },
+  mounted () {
+    const browserTimeZone = Intl.DateTimeFormat().resolvedOptions().timeZone
+
+    if (this.detectedPhoneValueDialCode) {
+      this.selectedCountry = this.countriesDialIndex[this.detectedPhoneValueDialCode]
+    } else if (browserTimeZone) {
+      const tz = browserTimeZone.split('/')[1]
+
+      this.selectedCountry = this.countries.find((country) => country.tz.includes(tz)) || this.countries[0]
     }
   },
   methods: {
     emitSubmit: throttle(function (e) {
       this.$emit('submit')
     }, 1000),
+    onCountrySelect (country) {
+      if (this.selectedCountry.flag !== country.flag) {
+        this.phoneValue = this.phoneValue.replace(`+${this.selectedCountry.dial}`, `+${country.dial}`)
+      }
+
+      this.selectedCountry = country
+
+      this.$refs.phone.focus()
+    },
+    onPhoneInput (e) {
+      this.phoneValue = e.target.value
+
+      if (this.detectedPhoneValueDialCode) {
+        this.selectedCountry = this.countriesDialIndex[this.detectedPhoneValueDialCode]
+      }
+    },
     onInputCode (e) {
       if (e.target.value.length === 6) {
         this.emitSubmit()
@@ -171,14 +256,14 @@ export default {
         body: JSON.stringify({
           submitter_slug: this.submitterSlug,
           locale: this.locale,
-          phone: this.$refs.phone.value
+          phone: this.fullInternationalPhoneValue
         }),
         headers: { 'Content-Type': 'application/json' }
       }).then(async (resp) => {
         if (resp.status === 422) {
           const data = await resp.json()
 
-          alert(this.t('number_phone_is_invalid').replace('{number}', this.$refs.phone.value))
+          alert(this.t('number_phone_is_invalid').replace('{number}', this.fullInternationalPhoneValue))
 
           return Promise.reject(new Error(data.error))
         }
@@ -189,13 +274,13 @@ export default {
         return Promise.resolve({})
       }
 
-      if (!this.$refs.phone.value.toString().startsWith('+')) {
+      if (!this.fullInternationalPhoneValue.toString().startsWith('+')) {
         alert(this.t('use_international_format'))
 
         return Promise.reject(new Error('phone invalid'))
       } else if (!this.isCodeSent) {
         return this.sendVerificationCode().then(() => {
-          this.$emit('update:model-value', this.$refs.phone.value)
+          this.$emit('update:model-value', this.fullInternationalPhoneValue)
 
           this.isCodeSent = true
 

app/javascript/submission_form/signature_step.vue

@@ -197,6 +197,7 @@
     <select
       v-if="requireSigningReason && !isOtherReason"
       class="select base-input !text-2xl w-full mt-6 text-center"
+      :class="{ 'text-gray-300': !reason }"
       required
       :name="`values[${field.preferences.reason_field_uuid}]`"
       @change="$event.target.value === 'other' ? [reason = '', isOtherReason = true] : $emit('update:reason', $event.target.value)"
@@ -205,6 +206,7 @@
         value=""
         disabled
         :selected="!reason"
+        class="text-gray-300"
       >
         {{ t('select_a_reason') }}
       </option>
@@ -213,10 +215,14 @@
         :key="option"
         :value="option"
         :selected="reason === option"
+        class="text-base-content"
       >
         {{ label }}
       </option>
-      <option value="other">
+      <option
+        value="other"
+        class="text-base-content"
+      >
         {{ t('other') }}
       </option>
     </select>

app/javascript/template_builder/builder.vue

@@ -693,6 +693,7 @@ export default {
         'de-DE': 'DD.MM.YYYY',
         'fr-FR': 'DD/MM/YYYY',
         'it-IT': 'DD/MM/YYYY',
+        'en-GB': 'DD/MM/YYYY',
         'es-ES': 'DD/MM/YYYY'
       }
     },

app/javascript/template_builder/conditions_modal.vue

@@ -50,6 +50,7 @@
               </div>
               <select
                 class="select select-bordered select-sm w-full bg-white h-11 pl-4 text-base font-normal"
+                :class="{ 'text-gray-300': !condition.field_uuid }"
                 required
                 @change="[
                   condition.field_uuid = $event.target.value,
@@ -68,6 +69,7 @@
                   v-for="f in fields"
                   :key="f.uuid"
                   :value="f.uuid"
+                  class="text-base-content"
                   :selected="condition.field_uuid === f.uuid"
                 >
                   {{ f.name || buildDefaultName(f, template.fields) }}
@@ -88,8 +90,9 @@
                 </option>
               </select>
               <select
-                v-if="conditionField(condition)?.options?.length"
+                v-if="['radio', 'select', 'multiple'].includes(conditionField(condition)?.type) && conditionField(condition)?.options"
                 class="select select-bordered select-sm w-full bg-white h-11 pl-4 text-base font-normal"
+                :class="{ 'text-gray-300': !condition.value }"
                 required
                 @change="condition.value = $event.target.value"
               >
@@ -105,6 +108,7 @@
                   :key="option.uuid"
                   :value="option.uuid"
                   :selected="condition.value === option.uuid"
+                  class="text-base-content"
                 >
                   {{ option.value || `${t('option')} ${index + 1}` }}
                 </option>

app/javascript/template_builder/i18n.js

@@ -1,5 +1,7 @@
 const en = {
   editable: 'Editable',
+  recurrent: 'Recurrent',
+  one_off: 'One-off',
   search_field: 'Search field',
   field_not_found: 'Field not found',
   clear: 'Clear',
@@ -151,6 +153,8 @@ const en = {
 }
 
 const es = {
+  recurrent: 'Recurrente',
+  one_off: 'Único',
   editable: 'Editable',
   search_field: 'Campo de búsqueda',
   field_not_found: 'Campo no encontrado',
@@ -303,6 +307,8 @@ const es = {
 }
 
 const it = {
+  ricorrente: 'Ricorrente',
+  una_volta: 'Una volta',
   editable: 'Modificabile',
   search_field: 'Campo di ricerca',
   field_not_found: 'Campo non trovato',
@@ -455,6 +461,8 @@ const it = {
 }
 
 const pt = {
+  recurrent: 'Recurrente',
+  one_off: 'Único',
   editable: 'Editável',
   search_field: 'Campo de busca',
   field_not_found: 'Campo não encontrado',
@@ -607,6 +615,8 @@ const pt = {
 }
 
 const fr = {
+  recurrent: 'Récurrent',
+  one_off: 'Ponctuel',
   editable: 'Éditable',
   search_field: 'Champ de recherche',
   field_not_found: 'Champ non trouvé',
@@ -759,6 +769,8 @@ const fr = {
 }
 
 const de = {
+  wiederkehrend: 'Wiederkehrend',
+  einmalig: 'Einmalig',
   editable: 'Bearbeitbar',
   search_field: 'Suchfeld',
   field_not_found: 'Feld nicht gefunden',

app/javascript/template_builder/import_list.vue

@@ -50,6 +50,7 @@
           <div class="flex">
             <select
               class="base-select !select-sm !h-10"
+              :class="{ '!text-gray-300': !mapping.field_name }"
               required
               @change="mapping.field_name = $event.target.value"
             >
@@ -65,6 +66,7 @@
                 :key="index"
                 :value="field.name"
                 :selected="mapping.field_name === field.name"
+                class="text-base-content"
               >
                 {{ field.name }}
               </option>
@@ -75,6 +77,7 @@
             <div class="w-full relative">
               <select
                 class="base-select !select-sm !h-10"
+                :class="{ '!text-gray-300': !mapping.column_index }"
                 required
                 @change="mapping.column_index = parseInt($event.target.value)"
               >
@@ -93,6 +96,7 @@
                     v-if="column"
                     :value="index"
                     :selected="index === mapping.column_index"
+                    class="text-base-content"
                   >
                     {{ column }}
                   </option>

app/javascript/template_builder/payment_settings.vue

@@ -21,6 +21,7 @@
       @click="closeDropdown"
     >
       <div
+        v-if="!('price_id' in field.preferences)"
         class="py-1.5 px-1 relative"
         @click.stop
       >
@@ -58,6 +59,13 @@
           class="input input-bordered input-xs w-full max-w-xs h-7 !outline-0"
           @blur="save"
         >
+        <input
+          v-else-if="'price_id' in field.preferences"
+          v-model="field.preferences.price_id"
+          placeholder="Price ID: price_XXXXX"
+          class="input input-bordered input-xs w-full max-w-xs h-7 !outline-0"
+          @blur="save"
+        >
         <input
           v-else
           v-model="field.preferences.price"
@@ -74,6 +82,23 @@
         >
           {{ t('price') }}
         </label>
+        <div class="flex items-center justify-center">
+          <a
+            href="#"
+            class="hover:underline"
+            style="font-size: 11px"
+            :class="{'underline': !('price_id' in field.preferences)}"
+            @click="delete field.preferences.price_id"
+          >{{ t('one_off') }}</a>
+          <span class="h-2.5 border-l border-base-content mx-1" />
+          <a
+            href="#"
+            class="hover:underline"
+            style="font-size: 11px"
+            :class="{'underline': ('price_id' in field.preferences)}"
+            @click="field.preferences.price_id ??= ''"
+          >{{ t('recurrent') }}</a>
+        </div>
       </div>
       <div
         v-if="!isConnected || isOauthSuccess"
@@ -158,7 +183,10 @@
           data-turbo="false"
         >{{ t('learn_more') }}</a>
       </div>
-      <li class="mb-1">
+      <li
+        v-if="!('price_id' in field.preferences)"
+        class="mb-1"
+      >
         <label
           class="label-text cursor-pointer text-center w-full flex items-center"
           @click="$emit('click-formula')"

app/jobs/generate_preview_images_job.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class GeneratePreviewImagesJob
+  include Sidekiq::Job
+
+  sidekiq_options queue: :images
+
+  def perform(params = {})
+    attachment = ActiveStorage::Attachment.find(params['attachment_id'])
+
+    max_page = [attachment.metadata['pdf']['number_of_pages'].to_i - 1,
+                Templates::ProcessDocument::MAX_NUMBER_OF_PAGES_PROCESSED].min
+
+    Templates::ProcessDocument.generate_document_preview_images(attachment, attachment.download, (1..max_page),
+                                                                concurrency: 1)
+  end
+end

app/jobs/process_submitter_completion_job.rb

@@ -6,6 +6,8 @@ class ProcessSubmitterCompletionJob
   def perform(params = {})
     submitter = Submitter.find(params['submitter_id'])
 
+    create_completed_submitter!(submitter)
+
     is_all_completed = !submitter.submission.submitters.exists?(completed_at: nil)
 
     if !is_all_completed && submitter.submission.submitters_order_preserved?
@@ -24,9 +26,42 @@ class ProcessSubmitterCompletionJob
       enqueue_completed_emails(submitter)
     end
 
+    create_completed_documents!(submitter)
+
     enqueue_completed_webhooks(submitter, is_all_completed:)
   end
 
+  def create_completed_submitter!(submitter)
+    completed_submitter = CompletedSubmitter.find_or_initialize_by(submitter_id: submitter.id)
+
+    return completed_submitter if completed_submitter.persisted?
+
+    submission = submitter.submission
+
+    completed_submitter.assign_attributes(
+      submission_id: submitter.submission_id,
+      account_id: submission.account_id,
+      template_id: submission.template_id,
+      source: submission.source,
+      sms_count: submitter.submission_events.where(event_type: %w[send_sms send_2fa_sms]).count,
+      completed_at: submitter.completed_at
+    )
+
+    completed_submitter.save!
+
+    completed_submitter
+  rescue ActiveRecord::RecordNotUnique
+    retry
+  end
+
+  def create_completed_documents!(submitter)
+    submitter.documents.filter_map do |attachment|
+      next if attachment.metadata['sha256'].blank?
+
+      CompletedDocument.find_or_create_by!(sha256: attachment.metadata['sha256'], submitter_id: submitter.id)
+    end
+  end
+
   def enqueue_completed_webhooks(submitter, is_all_completed: false)
     webhook_config = Accounts.load_webhook_config(submitter.account)
 

app/mailers/application_mailer.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class ApplicationMailer < ActionMailer::Base
-  default from: 'DocuSeal <info@docuseal.co>'
+  default from: 'DocuSeal <info@docuseal.com>'
   layout 'mailer'
 
   register_interceptor ActionMailerConfigsInterceptor

app/mailers/settings_mailer.rb

@@ -2,6 +2,6 @@
 
 class SettingsMailer < ApplicationMailer
   def smtp_successful_setup(email)
-    mail(to: email, subject: 'SMTP has been configured')
+    mail(to: email, from: email, subject: 'SMTP has been configured')
   end
 end

app/models/account_config.rb

@@ -28,6 +28,7 @@ class AccountConfig < ApplicationRecord
   FORCE_MFA = 'force_mfa'
   ALLOW_TYPED_SIGNATURE = 'allow_typed_signature'
   ALLOW_TO_RESUBMIT = 'allow_to_resubmit'
+  ALLOW_TO_DECLINE_KEY = 'allow_to_decline'
   SUBMITTER_REMINDERS = 'submitter_reminders'
   FORM_COMPLETED_BUTTON_KEY = 'form_completed_button'
   FORM_COMPLETED_MESSAGE_KEY = 'form_completed_message'
@@ -41,6 +42,7 @@ class AccountConfig < ApplicationRecord
   WITH_SIGNATURE_ID = 'with_signature_id'
   WITH_AUDIT_VALUES_KEY = 'with_audit_values'
   REQUIRE_SIGNING_REASON_KEY = 'require_signing_reason'
+  REUSE_SIGNATURE_KEY = 'reuse_signature'
   COMBINE_PDF_RESULT_KEY = 'combine_pdf_result_key'
 
   DEFAULT_VALUES = {

app/models/completed_document.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# == Schema Information
+#
+# Table name: completed_documents
+#
+#  id           :bigint           not null, primary key
+#  sha256       :string           not null
+#  created_at   :datetime         not null
+#  updated_at   :datetime         not null
+#  submitter_id :bigint           not null
+#
+# Indexes
+#
+#  index_completed_documents_on_sha256        (sha256)
+#  index_completed_documents_on_submitter_id  (submitter_id)
+#
+class CompletedDocument < ApplicationRecord
+  belongs_to :submitter, optional: true
+
+  has_one :completed_submitter, primary_key: :submitter_id, inverse_of: :completed_documents, dependent: :destroy
+end

app/models/completed_submitter.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+# == Schema Information
+#
+# Table name: completed_submitters
+#
+#  id            :bigint           not null, primary key
+#  completed_at  :datetime         not null
+#  sms_count     :integer          not null
+#  source        :string           not null
+#  created_at    :datetime         not null
+#  updated_at    :datetime         not null
+#  account_id    :bigint           not null
+#  submission_id :bigint           not null
+#  submitter_id  :bigint           not null
+#  template_id   :bigint           not null
+#
+# Indexes
+#
+#  index_completed_submitters_on_account_id    (account_id)
+#  index_completed_submitters_on_submitter_id  (submitter_id) UNIQUE
+#
+class CompletedSubmitter < ApplicationRecord
+  belongs_to :submitter
+  belongs_to :submission
+  belongs_to :account
+  belongs_to :template
+
+  has_many :completed_documents, dependent: :destroy,
+                                 primary_key: :submitter_id,
+                                 foreign_key: :submitter_id,
+                                 inverse_of: :submitter
+end

app/models/submission.rb

@@ -55,6 +55,8 @@ class Submission < ApplicationRecord
   has_one_attached :audit_trail
   has_one_attached :combined_document
 
