Merge from docusealco/wip

.github/workflows/ci.yml

@@ -6,6 +6,7 @@ jobs:
   rubocop:
     name: Rubocop
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Install Ruby
@@ -30,6 +31,7 @@ jobs:
   erblint:
     name: Erblint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Install Ruby
@@ -54,6 +56,7 @@ jobs:
   eslint:
     name: ESLint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Install Node.js
@@ -80,6 +83,7 @@ jobs:
   brakeman:
     name: Brakeman
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Install Ruby
@@ -107,6 +111,7 @@ jobs:
   rspec:
     name: RSpec
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     services:
       postgres:

.github/workflows/docker.yml

@@ -8,6 +8,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
 
     steps:
     - name: Checkout code

.rubocop.yml

@@ -63,7 +63,7 @@ RSpec/MultipleExpectations:
   Max: 25
 
 RSpec/ExampleLength:
-  Max: 50
+  Max: 500
 
 RSpec/MultipleMemoizedHelpers:
   Max: 15

Gemfile

@@ -34,6 +34,7 @@ gem 'rails'
 gem 'rails_autolink'
 gem 'rails-i18n'
 gem 'rotp'
+gem 'rouge', require: false
 gem 'rqrcode'
 gem 'ruby-vips'
 gem 'rubyXL'

Gemfile.lock

@@ -453,6 +453,7 @@ GEM
     retriable (3.1.2)
     rexml (3.4.0)
     rotp (6.3.0)
+    rouge (4.5.2)
     rqrcode (2.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 1.0)
@@ -632,6 +633,7 @@ DEPENDENCIES
   rails-i18n
   rails_autolink
   rotp
+  rouge
   rqrcode
   rspec-rails
   rubocop

app/controllers/api/submissions_controller.rb

@@ -63,12 +63,7 @@ module Api
 
       submissions = create_submissions(@template, params)
 
-      WebhookUrls.for_account_id(@template.account_id, 'submission.created').each do |webhook_url|
-        submissions.each do |submission|
-          SendSubmissionCreatedWebhookRequestJob.perform_async('submission_id' => submission.id,
-                                                               'webhook_url_id' => webhook_url.id)
-        end
-      end
+      WebhookUrls.enqueue_events(submissions, 'submission.created')
 
       Submissions.send_signature_requests(submissions)
 
@@ -96,10 +91,7 @@ module Api
       else
         @submission.update!(archived_at: Time.current)
 
-        WebhookUrls.for_account_id(@submission.account_id, 'submission.archived').each do |webhook_url|
-          SendSubmissionArchivedWebhookRequestJob.perform_async('submission_id' => @submission.id,
-                                                                'webhook_url_id' => webhook_url.id)
-        end
+        WebhookUrls.enqueue_events(@submission, 'submission.archived')
       end
 
       render json: @submission.as_json(only: %i[id archived_at])
@@ -112,9 +104,9 @@ module Api
       submissions = submissions.where(slug: params[:slug]) if params[:slug].present?
 
       if params[:template_folder].present?
-        folder = TemplateFolder.accessible_by(current_ability).find_by(name: params[:template_folder])
+        folder_ids = TemplateFolder.accessible_by(current_ability).where(name: params[:template_folder]).pluck(:id)
 
-        submissions = folder ? submissions.joins(:template).where(template: { folder_id: folder.id }) : submissions.none
+        submissions = submissions.joins(:template).where(template: { folder_id: folder_ids })
       end
 
       if params.key?(:archived)

app/controllers/api/submitter_form_views_controller.rb

@@ -13,10 +13,7 @@ module Api
 
       SubmissionEvents.create_with_tracking_data(@submitter, 'view_form', request)
 
-      WebhookUrls.for_account_id(@submitter.account_id, 'form.viewed').each do |webhook_url|
-        SendFormViewedWebhookRequestJob.perform_async('submitter_id' => @submitter.id,
-                                                      'webhook_url_id' => webhook_url.id)
-      end
+      WebhookUrls.enqueue_events(@submitter, 'form.viewed')
 
       render json: {}
     end

app/controllers/api/templates_clone_controller.rb

@@ -28,10 +28,7 @@ module Api
 
       cloned_template.save!
 
-      WebhookUrls.for_account_id(cloned_template.account_id, 'template.created').each do |webhook_url|
-        SendTemplateCreatedWebhookRequestJob.perform_async('template_id' => cloned_template.id,
-                                                           'webhook_url_id' => webhook_url.id)
-      end
+      WebhookUrls.enqueue_events(cloned_template, 'template.created')
 
       SearchEntries.enqueue_reindex(cloned_template)
 

app/controllers/api/templates_controller.rb

@@ -67,10 +67,7 @@ module Api
 
       SearchEntries.enqueue_reindex(@template)
 
-      WebhookUrls.for_account_id(@template.account_id, 'template.updated').each do |webhook_url|
-        SendTemplateUpdatedWebhookRequestJob.perform_async('template_id' => @template.id,
-                                                           'webhook_url_id' => webhook_url.id)
-      end
+      WebhookUrls.enqueue_events(@template, 'template.updated')
 
       render json: @template.as_json(only: %i[id updated_at])
     end
@@ -95,9 +92,9 @@ module Api
       templates = templates.where(slug: params[:slug]) if params[:slug].present?
 
       if params[:folder].present?
-        folder = TemplateFolder.accessible_by(current_ability).find_by(name: params[:folder])
+        folder_ids = TemplateFolder.accessible_by(current_ability).where(name: params[:folder]).pluck(:id)
 
-        templates = folder ? templates.where(folder:) : templates.none
+        templates = templates.where(folder_id: folder_ids)
       end
 
       templates

app/controllers/start_form_controller.rb

@@ -6,12 +6,15 @@ class StartFormController < ApplicationController
   skip_before_action :authenticate_user!
   skip_authorization_check
 
-  around_action :with_browser_locale, only: %i[show completed]
+  around_action :with_browser_locale, only: %i[show update completed]
   before_action :maybe_redirect_com, only: %i[show completed]
   before_action :load_resubmit_submitter, only: :update
   before_action :load_template
   before_action :authorize_start!, only: :update
 
+  COOKIES_TTL = 12.hours
+  COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze
+
   def show
     raise ActionController::RoutingError, I18n.t('not_found') if @template.preferences['require_phone_2fa']
 
@@ -20,6 +23,7 @@ class StartFormController < ApplicationController
                             .submitters.new(account_id: @template.account_id,
                                             uuid: (filter_undefined_submitters(@template).first ||
                                                   @template.submitters.first)['uuid'])
+      render :email_verification if params[:email_verification]
     else
       Rollbar.warning("Not shared template: #{@template.id}") if defined?(Rollbar)
 
@@ -49,17 +53,10 @@ class StartFormController < ApplicationController
         @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent)
       end
 
-      if @submitter.errors.blank? && @submitter.save
-        if is_new_record
-          enqueue_submission_create_webhooks(@submitter)
-
-          SearchEntries.enqueue_reindex(@submitter)
-
-          if @submitter.submission.expire_at?
-            ProcessSubmissionExpiredJob.perform_at(@submitter.submission.expire_at,
-                                                   'submission_id' => @submitter.submission_id)
-          end
-        end
+      if @template.preferences['shared_link_2fa'] == true
+        handle_require_2fa(@submitter, is_new_record:)
+      elsif @submitter.errors.blank? && @submitter.save
+        enqueue_new_submitter_jobs(@submitter) if is_new_record
 
         redirect_to submit_form_path(@submitter.slug)
       else
@@ -89,6 +86,16 @@ class StartFormController < ApplicationController
 
   private
 
+  def enqueue_new_submitter_jobs(submitter)
+    WebhookUrls.enqueue_events(submitter.submission, 'submission.created')
+
+    SearchEntries.enqueue_reindex(submitter)
+
+    return unless submitter.submission.expire_at?
+
+    ProcessSubmissionExpiredJob.perform_at(submitter.submission.expire_at, 'submission_id' => submitter.submission_id)
+  end
+
   def load_resubmit_submitter
     @resubmit_submitter =
       if params[:resubmit].present? && !params[:resubmit].in?([true, 'true'])
@@ -107,13 +114,6 @@ class StartFormController < ApplicationController
     redirect_to start_form_path(@template.slug)
   end
 
-  def enqueue_submission_create_webhooks(submitter)
-    WebhookUrls.for_account_id(submitter.account_id, 'submission.created').each do |webhook_url|
-      SendSubmissionCreatedWebhookRequestJob.perform_async('submission_id' => submitter.submission_id,
-                                                           'webhook_url_id' => webhook_url.id)
-    end
-  end
-
   def find_or_initialize_submitter(template, submitter_params)
     required_fields = template.preferences.fetch('link_form_fields', ['email'])
 