+  has_many_attached :preview_documents
+
   has_many :template_schema_documents,
            ->(e) { where(uuid: (e.template_schema.presence || e.template.schema).pluck('attachment_uuid')) },
            through: :template, source: :documents_attachments

app/models/submitter.rb

@@ -56,6 +56,8 @@ class Submitter < ApplicationRecord
 
   has_many :document_generation_events, dependent: :destroy
   has_many :submission_events, dependent: :destroy
+  has_many :start_form_submission_events, -> { where(event_type: :start_form) },
+           class_name: 'SubmissionEvent', dependent: :destroy, inverse_of: :submitter
 
   scope :completed, -> { where.not(completed_at: nil) }
 

app/models/user.rb

@@ -49,6 +49,9 @@ class User < ApplicationRecord
 
   EMAIL_REGEXP = /[^@;,<>\s]+@[^@;,<>\s]+/
 
+  FULL_EMAIL_REGEXP =
+    /\A[a-z0-9][\.']?(?:(?:[a-z0-9_-]+[\.\+'])*[a-z0-9_-]+)*@(?:[a-z0-9]+[\.-])*[a-z0-9]+\.[a-z]{2,}\z/i
+
   has_one_attached :signature
   has_one_attached :initials
 

app/views/accounts/show.html.erb

@@ -103,6 +103,18 @@
             </div>
           <% end %>
         <% end %>
+        <% account_config = AccountConfig.find_or_initialize_by(account: current_account, key: AccountConfig::ALLOW_TO_DECLINE_KEY) %>
+        <% if can?(:manage, account_config) %>
+          <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
+            <%= f.hidden_field :key %>
+            <div class="flex items-center justify-between py-2.5">
+              <span>
+                <%= t('allow_to_decline_documents') %>
+              </span>
+              <%= f.check_box :value, class: 'toggle', checked: account_config.value != false, onchange: 'this.form.requestSubmit()' %>
+            </div>
+          <% end %>
+        <% end %>
         <% account_config = AccountConfig.find_or_initialize_by(account: current_account, key: AccountConfig::FORM_PREFILL_SIGNATURE_KEY) %>
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>

app/views/api_settings/index.html.erb

@@ -10,8 +10,11 @@
         <label for="api_key" class="text-sm font-semibold">X-Auth-Token</label>
         <div class="flex flex-col md:flex-row gap-4">
           <div class="flex w-full space-x-4">
-            <input id="api_key" type="text" value="<%= current_user.access_token.token %>" class="input font-mono input-bordered w-full" autocomplete="off" readonly>
-            <%= render 'shared/clipboard_copy', icon: 'copy', text: current_user.access_token.token, class: 'base-button', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
+            <% token = current_user.access_token.token %>
+            <masked-input class="block w-full" data-token="<%= token %>">
+              <input id="api_key" type="text" value="<%= token.sub(token[5..], '*' * token[5..].size) %>" class="input font-mono input-bordered w-full" autocomplete="off" readonly>
+            </masked-input>
+            <%= render 'shared/clipboard_copy', icon: 'copy', text: token, class: 'base-button', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
           </div>
           <%= button_to button_title(title: t('rotate'), disabled_with: t('rotate'), icon: svg_icon('reload', class: 'w-6 h-6')), settings_api_index_path, class: 'white-button w-full', data: { turbo_confirm: t('remove_existing_api_token_and_generated_a_new_one_are_you_sure_') } %>
         </div>

app/views/devise/shared/_select_server.html.erb

@@ -1,10 +1,10 @@
 <div class="text-center">
   <div class="join">
-    <a href="https://docuseal.co<%= request.fullpath.gsub('docuseal.eu', 'docuseal.co') %>" class="btn bg-base-200 join-item w-32  <%= 'bg-base-300' if request.host == 'docuseal.co' %>">
+    <a href="https://docuseal.com<%= request.fullpath.gsub('docuseal.eu', 'docuseal.com') %>" class="btn bg-base-200 join-item w-32  <%= 'bg-base-300' if request.host == 'docuseal.com' %>">
       <%= svg_icon 'world', class: 'w-5 h-5' %>
       Global
     </a>
-    <a href="https://docuseal.eu<%= request.fullpath.gsub('docuseal.co', 'docuseal.eu') %>" class="btn bg-base-200 join-item w-32 <%= 'bg-base-300' if request.host == 'docuseal.eu' %>">
+    <a href="https://docuseal.eu<%= request.fullpath.gsub('docuseal.com', 'docuseal.eu') %>" class="btn bg-base-200 join-item w-32 <%= 'bg-base-300' if request.host == 'docuseal.eu' %>">
       <%= svg_icon 'eu_flag', class: 'w-5 h-5' %>
       Europe
     </a>

app/views/email_smtp_settings/index.html.erb

@@ -48,7 +48,7 @@
         </div>
         <div class="form-control">
           <%= ff.label :from_email, t('send_from_email'), class: 'label' %>
-          <%= ff.email_field :from_email, value: value['from_email'], required: true, class: 'base-input' %>
+          <%= ff.email_field :from_email, value: value['from_email'], required: !Docuseal.multitenant?, class: 'base-input' %>
         </div>
       <% end %>
       <div class="form-control pt-2">

app/views/shared/_navbar.html.erb

@@ -10,7 +10,7 @@
   <% if signed_in? %>
     <div class="space-x-4 flex items-center">
       <% if Docuseal.demo? %>
-        <a href="https://docuseal.co/sign_up" class="btn btn-neutral btn-sm btn-outline inline-flex items-center justify-center" style="height: 37px">
+        <a href="https://docuseal.com/sign_up" class="btn btn-neutral btn-sm btn-outline inline-flex items-center justify-center" style="height: 37px">
           <%= t('sign_up') %>
         </a>
         <span class="hidden sm:inline">

app/views/shared/_powered_by.html.erb

@@ -1,6 +1,6 @@
 <div class="text-center px-2">
   <% if local_assigns[:with_counter] %>
-    <% count = Submitter.where.not(completed_at: nil).distinct.count(:submission_id) %>
+    <% count = CompletedSubmitter.distinct.count(:submission_id) %>
     <% if count > 1 %>
       <%= t('count_documents_signed_with_html', count:) %>
     <% else %>

app/views/submissions/_detailed_form.html.erb

@@ -31,7 +31,7 @@
                   </submitters-autocomplete>
                   <submitters-autocomplete data-field="phone">
                     <linked-input data-target-id="<%= "detailed_phone_#{item['linked_to_uuid']}" if item['linked_to_uuid'].present? %>">
-                      <input type="tel" pattern="^\+[0-9\s\-]+$" oninvalid="this.value ? this.setCustomValidity('Use internatioanl format: +1xxx...') : ''" oninput="this.setCustomValidity('')" name="submission[1][submitters][][phone]" autocomplete="off" class="base-input !h-10 mt-1.5 w-full" placeholder="<%= "#{t('phone')} (#{t('optional')})" %>" id="detailed_phone_<%= item['uuid'] %>">
+                      <input type="tel" pattern="^\+[0-9\s\-]+$" oninvalid="this.value ? this.setCustomValidity('<%= t('use_international_format_1xxx_') %>') : ''" oninput="this.setCustomValidity('')" name="submission[1][submitters][][phone]" autocomplete="off" class="base-input !h-10 mt-1.5 w-full" placeholder="<%= "#{t('phone')} (#{t('optional')})" %>" id="detailed_phone_<%= item['uuid'] %>">
                     </linked-input>
                   </submitters-autocomplete>
                 </div>

app/views/submissions/_phone_form.html.erb

@@ -21,7 +21,7 @@
                   <input type="hidden" name="submission[1][submitters][][uuid]" value="<%= item['uuid'] %>">
                   <submitters-autocomplete data-field="phone">
                     <linked-input data-target-id="<%= "phone_phone_#{item['linked_to_uuid']}" if item['linked_to_uuid'].present? %>">
-                      <%= tag.input type: 'tel', pattern: '^\+[0-9\s\-]+$', oninvalid: "this.value ? this.setCustomValidity('Use internatioanl format: +1xxx...') : ''", oninput: "this.setCustomValidity('')", name: 'submission[1][submitters][][phone]', autocomplete: 'off', class: 'base-input !h-10 w-full', placeholder: t('phone'), required: index.zero?, id: "phone_phone_#{item['uuid']}" %>
+                      <%= tag.input type: 'tel', pattern: '^\+[0-9\s\-]+$', oninvalid: "this.value ? this.setCustomValidity('#{t('use_international_format_1xxx_')}') : ''", oninput: "this.setCustomValidity('')", name: 'submission[1][submitters][][phone]', autocomplete: 'off', class: 'base-input !h-10 w-full', placeholder: t('phone'), required: index.zero?, id: "phone_phone_#{item['uuid']}" %>
                     </linked-input>
                   </submitters-autocomplete>
                   <% if submitters.size > 1 %>

app/views/submissions/_send_email.html.erb

@@ -2,12 +2,12 @@
   <% can_send_emails = Accounts.can_send_emails?(current_account) %>
   <div class="flex justify-between items-center">
     <%= f.label :send_email, for: uuid = SecureRandom.uuid, class: 'flex items-center cursor-pointer' do %>
-      <%= f.check_box :send_email, id: uuid, class: 'base-checkbox', disabled: !can_send_emails, checked: can_send_emails %>
-      <span class="label"><%= t('send_emails') %></span>
+      <%= f.check_box :send_email, id: uuid, class: 'base-checkbox', disabled: !can_send_emails, checked: can_send_emails && !local_assigns.key?(:resend_email) %>
+      <span class="label"><%= local_assigns[:resend_email] ? t('re_send_email') : t('send_email') %></span>
     <% end %>
     <div>
       <% if can_send_emails %>
-        <%= render 'email_stats' %>
+        <%= render 'submissions/email_stats' %>
         <%= content_for(:edit_button) || capture do %>
           <label>
             <%= f.check_box :is_custom_message, onchange: "[this.form.querySelector('#message_field').classList.toggle('hidden', !event.currentTarget.checked)]", checked: false, class: 'hidden peer' %>
@@ -39,7 +39,7 @@
     <div class="form-control space-y-2">
       <div class="form-control">
         <%= f.label :subject, t('subject'), class: 'label' %>
-        <%= f.text_field :subject, value: @template.preferences['request_email_subject'].presence || config.value['subject'], required: true, class: '!text-sm base-input w-full', dir: 'auto' %>
+        <%= f.text_field :subject, value: local_assigns[:submitter_email_message]&.subject.presence || template.preferences['request_email_subject'].presence || config.value['subject'], required: true, class: '!text-sm base-input w-full', dir: 'auto' %>
       </div>
       <div class="form-control">
         <div class="flex items-center">
@@ -49,14 +49,16 @@
           </span>
         </div>
         <autoresize-textarea>
-          <%= f.text_area :body, value: @template.preferences['request_email_body'].presence || config.value['body'], required: true, class: 'base-textarea w-full', rows: 10, dir: 'auto' %>
+          <%= f.text_area :body, value: local_assigns[:submitter_email_message]&.body.presence || template.preferences['request_email_body'].presence || config.value['body'], required: true, class: 'base-textarea w-full', rows: 10, dir: 'auto' %>
         </autoresize-textarea>
-        <label for="<%= uuid = SecureRandom.uuid %>" class="flex items-center cursor-pointer">
-          <%= check_box_tag :save_message, id: uuid, class: 'base-checkbox', checked: false %>
-          <span class="label"><%= t('save_as_default_template_message') %></span>
-        </label>
+        <% unless local_assigns.fetch(:disable_save_as_default_template_option, false) %>
+          <label for="<%= uuid = SecureRandom.uuid %>" class="flex items-center cursor-pointer">
+            <%= check_box_tag :save_message, id: uuid, class: 'base-checkbox', checked: false %>
+            <span class="label"><%= t('save_as_default_template_message') %></span>
+          </label>
+        <% end %>
       </div>
-      <%= render 'message_fields' %>
+      <%= render 'submissions/message_fields' %>
     </div>
   </div>
 </div>

app/views/submissions/_value.html.erb

@@ -1,5 +1,5 @@
 <% align = field.dig('preferences', 'align') %>
-<field-value dir="auto" class="flex absolute text-[1.6vw] lg:text-base <%= 'font-serif' if field.dig('preferences', 'font') == 'Times' %> <%= align == 'right' ? 'justify-end' : (align == 'center' ? 'justify-center' : '') %>" style="width: <%= area['w'] * 100 %>%; height: <%= area['h'] * 100 %>%; left: <%= area['x'] * 100 %>%; top: <%= area['y'] * 100 %>%; <%= "font-size: #{field['preferences']['font_size']}pt" if field.dig('preferences', 'font_size') %>">
+<field-value dir="auto" class="flex absolute text-[1.6vw] lg:text-base <%= 'font-serif' if field.dig('preferences', 'font') == 'Times' %> <%= align == 'right' ? 'justify-end' : (align == 'center' ? 'justify-center' : '') %>" style="width: <%= area['w'] * 100 %>%; height: <%= area['h'] * 100 %>%; left: <%= area['x'] * 100 %>%; top: <%= area['y'] * 100 %>%; <%= "font-size: clamp(4pt, 1.6vw, #{field['preferences']['font_size']}pt); line-height: `clamp(6pt, 2.0vw, #{field['preferences']['font_size'].to_i + 3}pt)`" if field.dig('preferences', 'font_size') %>">
   <% if field['type'] == 'signature' %>
     <div class="flex flex-col justify-between h-full overflow-hidden">
       <div class="flex-grow flex overflow-hidden" style="min-height: 50%">

app/views/submissions/show.html.erb

@@ -17,41 +17,43 @@
       <% end %>
       <% if last_submitter = @submission.submitters.to_a.select(&:completed_at?).max_by(&:completed_at) %>
         <% is_all_completed = @submission.submitters.to_a.all?(&:completed_at?) %>
-        <div class="join relative">
-          <download-button data-src="<%= submitter_download_index_path(last_submitter.slug, { sig: params[:sig], combined: is_combined_enabled }.compact) %>" class="base-button <%= '!rounded-r-none !pr-2' if is_all_completed && !is_combined_enabled %>">
-            <span class="flex items-center justify-center space-x-2" data-target="download-button.defaultButton">
-              <%= svg_icon('download', class: 'w-6 h-6') %>
-              <span class="hidden md:inline"><%= t('download') %></span>
-            </span>
-            <span class="flex items-center justify-center space-x-2 hidden" data-target="download-button.loadingButton">
-              <%= svg_icon('loader', class: 'w-6 h-6 animate-spin') %>
-              <span class="hidden md:inline"><%= t('downloading') %></span>
-            </span>
-          </download-button>
-          <% if is_all_completed && !is_combined_enabled %>
-            <div class="dropdown dropdown-end">
-              <label tabindex="0" class="base-button !rounded-l-none !pl-1 !pr-2 !border-l-neutral-500">
-                <span class="text-sm align-text-top">
-                  <%= svg_icon('chevron_down', class: 'w-6 h-6 flex-shrink-0 stroke-2') %>
-                </span>
-              </label>
-              <ul tabindex="0" class="z-10 dropdown-content p-2 mt-2 shadow menu text-base bg-base-100 rounded-box text-right">
-                <li>
-                  <download-button data-src="<%= submitter_download_index_path(last_submitter.slug, { sig: params[:sig], combined: true }.compact) %>" class="flex items-center">
-                    <span class="flex items-center justify-center space-x-2" data-target="download-button.defaultButton">
-                      <%= svg_icon('download', class: 'w-6 h-6 flex-shrink-0') %>
-                      <span class="whitespace-nowrap"><%= t('download_combined_pdf') %></span>
-                    </span>
-                    <span class="flex items-center justify-center space-x-2 hidden" data-target="download-button.loadingButton">
-                      <%= svg_icon('loader', class: 'w-6 h-6 animate-spin') %>
-                      <span><%= t('downloading') %></span>
-                    </span>
-                  </download-button>
-                </li>
-              </ul>
-            </div>
-          <% end %>
-        </div>
+        <% if is_all_completed || !is_combined_enabled %>
+          <div class="join relative">
+            <download-button data-src="<%= submitter_download_index_path(last_submitter.slug, { sig: params[:sig], combined: is_combined_enabled }.compact) %>" class="base-button <%= '!rounded-r-none !pr-2' if is_all_completed && !is_combined_enabled %>">
+              <span class="flex items-center justify-center space-x-2" data-target="download-button.defaultButton">
+                <%= svg_icon('download', class: 'w-6 h-6') %>
+                <span class="hidden md:inline"><%= t('download') %></span>
+              </span>
+              <span class="flex items-center justify-center space-x-2 hidden" data-target="download-button.loadingButton">
+                <%= svg_icon('loader', class: 'w-6 h-6 animate-spin') %>
+                <span class="hidden md:inline"><%= t('downloading') %></span>
+              </span>
+            </download-button>
+            <% if is_all_completed && !is_combined_enabled %>
+              <div class="dropdown dropdown-end">
+                <label tabindex="0" class="base-button !rounded-l-none !pl-1 !pr-2 !border-l-neutral-500">
+                  <span class="text-sm align-text-top">
+                    <%= svg_icon('chevron_down', class: 'w-6 h-6 flex-shrink-0 stroke-2') %>
+                  </span>
+                </label>
+                <ul tabindex="0" class="z-10 dropdown-content p-2 mt-2 shadow menu text-base bg-base-100 rounded-box text-right">
+                  <li>
+                    <download-button data-src="<%= submitter_download_index_path(last_submitter.slug, { sig: params[:sig], combined: true }.compact) %>" class="flex items-center">
+                      <span class="flex items-center justify-center space-x-2" data-target="download-button.defaultButton">
+                        <%= svg_icon('download', class: 'w-6 h-6 flex-shrink-0') %>
+                        <span class="whitespace-nowrap"><%= t('download_combined_pdf') %></span>
+                      </span>
+                      <span class="flex items-center justify-center space-x-2 hidden" data-target="download-button.loadingButton">
+                        <%= svg_icon('loader', class: 'w-6 h-6 animate-spin') %>
+                        <span><%= t('downloading') %></span>
+                      </span>
+                    </download-button>
+                  </li>
+                </ul>
+              </div>
+            <% end %>
+          </div>
+        <% end %>
       <% elsif @submission.submitters.to_a.size == 1 && !@submission.expired? && !@submission.submitters.to_a.first.declined_at? %>
         <%= render 'shared/clipboard_copy', text: submit_form_url(slug: @submission.submitters.to_a.first.slug), class: 'base-button', icon_class: 'w-6 h-6 text-white', copy_title: t('copy_share_link'), copied_title: t('copied_to_clipboard') %>
       <% end %>
@@ -107,12 +109,21 @@
       <% (@submission.template_submitters || @submission.template.submitters).each_with_index do |item, index| %>
         <% submitter = @submission.submitters.find { |e| e.uuid == item['uuid'] } %>
         <div class="sticky -top-1 bg-base-100 pt-1 -mt-1">
-          <div class="border border-base-300 rounded-md px-2 py-1 mb-1">
-            <div class="flex items-center space-x-1">
-              <span class="mx-1 w-3 h-3 rounded-full <%= colors[index] %>"></span>
-              <span class="text-lg" dir="auto">
-                <%= (@submission.template_submitters || @submission.template.submitters).find { |e| e['uuid'] == submitter&.uuid }&.dig('name') || "#{(index + 1).ordinalize} Submitter" %>
-              </span>
+          <div class="group border border-base-300 rounded-md px-2 py-1 mb-1">
+            <div class="flex items-center justify-between">
+              <div class="flex items-center space-x-1">
+                <span class="mx-1 w-3 h-3 shrink-0 rounded-full <%= colors[index] %>"></span>
+                <span class="text-lg" dir="auto">
+                  <%= (@submission.template_submitters || @submission.template.submitters).find { |e| e['uuid'] == submitter&.uuid }&.dig('name') || "#{(index + 1).ordinalize} Submitter" %>
+                </span>
+              </div>
+              <% if signed_in? && can?(:update, submitter) && !submitter.completed_at? && !submitter.declined_at? && !@submission.archived_at? && !@submission.expired? && !submitter.start_form_submission_events.any? %>
+                <span class="tooltip tooltip-left" data-tip="<%= t('edit') %>">
+                  <%= link_to edit_submitter_path(submitter), class: 'shrink-0 inline md:hidden md:group-hover:inline', data: { turbo_frame: 'modal' } do %>
+                    <%= svg_icon('pencil', class: 'w-5 h-5') %>
+                  <% end %>
+                </span>
+              <% end %>
             </div>
             <% if submitter&.name.present? %>
               <div class="flex items-center space-x-1 mt-1">