@@ -130,7 +130,7 @@ class StartFormController < ApplicationController
       .order(id: :desc)
       .where(declined_at: nil)
       .where(external_id: nil)
-      .where(ip: [nil, request.remote_ip])
+      .where(template.preferences['shared_link_2fa'] == true ? {} : { ip: [nil, request.remote_ip] })
       .then { |rel| params[:resubmit].present? || params[:selfsign].present? ? rel.where(completed_at: nil) : rel }
       .find_or_initialize_by(find_params)
 
@@ -180,7 +180,7 @@ class StartFormController < ApplicationController
   end
 
   def submitter_params
-    return current_user.slice(:email) if params[:selfsign]
+    return { 'email' => current_user.email, 'name' => current_user.full_name } if params[:selfsign]
     return @resubmit_submitter.slice(:name, :phone, :email) if @resubmit_submitter.present?
 
     params.require(:submitter).permit(:email, :phone, :name).tap do |attrs|
@@ -204,4 +204,39 @@ class StartFormController < ApplicationController
       I18n.t('not_found')
     end
   end
+
+  def handle_require_2fa(submitter, is_new_record:)
+    return render :show, status: :unprocessable_entity if submitter.errors.present?
+
+    is_otp_verified = Submitters.verify_link_otp!(params[:one_time_code], submitter)
+
+    if cookies.encrypted[:email_2fa_slug] == submitter.slug || is_otp_verified
+      if submitter.save
+        enqueue_new_submitter_jobs(submitter) if is_new_record
+
+        if is_otp_verified
+          SubmissionEvents.create_with_tracking_data(submitter, 'email_verified', request)
+
+          cookies.encrypted[:email_2fa_slug] =
+            { value: submitter.slug, expires: COOKIES_TTL.from_now, **COOKIES_DEFAULTS }
+        end
+
+        redirect_to submit_form_path(submitter.slug)
+      else
+        render :show, status: :unprocessable_entity
+      end
+    else
+      Submitters.send_shared_link_email_verification_code(submitter, request:)
+
+      render :email_verification
+    end
+  rescue Submitters::UnableToSendCode, Submitters::InvalidOtp => e
+    redirect_to start_form_path(submitter.submission.template.slug,
+                                params: submitter_params.merge(email_verification: true)),
+                alert: e.message
+  rescue RateLimit::LimitApproached
+    redirect_to start_form_path(submitter.submission.template.slug,
+                                params: submitter_params.merge(email_verification: true)),
+                alert: I18n.t(:too_many_attempts)
+  end
 end

app/controllers/start_form_email_2fa_send_controller.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+class StartFormEmail2faSendController < ApplicationController
+  around_action :with_browser_locale
+
+  skip_before_action :authenticate_user!
+  skip_authorization_check
+
+  def create
+    @template = Template.find_by!(slug: params[:slug])
+
+    @submitter = @template.submissions.new(account_id: @template.account_id)
+                          .submitters.new(**submitter_params, account_id: @template.account_id)
+
+    Submitters.send_shared_link_email_verification_code(@submitter, request:)
+
+    redir_params = { notice: I18n.t(:code_has_been_resent) } if params[:resend]
+
+    redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
+                **redir_params
+  rescue Submitters::UnableToSendCode => e
+    redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)),
+                alert: e.message
+  end
+
+  private
+
+  def submitter_params
+    params.require(:submitter).permit(:name, :email, :phone)
+  end
+end

app/controllers/submission_events_controller.rb

@@ -12,6 +12,7 @@ class SubmissionEventsController < ApplicationController
     'send_2fa_sms' => '2fa',
     'send_sms' => 'send',
     'phone_verified' => 'phone_check',
+    'email_verified' => 'email_check',
     'click_sms' => 'hand_click',
     'decline_form' => 'x',
     'start_verification' => 'player_play',

app/controllers/submissions_controller.rb

@@ -54,7 +54,7 @@ class SubmissionsController < ApplicationController
                                            params: params.merge('send_completed_email' => true))
       end
 
-    enqueue_submission_created_webhooks(@template, submissions)
+    WebhookUrls.enqueue_events(submissions, 'submission.created')
 
     Submissions.send_signature_requests(submissions)
 
@@ -77,10 +77,7 @@ class SubmissionsController < ApplicationController
       else
         @submission.update!(archived_at: Time.current)
 
-        WebhookUrls.for_account_id(@submission.account_id, 'submission.archived').each do |webhook_url|
-          SendSubmissionArchivedWebhookRequestJob.perform_async('submission_id' => @submission.id,
-                                                                'webhook_url_id' => webhook_url.id)
-        end
+        WebhookUrls.enqueue_events(@submission, 'submission.archived')
 
         I18n.t('submission_has_been_archived')
       end
@@ -97,15 +94,6 @@ class SubmissionsController < ApplicationController
     template.save!
   end
 
-  def enqueue_submission_created_webhooks(template, submissions)
-    WebhookUrls.for_account_id(template.account_id, 'submission.created').each do |webhook_url|
-      submissions.each do |submission|
-        SendSubmissionCreatedWebhookRequestJob.perform_async('submission_id' => submission.id,
-                                                             'webhook_url_id' => webhook_url.id)
-      end
-    end
-  end
-
   def submissions_params
     params.permit(submission: { submitters: [%i[uuid email phone name]] })
   end

app/controllers/submissions_preview_controller.rb

@@ -28,7 +28,7 @@ class SubmissionsPreviewController < ApplicationController
       raise ActionController::RoutingError, I18n.t('not_found')
     end
 
-    if !submission_valid_ttl?(@submission) && !signature_valid
+    if use_signature?(@submission) && !signature_valid
       Rollbar.info("TTL: #{@submission.id}") if defined?(Rollbar)
 
       return redirect_to submissions_preview_completed_path(@submission.slug)
@@ -48,9 +48,15 @@ class SubmissionsPreviewController < ApplicationController
 
   private
 
-  def submission_valid_ttl?(submission)
-    return true if current_user && current_user.account.submissions.exists?(id: submission.id)
+  def use_signature?(submission)
+    return false if current_user && can?(:read, submission)
+    return true if submission.submitters.any? { |e| e.preferences['require_phone_2fa'] }
+    return true if submission.template&.preferences&.dig('require_phone_2fa')
 
+    !submission_valid_ttl?(submission)
+  end
+
+  def submission_valid_ttl?(submission)
     last_submitter = submission.submitters.select(&:completed_at?).max_by(&:completed_at)
 
     last_submitter && last_submitter.completed_at > TTL.ago

app/controllers/submit_form_controller.rb

@@ -9,6 +9,7 @@ class SubmitFormController < ApplicationController
 
   before_action :load_submitter, only: %i[show update completed]
   before_action :maybe_render_locked_page, only: :show
+  before_action :maybe_require_link_2fa, only: %i[show update]
 
   CONFIG_KEYS = [].freeze
 
@@ -50,7 +51,7 @@ class SubmitFormController < ApplicationController
       return render json: { error: I18n.t('form_has_been_completed_already') }, status: :unprocessable_entity
     end
 
-    if @submitter.template&.archived_at? || @submitter.submission.archived_at?
+    if @submitter.submission.template&.archived_at? || @submitter.submission.archived_at?
       return render json: { error: I18n.t('form_has_been_archived') }, status: :unprocessable_entity
     end
 
@@ -80,6 +81,15 @@ class SubmitFormController < ApplicationController
 
   private
 
+  def maybe_require_link_2fa
+    return if @submitter.submission.source != 'link'
+    return unless @submitter.submission.template&.preferences&.dig('shared_link_2fa') == true
+    return if cookies.encrypted[:email_2fa_slug] == @submitter.slug
+    return if @submitter.email == current_user&.email && current_user&.account_id == @submitter.account_id
+
+    redirect_to start_form_path(@submitter.submission.template.slug)
+  end
+
   def maybe_render_locked_page
     return render :archived if @submitter.submission.template&.archived_at? ||
                                @submitter.submission.archived_at? ||

app/controllers/submit_form_decline_controller.rb

@@ -25,10 +25,7 @@ class SubmitFormDeclineController < ApplicationController
       SubmitterMailer.declined_email(submitter, user).deliver_later!
     end
 
-    WebhookUrls.for_account_id(submitter.account_id, 'form.declined').each do |webhook_url|
-      SendFormDeclinedWebhookRequestJob.perform_async('submitter_id' => submitter.id,
-                                                      'webhook_url_id' => webhook_url.id)
-    end
+    WebhookUrls.enqueue_events(submitter, 'form.declined')
 
     redirect_to submit_form_path(submitter.slug)
   end

app/controllers/template_folders_controller.rb

@@ -3,11 +3,13 @@
 class TemplateFoldersController < ApplicationController
   load_and_authorize_resource :template_folder
 
+  helper_method :selected_order
+
   def show
     @templates = @template_folder.templates.active.accessible_by(current_ability)
                                  .preload(:author, :template_accesses)
     @templates = Templates.search(current_user, @templates, params[:q])
-    @templates = Templates::Order.call(@templates, current_user, cookies.permanent[:dashboard_templates_order])
+    @templates = Templates::Order.call(@templates, current_user, selected_order)
 