app/views/submit_form/_submission_form.html.erb

@@ -1,4 +1,4 @@
 <% data_attachments = attachments_index.values.select { |e| e.record_id == submitter.id }.to_json(only: %i[uuid created_at], methods: %i[url filename content_type]) %>
 <% data_fields = (submitter.submission.template_fields || submitter.submission.template.fields).select { |f| f['submitter_uuid'] == submitter.uuid }.to_json %>
 <% invite_submitters = (submitter.submission.template_submitters || submitter.submission.template.submitters).select { |s| s['invite_by_uuid'] == submitter.uuid && submitter.submission.submitters.none? { |e| e.uuid == s['uuid'] } }.to_json %>
-<submission-form data-is-demo="<%= Docuseal.demo? %>" data-require-signing-reason="<%= configs[:require_signing_reason] %>" data-with-signature-id="<%= configs[:with_signature_id] %>" data-with-confetti="<%= configs[:with_confetti] %>" data-completed-redirect-url="<%= submitter.preferences['completed_redirect_url'].presence || submitter.submission.template.preferences['completed_redirect_url'] %>" data-completed-message="<%= (configs[:completed_message]&.compact_blank.presence || submitter.submission.template.preferences['completed_message'] || {}).to_json %>" data-completed-button="<%= configs[:completed_button].to_json %>" data-go-to-last="<%= submitter.preferences.key?('go_to_last') ? submitter.preferences['go_to_last'] : submitter.opened_at? %>" data-submitter="<%= submitter.to_json(only: %i[uuid slug name phone email]) %>" data-can-send-email="<%= Accounts.can_send_emails?(submitter.submission.account) %>" data-invite-submitters="<%= invite_submitters %>" data-attachments="<%= data_attachments %>" data-fields="<%= data_fields %>" data-values="<%= submitter.values.to_json %>" data-with-typed-signature="<%= configs[:with_typed_signature] %>" data-previous-signature-value="<%= local_assigns[:signature_attachment]&.uuid %>" data-remember-signature="<%= configs[:prefill_signature] %>" data-dry-run="<%= local_assigns[:dry_run] %>" data-expand="<%= local_assigns[:expand] %>" data-scroll-padding="<%= local_assigns[:scroll_padding] %>" data-language="<%= I18n.locale.to_s.split('-').first %>"></submission-form>
+<submission-form data-is-demo="<%= Docuseal.demo? %>" data-reuse-signature="<%= configs[:reuse_signature] %>" data-require-signing-reason="<%= configs[:require_signing_reason] %>" data-with-signature-id="<%= configs[:with_signature_id] %>" data-with-confetti="<%= configs[:with_confetti] %>" data-completed-redirect-url="<%= submitter.preferences['completed_redirect_url'].presence || submitter.submission.template.preferences['completed_redirect_url'] %>" data-completed-message="<%= (configs[:completed_message]&.compact_blank.presence || submitter.submission.template.preferences['completed_message'] || {}).to_json %>" data-completed-button="<%= configs[:completed_button].to_json %>" data-go-to-last="<%= submitter.preferences.key?('go_to_last') ? submitter.preferences['go_to_last'] : submitter.opened_at? %>" data-submitter="<%= submitter.to_json(only: %i[uuid slug name phone email]) %>" data-can-send-email="<%= Accounts.can_send_emails?(submitter.submission.account) %>" data-invite-submitters="<%= invite_submitters %>" data-attachments="<%= data_attachments %>" data-fields="<%= data_fields %>" data-values="<%= submitter.values.to_json %>" data-with-typed-signature="<%= configs[:with_typed_signature] %>" data-previous-signature-value="<%= local_assigns[:signature_attachment]&.uuid %>" data-remember-signature="<%= configs[:prefill_signature] %>" data-dry-run="<%= local_assigns[:dry_run] %>" data-expand="<%= local_assigns[:expand] %>" data-scroll-padding="<%= local_assigns[:scroll_padding] %>" data-language="<%= I18n.locale.to_s.split('-').first %>"></submission-form>

app/views/submit_form/show.html.erb

@@ -15,18 +15,21 @@
             <%= @submitter.submission.template.name %>
           </div>
           <div class="flex items-center space-x-2" style="margin-left: 20px; flex-shrink: 0">
-            <div>
-              <%= render 'shared/html_modal', title: t(:decline), btn_text: t(:decline), btn_class: 'btn btn-sm !px-5', button_id: 'decline_button' do %>
-                <%= render 'submit_form/decline_form', submitter: @submitter %>
-              <% end %>
-            </div>
+            <% if @form_configs[:with_decline] %>
+              <div>
+                <%= render 'shared/html_modal', title: t(:decline), btn_text: t(:decline), btn_class: 'btn btn-sm !px-5', button_id: 'decline_button' do %>
+                  <%= render 'submit_form/decline_form', submitter: @submitter %>
+                <% end %>
+              </div>
+            <% end %>
             <download-button data-src="<%= submit_form_download_index_path(@submitter.slug) %>" class="btn btn-neutral text-white btn-sm !px-4">
-              <span class="flex items-center justify-center space-x-2" data-target="download-button.defaultButton">
-                <span><%= t('download') %></span>
+              <span class="flex items-center justify-center" data-target="download-button.defaultButton">
+                <%= svg_icon('download', class: 'w-6 h-6 inline md:hidden') %>
+                <span class="hidden md:inline"><%= t('download') %></span>
               </span>
               <span class="flex items-center justify-center space-x-2 hidden" data-target="download-button.loadingButton">
                 <%= svg_icon('loader', class: 'w-6 h-6 animate-spin') %>
-                <span><%= t('downloading') %></span>
+                <span class="hidden md:inline"><%= t('downloading') %></span>
               </span>
             </download-button>
           </div>
@@ -59,7 +62,7 @@
           </div>
         <% end %>
       <% end %>
-      <%= render 'shared/attribution', link_path: '/start', account: @submitter.account %>
+      <%= render 'shared/attribution', link_path: '/start', account: @submitter.account, with_style: false %>
     </div>
   </div>
 </div>

app/views/submit_form_draw_signature/show.html.erb

@@ -23,7 +23,7 @@
         </div>
         <div class="w-full bg-white rounded-2xl border relative" style="height: 300px">
           <canvas class="w-full"></canvas>
-          <button aria-label="<%= t('clear') %>" class="btn btn-ghost btn-sm font-medium top-0 right-0 absolute mt-1 mr-1">
+          <button aria-label="Clear" class="btn btn-ghost btn-sm font-medium top-0 right-0 absolute mt-1 mr-1">
             <%= svg_icon('reload', class: 'w-5 h-5') %>
             <span class="inline"><%= t('clear') %></span>
           </button>

app/views/submitters/edit.html.erb

@@ -0,0 +1,29 @@
+<%= render 'shared/turbo_modal_large', title: t('edit_recipient') do %>
+  <div class="px-5 mb-5 mt-4">
+    <%= form_for '', url: submitter_path(@submitter), method: :patch, html: { autocomplete: 'off' }, data: { turbo_frame: :_top } do |f| %>
+      <div class="mb-2">
+        <submitter-item class="form-control">
+          <submitters-autocomplete data-field="name">
+            <%= text_field_tag 'submitter[name]', @submitter.name, autocomplete: 'off', class: 'base-input !h-10 w-full', placeholder: "#{t('name')} (#{t('optional')})", dir: 'auto' %>
+          </submitters-autocomplete>
+          <div class="grid md:grid-cols-2 gap-1.5 mt-1.5">
+            <submitters-autocomplete data-field="email">
+              <%= email_field_tag 'submitter[email]', @submitter.email, autocomplete: 'off', class: 'base-input !h-10 mt-1.5 w-full', placeholder: "#{t('email')} (#{t('optional')})" %>
+            </submitters-autocomplete>
+            <submitters-autocomplete data-field="phone">
+              <%= telephone_field_tag 'submitter[phone]', @submitter.phone, autocomplete: 'off', pattern: '^\+[0-9\s\-]+$', class: 'base-input !h-10 mt-1.5 w-full', placeholder: "#{t('phone')} (#{t('optional')})", oninvalid: "this.value ? this.setCustomValidity('#{t('use_international_format_1xxx_')}') : ''", oninput: "this.setCustomValidity('')" %>
+            </submitters-autocomplete>
+          </div>
+        </submitter-item>
+      </div>
+      <div>
+        <%= render 'submissions/send_email', f:, template: @submitter.template, submitter: @submitter, resend_email: @submitter.sent_at?, submitter_email_message: @submitter_email_message, disable_save_as_default_template_option: true %>
+        <%= render 'submissions/send_sms', f:, resend_sms: @submitter.sent_at? %>
+      </div>
+      <div class="form-control mt-4">
+        <%= f.button button_title(title: t('update_recipient'), disabled_with: t('updating')), class: 'base-button' %>
+      </div>
+    <% end %>
+  </div>
+  <%= content_for(:modal_extra) %>
+<% end %>

app/views/templates/_submission.html.erb

@@ -26,7 +26,7 @@
       </div>
     </a>
   <% end %>
-  <a href="<%= submission_path(submission) %>" class="w-full flex flex-col md:flex-row space-y-4 md:space-y-0 md:justify-between px-5 md:px-6 pb-5 md:items-center pt-5">
+  <div class="w-full flex flex-col md:flex-row space-y-4 md:space-y-0 md:justify-between px-5 md:px-6 pb-5 md:items-center pt-5 relative cursor-pointer">
     <% submitters = (submission.template_submitters || submission.template.submitters).filter_map { |item| submission.submitters.find { |e| e.uuid == item['uuid'] } } %>
     <% is_submission_completed = submitters.all?(&:completed_at?) && submitters.size.positive? %>
     <% if submitters.size == 1 %>
@@ -41,22 +41,31 @@
                 </span>
               </div>
             <% else %>
-              <div class="tooltip flex" data-tip="<%= l(submitter.status_event_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %>">
-                <span class="badge <%= status_badges[submitter.status] %> md:w-32 badge-lg bg-opacity-50 uppercase text-sm font-semibold">
+              <a href="<%= submission_path(submission) %>" class="flex z-[1]">
+                <span class="badge <%= status_badges[submitter.status] %> md:w-32 badge-lg bg-opacity-50 uppercase text-sm font-semibold tooltip" data-tip="<%= l(submitter.status_event_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %>">
                   <%= t(submitter.status) %>
                 </span>
-              </div>
+              </a>
             <% end %>
-            <span class="text-lg break-all flex items-center">
-              <%= submitter.name || submitter.email || submitter.phone %>
+            <span class="flex items-center z-[1]">
+              <a href="<%= submission_path(submission) %>" class="text-lg break-all peer">
+                <%= submitter.name || submitter.email || submitter.phone %>
+              </a>
+              <% if can?(:update, submitter) && !submitter.start_form_submission_events.any? && !submission.archived_at? && !submission.expired? %>
+                <span class="pl-0.5 tooltip tooltip-top md:opacity-0 md:hover:opacity-100 md:peer-hover:opacity-100" data-tip="<%= t('edit') %>">
+                  <%= link_to edit_submitter_path(submitter), class: 'shrink-0', data: { turbo_frame: 'modal' } do %>
+                    <%= svg_icon('pencil', class: 'w-5 h-5') %>
+                  <% end %>
+                </span>
+              <% end %>
             </span>
           </span>
         </div>
       </div>
-      <div class="flex space-x-2 items-center">
+      <div class="flex space-x-2 items-center z-[1]">
         <% if submitter.completed_at? %>
-          <form onsubmit="event.preventDefault()" class="flex-1 md:flex-none">
-            <button onclick="event.stopPropagation()" class="w-full md:w-fit">
+          <div class="flex-1 md:flex-none">
+            <div class="w-full md:w-fit">
               <download-button data-src="<%= submitter_download_index_path(submitter.slug) %>" class="btn btn-sm btn-neutral text-white w-full md:w-36">
                 <span class="flex items-center justify-center space-x-1 <%= 'md:space-x-2' if t('download').length < 11 %>" data-target="download-button.defaultButton">
                   <%= svg_icon('download', class: 'w-5 h-5 stroke-2') %>
@@ -67,37 +76,39 @@
                   <span class="inline"><%= t('download')[..-2] %>...</span>
                 </span>
               </download-button>
-            </button>
-          </form>
+            </div>
+          </div>
         <% elsif !submission.archived_at? && !template.archived_at? && !submission.expired? && !submitter.declined_at? %>
           <% if current_user.email == submitter.email %>
-            <form data-turbo="false" method="get" action="<%= submit_form_url(slug: submitter.slug) %>" class="flex-1 md:flex-none">
-              <button onclick="event.stopPropagation()" class="btn btn-sm btn-neutral btn-outline bg-white w-full md:w-36 flex">
+            <div class="flex-1 md:flex-none md:w-36 flex">
+              <a href="<%= submit_form_url(slug: submitter.slug) %>" data-turbo="false" target="_blank" class="btn btn-sm btn-neutral btn-outline bg-white w-full md:w-36 flex z-[1]">
                 <span class="flex items-center justify-center space-x-1 md:space-x-2">
                   <% if t('sign_now').length < 12 %>
                     <%= svg_icon('writing_sign', class: 'w-4 h-4 stroke-2') %>
                   <% end %>
                   <span class="inline shrink-0"><%= t('sign_now') %></span>
                 </span>
-              </button>
-            </form>
+              </a>
+            </div>
           <% else %>
             <div class="flex-1 md:flex-none">
-              <%= render 'shared/clipboard_copy', text: submit_form_url(slug: submitter.slug), class: 'btn btn-sm btn-neutral text-white md:w-36 flex', icon_class: 'w-6 h-6 text-white', copy_title: t('copy_link').length < 10 ? t('copy_link') : t('copy'), copy_title_md: t('copy'), copied_title_md: t('copied') %>
+              <%= render 'shared/clipboard_copy', text: submit_form_url(slug: submitter.slug), class: 'btn btn-sm btn-neutral text-white md:w-36 flex z-[1]', icon_class: 'w-6 h-6 text-white', copy_title: t('copy_link').length < 10 ? t('copy_link') : t('copy'), copy_title_md: t('copy'), copied_title_md: t('copied') %>
             </div>
           <% end %>
         <% end %>
-        <div class="flex-1 md:flex-none">
-          <span class="btn btn-outline btn-sm w-full md:w-24"><%= t('view') %></span>
+        <div class="flex-1 md:flex-none z-[1]">
+          <a href="<%= submission_path(submission) %>" class="btn btn-outline btn-sm w-full md:w-24">
+            <%= t('view') %>
+          </a>
         </div>
         <% if !submission.archived_at? && !template.archived_at? && can?(:destroy, submission) %>
           <span data-tip="<%= t('archive') %>" class="sm:tooltip tooltip-top">
-            <%= button_to button_title(title: nil, disabled_with: t(:archive).first(4), icon: svg_icon('archive', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm w-full md:w-fit', form: { class: 'flex' }, title: t('archive'), method: :delete, onclick: 'event.stopPropagation()' %>
+            <%= button_to button_title(title: nil, disabled_with: t(:archive).first(4), icon: svg_icon('archive', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm w-full md:w-fit', form: { class: 'flex' }, title: t('archive'), method: :delete %>
           </span>
         <% end %>
         <% if local_assigns[:archived] && can?(:destroy, submission) %>
           <span data-tip="<%= t('remove') %>" class="sm:tooltip tooltip-top">
-            <%= button_to button_title(title: nil, disabled_with: t(:remove).first(3), icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission, permanently: true), class: 'btn btn-outline btn-sm w-full md:w-fit', form: { class: 'flex' }, title: t('remove'), method: :delete, data: { turbo_confirm: t('submission_deletion_is_irreversible_and_will_permanently_remove_all_associated_signed_documents_with_it_are_you_sure_') }, onclick: 'event.stopPropagation()' %>
+            <%= button_to button_title(title: nil, disabled_with: t(:remove).first(3), icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission, permanently: true), class: 'btn btn-outline btn-sm w-full md:w-fit', form: { class: 'flex' }, title: t('remove'), method: :delete, data: { turbo_confirm: t('submission_deletion_is_irreversible_and_will_permanently_remove_all_associated_signed_documents_with_it_are_you_sure_') } %>
           </span>
         <% end %>
       </div>
@@ -106,11 +117,11 @@
         <div class="flex flex-col md:flex-row md:items-center gap-3">
           <% if is_submission_completed %>
             <% latest_submitter = submitters.select(&:completed_at?).max_by(&:completed_at) %>
-            <div class="tooltip flex" data-tip="<%= l(latest_submitter.status_event_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %>">
+            <a href="<%= submission_path(submission) %>" class="z-[1] tooltip flex" data-tip="<%= l(latest_submitter.status_event_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %>">
               <span class="badge <%= status_badges[latest_submitter.status] %> md:w-32 bg-opacity-50 badge-lg uppercase text-sm font-semibold">
                 <%= t(latest_submitter.status) %>
               </span>
-            </div>
+            </a>
           <% elsif submission.expired? %>
             <div class="tooltip flex" data-tip="<%= l(submission.expire_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %>">
               <span class="badge badge-error md:w-32 bg-opacity-50 badge-lg uppercase text-sm font-semibold">
@@ -123,46 +134,49 @@
               <div class="relative flex justify-between items-start md:items-center space-x-3">
                 <span class="flex flex-col md:flex-row md:items-center gap-2">
                   <% if !is_submission_completed && !submission.expired? %>
-                    <div class="tooltip flex" data-tip="<%= l(submitter.status_event_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %>">
+                    <a href="<%= submission_path(submission) %>" class="z-[1] tooltip flex" data-tip="<%= l(submitter.status_event_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) %>">
                       <span class="badge md:w-24 <%= status_badges[submitter.status] %> bg-opacity-50 uppercase text-xs font-semibold">
                         <%= t(submitter.status) %>
                       </span>
-                    </div>
+                    </a>
                   <% end %>
-                  <span class="text-lg break-all">
-                    <%= submitter.name || submitter.email || submitter.phone %>
+                  <span class="flex items-center z-[1]">
+                    <a href="<%= submission_path(submission) %>" class="text-lg break-all peer">
+                      <%= submitter.name || submitter.email || submitter.phone %>
+                    </a>
+                    <% if can?(:update, submitter) && !submitter.start_form_submission_events.any? && !submission.archived_at? && !submission.expired? %>
+                      <span class="pl-0.5 tooltip tooltip-top md:opacity-0 md:hover:opacity-100 md:peer-hover:opacity-100" data-tip="<%= t('edit') %>">
+                        <%= link_to edit_submitter_path(submitter), class: 'shrink-0', data: { turbo_frame: 'modal' } do %>
+                          <%= svg_icon('pencil', class: 'w-5 h-5') %>
+                        <% end %>
+                      </span>
+                    <% end %>
                   </span>
                 </span>
                 <% if submitter.completed_at? && !is_submission_completed %>
-                  <form onsubmit="event.preventDefault()">
-                    <button onclick="event.stopPropagation()">
-                      <download-button data-src="<%= submitter_download_index_path(submitter.slug) %>" class="absolute md:relative top-0 right-0 btn btn-xs btn-neutral text-white md:w-36">
-                        <span class="flex items-center justify-center space-x-1 md:space-x-2" data-target="download-button.defaultButton">
-                          <%= svg_icon('download', class: 'w-4 h-4 stroke-2') %>
-                          <span class="inline"><%= t('download') %></span>
-                        </span>
-                        <span class="flex items-center justify-center space-x-1 md:space-x-2 hidden" data-target="download-button.loadingButton">
-                          <%= svg_icon('loader', class: 'w-4 h-4 animate-spin') %>
-                          <span class="inline"><%= t('download')[..-2] %>...</span>
-                        </span>
-                      </download-button>
-                    </button>
-                  </form>
+                  <download-button data-src="<%= submitter_download_index_path(submitter.slug) %>" class="absolute md:relative top-0 right-0 btn btn-xs btn-neutral text-white md:w-36 z-[1]">
+                    <span class="flex items-center justify-center space-x-1 md:space-x-2" data-target="download-button.defaultButton">
+                      <%= svg_icon('download', class: 'w-4 h-4 stroke-2') %>
+                      <span class="inline"><%= t('download') %></span>
+                    </span>
+                    <span class="flex items-center justify-center space-x-1 md:space-x-2 hidden" data-target="download-button.loadingButton">
+                      <%= svg_icon('loader', class: 'w-4 h-4 animate-spin') %>
+                      <span class="inline"><%= t('download')[..-2] %>...</span>
+                    </span>
+                  </download-button>
                 <% elsif !template.archived_at? && !submission.archived_at? && !is_submission_completed && !submission.expired? && !submitter.declined_at? %>
                   <div class="relative flex items-center space-x-3">
                     <% if current_user.email == submitter.email %>
-                      <form data-turbo="false" method="get" action="<%= submit_form_url(slug: submitter.slug) %>">
-                        <button onclick="event.stopPropagation()" class="absolute md:relative top-0 right-0 btn btn-xs btn-outline btn-neutral bg-white w-28 md:w-36">
-                          <span class="flex items-center justify-center space-x-1 md:space-x-2">
-                            <% if t('sign_now').length < 12 %>
-                              <%= svg_icon('writing_sign', class: 'w-4 h-4 stroke-2') %>
-                            <% end %>
-                            <span class="inline shrink-0"><%= t('sign_now') %></span>
-                          </span>
-                        </button>
-                      </form>
+                      <a href="<%= submit_form_url(slug: submitter.slug) %>" data-turbo="false" target="_blank" class="absolute md:relative top-0 right-0 btn btn-xs btn-outline btn-neutral bg-white w-28 md:w-36 z-[1]">
+                        <span class="flex items-center justify-center space-x-1 md:space-x-2">
+                          <% if t('sign_now').length < 12 %>
+                            <%= svg_icon('writing_sign', class: 'w-4 h-4 stroke-2') %>
+                          <% end %>
+                          <span class="inline shrink-0"><%= t('sign_now') %></span>
+                        </span>
+                      </a>
                     <% else %>
-                      <%= render 'shared/clipboard_copy', text: submit_form_url(slug: submitter.slug), class: 'absolute md:relative top-0 right-0 btn btn-xs text-xs btn-neutral text-white w-28 md:w-36 flex', icon_class: 'w-4 h-4 text-white', copy_title: t('copy_link'), copy_title_md: t('copy_link').length < 10 ? t('copy_link') : t('copy'), copied_title_md: t('copied') %>
+                      <%= render 'shared/clipboard_copy', text: submit_form_url(slug: submitter.slug), class: 'absolute md:relative top-0 right-0 btn btn-xs text-xs btn-neutral text-white w-28 md:w-36 flex z-[1]', icon_class: 'w-4 h-4 text-white', copy_title: t('copy_link'), copy_title_md: t('copy_link').length < 10 ? t('copy_link') : t('copy'), copied_title_md: t('copied') %>
                     <% end %>
                   </div>
                 <% end %>
@@ -171,40 +185,41 @@
           </div>
         </div>
       </div>
-      <div class="flex space-x-1 md:space-x-2 items-center">
+      <div class="flex space-x-1 md:space-x-2 items-center z-[1]">
         <% if is_submission_completed %>
           <% latest_submitter = submitters.select(&:completed_at?).max_by(&:completed_at) %>
           <div class="flex-1 md:flex-none">
-            <form onsubmit="event.preventDefault()" class="w-full md:w-fit">
-              <button onclick="event.stopPropagation()" class="w-full">
-                <download-button data-src="<%= submitter_download_index_path(latest_submitter.slug) %>" class="btn btn-sm btn-neutral text-white w-full md:w-36">
-                  <span class="flex items-center justify-center space-x-1 md:space-x-2" data-target="download-button.defaultButton">
-                    <%= svg_icon('download', class: 'w-5 h-5 stroke-2') %>
-                    <span class="inline"><%= t('download') %></span>
-                  </span>
-                  <span class="flex items-center justify-center space-x-1 md:space-x-2 hidden" data-target="download-button.loadingButton">
-                    <%= svg_icon('loader', class: 'w-5 h-5 animate-spin') %>
-                    <span class="inline"><%= t('download')[..-2] %>...</span>
-                  </span>
-                </download-button>
-              </button>
-            </form>
+            <div class="w-full md:w-fit">
+              <download-button data-src="<%= submitter_download_index_path(latest_submitter.slug) %>" class="btn btn-sm btn-neutral text-white w-full md:w-36 z-[1]">
+                <span class="flex items-center justify-center space-x-1 md:space-x-2" data-target="download-button.defaultButton">
+                  <%= svg_icon('download', class: 'w-5 h-5 stroke-2') %>
+                  <span class="inline"><%= t('download') %></span>
+                </span>
+                <span class="flex items-center justify-center space-x-1 md:space-x-2 hidden" data-target="download-button.loadingButton">
+                  <%= svg_icon('loader', class: 'w-5 h-5 animate-spin') %>
+                  <span class="inline"><%= t('download')[..-2] %>...</span>
+                </span>
+              </download-button>
+            </div>
           </div>
         <% end %>
-        <div class="flex-1 md:flex-none">
-          <span class="btn btn-outline btn-sm w-full md:w-24"><%= t('view') %></span>
+        <div class="flex-1 md:flex-none z-[1]">
+          <a href="<%= submission_path(submission) %>" class="btn btn-outline btn-sm w-full md:w-24">
+            <%= t('view') %>
+          </a>
         </div>
         <% if !submission.archived_at? && !template.archived_at? %>
           <span data-tip="<%= t('archive') %>" class="sm:tooltip tooltip-top">
-            <%= button_to button_title(title: nil, disabled_with: t(:archive).first(4), icon: svg_icon('archive', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm w-full md:w-fit', form: { class: 'flex' }, title: t('archive'), method: :delete, onclick: 'event.stopPropagation()' %>
+            <%= button_to button_title(title: nil, disabled_with: t(:archive).first(4), icon: svg_icon('archive', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm w-full md:w-fit', form: { class: 'flex' }, title: t('archive'), method: :delete %>
           </span>
         <% end %>
         <% if local_assigns[:archived] && can?(:destroy, submission) %>
           <span data-tip="<%= t('remove') %>" class="sm:tooltip tooltip-top">
-            <%= button_to button_title(title: nil, disabled_with: t(:remove).first(3), icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission, permanently: true), class: 'btn btn-outline btn-sm w-full md:w-fit', form: { class: 'flex' }, title: t('remove'), method: :delete, data: { turbo_confirm: t('submission_deletion_is_irreversible_and_will_permanently_remove_all_associated_signed_documents_with_it_are_you_sure_') }, onclick: 'event.stopPropagation()' %>
+            <%= button_to button_title(title: nil, disabled_with: t(:remove).first(3), icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission, permanently: true), class: 'btn btn-outline btn-sm w-full md:w-fit', form: { class: 'flex' }, title: t('remove'), method: :delete, data: { turbo_confirm: t('submission_deletion_is_irreversible_and_will_permanently_remove_all_associated_signed_documents_with_it_are_you_sure_') } %>
           </span>
         <% end %>
       </div>
     <% end %>
-  </a>
+    <a href="<%= submission_path(submission) %>" class="top-0 bottom-0 left-0 right-0 absolute"></a>
+  </div>
 </div>

app/views/users/_bottom_links.html.erb

@@ -0,0 +1,16 @@
+<div class="flex items-center space-x-1">
+  <% if %w[archived integration].include?(params[:status]) %>
+    <%= link_to t('view_active'), settings_users_path, class: 'link text-sm' %>
+  <% else %>
+    <% archived_exists = current_account.users.archived.where.not(role: 'integration').exists? %>
+    <% if current_account.users.active.exists?(role: 'integration') %>
+      <%= link_to t('view_embedding_users'), settings_integration_users_path, class: 'link text-sm' %>
+      <% if archived_exists %>
+        <span class="text-neutral-700">|</span>
+      <% end %>
+    <% end %>
+    <% if archived_exists %>
+      <%= link_to t('view_archived'), settings_archived_users_path, class: 'link text-sm' %>
+    <% end %>
+  <% end %>
+</div>

app/views/users/index.html.erb

@@ -1,12 +1,18 @@
 <div class="flex-wrap space-y-4 md:flex md:flex-nowrap md:space-y-0 md:space-x-10">
   <%= render 'shared/settings_nav' %>
   <div class="md:flex-grow">
-    <div class="flex flex-col md:flex-row gap-2 md:justify-between md:items-end mb-4">
+    <div class="flex flex-col md:flex-row gap-2 md:justify-between md:items-end mb-4 min-h-12">
       <h1 class="text-4xl font-bold">
-        <%= t('status_users', status: params[:status].to_s.titleize) %>
+        <% if params[:status] == 'archived' %>
+          <%= t('archived_users') %>
+        <% elsif params[:status] == 'integration' %>
+          <%= t('embedding_users') %>
+        <% else %>
+          <%= t('users') %>
+        <% end %>
       </h1>
       <div class="flex flex-col md:flex-row gap-y-2 gap-x-4 md:items-center">
-        <% if can?(:create, User.new(account: current_account)) %>
+        <% if params[:status].blank? && can?(:create, User.new(account: current_account)) %>
           <%= render 'users/extra_buttons' %>
           <% if content_for(:add_user_button) %>
             <%= content_for(:add_user_button) %>
@@ -57,17 +63,17 @@
                 <%= user.last_sign_in_at ? l(user.last_sign_in_at.in_time_zone(current_account.timezone), format: :short, locale: current_account.locale) : '-' %>
               </td>
               <td class="flex items-center space-x-2 justify-end">
-                <% if can?(:update, user) && user.archived_at.blank? %>
+                <% if params[:status].blank? && can?(:update, user) && user.archived_at.blank? %>
                   <%= link_to edit_user_path(user), class: 'btn btn-outline btn-xs', title: t('edit'), data: { turbo_frame: 'modal' } do %>
                     <%= t('edit') %>
                   <% end %>
                 <% end %>
-                <% if params[:status].blank? && can?(:destroy, user) && user != current_user %>
+                <% if params[:status] != 'archived' && can?(:destroy, user) && user != current_user %>
                   <%= button_to user_path(user), method: :delete, class: 'btn btn-outline btn-error btn-xs', title: t('remove'), data: { turbo_confirm: t('are_you_sure_') } do %>
                     <%= t('remove') %>
                   <% end %>
                 <% end %>
-                <% if params[:status].present? && can?(:manage, user) && user != current_user %>
+                <% if params[:status] == 'archived' && can?(:manage, user) && user != current_user && user.archived_at? %>
                   <%= button_to user_path(user), method: :put, params: { user: { archived_at: nil } }, class: 'btn btn-outline btn-xs', title: t('unarchive'), data: { turbo_confirm: t('are_you_sure_') } do %>
                     <%= t('unarchive') %>
                   <% end %>
@@ -78,22 +84,11 @@
         </tbody>
       </table>
     </div>
-    <% view_archived_html = capture do %>
-      <% if current_account.users.archived.exists? %>
-        <div>
-          <% if params[:status] == 'archived' %>
-            <a href="<%= settings_users_path %>" class="link text-sm"><%= t('view_active') %></a>
-          <% else %>
-            <a href="<%= settings_archived_users_path %>" class="link text-sm"><%= t('view_archived') %></a>
-          <% end %>
-        </div>
-      <% end %>
-    <% end %>
     <% if @pagy.pages > 1 %>
-      <%= render 'shared/pagination', pagy: @pagy, items_name: 'users', left_additional_html: view_archived_html %>
+      <%= render 'shared/pagination', pagy: @pagy, items_name: 'users', left_additional_html: render('bottom_links') %>
     <% else %>
       <div class="mt-2">
-        <%= view_archived_html %>
+        <%= render 'bottom_links' %>
       </div>
     <% end %>
   </div>