     @pagy, @templates = pagy_auto(@templates, limit: 12)
   end
@@ -25,6 +27,16 @@ class TemplateFoldersController < ApplicationController
 
   private
 
+  def selected_order
+    @selected_order ||=
+      if cookies.permanent[:dashboard_templates_order].blank? ||
+         (cookies.permanent[:dashboard_templates_order] == 'used_at' && can?(:manage, :countless))
+        'created_at'
+      else
+        cookies.permanent[:dashboard_templates_order]
+      end
+  end
+
   def template_folder_params
     params.require(:template_folder).permit(:name)
   end

app/controllers/templates_controller.rb

@@ -74,7 +74,7 @@ class TemplatesController < ApplicationController
 
       SearchEntries.enqueue_reindex(@template)
 
-      enqueue_template_created_webhooks(@template)
+      WebhookUrls.enqueue_events(@template, 'template.created')
 
       maybe_redirect_to_template(@template)
     else
@@ -91,7 +91,7 @@ class TemplatesController < ApplicationController
 
     SearchEntries.enqueue_reindex(@template) if is_name_changed
 
-    enqueue_template_updated_webhooks(@template)
+    WebhookUrls.enqueue_events(@template, 'template.updated')
 
     head :ok
   end
@@ -142,20 +142,6 @@ class TemplatesController < ApplicationController
     end
   end
 
-  def enqueue_template_created_webhooks(template)
-    WebhookUrls.for_account_id(template.account_id, 'template.created').each do |webhook_url|
-      SendTemplateCreatedWebhookRequestJob.perform_async('template_id' => template.id,
-                                                         'webhook_url_id' => webhook_url.id)
-    end
-  end
-
-  def enqueue_template_updated_webhooks(template)
-    WebhookUrls.for_account_id(template.account_id, 'template.updated').each do |webhook_url|
-      SendTemplateUpdatedWebhookRequestJob.perform_async('template_id' => template.id,
-                                                         'webhook_url_id' => webhook_url.id)
-    end
-  end
-
   def load_base_template
     return if params[:base_template_id].blank?
 

app/controllers/templates_dashboard_controller.rb

@@ -8,12 +8,13 @@ class TemplatesDashboardController < ApplicationController
   TEMPLATES_PER_PAGE = 12
   FOLDERS_PER_PAGE = 18
 
+  helper_method :selected_order
+
   def index
     @template_folders = @template_folders.where(id: @templates.active.select(:folder_id))
 
     @template_folders = TemplateFolders.search(@template_folders, params[:q])
-    @template_folders = sort_template_folders(@template_folders, current_user,
-                                              cookies.permanent[:dashboard_templates_order])
+    @template_folders = sort_template_folders(@template_folders, current_user, selected_order)
 
     @pagy, @template_folders = pagy(
       @template_folders,
@@ -26,7 +27,7 @@ class TemplatesDashboardController < ApplicationController
     else
       @template_folders = @template_folders.reject { |e| e.name == TemplateFolder::DEFAULT_NAME }
       @templates = filter_templates(@templates).preload(:author, :template_accesses)
-      @templates = Templates::Order.call(@templates, current_user, cookies.permanent[:dashboard_templates_order])
+      @templates = Templates::Order.call(@templates, current_user, selected_order)
 
       limit =
         if @template_folders.size < 4
@@ -56,7 +57,7 @@ class TemplatesDashboardController < ApplicationController
         rel = Template.where(
           Template.arel_table[:id].in(
             rel.where(folder_id: current_account.default_template_folder.id).select(:id).arel
-               .union(shared_template_ids.arel)
+               .union(:all, shared_template_ids.arel)
           )
         )
       else
@@ -101,6 +102,16 @@ class TemplatesDashboardController < ApplicationController
     end
   end
 
+  def selected_order
+    @selected_order ||=
+      if cookies.permanent[:dashboard_templates_order].blank? ||
+         (cookies.permanent[:dashboard_templates_order] == 'used_at' && can?(:manage, :countless))
+        'created_at'
+      else
+        cookies.permanent[:dashboard_templates_order]
+      end
+  end
+
   def load_related_submissions
     @related_submissions = Submission.accessible_by(current_ability)
                                      .left_joins(:template)

app/controllers/templates_preferences_controller.rb

@@ -26,7 +26,7 @@ class TemplatesPreferencesController < ApplicationController
                       completed_notification_email_attach_documents
                       completed_redirect_url validate_unique_submitters
                       require_all_submitters submitters_order require_phone_2fa
-                      default_expire_at_duration
+                      default_expire_at_duration shared_link_2fa
                       default_expire_at
                       completed_notification_email_subject completed_notification_email_body
                       completed_notification_email_enabled completed_notification_email_attach_audit] +

app/controllers/templates_uploads_controller.rb

@@ -23,7 +23,7 @@ class TemplatesUploadsController < ApplicationController
 
     @template.update!(schema:)
 
-    enqueue_template_created_webhooks(@template)
+    WebhookUrls.enqueue_events(@template, 'template.created')
 
     SearchEntries.enqueue_reindex(@template)
 
@@ -68,11 +68,4 @@ class TemplatesUploadsController < ApplicationController
 
     { files: [file] }
   end
-
-  def enqueue_template_created_webhooks(template)
-    WebhookUrls.for_account_id(template.account_id, 'template.created').each do |webhook_url|
-      SendTemplateCreatedWebhookRequestJob.perform_async('template_id' => template.id,
-                                                         'webhook_url_id' => webhook_url.id)
-    end
-  end
 end

app/controllers/webhook_events_controller.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+class WebhookEventsController < ApplicationController
+  load_and_authorize_resource :webhook_url, parent: false, id_param: :webhook_id
+  before_action :load_webhook_event
+
+  def show
+    return unless current_ability.can?(:read, @webhook_event.record)
+
+    @data =
+      case @webhook_event.event_type
+      when 'form.started', 'form.completed', 'form.declined', 'form.viewed'
+        Submitters::SerializeForWebhook.call(@webhook_event.record)
+      when 'submission.created', 'submission.completed', 'submission.expired'
+        Submissions::SerializeForApi.call(@webhook_event.record)
+      when 'template.created', 'template.updated'
+        Templates::SerializeForApi.call(@webhook_event.record)
+      when 'submission.archived'
+        @webhook_event.record.as_json(only: %i[id archived_at])
+      end
+  end
+
+  def resend
+    id_key = WebhookUrls::EVENT_TYPE_ID_KEYS.fetch(@webhook_event.event_type.split('.').first)
+
+    last_attempt_id = @webhook_event.webhook_attempts.maximum(:id)
+
+    WebhookUrls::EVENT_TYPE_TO_JOB_CLASS[@webhook_event.event_type].perform_async(
+      id_key => @webhook_event.record_id,
+      'webhook_url_id' => @webhook_event.webhook_url_id,
+      'event_uuid' => @webhook_event.uuid,
+      'attempt' => SendWebhookRequest::MANUAL_ATTEMPT,
+      'last_status' => 0
+    )
+
+    render turbo_stream: [
+      turbo_stream.after(
+        params[:button_id],
+        helpers.tag.submit_form(
+          helpers.button_to('', refresh_settings_webhook_event_path(@webhook_url.id, @webhook_event.uuid),
+                            params: { last_attempt_id: }),
+          class: 'hidden', data: { interval: 3_000 }
+        )
+      )
+    ]
+  end
+
+  def refresh
+    return head :ok if @webhook_event.webhook_attempts.maximum(:id) == params[:last_attempt_id].to_i
+
+    render turbo_stream: [
+      turbo_stream.replace(helpers.dom_id(@webhook_event),
+                           partial: 'event_row',
+                           locals: { with_status: true, webhook_url: @webhook_url, webhook_event: @webhook_event }),
+      turbo_stream.replace(helpers.dom_id(@webhook_event, :drawer_events),
+                           partial: 'drawer_events',
+                           locals: { webhook_url: @webhook_url, webhook_event: @webhook_event })
+    ]
+  end
+
+  private
+
+  def load_webhook_event
+    @webhook_event = @webhook_url.webhook_events.find_by!(uuid: params[:id])
+  end
+end

app/controllers/webhook_settings_controller.rb

@@ -8,10 +8,26 @@ class WebhookSettingsController < ApplicationController
     @webhook_urls = @webhook_urls.order(id: :desc)
     @webhook_url = @webhook_urls.first_or_initialize
 
-    render @webhook_urls.size > 1 ? 'index' : 'show'
+    if @webhook_urls.size > 1
+      render :index
+    else
+      @webhook_events = @webhook_url.webhook_events
+
+      @webhook_events = @webhook_events.where(status: params[:status]) if %w[success error].include?(params[:status])
+
+      @pagy, @webhook_events = pagy_countless(@webhook_events.order(id: :desc))
+
+      render :show
+    end
   end
 