config/initializers/migrate.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 Rails.configuration.to_prepare do
-  ActiveRecord::Tasks::DatabaseTasks.migrate if ENV['RAILS_ENV'] == 'production'
+  ActiveRecord::Tasks::DatabaseTasks.migrate if ENV['RAILS_ENV'] == 'production' && ENV['RUN_MIGRATIONS'] != 'false'
 end

config/locales/i18n.yml

@@ -134,6 +134,7 @@ en: &en
   require_signing_reason: Require signing reason
   allow_typed_text_signatures: Allow typed text signatures
   allow_to_resubmit_completed_forms: Allow to resubmit completed forms
+  allow_to_decline_documents: Allow to decline documents
   remember_and_pre_fill_signatures: Remember and pre-fill signatures
   require_authentication_for_file_download_links: Require authentication for file download links
   combine_completed_documents_and_audit_log: Combine completed documents and Audit Log
@@ -473,7 +474,6 @@ en: &en
   back: Back
   add_secret: Add Secret
   submission_example_payload: Submission example payload
-  status_users: '%{status} Users'
   there_are_no_signatures: There are no signatures
   signed_with_trusted_certificate: Signed with trusted certificate
   signed_with_external_certificate: Signed with external certificate
@@ -613,6 +613,15 @@ en: &en
   unverified: Unverified
   document: Document
   completed_at: Completed At
+  edit_recipient: Edit Recipient
+  update_recipient: Update Recipient
+  use_international_format_1xxx_: 'Use internatioanl format: +1xxx...'
+  submitter_cannot_be_updated: Submitter cannot be updated.
+  at_least_one_field_must_be_filled: At least one field must be filled.
+  archived_users: Archived Users
+  embedding_users: Embedding Users
+  view_embedding_users: View Embedding Users
+  view_users: View Users
   submission_event_names:
     send_email_to_html: '<b>Email sent</b> to %{submitter_name}'
     send_reminder_email_to_html: '<b>Reminder email sent</b> to %{submitter_name}'
@@ -765,6 +774,7 @@ es: &es
   require_signing_reason: Requerir motivo de firma
   allow_typed_text_signatures: Permitir firmas de texto mecanografiadas
   allow_to_resubmit_completed_forms: Permitir reenviar formularios completados
+  allow_to_decline_documents: Permitir rechazar documentos
   remember_and_pre_fill_signatures: Recordar y prellenar firmas
   require_authentication_for_file_download_links: Requerir autenticación para enlaces de descarga de archivos
   combine_completed_documents_and_audit_log: Combinar documentos completados y Registro de Auditoría
@@ -1104,7 +1114,6 @@ es: &es
   back: Atrás
   add_secret: Agregar secreto
   submission_example_payload: Ejemplo de payload de envío
-  status_users: '%{status} Usuarios'
   there_are_no_signatures: No hay firmas
   signed_with_trusted_certificate: Firmado con certificado de confianza
   signed_with_external_certificate: Firmado con certificado externo
@@ -1244,6 +1253,14 @@ es: &es
   unverified: No verificado
   document: Documento
   completed_at: Completado el
+  edit_recipient: Editar Destinatario
+  update_recipient: Actualizar Destinatario
+  use_international_format_1xxx_: 'Usa el formato internacional: +1xxx...'
+  submitter_cannot_be_updated: El remitente no puede ser actualizado.
+  at_least_one_field_must_be_filled: Al menos un campo debe estar completo.
+  archived_users: Usuarios Archivados
+  embedding_users: Usuarios Integrados
+  view_embedding_users: Ver Usuarios Integrado
   submission_event_names:
     send_email_to_html: '<b>Correo electrónico enviado</b> a %{submitter_name}'
     send_reminder_email_to_html: '<b>Correo de recordatorio enviado</b> a %{submitter_name}'
@@ -1396,6 +1413,7 @@ it: &it
   require_signing_reason: Richiedere il motivo della firma
   allow_typed_text_signatures: Permettere firme con testo digitato
   allow_to_resubmit_completed_forms: Permettere di reinviare i moduli completati
+  allow_to_decline_documents: Permettere di rifiutare i documenti
   remember_and_pre_fill_signatures: Ricordare e precompilare le firme
   require_authentication_for_file_download_links: "Richiedere l'autenticazione per i link di download dei file"
   combine_completed_documents_and_audit_log: Combinare i documenti completati e il Registro di Audit
@@ -1735,7 +1753,6 @@ it: &it
   back: Indietro
   add_secret: Aggiungi segreto
   submission_example_payload: Esempio di payload di invio
-  status_users: '%{status} Utenti'
   there_are_no_signatures: Non ci sono firme
   signed_with_trusted_certificate: Firmato con certificato affidabile
   signed_with_external_certificate: Firmato con certificato esterno
@@ -1875,6 +1892,14 @@ it: &it
   unverified: Non verificato
   document: Documento
   completed_at: Completato il
+  edit_recipient: Modifica Destinatario
+  update_recipient: Aggiorna Destinatario
+  use_international_format_1xxx_: 'Utilizza il formato internazionale: +1xxx...'
+  submitter_cannot_be_updated: Il mittente non può essere aggiornato.
+  at_least_one_field_must_be_filled: Almeno un campo deve essere compilato.
+  archived_users: Utenti Archiviati
+  embedding_users: Utenti Incorporati
+  view_embedding_users: Visualizza Utenti Incorporati
   submission_event_names:
     send_email_to_html: '<b>E-mail inviato</b> a %{submitter_name}'
     send_reminder_email_to_html: '<b>E-mail di promemoria inviato</b> a %{submitter_name}'
@@ -2028,6 +2053,7 @@ fr: &fr
   require_signing_reason: Demander une raison pour la signature
   allow_typed_text_signatures: Autoriser les signatures en texte tapé
   allow_to_resubmit_completed_forms: Autoriser la resoumission des formulaires complétés
+  allow_to_decline_documents: Autoriser le refus des documents
   remember_and_pre_fill_signatures: Se souvenir et préremplir les signatures
   require_authentication_for_file_download_links: Exiger une authentification pour les liens de téléchargement des fichiers
   combine_completed_documents_and_audit_log: "Combiner les documents complétés et le journal d'audit"
@@ -2367,7 +2393,6 @@ fr: &fr
   back: Retour
   add_secret: Ajouter un secret
   submission_example_payload: Exemple de payload de soumission
-  status_users: '%{status} Utilisateurs'
   there_are_no_signatures: "Il n'y a pas de signatures"
   signed_with_trusted_certificate: Signé avec un certificat de confiance
   signed_with_external_certificate: Signé avec un certificat externe
@@ -2507,6 +2532,14 @@ fr: &fr
   unverified: Non vérifié
   document: Document
   completed_at: Terminé le
+  edit_recipient: Modifica Destinatario
+  update_recipient: Aggiorna Destinatario
+  use_international_format_1xxx_: 'Utilizza il formato internazionale: +1xxx...'
+  submitter_cannot_be_updated: Il mittente non può essere aggiornato.
+  at_least_one_field_must_be_filled: Almeno un campo deve essere compilato.
+  archived_users: Utilisateurs Archivés
+  embedding_users: Utilisateurs Intégrés
+  view_embedding_users: Voir les Utilisateurs Intégrés
   submission_event_names:
     send_email_to_html: '<b>E-mail envoyé</b> à %{submitter_name}'
     send_reminder_email_to_html: '<b>E-mail de rappel envoyé</b> à %{submitter_name}'
@@ -2659,6 +2692,7 @@ pt: &pt
   require_signing_reason: Requerer motivo para assinatura
   allow_typed_text_signatures: Permitir assinaturas digitadas
   allow_to_resubmit_completed_forms: Permitir reenviar formulários concluídos
+  allow_to_decline_documents: Permitir recusar documentos
   remember_and_pre_fill_signatures: Lembrar e preencher assinaturas automaticamente
   require_authentication_for_file_download_links: Requerer autenticação para links de download de arquivos
   combine_completed_documents_and_audit_log: Combinar documentos concluídos e log de auditoria
@@ -2998,7 +3032,6 @@ pt: &pt
   back: Voltar
   add_secret: Adicionar segredo
   submission_example_payload: Exemplo de payload de submissão
-  status_users: '%{status} Usuários'
   there_are_no_signatures: Não há assinaturas
   signed_with_trusted_certificate: Assinado com certificado confiável
   signed_with_external_certificate: Assinado com certificado externo
@@ -3138,6 +3171,14 @@ pt: &pt
   unverified: Não verificado
   document: Documento
   completed_at: Concluído em
+  edit_recipient: Editar Destinatário
+  update_recipient: Atualizar Destinatário
+  use_international_format_1xxx_: 'Use o formato internacional: +1xxx...'
+  submitter_cannot_be_updated: O remetente não pode ser atualizado.
+  at_least_one_field_must_be_filled: Pelo menos um campo deve ser preenchido.
+  archived_users: Usuários Arquivados
+  embedding_users: Usuários Incorporados
+  view_embedding_users: Ver Usuários Incorporados
   submission_event_names:
     send_email_to_html: '<b>E-mail enviado</b> para %{submitter_name}'
     send_reminder_email_to_html: '<b>E-mail de lembrete enviado</b> para %{submitter_name}'
@@ -3290,6 +3331,7 @@ de: &de
   require_signing_reason: Grund für die Signatur erforderlich
   allow_typed_text_signatures: Unterschriften mit getipptem Text zulassen
   allow_to_resubmit_completed_forms: Erneutes Einreichen abgeschlossener Formulare zulassen
+  allow_to_decline_documents: Erlauben, Dokumente abzulehnen
   remember_and_pre_fill_signatures: Signaturen merken und vorab ausfüllen
   require_authentication_for_file_download_links: Authentifizierung für Dateidownload-Links erforderlich
   combine_completed_documents_and_audit_log: Abgeschlossene Dokumente und Prüfprotokoll kombinieren
@@ -3629,7 +3671,6 @@ de: &de
   back: Zurück
   add_secret: Geheimnis hinzufügen
   submission_example_payload: Beispiel-Payload für Einreichung
-  status_users: '%{status} Benutzer'
   there_are_no_signatures: Es gibt keine Unterschriften
   signed_with_trusted_certificate: Signiert mit vertrauenswürdigem Zertifikat
   signed_with_external_certificate: Signiert mit externem Zertifikat
@@ -3769,6 +3810,14 @@ de: &de
   unverified: Nicht verifiziert
   document: Dokument
   completed_at: Abgeschlossen am
+  edit_recipient: Empfänger bearbeiten
+  update_recipient: Empfänger aktualisieren
+  use_international_format_1xxx_: 'Verwenden Sie das internationale Format: +1xxx...'
+  submitter_cannot_be_updated: Der Absender kann nicht aktualisiert werden.
+  at_least_one_field_must_be_filled: Mindestens ein Feld muss ausgefüllt werden.
+  archived_users: Archivierte Benutzer
+  embedding_users: Einbettende Benutzer
+  view_embedding_users: Einbettende Benutzer anzeigen
   submission_event_names:
     send_email_to_html: '<b>E-Mail gesendet</b> an %{submitter_name}'
     send_reminder_email_to_html: '<b>Erinnerungs-E-Mail gesendet</b> an %{submitter_name}'

config/routes.rb

@@ -34,6 +34,7 @@ Rails.application.routes.draw do
     resources :submitter_form_views, only: %i[create]
     resources :submitters, only: %i[index show update]
     resources :submissions, only: %i[index show create destroy] do
+      resources :documents, only: %i[index], controller: 'submission_documents'
       collection do
         resources :init, only: %i[create], controller: 'submissions'
         resources :emails, only: %i[create], controller: 'submissions', as: :submissions_emails
@@ -69,6 +70,7 @@ Rails.application.routes.draw do
   resources :submissions_archived, only: %i[index], path: 'submissions/archived'
   resources :submissions, only: %i[index], controller: 'submissions_dashboard'
   resources :submissions, only: %i[show destroy]
+  resources :submitters, only: %i[edit update]
   resources :console_redirect, only: %i[index]
   resources :upgrade, only: %i[index], controller: 'console_redirect'
   resources :manage, only: %i[index], controller: 'console_redirect'
@@ -151,15 +153,17 @@ Rails.application.routes.draw do
   scope '/settings', as: :settings do
     unless Docuseal.multitenant?
       resources :storage, only: %i[index create], controller: 'storage_settings'
-      resources :email, only: %i[index create], controller: 'email_smtp_settings'
       resources :sms, only: %i[index], controller: 'sms_settings'
     end
+    resources :email, only: %i[index create], controller: 'email_smtp_settings'
     resources :sso, only: %i[index], controller: 'sso_settings'
     resources :notifications, only: %i[index create], controller: 'notifications_settings'
     resource :esign, only: %i[show create new update destroy], controller: 'esign_settings'
     resources :users, only: %i[index]
     resources :archived_users, only: %i[index], path: 'users/:status', controller: 'users',
                                defaults: { status: :archived }
+    resources :integration_users, only: %i[index], path: 'users/:status', controller: 'users',
+                                  defaults: { status: :integration }
     resource :personalization, only: %i[show create], controller: 'personalization_settings'
     resources :api, only: %i[index create], controller: 'api_settings'
     resource :webhooks, only: %i[show create update], controller: 'webhook_settings'

config/sidekiq.yml

@@ -1,6 +1,7 @@
 queues:
   - [default, 1]
   - [webhooks, 1]
+  - [images, 1]
   - [mailers, 1]
   - [recurrent, 1]
   - [rollbar, 1]

config/webpack/webpack.config.js

@@ -11,6 +11,7 @@ const configs = generateWebpackConfig({
   },
   optimization: {
     runtimeChunk: false,
+    concatenateModules: !process.env.BUNDLE_ANALYZE,
     splitChunks: {
       chunks (chunk) {
         return chunk.name !== 'rollbar'

db/migrate/20241018115034_create_completed_submitters_and_documents.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class CreateCompletedSubmittersAndDocuments < ActiveRecord::Migration[7.2]
+  def change
+    create_table :completed_submitters do |t|
+      t.bigint :submitter_id, null: false, index: true
+      t.bigint :submission_id, null: false
+      t.bigint :account_id, null: false, index: true
+      t.bigint :template_id, null: false
+      t.string :source, null: false
+      t.integer :sms_count, null: false
+      t.datetime :completed_at, null: false
+
+      t.timestamps
+    end
+
+    create_table :completed_documents do |t|
+      t.bigint :submitter_id, null: false, index: true
+      t.string :sha256, null: false, index: true
+
+      t.timestamps
+    end
+  end
+end

db/migrate/20241022125135_populate_completed_submitters_and_documents.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+class PopulateCompletedSubmittersAndDocuments < ActiveRecord::Migration[7.2]
+  disable_ddl_transaction
+
+  class MigrationSubmitter < ApplicationRecord
+    self.table_name = 'submitters'
+
+    belongs_to :submission, class_name: 'MigrationSubmission'
+    has_many :submission_sms_events, -> { where(event_type: %w[send_sms send_2fa_sms]) },
+             class_name: 'MigrationSubmissionEvent', foreign_key: :submitter_id
+  end
+
+  class MigrationSubmission < ApplicationRecord
+    self.table_name = 'submissions'
+  end
+
+  class MigrationSubmissionEvent < ApplicationRecord
+    self.table_name = 'submission_events'
+  end
+
+  class MigrationCompletedSubmitter < ApplicationRecord
+    self.table_name = 'completed_submitters'
+  end
+
+  class MigrationCompletedDocument < ApplicationRecord
+    self.table_name = 'completed_documents'
+  end
+
+  def up
+    submitters = MigrationSubmitter.where.not(completed_at: nil)
+                                   .preload(:submission, :submission_sms_events)
+
+    count = submitters.count
+
+    puts "Updating the database - it might take ~#{(count / 1000 * 3) + 1} seconds" if count > 2000
+
+    submitters.find_each do |submitter|
+      completed_submitter = MigrationCompletedSubmitter.find_or_initialize_by(submitter_id: submitter.id)
+
+      next if completed_submitter.persisted?
+
+      submission = submitter.submission
+
+      completed_submitter.assign_attributes(
+        submission_id: submitter.submission_id,
+        account_id: submission.account_id,
+        template_id: submission.template_id,
+        source: submission.source,
+        sms_count: submitter.submission_sms_events.size,
+        completed_at: submitter.completed_at,
+        created_at: submitter.completed_at,
+        updated_at: submitter.completed_at
+      )
+
+      completed_submitter.save!
+    end
+
+    attachments = ActiveStorage::Attachment.where(record_type: 'Submitter', name: 'documents').preload(:blob)
+
+    attachments.find_each do |attachment|
+      sha256 = attachment.metadata['sha256']
+
+      next if sha256.blank?
+
+      completed_document = MigrationCompletedDocument.find_or_initialize_by(submitter_id: attachment.record_id, sha256:)
+
+      next if completed_document.persisted?
+
+      completed_document.assign_attributes(created_at: attachment.created_at, updated_at: attachment.created_at)
+
+      completed_document.save!
+    end
+  end
+
+  def down
+    nil
+  end
+end

db/migrate/20241026161207_add_unique_index_on_completed_submitters.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class AddUniqueIndexOnCompletedSubmitters < ActiveRecord::Migration[7.2]
+  def change
+    remove_index :completed_submitters, :submitter_id
+    add_index :completed_submitters, :submitter_id, unique: true
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2024_08_20_180922) do
+ActiveRecord::Schema[7.2].define(version: 2024_10_26_161207) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -89,6 +89,29 @@ ActiveRecord::Schema[7.1].define(version: 2024_08_20_180922) do
     t.index ["blob_id", "variation_digest"], name: "index_active_storage_variant_records_uniqueness", unique: true
   end
 
+  create_table "completed_documents", force: :cascade do |t|
+    t.bigint "submitter_id", null: false
+    t.string "sha256", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["sha256"], name: "index_completed_documents_on_sha256"
+    t.index ["submitter_id"], name: "index_completed_documents_on_submitter_id"
+  end
+
+  create_table "completed_submitters", force: :cascade do |t|
+    t.bigint "submitter_id", null: false
+    t.bigint "submission_id", null: false
+    t.bigint "account_id", null: false
+    t.bigint "template_id", null: false
+    t.string "source", null: false
+    t.integer "sms_count", null: false
+    t.datetime "completed_at", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["account_id"], name: "index_completed_submitters_on_account_id"
+    t.index ["submitter_id"], name: "index_completed_submitters_on_submitter_id", unique: true
+  end
+
   create_table "document_generation_events", force: :cascade do |t|
     t.bigint "submitter_id", null: false
     t.string "event_name", null: false

lib/accounts.rb

@@ -11,7 +11,7 @@ module Accounts
     new_user.uuid = SecureRandom.uuid
     new_user.account = new_account
     new_user.encrypted_password = SecureRandom.hex
-    new_user.email = "#{SecureRandom.hex}@docuseal.co"
+    new_user.email = "#{SecureRandom.hex}@docuseal.com"
 
     account.templates.each do |template|
       new_template = template.dup

lib/action_mailer_configs_interceptor.rb

@@ -16,19 +16,27 @@ module ActionMailerConfigsInterceptor
     end
 
     if Rails.env.production? && Rails.application.config.action_mailer.delivery_method
-      message.from = ENV.fetch('SMTP_FROM')
+      from = ENV.fetch('SMTP_FROM').to_s.split(',').sample
+
+      if from.match?(User::FULL_EMAIL_REGEXP)
+        message[:from] = message[:from].to_s.sub(User::EMAIL_REGEXP, from)
+      else
+        message.from = from
+      end
 
       return message
     end
 
-    email_configs = EncryptedConfig.find_by(key: EncryptedConfig::EMAIL_SMTP_KEY)
+    unless Docuseal.multitenant?
+      email_configs = EncryptedConfig.find_by(key: EncryptedConfig::EMAIL_SMTP_KEY)
 
-    if email_configs
-      message.delivery_method(:smtp, build_smtp_configs_hash(email_configs))
+      if email_configs
+        message.delivery_method(:smtp, build_smtp_configs_hash(email_configs))
 
-      message.from = %("#{email_configs.account.name.to_s.delete('"')}" <#{email_configs.value['from_email']}>)
-    else
-      message.delivery_method(:test)
+        message.from = %("#{email_configs.account.name.to_s.delete('"')}" <#{email_configs.value['from_email']}>)
+      else
+        message.delivery_method(:test)
+      end
     end
 
     message

lib/action_mailer_events_observer.rb

@@ -22,7 +22,7 @@ module ActionMailerEventsObserver
         emailable_type:,
         event_type: :send,
         email:,
-        data: { method: mail.delivery_method.class.name.underscore },
+        data: { from: mail.from, method: mail.delivery_method.class.name.underscore },
         event_datetime: Time.current
       )
     end

lib/docuseal.rb

@@ -12,7 +12,7 @@ module Docuseal
   TWITTER_URL = 'https://twitter.com/docusealco'
   TWITTER_HANDLE = '@docusealco'
   CHATGPT_URL = 'https://chatgpt.com/g/g-9hg8AAw0r-docuseal'
-  SUPPORT_EMAIL = 'support@docuseal.co'
+  SUPPORT_EMAIL = 'support@docuseal.com'
   HOST = ENV.fetch('HOST', 'localhost')
   AATL_CERT_NAME = 'docuseal_aatl'
   CONSOLE_URL = if Rails.env.development?
@@ -20,19 +20,19 @@ module Docuseal
                 elsif ENV['MULTITENANT'] == 'true'
                   "https://console.#{HOST}"
                 else
-                  'https://console.docuseal.co'
+                  'https://console.docuseal.com'
                 end
   CLOUD_URL = if Rails.env.development?
                 'http://localhost:3000'
               else
-                'https://docuseal.co'
+                'https://docuseal.com'
               end
   CDN_URL = if Rails.env.development?
               'http://localhost:3000'
             elsif ENV['MULTITENANT'] == 'true'
               "https://cdn.#{HOST}"
             else
-              'https://cdn.docuseal.co'
+              'https://cdn.docuseal.com'
             end
 
   CERTS = JSON.parse(ENV.fetch('CERTS', '{}'))

lib/params/base_validator.rb

@@ -2,6 +2,8 @@
 
 module Params
   class BaseValidator
+    EMAIL_REGEXP = User::FULL_EMAIL_REGEXP
+
     InvalidParameterError = Class.new(StandardError)
 
     def self.call(...)
@@ -65,6 +67,28 @@ module Params
       raise_error(message || "#{key} must follow the #{regexp.source} format")
     end
 
+    def email_format(params, key, message: nil)
+      return if params.blank?
+      return if params[key].blank?
+      return if params[key].to_s.include?('<')
+
+      if params[key].to_s.strip.split(/\s*[;,]\s*/).compact_blank
+                    .all? { |email| EmailTypo::DotCom.call(email).match?(EMAIL_REGEXP) }
+        return
+      end
+
+      raise_error(message || "#{key} must follow the email format: '#{params[key]}'")
+    end
+
+    def unique_value(params, key, message: nil)
+      return unless params.is_a?(Array)
+      return if params.none?
+      return if params.all? { |p| p[key].blank? }
+      return if params.pluck(key).compact_blank.uniq.size == params.pluck(key).compact_blank.size
+
+      raise_error(message || "#{key} must be unique")
+    end
+
     def in_path(params, path = [])
       old_path = @current_path
 

lib/params/submission_create_validator.rb

@@ -22,6 +22,7 @@ module Params
       required(params, %i[emails email])
 
       type(params, :emails, String)
+      email_format(params, :emails, message: 'emails are invalid')
       boolean(params, :send_email)
       type(params, :message, Hash)
 
@@ -43,8 +44,8 @@ module Params
       type(params, :completed_redirect_url, String)
       type(params, :bcc_completed, String)
       type(params, :reply_to, String)
-      format(params, :bcc_completed, /@/, message: 'bcc_completed email is invalid')
-      format(params, :reply_to, /@/, message: 'reply_to email is invalid')
+      email_format(params, :bcc_completed, message: 'bcc_completed email is invalid')
+      email_format(params, :reply_to, message: 'reply_to email is invalid')
       type(params, :message, Hash)
       type(params, :submitters, Array)
 
@@ -60,6 +61,7 @@ module Params
       if params[:submitters].present?
         in_path(params, :submitters) do |submitters_params|
           type(submitters_params, 0, Hash)
+          unique_value(submitters_params, :role)
         end
       end
 
@@ -74,8 +76,8 @@ module Params
       type(submitter_params, :name, String)
       type(submitter_params, :reply_to, String)
       type(submitter_params, :email, String)
-      format(submitter_params, :email, /@/, message: 'email is invalid')
-      format(submitter_params, :reply_to, /@/, message: 'reply_to email is invalid')
+      email_format(submitter_params, :email, message: 'email is invalid')
+      email_format(submitter_params, :reply_to, message: 'reply_to email is invalid')
       type(submitter_params, :phone, String)
       format(submitter_params, :phone, /\A\+\d+\z/,
              message: 'phone should start with +<country code> and contain only digits')
@@ -105,7 +107,7 @@ module Params
       type(params, :order, String)
       type(params, :completed_redirect_url, String)
       type(params, :bcc_completed, String)
-      format(params, :bcc_completed, /@/, message: 'bcc_completed email is invalid')
+      email_format(params, :bcc_completed, message: 'bcc_completed email is invalid')
       type(params, :message, Hash)
 
       in_path(params, :message) do |message_params|

lib/submissions/create_from_submitters.rb

@@ -2,8 +2,11 @@
 
 module Submissions
   module CreateFromSubmitters
+    BaseError = Class.new(StandardError)
+
     module_function
 
+    # rubocop:disable Metrics/BlockLength
     def call(template:, user:, submissions_attrs:, source:, submitters_order:, params: {})
       preferences = Submitters.normalize_preferences(user.account, user, params)
 
@@ -37,6 +40,10 @@ module Submissions
                           preferences: preferences.merge(submission_preferences))
         end
 
+        if submission.submitters.size > template.submitters.size
+          raise BaseError, 'Defined more signing parties than in template'
+        end
+
         next if submission.submitters.blank?
 
         maybe_add_invite_submitters(submission, template)
@@ -44,6 +51,7 @@ module Submissions
         submission.tap(&:save!)
       end
     end
+    # rubocop:enable Metrics/BlockLength
 
     def maybe_add_invite_submitters(submission, template)
       template.submitters.each do |item|

lib/submissions/generate_audit_trail.rb

@@ -393,7 +393,7 @@ module Submissions
     end
 
     def sign_reason
-      'Signed with DocuSeal.co'
+      'Signed with DocuSeal.com'
     end
 
     def maybe_add_background(_canvas, _submission, _page_size); end

lib/submissions/generate_preview_attachments.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module Submissions
+  module GeneratePreviewAttachments
+    module_function
+
+    # rubocop:disable Metrics
+    def call(submission, values_hash: nil)
+      values_hash ||= build_values_hash(submission)
+
+      configs = submission.account.account_configs.where(key: [AccountConfig::FLATTEN_RESULT_PDF_KEY,
+                                                               AccountConfig::WITH_SIGNATURE_ID])
+
+      with_signature_id = configs.find { |c| c.key == AccountConfig::WITH_SIGNATURE_ID }&.value == true
+      is_flatten = configs.find { |c| c.key == AccountConfig::FLATTEN_RESULT_PDF_KEY }&.value != false
+
+      pdfs_index = GenerateResultAttachments.build_pdfs_index(submission, flatten: is_flatten)
+
+      submission.submitters.where(completed_at: nil).preload(attachments_attachments: :blob).each do |submitter|
+        GenerateResultAttachments.fill_submitter_fields(submitter, submission.account, pdfs_index,
+                                                        with_signature_id:, is_flatten:)
+      end
+
+      template = submission.template
+
+      image_pdfs = []
+      original_documents = template.documents.preload(:blob)
+
+      result_attachments =
+        (submission.template_schema || template.schema).map do |item|
+          pdf = pdfs_index[item['attachment_uuid']]
+
+          if original_documents.find { |a| a.uuid == item['attachment_uuid'] }.image?
+            pdf = GenerateResultAttachments.normalize_image_pdf(pdf)
+
+            image_pdfs << pdf
+          end
+
+          build_pdf_attachment(pdf:, submission:,
+                               uuid: item['attachment_uuid'],
+                               values_hash:,
+                               name: item['name'])
+        end
+
+      return ApplicationRecord.no_touching { result_attachments.map { |e| e.tap(&:save!) } } if image_pdfs.size < 2
+
+      images_pdf =
+        image_pdfs.each_with_object(HexaPDF::Document.new) do |pdf, doc|
+          pdf.pages.each { |page| doc.pages << doc.import(page) }
+        end
+
+      images_pdf = GenerateResultAttachments.normalize_image_pdf(images_pdf)
+
+      images_pdf_attachment =
+        build_pdf_attachment(
+          pdf: images_pdf,
+          submission:,
+          uuid: GenerateResultAttachments.images_pdf_uuid(original_documents.select(&:image?)),
+          values_hash:,
+          name: template.name
+        )
+
+      ApplicationRecord.no_touching do
+        (result_attachments + [images_pdf_attachment]).map { |e| e.tap(&:save!) }
+      end
+    end
+
+    def build_values_hash(submission)
+      submission.submitters.reduce({}) { |acc, s| acc.merge(s.values) }.hash
+    end
+
+    def build_pdf_attachment(pdf:, submission:, uuid:, name:, values_hash:)
+      io = StringIO.new
+
+      begin
+        pdf.write(io, incremental: true, validate: false)
+      rescue HexaPDF::MalformedPDFError => e
+        Rollbar.error(e) if defined?(Rollbar)
+
+        pdf.write(io, incremental: false, validate: false)
+      end
+
+      ActiveStorage::Attachment.new(
+        blob: ActiveStorage::Blob.create_and_upload!(io: io.tap(&:rewind), filename: "#{name}.pdf"),
+        metadata: { original_uuid: uuid,
+                    values_hash:,
+                    analyzed: true,
+                    sha256: Base64.urlsafe_encode64(Digest::SHA256.digest(io.string)) },
+        name: 'preview_documents',
+        record: submission
+      )
+    end
+    # rubocop:enable Metrics
+  end
+end

lib/submissions/generate_result_attachments.rb

@@ -92,19 +92,13 @@ module Submissions
     end
 
     def generate_pdfs(submitter)
-      cell_layouter = HexaPDF::Layout::TextLayouter.new(text_valign: :center, text_align: :center)
+      configs = submitter.account.account_configs.where(key: [AccountConfig::FLATTEN_RESULT_PDF_KEY,
+                                                              AccountConfig::WITH_SIGNATURE_ID])
 
-      with_signature_id = submitter.account.account_configs
-                                   .exists?(key: AccountConfig::WITH_SIGNATURE_ID, value: true)
+      with_signature_id = configs.find { |c| c.key == AccountConfig::WITH_SIGNATURE_ID }&.value == true
+      is_flatten = configs.find { |c| c.key == AccountConfig::FLATTEN_RESULT_PDF_KEY }&.value != false
 
-      is_flatten =
-        submitter.account.account_configs
-                 .find_or_initialize_by(key: AccountConfig::FLATTEN_RESULT_PDF_KEY).value != false
-
-      account = submitter.account
-      attachments_data_cache = {}
-
-      pdfs_index = build_pdfs_index(submitter, flatten: is_flatten)
+      pdfs_index = build_pdfs_index(submitter.submission, submitter:, flatten: is_flatten)
 
       if with_signature_id || submitter.account.testing?
         pdfs_index.each_value do |pdf|
@@ -145,6 +139,16 @@ module Submissions
         end
       end
 
+      fill_submitter_fields(submitter, submitter.account, pdfs_index, with_signature_id:, is_flatten:)
+    end
+
+    def fill_submitter_fields(submitter, account, pdfs_index, with_signature_id:, is_flatten:)
+      cell_layouter = HexaPDF::Layout::TextLayouter.new(text_valign: :center, text_align: :center)
+
+      attachments_data_cache = {}
+
+      return pdfs_index if submitter.submission.template_fields.blank?
+
       submitter.submission.template_fields.each do |field|
         next if field['submitter_uuid'] != submitter.uuid
 
@@ -459,6 +463,8 @@ module Submissions
           **build_signing_params(submitter, pkcs, tsa_url)
         }
 
+        pdf.pages.first[:Annots] = [] unless pdf.pages.first[:Annots].respond_to?(:<<)
+
         begin
           pdf.sign(io, write_options: { validate: false }, **sign_params)
         rescue HexaPDF::MalformedPDFError => e
@@ -512,13 +518,13 @@ module Submissions
       Digest::UUID.uuid_v5(Digest::UUID::OID_NAMESPACE, attachments.map(&:uuid).sort.join(':'))
     end
 
-    def build_pdfs_index(submitter, flatten: true)
-      latest_submitter = find_last_submitter(submitter)
+    def build_pdfs_index(submission, submitter: nil, flatten: true)
+      latest_submitter = find_last_submitter(submission, submitter:)
 
       Submissions::EnsureResultGenerated.call(latest_submitter) if latest_submitter
 
       documents   = latest_submitter&.documents&.preload(:blob).to_a.presence
-      documents ||= submitter.submission.template_schema_documents.preload(:blob)
+      documents ||= submission.template_schema_documents.preload(:blob)
 
       documents.to_h do |attachment|
         pdf =
@@ -580,11 +586,11 @@ module Submissions
       font_wrapper.custom_glyph(replace_with, character)
     end
 