-  def show; end
+  def show
+    @webhook_events = @webhook_url.webhook_events
+
+    @webhook_events = @webhook_events.where(status: params[:status]) if %w[success error].include?(params[:status])
+
+    @pagy, @webhook_events = pagy_countless(@webhook_events.order(id: :desc))
+  end
 
   def new; end
 
@@ -37,13 +53,18 @@ class WebhookSettingsController < ApplicationController
   def resend
     submitter = current_account.submitters.where.not(completed_at: nil).order(:id).last
 
+    authorize!(:read, submitter)
+
     if submitter.blank? || @webhook_url.blank?
       return redirect_back(fallback_location: settings_webhooks_path,
                            alert: I18n.t('unable_to_resend_webhook_request'))
     end
 
-    SendFormCompletedWebhookRequestJob.perform_async('submitter_id' => submitter.id,
-                                                     'webhook_url_id' => @webhook_url.id)
+    SendTestWebhookRequestJob.perform_async(
+      'submitter_id' => submitter.id,
+      'event_uuid' => SecureRandom.uuid,
+      'webhook_url_id' => @webhook_url.id
+    )
 
     redirect_back(fallback_location: settings_webhooks_path, notice: I18n.t('webhook_request_has_been_sent'))
   end

app/javascript/application.js

@@ -36,6 +36,7 @@ import IndeterminateCheckbox from './elements/indeterminate_checkbox'
 import AppTour from './elements/app_tour'
 import DashboardDropzone from './elements/dashboard_dropzone'
 import RequiredCheckboxGroup from './elements/required_checkbox_group'
+import PageContainer from './elements/page_container'
 
 import * as TurboInstantClick from './lib/turbo_instant_click'
 
@@ -107,6 +108,7 @@ safeRegisterElement('app-tour', AppTour)
 safeRegisterElement('dashboard-dropzone', DashboardDropzone)
 safeRegisterElement('check-on-click', CheckOnClick)
 safeRegisterElement('required-checkbox-group', RequiredCheckboxGroup)
+safeRegisterElement('page-container', PageContainer)
 
 safeRegisterElement('template-builder', class extends HTMLElement {
   connectedCallback () {

app/javascript/application.scss

@@ -147,3 +147,11 @@ button[disabled] .enabled {
   outline-offset: 3px;
   outline-color: hsl(var(--bc) / 0.2);
 }
+
+.font-times {
+  font-family: "Times New Roman", Times, ui-serif, serif, Cambria, Georgia;
+}
+
+.font-courier {
+  font-family: "Courier New", Consolas, "Liberation Mono", monospace, ui-monospace, SFMono-Regular, Menlo, Monaco;
+}

app/javascript/elements/dashboard_dropzone.js

@@ -98,13 +98,13 @@ export default targetable(class extends HTMLElement {
       el.classList.add('opacity-50')
 
       if (e.dataTransfer.files.length) {
-        const params = new URLSearchParams({ folder_name: el.innerText }).toString()
+        const params = new URLSearchParams({ folder_name: el.innerText.trim() }).toString()
 
         this.uploadFiles(e.dataTransfer.files, `/templates_upload?${params}`)
       } else {
         const formData = new FormData()
 
-        formData.append('name', el.innerText)
+        formData.append('name', el.innerText.trim())
 
         fetch(`/templates/${templateId}/folder`, {
           method: 'PUT',

app/javascript/elements/page_container.js

@@ -0,0 +1,14 @@
+export default class extends HTMLElement {
+  connectedCallback () {
+    this.image.addEventListener('load', (e) => {
+      this.image.setAttribute('width', e.target.naturalWidth)
+      this.image.setAttribute('height', e.target.naturalHeight)
+
+      this.style.aspectRatio = `${e.target.naturalWidth} / ${e.target.naturalHeight}`
+    })
+  }
+
+  get image () {
+    return this.querySelector('img')
+  }
+}

app/javascript/elements/submit_form.js

@@ -1,5 +1,17 @@
 export default class extends HTMLElement {
   connectedCallback () {
-    this.querySelector('form').requestSubmit()
+    if (this.dataset.interval) {
+      this.interval = setInterval(() => {
+        this.querySelector('form').requestSubmit()
+      }, parseInt(this.dataset.interval))
+    } else {
+      this.querySelector('form').requestSubmit()
+    }
+  }
+
+  disconnectedCallback () {
+    if (this.interval) {
+      clearInterval(this.interval)
+    }
   }
 }

app/javascript/form.js

@@ -5,6 +5,7 @@ import DownloadButton from './elements/download_button'
 import ToggleSubmit from './elements/toggle_submit'
 import FetchForm from './elements/fetch_form'
 import ScrollButtons from './elements/scroll_buttons'
+import PageContainer from './elements/page_container'
 
 const safeRegisterElement = (name, element, options = {}) => !window.customElements.get(name) && window.customElements.define(name, element, options)
 
@@ -12,6 +13,7 @@ safeRegisterElement('download-button', DownloadButton)
 safeRegisterElement('toggle-submit', ToggleSubmit)
 safeRegisterElement('fetch-form', FetchForm)
 safeRegisterElement('scroll-buttons', ScrollButtons)
+safeRegisterElement('page-container', PageContainer)
 safeRegisterElement('submission-form', class extends HTMLElement {
   connectedCallback () {
     this.appElem = document.createElement('div')

app/javascript/form.scss

@@ -70,3 +70,11 @@ button[disabled] .enabled {
 .base-radio {
   @apply radio bg-white radio-sm;
 }
+
+.font-times {
+  font-family: "Times New Roman", Times, ui-serif, serif, Cambria, Georgia;
+}
+
+.font-courier {
+  font-family: "Courier New", Consolas, "Liberation Mono", monospace, ui-monospace, SFMono-Regular, Menlo, Monaco;
+}

app/javascript/submission_form/area.vue

@@ -2,8 +2,8 @@
   <div
     class="flex absolute lg:text-base -outline-offset-1 field-area"
     dir="auto"
-    :style="computedStyle"
-    :class="{ 'text-[1.6vw] lg:text-base': !textOverflowChars, 'text-[1.0vw] lg:text-xs': textOverflowChars, 'cursor-default': !submittable, 'border border-red-100 bg-red-100 cursor-pointer': submittable, 'border border-red-100': !isActive && submittable, 'bg-opacity-80': !isActive && !isValueSet && submittable, 'outline-red-500 outline-dashed outline-2 z-10 field-area-active': isActive && submittable, 'bg-opacity-40': (isActive || isValueSet) && submittable }"
+    :style="[computedStyle, fontStyle]"
+    :class="{ 'cursor-default': !submittable, 'border border-red-100 bg-red-100 cursor-pointer': submittable, 'border border-red-100': !isActive && submittable, 'bg-opacity-80': !isActive && !isValueSet && submittable, 'outline-red-500 outline-dashed outline-2 z-10 field-area-active': isActive && submittable, 'bg-opacity-40': (isActive || isValueSet) && submittable }"
   >
     <div
       v-if="(!withFieldPlaceholder || !field.name || field.type === 'cells') && !isActive && !isValueSet && field.type !== 'checkbox' && submittable && !area.option_uuid"
@@ -236,6 +236,11 @@ export default {
       type: Object,
       required: true
     },
+    isInlineSize: {
+      type: Boolean,
+      required: false,
+      default: true
+    },
     submitter: {
       type: Object,
       required: false,
@@ -348,8 +353,8 @@ export default {
       }
 
       return {
-        'font-mono': this.field.preferences.font === 'Courier',
-        'font-serif': this.field.preferences.font === 'Times',
+        'font-courier': this.field.preferences.font === 'Courier',
+        'font-times': this.field.preferences.font === 'Times',
         'font-bold': ['bold_italic', 'bold'].includes(this.field.preferences.font_type),
         italic: ['bold_italic', 'italic'].includes(this.field.preferences.font_type)
       }
@@ -427,6 +432,37 @@ export default {
         return []
       }
     },
+    fontStyle () {
+      let fontSize = ''
+
+      if (this.isInlineSize) {
+        if (this.textOverflowChars) {
+          fontSize = `${this.fontSizePx / 1.5 / 10}cqmin`
+        } else {
+          fontSize = `${this.fontSizePx / 10}cqmin`
+        }
+      } else {
+        if (this.textOverflowChars) {
+          fontSize = `clamp(1pt, ${this.fontSizePx / 1.5 / 10}vw, ${this.fontSizePx / 1.5}px)`
+        } else {
+          fontSize = `clamp(1pt, ${this.fontSizePx / 10}vw, ${this.fontSizePx}px)`
+        }
+      }
+
+      return { fontSize, lineHeight: `calc(${fontSize} * ${this.lineHeight})` }
+    },
+    fontSizePx () {
+      return parseInt(this.field?.preferences?.font_size || 11) * this.fontScale
+    },
+    lineHeight () {
+      return 1.3
+    },
+    fontScale () {
+      return 1000 / 612.0
+    },
+    ladscapeScale () {
+      return 8.5 / 11.0
+    },
     computedStyle () {
       const { x, y, w, h } = this.area
 