-    def find_last_submitter(submitter)
-      submitter.submission.submitters
-               .select(&:completed_at?)
-               .select { |e| e.id != submitter.id && e.completed_at <= submitter.completed_at }
-               .max_by(&:completed_at)
+    def find_last_submitter(submission, submitter: nil)
+      submission.submitters
+                .select(&:completed_at?)
+                .select { |e| submitter.nil? ? true : e.id != submitter.id && e.completed_at <= submitter.completed_at }
+                .max_by(&:completed_at)
     end
 
     def build_pdf_from_image(attachment)

lib/submitters/form_configs.rb

@@ -7,7 +7,9 @@ module Submitters
                     AccountConfig::FORM_WITH_CONFETTI_KEY,
                     AccountConfig::FORM_PREFILL_SIGNATURE_KEY,
                     AccountConfig::WITH_SIGNATURE_ID,
+                    AccountConfig::ALLOW_TO_DECLINE_KEY,
                     AccountConfig::REQUIRE_SIGNING_REASON_KEY,
+                    AccountConfig::REUSE_SIGNATURE_KEY,
                     AccountConfig::ALLOW_TYPED_SIGNATURE].freeze
 
     module_function
@@ -20,16 +22,22 @@ module Submitters
       with_typed_signature = find_safe_value(configs, AccountConfig::ALLOW_TYPED_SIGNATURE) != false
       with_confetti = find_safe_value(configs, AccountConfig::FORM_WITH_CONFETTI_KEY) != false
       prefill_signature = find_safe_value(configs, AccountConfig::FORM_PREFILL_SIGNATURE_KEY) != false
+      reuse_signature = find_safe_value(configs, AccountConfig::REUSE_SIGNATURE_KEY) != false
+      with_decline = find_safe_value(configs, AccountConfig::ALLOW_TO_DECLINE_KEY) != false
       with_signature_id = find_safe_value(configs, AccountConfig::WITH_SIGNATURE_ID) == true
       require_signing_reason = find_safe_value(configs, AccountConfig::REQUIRE_SIGNING_REASON_KEY) == true
 
-      attrs = { completed_button:,
-                with_typed_signature:,
-                with_confetti:,
-                completed_message:,
-                require_signing_reason:,
-                prefill_signature:,
-                with_signature_id: }
+      attrs = {
+        completed_button:,
+        with_typed_signature:,
+        with_confetti:,
+        reuse_signature:,
+        with_decline:,
+        completed_message:,
+        require_signing_reason:,
+        prefill_signature:,
+        with_signature_id:
+      }
 
       keys.each do |key|
         attrs[key.to_sym] = configs.find { |e| e.key == key.to_s }&.value

lib/submitters/submit_values.rb

@@ -220,7 +220,7 @@ module Submitters
           end
         when 'date'
           if with_time
-            I18n.l(Time.current.in_time_zone(submission.account.timezone).to_date)
+            Time.current.in_time_zone(submission.account.timezone).to_date.to_s
           else
             e
           end

lib/templates/find_acro_fields.rb

@@ -25,6 +25,8 @@ module Templates
           media_box_start = [media_box[0], media_box[1]]
           crop_shift = [crop_box[0] - media_box[0], crop_box[1] - media_box[1]]
 
+          next unless child_field[:Rect]
+
           x0, y0, x1, y1 = child_field[:Rect]
 
           x0, y0 = correct_coordinates(x0, y0, crop_shift, media_box_start)
@@ -202,6 +204,7 @@ module Templates
             field = annot[:Parent]
             field = field[:Parent] while field[:Parent]
 
+            annots_index[field.hash] ||= page
             fields_index[field.hash] ||= HexaPDF::Type::AcroForm::Field.wrap(pdf, field)
           end
         end

lib/templates/process_document.rb

@@ -17,7 +17,7 @@ module Templates
 
     module_function
 
-    def call(attachment, data, extract_fields: false)
+    def call(attachment, data, extract_fields: false, max_pages: MAX_NUMBER_OF_PAGES_PROCESSED)
       if attachment.content_type == PDF_CONTENT_TYPE
         if extract_fields && data.size < MAX_FLATTEN_FILE_SIZE
           pdf = HexaPDF::Document.new(io: StringIO.new(data))
@@ -25,7 +25,7 @@ module Templates
           fields = Templates::FindAcroFields.call(pdf, attachment)
         end
 
-        generate_pdf_preview_images(attachment, data, pdf)
+        generate_pdf_preview_images(attachment, data, pdf, max_pages:)
 
         attachment.metadata['pdf']['fields'] = fields if fields
       elsif attachment.image?
@@ -56,7 +56,7 @@ module Templates
       )
     end
 
-    def generate_pdf_preview_images(attachment, data, pdf = nil)
+    def generate_pdf_preview_images(attachment, data, pdf = nil, max_pages: MAX_NUMBER_OF_PAGES_PROCESSED)
       ActiveStorage::Attachment.where(name: ATTACHMENT_NAME, record: attachment).destroy_all
 
       pdf ||= HexaPDF::Document.new(io: StringIO.new(data))
@@ -71,12 +71,16 @@ module Templates
         attachment.save!
       end
 
-      max_pages_to_process = data.size < GENERATE_PREVIEW_SIZE_LIMIT ? MAX_NUMBER_OF_PAGES_PROCESSED : 1
+      max_pages_to_process = data.size < GENERATE_PREVIEW_SIZE_LIMIT ? max_pages : 1
 
-      pool = Concurrent::FixedThreadPool.new(CONCURRENCY)
+      generate_document_preview_images(attachment, data, (0..[number_of_pages - 1, max_pages_to_process].min))
+    end
+
+    def generate_document_preview_images(attachment, data, range, concurrency: CONCURRENCY)
+      pool = Concurrent::FixedThreadPool.new(concurrency)
 
       promises =
-        (0..[number_of_pages - 1, max_pages_to_process].min).map do |page_number|
+        range.map do |page_number|
           Concurrent::Promise.execute(executor: pool) { build_and_upload_blob(data, page_number) }
         end
 

spec/factories/accounts.rb

@@ -5,5 +5,14 @@ FactoryBot.define do
     name { Faker::Company.name }
     locale { 'en-US' }
     timezone { 'UTC' }
+
+    trait :with_testing_account do
+      after(:create) do |account|
+        testing_account = account.dup.tap { |a| a.name = "Testing - #{account.name}" }
+        testing_account.uuid = SecureRandom.uuid
+        account.testing_accounts << testing_account
+        account.save!
+      end
+    end
   end
 end

spec/factories/completed_documents.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :completed_document do
+    submitter
+    sha256 { SecureRandom.hex(32) }
+  end
+end

spec/factories/templates.rb

@@ -7,7 +7,11 @@ FactoryBot.define do
     author factory: %i[user]
     name { Faker::Book.title }
 
-    after(:create) do |template|
+    transient do
+      submitter_count { 1 }
+    end
+
+    after(:create) do |template, evaluator|
       blob = ActiveStorage::Blob.create_and_upload!(
         io: Rails.root.join('spec/fixtures/sample-document.pdf').open,
         filename: 'sample-document.pdf',
@@ -22,39 +26,46 @@ FactoryBot.define do
       Templates::ProcessDocument.call(attachment, attachment.download)
 
       template.schema = [{ attachment_uuid: attachment.uuid, name: 'sample-document' }]
-      template.submitters = [
+      number_words = %w[first second third fourth fifth sixth seventh eighth ninth tenth]
+
+      template.submitters = Array.new(evaluator.submitter_count) do |i|
         {
-          'name' => 'First Party',
-          'uuid' => '513848eb-1096-4abc-a743-68596b5aaa4c'
+          'name' => "#{number_words[i]&.capitalize} Party",
+          'uuid' => SecureRandom.uuid
         }
-      ]
-      template.fields = [
-        {
-          'uuid' => '21637fc9-0655-45df-8952-04ec64949e85',
-          'submitter_uuid' => '513848eb-1096-4abc-a743-68596b5aaa4c',
-          'name' => 'First Name',
-          'type' => 'text',
-          'required' => true,
-          'areas' => [
-            {
-              'x' => 0.09027777777777778,
-              'y' => 0.1197252208047105,
-              'w' => 0.3069444444444444,
-              'h' => 0.03336604514229637,
-              'attachment_uuid' => attachment.uuid,
-              'page' => 0
-            }
-          ]
-        },
-        {
-          'uuid' => '1f97f8e3-dc82-4586-aeea-6ebed6204e46',
-          'submitter_uuid' => '513848eb-1096-4abc-a743-68596b5aaa4c',
-          'name' => '',
-          'type' => 'signature',
-          'required' => true,
-          'areas' => []
-        }
-      ]
+      end
+
+      template.fields = template.submitters.reduce([]) do |fields, submitter|
+        fields += [
+          {
+            'uuid' => SecureRandom.uuid,
+            'submitter_uuid' => submitter['uuid'],
+            'name' => 'First Name',
+            'type' => 'text',
+            'required' => true,
+            'areas' => [
+              {
+                'x' => 0.09027777777777778,
+                'y' => 0.1197252208047105,
+                'w' => 0.3069444444444444,
+                'h' => 0.03336604514229637,
+                'attachment_uuid' => attachment.uuid,
+                'page' => 0
+              }
+            ]
+          },
+          {
+            'uuid' => SecureRandom.uuid,
+            'submitter_uuid' => submitter['uuid'],
+            'name' => '',
+            'type' => 'signature',
+            'required' => true,
+            'areas' => []
+          }
+        ]
+
+        fields
+      end
 
       template.save!
     end

spec/jobs/process_submitter_completion_job_spec.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe ProcessSubmitterCompletionJob do
+  let(:account) { create(:account) }
+  let(:user) { create(:user, account:) }
+  let(:template) { create(:template, account:, author: user) }
+  let(:submission) { create(:submission, template:, created_by_user: user) }
+  let(:submitter) { create(:submitter, submission:, uuid: SecureRandom.uuid, completed_at: Time.current) }
+
+  before do
+    create(:encrypted_config, key: EncryptedConfig::ESIGN_CERTS_KEY,
+                              value: GenerateCertificate.call.transform_values(&:to_pem))
+  end
+
+  describe '#perform' do
+    it 'creates a completed submitter' do
+      expect do
+        described_class.new.perform('submitter_id' => submitter.id)
+      end.to change(CompletedSubmitter, :count).by(1)
+
+      completed_submitter = CompletedSubmitter.last
+      submitter.reload
+
+      expect(completed_submitter.submitter_id).to eq(submitter.id)
+      expect(completed_submitter.submission_id).to eq(submitter.submission_id)
+      expect(completed_submitter.account_id).to eq(submitter.submission.account_id)
+      expect(completed_submitter.template_id).to eq(submitter.submission.template_id)
+      expect(completed_submitter.source).to eq(submitter.submission.source)
+    end
+
+    it 'creates a completed document' do
+      expect do
+        described_class.new.perform('submitter_id' => submitter.id)
+      end.to change(CompletedDocument, :count).by(1)
+
+      completed_document = CompletedDocument.last
+
+      expect(completed_document.submitter_id).to eq(submitter.id)
+      expect(completed_document.sha256).to be_present
+      expect(completed_document.sha256).to eq(submitter.documents.first.metadata['sha256'])
+    end
+
+    it 'raises an error if the submitter is not found' do
+      expect do
+        described_class.new.perform('submitter_id' => 'invalid_id')
+      end.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+end

spec/lib/params/base_validator_spec.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Params::BaseValidator do
+  let(:validator) { described_class.new({}) }
+
+  describe '#email_format' do
+    it 'when email is valid' do
+      emails = [
+        '  john.doe@example.com  ',
+        'john.doe@example.com',
+        'Test <john.doe@example.com>',
+        'jane+newsletter@domain.org',
+        'mike_smith@company.net',
+        'lisa-wong@sub.example.co.uk',
+        'peter@webmail.com',
+        'anna.jones123@my-domain.com',
+        'contact@company.email',
+        'info@my-company123.org',
+        'hello.world@business.info',
+        'feedback@new-domain.com',
+        'alerts+user@localdomain.net',
+        'webmaster@industry.biz',
+        'services@agency.example',
+        'george123@consultant.pro',
+        'sales-team@company.io'
+      ]
+
+      emails.each do |email|
+        expect { validator.email_format({ email: }, :email) }.not_to raise_error
+      end
+    end
+
+    it 'when signle email is invalid' do
+      emails = [
+        'jone.doe@',
+        'this...is@strange.but.valid.com',
+        'user@-weird-domain-.com',
+        'user.name@[IPv6:2001:db8::1]',
+        'tricky.email@sub.example-.com'
+      ]
+
+      emails.each do |email|
+        expect do
+          validator.email_format({ email: }, :email)
+        end.to raise_error(described_class::InvalidParameterError, "email must follow the email format: '#{email}'")
+      end
+    end
+
+    it 'when multiple emails are valid' do
+      emails = [
+        'john.doe@example.com, jane.doe+newsletter@domain.org',
+        'joshua@automobile.car ; chloe+fashion@food.delivery',
+        'mike-smith@company.net;lisa.wong-sales@sub.example.co.uk',
+        'peter.parker+info@webmail.com,laura.martin-office@company.co',
+        'anna.jones123@my-domain.com, jack.brown+work@college.edu',
+        'susan.green@business-info.org; dave.clark+personal@nonprofit.org',
+        'chris.lee+team@new-domain.com;jenny.king.marketing@localdomain.net',
+        'george.morris@consultant.pro; nancy.davis-office@company.io',
+        'joshua-jones@automobile.car; chloe.taylor+fashion@food.delivery',
+        'ryan.moore+alerts@music-band.com,isabella.walker.design@fashion.design',
+        'support-team@company.com, contact.us@domain.org',
+        'admin.office@industry.biz, hr.department@service.pro',
+        'feedback@agency-example.org; hello.world@creative-studio.net',
+        'sales-team@e-commerce.shop, support.department@technology.co',
+        'media.contact@financial.servicesl; events-coordinator@food.delivery',
+        'order@music-band.com; info.support@creative.example',
+        'design.team@webmail.com , admin-office@company.co',
+        'contact.sales@sub-example.co.uk, support+info@legal.gov',
+        'support@media.group;subscribe-updates@concert.events'
+      ]
+
+      emails.each do |email|
+        expect { validator.email_format({ email: }, :email) }.not_to raise_error
+      end
+    end
+
+    it 'when multiple emails are invalid' do
+      emails = [
+        'john.doe@example.com  dave@nonprofit.org',
+        'amy.baker@ example.com, george.morris@ example.com',
+        'jenny.king@example.com . diana.robinson@example.com',
+        'nancy.davis@.com, henry.ford@.com',
+        'jack.brown@example.com, laura.martin@example .com',
+        'anna.jones@example,com lisa.wong@example.com',
+        'dave.clark@example.com kevin.white@example;com',
+        'susan.green@ example.com; john.doe@example.com',
+        'amy.baker@sub_domain.com george.morris@-example.com',
+        'nancy.davis@example..com john.doe@example.c',
+        'peter.parker@example.com, .henry.ford@example.com',
+        'diana.robinson@.example..com, mike.smith@.',
+        'oliver.scott@example.com; laura.martin@ example.com, jane.doe@@example.com'
+      ]
+
+      emails.each do |email|
+        expect do
+          validator.email_format({ email: }, :email)
+        end.to raise_error(described_class::InvalidParameterError, "email must follow the email format: '#{email}'")
+      end
+    end
+
+    it 'when email is invalid with custom message' do
+      expect do
+        validator.email_format({ email: 'jone.doe@' }, :email, message: 'email is invalid')
+      end.to raise_error(described_class::InvalidParameterError, 'email is invalid')
+    end
+  end
+end

spec/requests/submissions_spec.rb

@@ -3,10 +3,17 @@
 require 'rails_helper'
 
 describe 'Submission API', type: :request do
-  let!(:account) { create(:account) }
-  let!(:author) { create(:user, account:) }
-  let!(:folder) { create(:template_folder, account:) }
-  let!(:templates) { create_list(:template, 2, account:, author:, folder:) }
+  let(:account) { create(:account, :with_testing_account) }
+  let(:testing_account) { account.testing_accounts.first }
+  let(:author) { create(:user, account:) }
+  let(:testing_author) { create(:user, account: testing_account) }
+  let(:folder) { create(:template_folder, account:) }
+  let(:testing_folder) { create(:template_folder, account: testing_account) }
+  let(:templates) { create_list(:template, 2, account:, author:, folder:) }
+  let(:multiple_submitters_template) { create(:template, submitter_count: 3, account:, author:, folder:) }
+  let(:testing_templates) do
+    create_list(:template, 2, account: testing_account, author: testing_author, folder: testing_folder)
+  end
 
   describe 'GET /api/submissions' do
     it 'returns a list of submissions' do
@@ -40,6 +47,31 @@ describe 'Submission API', type: :request do
       expect(response).to have_http_status(:ok)
       expect(response.parsed_body).to eq(JSON.parse(show_submission_body(submission).to_json))
     end
+
+    it 'returns an authorization error if test account API token is used with a production submission' do
+      submission = create(:submission, :with_submitters, :with_events, template: templates[0], created_by_user: author)
+
+      get "/api/submissions/#{submission.id}", headers: { 'x-auth-token': testing_author.access_token.token }
+
+      expect(response).to have_http_status(:forbidden)
+      expect(response.parsed_body).to eq(
+        JSON.parse({ error: "Submission #{submission.id} not found using testing API key; " \
+                            'Use production API key to access production submissions.' }.to_json)
+      )
+    end
+
+    it 'returns an authorization error if production account API token is used with a test submission' do
+      submission = create(:submission, :with_submitters, :with_events, template: testing_templates[0],
+                                                                       created_by_user: testing_author)
+
+      get "/api/submissions/#{submission.id}", headers: { 'x-auth-token': author.access_token.token }
+
+      expect(response).to have_http_status(:forbidden)
+      expect(response.parsed_body).to eq(
+        JSON.parse({ error: "Submission #{submission.id} not found using production API key; " \
+                            'Use testing API key to access testing submissions.' }.to_json)
+      )
+    end
   end
 
   describe 'POST /api/submissions' do
@@ -47,7 +79,7 @@ describe 'Submission API', type: :request do
       post '/api/submissions', headers: { 'x-auth-token': author.access_token.token }, params: {
         template_id: templates[0].id,
         send_email: true,
-        submitters: [{ role: 'First Role', email: 'john.doe@example.com' }]
+        submitters: [{ role: 'First Party', email: 'john.doe@example.com' }]
       }.to_json
 
       expect(response).to have_http_status(:ok)
@@ -56,13 +88,16 @@ describe 'Submission API', type: :request do
 
       expect(response.parsed_body).to eq(JSON.parse(create_submission_body(submission).to_json))
     end
-  end
 
-  describe 'POST /api/submissions/emails' do
-    it 'creates a submission using email' do
+    it 'creates a submission when some submitter roles are not provided' do
       post '/api/submissions', headers: { 'x-auth-token': author.access_token.token }, params: {
-        template_id: templates[0].id,
-        emails: 'john.doe@example.com'
+        template_id: multiple_submitters_template.id,
+        send_email: true,
+        submitters: [
+          { role: 'First Party', email: 'john.doe@example.com' },
+          { email: 'jane.doe@example.com' },
+          { email: 'mike.doe@example.com' }
+        ]
       }.to_json
 
       expect(response).to have_http_status(:ok)
@@ -70,6 +105,95 @@ describe 'Submission API', type: :request do
       submission = Submission.last
 
       expect(response.parsed_body).to eq(JSON.parse(create_submission_body(submission).to_json))
+      expect(response.parsed_body).to eq(JSON.parse(create_submission_body(submission).to_json))
+      expect(response.parsed_body[0]['role']).to eq('First Party')
+      expect(response.parsed_body[0]['email']).to eq('john.doe@example.com')
+      expect(response.parsed_body[1]['role']).to eq('Second Party')
+      expect(response.parsed_body[1]['email']).to eq('jane.doe@example.com')
+      expect(response.parsed_body[2]['role']).to eq('Third Party')
+      expect(response.parsed_body[2]['email']).to eq('mike.doe@example.com')
+    end
+
+    it 'returns an error if the submitter email is invalid' do
+      post '/api/submissions', headers: { 'x-auth-token': author.access_token.token }, params: {
+        template_id: templates[0].id,
+        send_email: true,
+        submitters: [
+          { role: 'First Party', email: 'john@example' }
+        ]
+      }.to_json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+
+      expect(response.parsed_body).to eq({ 'error' => 'email is invalid in `submitters[0]`.' })
+    end
+
+    it 'returns an error if the template fields are missing' do
+      templates[0].update(fields: [])
+
+      post '/api/submissions', headers: { 'x-auth-token': author.access_token.token }, params: {
+        template_id: templates[0].id,
+        send_email: true,
+        submitters: [{ role: 'First Party', email: 'john.doe@example.com' }]
+      }.to_json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(response.parsed_body).to eq({ 'error' => 'Template does not contain fields' })
+    end
+
+    it 'returns an error if submitter roles are not unique' do
+      post '/api/submissions', headers: { 'x-auth-token': author.access_token.token }, params: {
+        template_id: multiple_submitters_template.id,
+        send_email: true,
+        submitters: [
+          { role: 'First Party', email: 'john.doe@example.com' },
+          { role: 'First Party', email: 'jane.doe@example.com' }
+        ]
+      }.to_json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(response.parsed_body).to eq({ 'error' => 'role must be unique in `submitters`.' })
+    end
+
+    it 'returns an error if number of submitters more than in the template' do
+      post '/api/submissions', headers: { 'x-auth-token': author.access_token.token }, params: {
+        template_id: templates[0].id,
+        send_email: true,
+        submitters: [
+          { email: 'jane.doe@example.com' },
+          { role: 'First Party', email: 'john.doe@example.com' }
+        ]
+      }.to_json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(response.parsed_body).to eq({ 'error' => 'Defined more signing parties than in template' })
+    end
+  end
+
+  describe 'POST /api/submissions/emails' do
+    it 'creates a submission using email' do
+      post '/api/submissions/emails', headers: { 'x-auth-token': author.access_token.token }, params: {
+        template_id: templates[0].id,
+        emails: 'john.doe@example.com,jane.doe@example.com'
+      }.to_json
+
+      expect(response).to have_http_status(:ok)
+
+      submissions = Submission.last(2)
+      submissions_body = submissions.reduce([]) { |acc, submission| acc + create_submission_body(submission) }
+
+      expect(response.parsed_body).to eq(JSON.parse(submissions_body.to_json))
+    end
+
+    it 'returns an error if emails are invalid' do
+      post '/api/submissions/emails', headers: { 'x-auth-token': author.access_token.token }, params: {
+        template_id: templates[0].id,
+        emails: 'amy.baker@example.com, george.morris@example.com@gmail.com'
+      }.to_json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+
+      expect(response.parsed_body).to eq({ 'error' => 'emails are invalid' })
     end
   end
 

spec/requests/submitters_spec.rb

@@ -3,10 +3,16 @@
 require 'rails_helper'
 
 describe 'Submitter API', type: :request do
-  let!(:account) { create(:account) }
-  let!(:author) { create(:user, account:) }
-  let!(:folder) { create(:template_folder, account:) }
-  let!(:templates) { create_list(:template, 2, account:, author:, folder:) }
+  let(:account) { create(:account, :with_testing_account) }
+  let(:testing_account) { account.testing_accounts.first }
+  let(:author) { create(:user, account:) }
+  let(:testing_author) { create(:user, account: testing_account) }
+  let(:folder) { create(:template_folder, account:) }
+  let(:testing_folder) { create(:template_folder, account: testing_account) }
+  let(:templates) { create_list(:template, 2, account:, author:, folder:) }
+  let(:testing_templates) do
+    create_list(:template, 2, account: testing_account, author: testing_author, folder: testing_folder)
+  end
 
   describe 'GET /api/submitters' do
     it 'returns a list of submitters' do
@@ -42,6 +48,34 @@ describe 'Submitter API', type: :request do
       expect(response).to have_http_status(:ok)
       expect(response.parsed_body).to eq(JSON.parse(submitter_body(submitter).to_json))
     end
+
+    it 'returns an authorization error if test account API token is used with a production submitter' do
+      submitter = create(:submission, :with_submitters, :with_events,
+                         template: templates[0],
+                         created_by_user: author).submitters.first
+
+      get "/api/submitters/#{submitter.id}", headers: { 'x-auth-token': testing_author.access_token.token }
+
+      expect(response).to have_http_status(:forbidden)
+      expect(response.parsed_body).to eq(
+        JSON.parse({ error: "Submitter #{submitter.id} not found using " \
+                            'testing API key; Use production API key to access production submitters.' }.to_json)
+      )
+    end
+
+    it 'returns an authorization error if production account API token is used with a test submitter' do
+      submitter = create(:submission, :with_submitters, :with_events,
+                         template: testing_templates[0],
+                         created_by_user: testing_author).submitters.first
+
+      get "/api/submitters/#{submitter.id}", headers: { 'x-auth-token': author.access_token.token }
+
+      expect(response).to have_http_status(:forbidden)
+      expect(response.parsed_body).to eq(
+        JSON.parse({ error: "Submitter #{submitter.id} not found using production API key; " \
+                            'Use testing API key to access testing submitters.' }.to_json)
+      )
+    end
   end
 
   describe 'PUT /api/submitters' do

spec/requests/templates_spec.rb

@@ -3,10 +3,12 @@
 require 'rails_helper'
 
 describe 'Templates API', type: :request do
-  let!(:account) { create(:account) }
-  let!(:author) { create(:user, account:) }
-  let!(:folder) { create(:template_folder, account:) }
-  let!(:template_preferences) { { 'request_email_subject' => 'Subject text', 'request_email_body' => 'Body Text' } }
+  let(:account) { create(:account, :with_testing_account) }
+  let(:testing_account) { account.testing_accounts.first }
+  let(:author) { create(:user, account:) }
+  let(:testing_author) { create(:user, account: testing_account) }
+  let(:folder) { create(:template_folder, account:) }
+  let(:template_preferences) { { 'request_email_subject' => 'Subject text', 'request_email_body' => 'Body Text' } }
 
   describe 'GET /api/templates' do
     it 'returns a list of templates' do
@@ -48,6 +50,38 @@ describe 'Templates API', type: :request do
       expect(response).to have_http_status(:ok)
       expect(response.parsed_body).to eq(JSON.parse(template_body(template).to_json))
     end
+
+    it 'returns an authorization error if test account API token is used with a production template' do
+      template = create(:template, account:,
+                                   author:,
+                                   folder:,
+                                   external_id: SecureRandom.base58(10),
+                                   preferences: template_preferences)
+
+      get "/api/templates/#{template.id}", headers: { 'x-auth-token': testing_author.access_token.token }
+
+      expect(response).to have_http_status(:forbidden)
+      expect(response.parsed_body).to eq(
+        JSON.parse({ error: "Template #{template.id} not found using testing API key; " \
+                            'Use production API key to access production templates.' }.to_json)
+      )
+    end
+
+    it 'returns an authorization error if production account API token is used with a test template' do
+      template = create(:template, account: testing_account,
+                                   author: testing_author,
+                                   folder:,
+                                   external_id: SecureRandom.base58(10),
+                                   preferences: template_preferences)
+
+      get "/api/templates/#{template.id}", headers: { 'x-auth-token': author.access_token.token }
+
+      expect(response).to have_http_status(:forbidden)
+      expect(response.parsed_body).to eq(
+        JSON.parse({ error: "Template #{template.id} not found using production API key; " \
+                            'Use testing API key to access testing templates.' }.to_json)
+      )
+    end
   end
 
   describe 'PUT /api/templates' do
@@ -144,8 +178,8 @@ describe 'Templates API', type: :request do
       name: template.name,
       fields: [
         {
-          'uuid' => '21637fc9-0655-45df-8952-04ec64949e85',
-          'submitter_uuid' => '513848eb-1096-4abc-a743-68596b5aaa4c',
+          'uuid' => template.fields[0]['uuid'],
+          'submitter_uuid' => template.submitters[0]['uuid'],
           'name' => 'First Name',
           'type' => 'text',
           'required' => true,
@@ -161,8 +195,8 @@ describe 'Templates API', type: :request do
           ]
         },
         {
-          'uuid' => '1f97f8e3-dc82-4586-aeea-6ebed6204e46',
-          'submitter_uuid' => '513848eb-1096-4abc-a743-68596b5aaa4c',
+          'uuid' => template.fields[1]['uuid'],
+          'submitter_uuid' => template.submitters[0]['uuid'],
           'name' => '',
           'type' => 'signature',
           'required' => true,

spec/requests/tools_spec.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Tools API', type: :request do
+  let(:account) { create(:account) }
+  let(:author) { create(:user, account:) }
+  let(:file_path) { Rails.root.join('spec/fixtures/sample-document.pdf') }
+
+  before do
+    create(:encrypted_config, key: EncryptedConfig::ESIGN_CERTS_KEY,
+                              value: GenerateCertificate.call.transform_values(&:to_pem))
+  end
+
+  describe 'POST /api/tools/verify' do
+    it 'returns a verification result' do
+      template = create(:template, account:, author:)
+      submission = create(:submission, :with_submitters, :with_events, template:, created_by_user: author)
+      blob = ActiveStorage::Blob.create_and_upload!(
+        io: file_path.open,
+        filename: 'sample-document.pdf',
+        content_type: 'application/pdf'
+      )
+      create(:completed_document, submitter: submission.submitters.first,
+                                  sha256: Base64.urlsafe_encode64(Digest::SHA256.digest(blob.download)))
+
+      ActiveStorage::Attachment.create!(
+        blob:,
+        name: :documents,
+        record: submission.submitters.first
+      )
+
+      post '/api/tools/verify', headers: { 'x-auth-token': author.access_token.token }, params: {
+        file: Base64.encode64(File.read(file_path))
+      }.to_json
+
+      expect(response).to have_http_status(:ok)
+      expect(response.parsed_body['checksum_status']).to eq('verified')
+    end
+  end
+end

spec/system/api_settings_spec.rb

@@ -13,6 +13,7 @@ RSpec.describe 'API Settings' do
 
   it 'shows verify signed PDF page' do
     expect(page).to have_content('API')
-    expect(page).to have_field('X-Auth-Token', with: user.access_token.token)
+    token = user.access_token.token
+    expect(page).to have_field('X-Auth-Token', with: token.sub(token[5..], '*' * token[5..].size))
   end
 end

spec/system/submit_form_spec.rb

@@ -3,9 +3,9 @@
 require 'rails_helper'
 
 RSpec.describe 'Submit Form' do
-  let!(:account) { create(:account) }
-  let!(:user) { create(:user, account:) }
-  let!(:template) { create(:template, account:, author: user) }
+  let(:account) { create(:account) }
+  let(:user) { create(:user, account:) }
+  let(:template) { create(:template, account:, author: user) }
 
   before do
     sign_in(user)
@@ -48,8 +48,8 @@ RSpec.describe 'Submit Form' do
   end
 
   context 'when initialized by shared email address' do
-    let!(:submission) { create(:submission, template:, created_by_user: user) }
-    let!(:submitters) { template.submitters.map { |s| create(:submitter, submission:, uuid: s['uuid']) } }
+    let(:submission) { create(:submission, template:, created_by_user: user) }
+    let(:submitters) { template.submitters.map { |s| create(:submitter, submission:, uuid: s['uuid']) } }
     let(:submitter) { submitters.first }
 
     before do

spec/system/team_settings_spec.rb

@@ -18,13 +18,19 @@ RSpec.describe 'Team Settings' do
       visit settings_users_path
     end
 
-    it 'shows all users' do
+    it 'shows only active users' do
       within '.table' do
         users.each do |user|
           expect(page).to have_content(user.full_name)
           expect(page).to have_content(user.email)
-          expect(page).to have_no_content(other_user.email)
+          expect(page).to have_link('Edit', href: edit_user_path(user))
         end
+
+        expect(page).to have_button('Remove')
+        expect(page).to have_no_button('Unarchive')
+
+        expect(page).to have_no_content(other_user.full_name)
+        expect(page).to have_no_content(other_user.email)
       end
     end
 
@@ -89,4 +95,58 @@ RSpec.describe 'Team Settings' do
       expect(page).to have_no_content('User has been removed')
     end
   end
+
+  context 'when some users are archived' do
+    let!(:users) { create_list(:user, 2, account:) }
+    let!(:archived_users) { create_list(:user, 2, account:, archived_at: Time.current) }
+    let!(:other_user) { create(:user) }
+
+    it 'shows only active users' do
+      visit settings_users_path
+
+      within '.table' do
+        users.each do |user|
+          expect(page).to have_content(user.full_name)
+          expect(page).to have_content(user.email)
+        end
+
+        archived_users.each do |user|
+          expect(page).to have_no_content(user.full_name)
+          expect(page).to have_no_content(user.email)
+        end
+
+        expect(page).to have_no_content(other_user.full_name)
+        expect(page).to have_no_content(other_user.email)
+      end
+
+      expect(page).to have_link('View Archived', href: settings_archived_users_path)
+    end
+
+    it 'shows only archived users' do
+      visit settings_archived_users_path
+
+      within '.table' do
+        archived_users.each do |user|
+          expect(page).to have_content(user.full_name)
+          expect(page).to have_content(user.email)
+          expect(page).to have_no_link('Edit', href: edit_user_path(user))
+        end
+
+        users.each do |user|
+          expect(page).to have_no_content(user.full_name)
+          expect(page).to have_no_content(user.email)
+          expect(page).to have_no_link('Edit', href: edit_user_path(user))
+        end
+
+        expect(page).to have_button('Unarchive')
+        expect(page).to have_no_button('Remove')
+
+        expect(page).to have_no_content(other_user.full_name)
+        expect(page).to have_no_content(other_user.email)
+      end
+
+      expect(page).to have_content('Archived Users')
+      expect(page).to have_link('View Active', href: settings_users_path)
+    end
+  end
 end