@@ -437,11 +473,6 @@ export default {
         height: h * 100 + '%'
       }
 
-      if (this.field.preferences?.font_size) {
-        style.fontSize = `clamp(4pt, 1.6vw, ${parseInt(this.field.preferences.font_size) * 1.23}pt)`
-        style.lineHeight = `clamp(6pt, 2.0vw, ${parseInt(this.field.preferences.font_size) * 1.23 + 3}pt)`
-      }
-
       if (this.field.preferences?.color) {
         style.color = this.field.preferences.color
       }
@@ -456,7 +487,7 @@ export default {
     modelValue () {
       this.$nextTick(() => {
         if (['date', 'text', 'number'].includes(this.field.type) && this.$refs.textContainer && (this.textOverflowChars === 0 || (this.textOverflowChars - 4) > `${this.modelValue}`.length)) {
-          this.textOverflowChars = this.$refs.textContainer.scrollHeight > this.$refs.textContainer.clientHeight ? `${this.modelValue || (this.withFieldPlaceholder ? this.field.name : '')}`.length : 0
+          this.textOverflowChars = this.$refs.textContainer.scrollHeight > (this.$refs.textContainer.clientHeight + 1) ? `${this.modelValue || (this.withFieldPlaceholder ? this.field.name : '')}`.length : 0
         }
       })
     }
@@ -464,7 +495,7 @@ export default {
   mounted () {
     this.$nextTick(() => {
       if (['date', 'text', 'number'].includes(this.field.type) && this.$refs.textContainer) {
-        this.textOverflowChars = this.$refs.textContainer.scrollHeight > this.$refs.textContainer.clientHeight ? `${this.modelValue || (this.withFieldPlaceholder ? this.field.name : '')}`.length : 0
+        this.textOverflowChars = this.$refs.textContainer.scrollHeight > (this.$refs.textContainer.clientHeight + 1) ? `${this.modelValue || (this.withFieldPlaceholder ? this.field.name : '')}`.length : 0
       }
     })
   },

app/javascript/submission_form/areas.vue

@@ -23,6 +23,7 @@
             :area="area"
             :submittable="submittable"
             :field-index="fieldIndex"
+            :is-inline-size="isInlineSize"
             :scroll-padding="scrollPadding"
             :submitter="submitter"
             :with-field-placeholder="withFieldPlaceholder"
@@ -110,6 +111,9 @@ export default {
     }
   },
   computed: {
+    isInlineSize () {
+      return CSS.supports('container-type: size')
+    },
     isMobileContainer () {
       const root = this.$root.$el.parentNode.getRootNode()
       const container = root.body || root.querySelector('div')

app/javascript/submission_form/dropzone.vue

@@ -95,7 +95,19 @@ export default {
   },
   methods: {
     onDropFiles (e) {
-      this.uploadFiles(e.dataTransfer.files)
+      const files = Array.from(e.dataTransfer.files).filter((f) => {
+        if (this.accept === 'image/*') {
+          return f.type.startsWith('image')
+        } else {
+          return true
+        }
+      })
+
+      if (this.accept === 'image/*' && !files.length) {
+        alert(this.t('please_upload_an_image_file'))
+      } else {
+        this.uploadFiles(files)
+      }
     },
     onSelectFiles (e) {
       e.preventDefault()

app/javascript/submission_form/form.vue

@@ -67,7 +67,7 @@
   <button
     v-if="!isFormVisible"
     id="expand_form_button"
-    class="btn btn-neutral flex text-white absolute bottom-0 w-full mb-3 expand-form-button"
+    class="btn btn-neutral flex text-white absolute bottom-0 w-full mb-3 expand-form-button text-base"
     style="width: 96%; margin-left: 2%"
     @click.prevent="[isFormVisible = true, scrollIntoField(currentField)]"
   >

app/javascript/submission_form/formula_areas.vue

@@ -14,6 +14,7 @@
         <FieldArea
           v-if="isMathLoaded"
           :model-value="calculateFormula(field)"
+          :is-inline-size="isInlineSize"
           :field="field"
           :area="area"
           :submittable="false"
@@ -54,6 +55,11 @@ export default {
       isMathLoaded: false
     }
   },
+  computed: {
+    isInlineSize () {
+      return CSS.supports('container-type: size')
+    }
+  },
   async mounted () {
     const {
       create,

app/javascript/submission_form/i18n.js

@@ -1,4 +1,6 @@
 const en = {
+  please_upload_an_image_file: 'Please upload an image file',
+  must_be_characters_length: 'Must be {number} characters length',
   complete_all_required_fields_to_proceed_with_identity_verification: 'Complete all required fields to proceed with identity verification.',
   verify_id: 'Verify ID',
   identity_verification: 'Identity verification',
@@ -98,6 +100,8 @@ const en = {
 }
 
 const es = {
+  please_upload_an_image_file: 'Por favor, sube un archivo de imagen',
+  must_be_characters_length: 'Debe tener {number} caracteres de longitud',
   complete_all_required_fields_to_proceed_with_identity_verification: 'Complete todos los campos requeridos para continuar con la verificación de identidad.',
   verify_id: 'Verificar ID',
   identity_verification: 'Verificación de identidad',
@@ -197,6 +201,8 @@ const es = {
 }
 
 const it = {
+  please_upload_an_image_file: 'Per favore carica un file immagine',
+  must_be_characters_length: 'Deve essere lungo {number} caratteri',
   complete_all_required_fields_to_proceed_with_identity_verification: "Compila tutti i campi obbligatori per procedere con la verifica dell'identità.",
   verify_id: 'Verifica ID',
   identity_verification: "Verifica dell'identità",
@@ -296,6 +302,8 @@ const it = {
 }
 
 const de = {
+  please_upload_an_image_file: 'Bitte laden Sie eine Bilddatei hoch',
+  must_be_characters_length: 'Muss {number} Zeichen lang sein',
   complete_all_required_fields_to_proceed_with_identity_verification: 'Vervollständigen Sie alle erforderlichen Felder, um mit der Identitätsverifizierung fortzufahren.',
   verify_id: 'ID überprüfen',
   identity_verification: 'Identitätsüberprüfung',
@@ -395,6 +403,8 @@ const de = {
 }
 
 const fr = {
+  please_upload_an_image_file: 'Veuillez télécharger un fichier image',
+  must_be_characters_length: 'Doit contenir {number} caractères',
   complete_all_required_fields_to_proceed_with_identity_verification: "Veuillez remplir tous les champs obligatoires pour continuer la vérification de l'identité.",
   verify_id: "Vérification de l'ID",
   identity_verification: "Vérification de l'identité",
@@ -494,6 +504,8 @@ const fr = {
 }
 
 const pl = {
+  please_upload_an_image_file: 'Proszę przesłać plik obrazu',
+  must_be_characters_length: 'Musi mieć długość {number} znaków',
   complete_all_required_fields_to_proceed_with_identity_verification: 'Uzupełnij wszystkie wymagane pola, aby kontynuować weryfikację tożsamości.',
   verify_id: 'Zweryfikuj ID',
   identity_verification: 'Weryfikacja tożsamości',
@@ -593,6 +605,8 @@ const pl = {
 }
 
 const uk = {
+  please_upload_an_image_file: 'Будь ласка, завантажте файл зображення',
+  must_be_characters_length: 'Має містити {number} символів',
   complete_all_required_fields_to_proceed_with_identity_verification: "Заповніть всі обов'язкові поля, щоб продовжити перевірку особи.",
   verify_id: 'Підтвердження ідентичності',
   identity_verification: 'Ідентифікація особи',
@@ -692,6 +706,8 @@ const uk = {
 }
 
 const cs = {
+  please_upload_an_image_file: 'Nahrajte prosím obrázkový soubor',
+  must_be_characters_length: 'Musí mít délku {number} znaků',
   complete_all_required_fields_to_proceed_with_identity_verification: 'Vyplňte všechna povinná pole, abyste mohli pokračovat v ověření identity.',
   verify_id: 'Ověřit ID',
   identity_verification: 'Ověření identity',
@@ -791,6 +807,8 @@ const cs = {
 }
 
 const pt = {
+  please_upload_an_image_file: 'Por favor, envie um arquivo de imagem',
+  must_be_characters_length: 'Deve ter {number} caracteres',
   complete_all_required_fields_to_proceed_with_identity_verification: 'Preencha todos os campos obrigatórios para prosseguir com a verificação de identidade.',
   verify_id: 'Verificar ID',
   identity_verification: 'Verificação de identidade',
@@ -890,6 +908,8 @@ const pt = {
 }
 
 const he = {
+  please_upload_an_image_file: 'אנא העלה קובץ תמונה',
+  must_be_characters_length: 'חייב להיות באורך של {number} תווים',
   complete_all_required_fields_to_proceed_with_identity_verification: 'מלא את כל השדות הנדרשים כדי להמשיך עם אימות זהות.',
   verify_id: 'אמת מזהה',
   identity_verification: 'אימות זהות',
@@ -989,6 +1009,8 @@ const he = {
 }
 
 const nl = {
+  please_upload_an_image_file: 'Upload alstublieft een afbeeldingsbestand',
+  must_be_characters_length: 'Moet {number} tekens lang zijn',
   complete_all_required_fields_to_proceed_with_identity_verification: 'Vul alle verplichte velden in om door te gaan met de identiteitsverificatie.',
   verify_id: 'Verifiëren ID',
   identity_verification: 'Identiteitsverificatie',
@@ -1088,6 +1110,8 @@ const nl = {
 }
 
 const ar = {
+  please_upload_an_image_file: 'يرجى تحميل ملف صورة',
+  must_be_characters_length: 'يجب أن يكون الطول {number} حرفًا',
   complete_all_required_fields_to_proceed_with_identity_verification: 'أكمل جميع الحقول المطلوبة للمتابعة في التحقق من الهوية.',
   verify_id: 'تحقق من الهوية',
   identity_verification: 'التحقق من الهوية',
@@ -1187,6 +1211,8 @@ const ar = {
 }
 
 const ko = {
+  please_upload_an_image_file: '이미지 파일을 업로드해 주세요',
+  must_be_characters_length: '{number}자여야 합니다',
   complete_all_required_fields_to_proceed_with_identity_verification: '신원 확인을 진행하려면 모든 필수 필드를 작성하십시오.',
   verify_id: '아이디 확인',
   identity_verification: '신원 확인',
@@ -1286,6 +1312,8 @@ const ko = {
 }
 
 const ja = {
+  please_upload_an_image_file: '画像ファイルをアップロードしてください',
+  must_be_characters_length: '{number}文字でなければなりません',
   complete_all_required_fields_to_proceed_with_identity_verification: '本人確認を進めるには、すべての必須項目を入力してください。',
   verify_id: '本人確認',
   identity_verification: '本人確認',

app/javascript/submission_form/text_step.vue

@@ -43,8 +43,8 @@
       :placeholder="`${t('type_here_')}${field.required ? '' : ` (${t('optional')})`}`"
       type="text"
       :name="`values[${field.uuid}]`"
-      @invalid="field.validation?.message ? $event.target.setCustomValidity(field.validation.message) : ''"
-      @input="field.validation?.message ? $event.target.setCustomValidity('') : ''"
+      @invalid="validationMessage ? $event.target.setCustomValidity(validationMessage) : ''"
+      @input="validationMessage ? $event.target.setCustomValidity('') : ''"
       @focus="$emit('focus')"
     >
     <textarea
@@ -127,6 +127,28 @@ export default {
         return null
       }
     },
+    lengthValidation () {
+      if (this.field.validation?.pattern) {
+        return this.field.validation.pattern.match(/^\.{(?<min>\d+),(?<max>\d+)?}$/)?.groups
+      } else {
+        return null
+      }
+    },
+    validationMessage () {
+      if (this.field.validation?.message) {
+        return this.field.validation.message
+      } else if (this.lengthValidation) {
+        const number =
+          [this.lengthValidation.min, this.lengthValidation.max]
+            .filter(Boolean)
+            .filter((v, i, a) => a.indexOf(v) === i)
+            .join('-')
+
+        return this.t('must_be_characters_length').replace('{number}', number)
+      } else {
+        return ''
+      }
+    },
     text: {
       set (value) {
         this.$emit('update:model-value', value)

app/javascript/template_builder/area.vue

@@ -172,7 +172,8 @@
       >
         <div
           v-if="isDefaultValuePresent || isValueInput || (withFieldPlaceholder && field.areas && field.type !== 'checkbox')"
-          :class="{ 'w-full h-full': ['cells', 'checkbox'].includes(field.type), 'text-[1.6vw] lg:text-base': !textOverflowChars, 'text-[1.0vw] lg:text-xs': textOverflowChars }"
+          :class="{ 'w-full h-full': ['cells', 'checkbox'].includes(field.type) }"
+          :style="fontStyle"
         >
           <div
             ref="textContainer"
@@ -315,7 +316,7 @@ export default {
     FieldSubmitter,
     IconX
   },
-  inject: ['template', 'selectedAreaRef', 'save', 't'],
+  inject: ['template', 'selectedAreaRef', 'save', 't', 'isInlineSize'],
   props: {
     area: {
       type: Object,
@@ -385,6 +386,37 @@ export default {
     fieldNames: FieldType.computed.fieldNames,
     fieldLabels: FieldType.computed.fieldLabels,
     fieldIcons: FieldType.computed.fieldIcons,
+    fontStyle () {
+      let fontSize = ''
+
+      if (this.isInlineSize) {
+        if (this.textOverflowChars) {
+          fontSize = `${this.fontSizePx / 1.5 / 10}cqmin`
+        } else {
+          fontSize = `${this.fontSizePx / 10}cqmin`
+        }
+      } else {
+        if (this.textOverflowChars) {
+          fontSize = `clamp(1pt, ${this.fontSizePx / 1.5 / 10}vw, ${this.fontSizePx / 1.5}px)`
+        } else {
+          fontSize = `clamp(1pt, ${this.fontSizePx / 10}vw, ${this.fontSizePx}px)`
+        }
+      }
+
+      return { fontSize, lineHeight: `calc(${fontSize} * ${this.lineHeight})` }
+    },
+    fontSizePx () {
+      return parseInt(this.field?.preferences?.font_size || 11) * this.fontScale
+    },
+    lineHeight () {
+      return 1.3
+    },
+    fontScale () {
+      return 1040 / 612.0
+    },
+    ladscapeScale () {
+      return 8.5 / 11.0
+    },
     isDefaultValuePresent () {
       if (this.field?.type === 'radio' && this.field?.areas?.length > 1) {
         return false
@@ -413,8 +445,8 @@ export default {
         'justify-center': this.field.preferences.align === 'center',
         'justify-start': this.field.preferences.align === 'left',
         'justify-end': this.field.preferences.align === 'right',
-        'font-mono': this.field.preferences.font === 'Courier',
-        'font-serif': this.field.preferences.font === 'Times',
+        'font-courier': this.field.preferences.font === 'Courier',
+        'font-times': this.field.preferences.font === 'Times',
         'font-bold': ['bold_italic', 'bold'].includes(this.field.preferences.font_type),
         italic: ['bold_italic', 'italic'].includes(this.field.preferences.font_type)
       }
@@ -491,7 +523,7 @@ export default {
     'field.default_value' () {
       this.$nextTick(() => {
         if (['date', 'text', 'number'].includes(this.field.type) && this.field.default_value && this.$refs.textContainer && (this.textOverflowChars === 0 || (this.textOverflowChars - 4) > `${this.field.default_value}`.length)) {
-          this.textOverflowChars = this.$el.clientHeight < this.$refs.textContainer.clientHeight ? `${this.field.default_value}`.length : 0
+          this.textOverflowChars = (this.$el.clientHeight + 1) < this.$refs.textContainer.clientHeight ? `${this.field.default_value}`.length : 0
         }
       })
     }
@@ -499,7 +531,7 @@ export default {
   mounted () {
     this.$nextTick(() => {
       if (['date', 'text', 'number'].includes(this.field.type) && this.field.default_value && this.$refs.textContainer && (this.textOverflowChars === 0 || (this.textOverflowChars - 4) > `${this.field.default_value}`.length)) {
-        this.textOverflowChars = this.$el.clientHeight < this.$refs.textContainer.clientHeight ? `${this.field.default_value}`.length : 0
+        this.textOverflowChars = (this.$el.clientHeight + 1) < this.$refs.textContainer.clientHeight ? `${this.field.default_value}`.length : 0
       }
     })
   },

app/javascript/template_builder/builder.vue

@@ -542,6 +542,7 @@ export default {
       isPaymentConnected: this.isPaymentConnected,
       withFormula: this.withFormula,
       withConditions: this.withConditions,
+      isInlineSize: this.isInlineSize,
       defaultDrawFieldType: this.defaultDrawFieldType,
       selectedAreaRef: computed(() => this.selectedAreaRef),
       fieldsDragFieldRef: computed(() => this.fieldsDragFieldRef)
@@ -793,6 +794,9 @@ export default {
     language () {
       return this.locale.split('-')[0].toLowerCase()
     },
+    isInlineSize () {
+      return CSS.supports('container-type: size')
+    },
     isMobile () {
       const isMobileSafariIos = 'ontouchstart' in window && navigator.maxTouchPoints > 0 && /AppleWebKit/i.test(navigator.userAgent)
 

app/javascript/template_builder/document.vue

@@ -29,6 +29,7 @@
 </template>
 <script>
 import Page from './page'
+import { reactive } from 'vue'
 
 export default {
   name: 'TemplateDocument',
@@ -123,14 +124,14 @@ export default {
       return this.document.metadata?.pdf?.number_of_pages || this.document.preview_images.length
     },
     sortedPreviewImages () {
-      const lazyloadMetadata = this.document.preview_images[this.document.preview_images.length - 1].metadata
+      const lazyloadMetadata = this.document.preview_images[this.document.preview_images.length - 1]?.metadata || { width: 1400, height: 1812 }
 
       return [...Array(this.numberOfPages).keys()].map((i) => {
-        return this.previewImagesIndex[i] || {
-          metadata: lazyloadMetadata,
+        return this.previewImagesIndex[i] || reactive({
+          metadata: { ...lazyloadMetadata },
           id: Math.random().toString(),
           url: this.basePreviewUrl + `/preview/${this.document.signed_uuid || this.document.uuid}/${i}.jpg`
-        }
+        })
       })
     },
     previewImagesIndex () {

app/javascript/template_builder/field_settings.vue

@@ -153,13 +153,13 @@
       <option
         v-for="(key, value) in validations"
         :key="key"
-        :selected="field.validation?.pattern ? value === field.validation.pattern : value === 'none'"
-        :value="value"
+        :selected="lengthValidation ? key == 'length' : (field.validation?.pattern ? value === field.validation.pattern : key === 'none')"
+        :value="key"
       >
         {{ t(key) }}
       </option>
       <option
-        :selected="field.validation && !validations[field.validation.pattern]"
+        :selected="field.validation && !validations[field.validation.pattern] && !lengthValidation"
         :value="validations[field.validation?.pattern] || !field.validation?.pattern ? 'custom' : field.validation?.pattern"
       >
         {{ t('custom') }}
@@ -174,7 +174,51 @@
     </label>
   </div>
   <div
-    v-if="['text', 'cells'].includes(field.type) && field.validation && !validations[field.validation.pattern]"
+    v-if="['text', 'cells'].includes(field.type) && field.validation && lengthValidation"
+    class="py-1.5 px-1 relative flex space-x-1"
+    @click.stop
+  >
+    <div class="w-1/2 relative">
+      <input
+        :placeholder="t('min')"
+        type="number"
+        min="0"
+        :value="lengthValidation.min"
+        class="input input-bordered w-full input-xs h-7 !outline-0 bg-transparent"
+        @input="field.validation.pattern = `.{${$event.target.value || 0},${lengthValidation.max || ''}}`"
+        @blur="save"
+      >
+      <label
+        v-if="lengthValidation.min"
+        :style="{ backgroundColor }"
+        class="absolute -top-2.5 left-1.5 px-1 h-4"
+        style="font-size: 8px"
+      >
+        {{ t('min') }}
+      </label>
+    </div>
+    <div class="w-1/2 relative">
+      <input
+        :placeholder="t('max')"
+        type="number"
+        min="1"
+        class="input input-bordered w-full input-xs h-7 !outline-0 bg-transparent"
+        :value="lengthValidation.max"
+        @input="field.validation.pattern = `.{${lengthValidation.min},${$event.target.value || ''}}`"
+        @blur="save"
+      >
+      <label
+        v-if="lengthValidation.max"
+        :style="{ backgroundColor }"
+        class="absolute -top-2.5 left-1.5 px-1 h-4"
+        style="font-size: 8px"
+      >
+        {{ t('max') }}
+      </label>
+    </div>
+  </div>
+  <div
+    v-if="['text', 'cells'].includes(field.type) && field.validation && !validations[field.validation.pattern] && !lengthValidation"
     class="py-1.5 px-1 relative"
     @click.stop
   >
@@ -195,6 +239,27 @@
       {{ t('regexp_validation') }}
     </label>
   </div>
+  <div
+    v-if="['text', 'cells'].includes(field.type) && field.validation && !validations[field.validation.pattern] && !lengthValidation"
+    class="py-1.5 px-1 relative"
+    @click.stop
+  >
+    <input
+      v-model="field.validation.message"
+      :placeholder="t('error_message')"
+      dir="auto"
+      class="input input-bordered input-xs w-full max-w-xs h-7 !outline-0 bg-transparent"
+      @blur="save"
+    >
+    <label
+      v-if="field.validation.message"
+      :style="{ backgroundColor }"
+      class="absolute -top-1 left-2.5 px-1 h-4"
+      style="font-size: 8px"
+    >
+      {{ t('error_message') }}
+    </label>
+  </div>
   <div
     v-if="field.type === 'date'"
     class="py-1.5 px-1 relative"
@@ -330,7 +395,7 @@
     v-if="field.type != 'stamp'"
     class="pb-0.5 mt-0.5"
   >
-  <li v-if="['text', 'number', 'date'].includes(field.type)">
+  <li v-if="['text', 'number', 'date', 'select'].includes(field.type)">
     <label
       class="label-text cursor-pointer text-center w-full flex items-center"
       @click="$emit('click-font')"
@@ -489,6 +554,7 @@ export default {
   emits: ['set-draw', 'scroll-to', 'click-formula', 'click-description', 'click-condition', 'click-font', 'remove-area'],
   data () {
     return {
+      selectedValidation: ''
     }
   },
   computed: {
@@ -533,8 +599,16 @@ export default {
 
       return formats
     },
+    lengthValidation () {
+      if (this.field.validation?.pattern && this.selectedValidation !== 'custom') {
+        return this.field.validation.pattern.match(/^\.{(?<min>\d+),(?<max>\d+)?}$/)?.groups
+      } else {
+        return null
+      }
+    },
     validations () {
       return {
+        '.{0,}': 'length',
         '^[0-9]{3}-[0-9]{2}-[0-9]{4}$': 'ssn',
         '^[0-9]{2}-[0-9]{7}$': 'ein',
         '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$': 'email',
@@ -553,13 +627,21 @@ export default {
   methods: {
     onChangeValidation (event) {
       if (event.target.value === 'custom') {
-        this.field.validation = { pattern: '' }
+        this.selectedValidation = 'custom'
+
+        this.field.validation = { pattern: '', message: '' }
 
         this.$nextTick(() => this.$refs.validationCustom.focus())
       } else if (event.target.value) {
         this.field.validation ||= {}
-        this.field.validation.pattern = event.target.value
+        this.field.validation.pattern =
+          Object.keys(this.validations).find(key => this.validations[key] === event.target.value)
+
+        this.selectedValidation = event.target.value
+        delete this.field.validation.message
       } else {
+        this.selectedValidation = ''
+
         delete this.field.validation
       }
 

app/javascript/template_builder/font_modal.vue

@@ -222,8 +222,8 @@ export default {
     fonts () {
       return [
         { value: null, label: 'Default' },
-        { value: 'Times', label: 'Times', class: 'font-serif' },
-        { value: 'Courier', label: 'Courier', class: 'font-mono' }
+        { value: 'Times', label: 'Times', class: 'font-times' },
+        { value: 'Courier', label: 'Courier', class: 'font-courier' }
       ]
     },
     types () {
@@ -258,8 +258,8 @@ export default {
     },
     textClasses () {
       return {
-        'font-mono': this.preferences.font === 'Courier',
-        'font-serif': this.preferences.font === 'Times',
+        'font-courier': this.preferences.font === 'Courier',
+        'font-times': this.preferences.font === 'Times',
         'justify-center': this.preferences.align === 'center',
         'justify-start': this.preferences.align === 'left',
         'justify-end': this.preferences.align === 'right',

app/javascript/template_builder/i18n.js

@@ -1,4 +1,8 @@
 const en = {
+  error_message: 'Error message',
+  length: 'Length',
+  min: 'Min',
+  max: 'Max',
   font: 'Font',
   party: 'Party',
   date_signed: 'Date Signed',
@@ -168,6 +172,10 @@ const en = {
 }
 
 const es = {
+  error_message: 'Mensaje de error',
+  length: 'Longitud',
+  min: 'Mín',
+  max: 'Máx',
   date_signed: 'Fecha actual',
   fuente: 'Fuente',
   party: 'Parte',
@@ -337,6 +345,10 @@ const es = {
 }
 
 const it = {
+  error_message: 'Messaggio di errore',
+  length: 'Lunghezza',
+  min: 'Min',
+  max: 'Max',
   date_signed: 'Data attuale',
   font: 'Carattere',
   party: 'Parte',
@@ -506,6 +518,10 @@ const it = {
 }
 
 const pt = {
+  error_message: 'Mensagem de erro',
+  length: 'Comprimento',
+  min: 'Mín',
+  max: 'Máx',
   date_signed: 'Data atual',
   fonte: 'Fonte',
   party: 'Parte',
@@ -675,6 +691,10 @@ const pt = {
 }
 
 const fr = {
+  error_message: 'Message d\'erreur',
+  length: 'Longueur',
+  min: 'Min',
+  max: 'Max',
   date_signed: 'Date actuelle',
   font: 'Police',
   party: 'Partie',
@@ -844,6 +864,10 @@ const fr = {
 }
 
 const de = {
+  error_message: 'Fehlermeldung',
+  length: 'Länge',
+  min: 'Min',
+  max: 'Max',
   date_now: 'Akt. Datum',
   font: 'Schriftart',
   party: 'Partei',

app/javascript/template_builder/page.vue

@@ -1,8 +1,9 @@
 <template>
   <div
-    class="relative select-none"
-    :class="{ 'cursor-crosshair': allowDraw }"
-    :style="drawField ? 'touch-action: none' : ''"
+    class="relative select-none mb-4 before:border before:rounded before:top-0 before:bottom-0 before:left-0 before:right-0 before:absolute"
+    :class="{ 'cursor-crosshair': allowDraw, 'touch-none': !!drawField }"
+    style="container-type: size"
+    :style="{ aspectRatio: `${width} / ${height}`}"
   >
     <img
       ref="image"
@@ -10,7 +11,7 @@
       :src="image.url"
       :width="width"
       :height="height"
-      class="border rounded mb-4"
+      class="rounded"
       @load="onImageLoad"
     >
     <div
@@ -191,8 +192,8 @@ export default {
   },
   methods: {
     onImageLoad (e) {
-      e.target.setAttribute('width', e.target.naturalWidth)
-      e.target.setAttribute('height', e.target.naturalHeight)
+      this.image.metadata.width = e.target.naturalWidth
+      this.image.metadata.height = e.target.naturalHeight
     },
     setAreaRefs (el) {
       if (el) {

app/jobs/process_submission_expired_job.rb

@@ -11,9 +11,6 @@ class ProcessSubmissionExpiredJob
     return if submission.submitters.where.not(declined_at: nil).exists?
     return unless submission.submitters.exists?(completed_at: nil)
 
-    WebhookUrls.for_account_id(submission.account_id, %w[submission.expired]).each do |webhook|
-      SendSubmissionExpiredWebhookRequestJob.perform_async('submission_id' => submission.id,
-                                                           'webhook_url_id' => webhook.id)
-    end
+    WebhookUrls.enqueue_events(submission, 'submission.expired')
   end
 end

app/jobs/process_submitter_completion_job.rb

@@ -63,16 +63,24 @@ class ProcessSubmitterCompletionJob
   end
 
   def enqueue_completed_webhooks(submitter, is_all_completed: false)
+    event_uuids = {}
+
     WebhookUrls.for_account_id(submitter.account_id, %w[form.completed submission.completed]).each do |webhook|
       if webhook.events.include?('form.completed')
+        event_uuids['form.completed'] ||= SecureRandom.uuid
+
         SendFormCompletedWebhookRequestJob.perform_async('submitter_id' => submitter.id,
+                                                         'event_uuid' => event_uuids['form.completed'],
                                                          'webhook_url_id' => webhook.id)
       end
 
-      if webhook.events.include?('submission.completed') && is_all_completed
-        SendSubmissionCompletedWebhookRequestJob.perform_async('submission_id' => submitter.submission_id,
-                                                               'webhook_url_id' => webhook.id)
-      end
+      next unless webhook.events.include?('submission.completed') && is_all_completed
+
+      event_uuids['submission.completed'] ||= SecureRandom.uuid
+
+      SendSubmissionCompletedWebhookRequestJob.perform_async('submission_id' => submitter.submission_id,
+                                                             'event_uuid' => event_uuids['submission.completed'],
+                                                             'webhook_url_id' => webhook.id)
     end
   end
 

app/jobs/send_form_completed_webhook_request_job.rb

@@ -20,6 +20,9 @@ class SendFormCompletedWebhookRequestJob
     ActiveStorage::Current.url_options = Docuseal.default_url_options
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'form.completed',
+                                                event_uuid: params['event_uuid'],
+                                                record: submitter,
+                                                attempt:,
                                                 data: Submitters::SerializeForWebhook.call(submitter))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&

app/jobs/send_form_declined_webhook_request_job.rb

@@ -18,13 +18,15 @@ class SendFormDeclinedWebhookRequestJob
     ActiveStorage::Current.url_options = Docuseal.default_url_options
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'form.declined',
+                                                event_uuid: params['event_uuid'],
+                                                record: submitter,
+                                                attempt:,
                                                 data: Submitters::SerializeForWebhook.call(submitter))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&
        (!Docuseal.multitenant? || submitter.account.account_configs.exists?(key: :plan))
       SendFormDeclinedWebhookRequestJob.perform_in((2**attempt).minutes, {
-                                                     'submitter_id' => submitter.id,
-                                                     'webhook_url_id' => webhook_url.id,
+                                                     **params,
                                                      'attempt' => attempt + 1,
                                                      'last_status' => resp&.status.to_i
                                                    })

app/jobs/send_form_started_webhook_request_job.rb

@@ -18,13 +18,15 @@ class SendFormStartedWebhookRequestJob
     ActiveStorage::Current.url_options = Docuseal.default_url_options
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'form.started',
+                                                event_uuid: params['event_uuid'],
+                                                record: submitter,
+                                                attempt:,
                                                 data: Submitters::SerializeForWebhook.call(submitter))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&
        (!Docuseal.multitenant? || submitter.account.account_configs.exists?(key: :plan))
       SendFormStartedWebhookRequestJob.perform_in((2**attempt).minutes, {
-                                                    'submitter_id' => submitter.id,
-                                                    'webhook_url_id' => webhook_url.id,
+                                                    **params,
                                                     'attempt' => attempt + 1,
                                                     'last_status' => resp&.status.to_i
                                                   })

app/jobs/send_form_viewed_webhook_request_job.rb

@@ -18,13 +18,15 @@ class SendFormViewedWebhookRequestJob
     ActiveStorage::Current.url_options = Docuseal.default_url_options
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'form.viewed',
+                                                event_uuid: params['event_uuid'],
+                                                record: submitter,
+                                                attempt:,
                                                 data: Submitters::SerializeForWebhook.call(submitter))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&
        (!Docuseal.multitenant? || submitter.account.account_configs.exists?(key: :plan))
       SendFormViewedWebhookRequestJob.perform_in((2**attempt).minutes, {
-                                                   'submitter_id' => submitter.id,
-                                                   'webhook_url_id' => webhook_url.id,
+                                                   **params,
                                                    'attempt' => attempt + 1,
                                                    'last_status' => resp&.status.to_i
                                                  })

app/jobs/send_submission_archived_webhook_request_job.rb

@@ -16,13 +16,15 @@ class SendSubmissionArchivedWebhookRequestJob
     return if webhook_url.url.blank? || webhook_url.events.exclude?('submission.archived')
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'submission.archived',
+                                                event_uuid: params['event_uuid'],
+                                                record: submission,
+                                                attempt:,
                                                 data: submission.as_json(only: %i[id archived_at]))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&
        (!Docuseal.multitenant? || submission.account.account_configs.exists?(key: :plan))
       SendSubmissionArchivedWebhookRequestJob.perform_in((2**attempt).minutes, {
-                                                           'submission_id' => submission.id,
-                                                           'webhook_url_id' => webhook_url.id,
+                                                           **params,
                                                            'attempt' => attempt + 1,
                                                            'last_status' => resp&.status.to_i
                                                          })

app/jobs/send_submission_completed_webhook_request_job.rb

@@ -16,6 +16,9 @@ class SendSubmissionCompletedWebhookRequestJob
     return if webhook_url.url.blank? || webhook_url.events.exclude?('submission.completed')
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'submission.completed',
+                                                event_uuid: params['event_uuid'],
+                                                record: submission,
+                                                attempt:,
                                                 data: Submissions::SerializeForApi.call(submission))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&

app/jobs/send_submission_created_webhook_request_job.rb

@@ -16,13 +16,15 @@ class SendSubmissionCreatedWebhookRequestJob
     return if webhook_url.url.blank? || webhook_url.events.exclude?('submission.created')
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'submission.created',
+                                                event_uuid: params['event_uuid'],
+                                                record: submission,
+                                                attempt:,
                                                 data: Submissions::SerializeForApi.call(submission))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&
        (!Docuseal.multitenant? || submission.account.account_configs.exists?(key: :plan))
       SendSubmissionCreatedWebhookRequestJob.perform_in((2**attempt).minutes, {
-                                                          'submission_id' => submission.id,
-                                                          'webhook_url_id' => webhook_url.id,
+                                                          **params,
                                                           'attempt' => attempt + 1,
                                                           'last_status' => resp&.status.to_i
                                                         })

app/jobs/send_submission_expired_webhook_request_job.rb

@@ -16,13 +16,15 @@ class SendSubmissionExpiredWebhookRequestJob
     return if webhook_url.url.blank? || webhook_url.events.exclude?('submission.expired')
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'submission.expired',
+                                                event_uuid: params['event_uuid'],
+                                                record: submission,
+                                                attempt:,
                                                 data: Submissions::SerializeForApi.call(submission))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&
        (!Docuseal.multitenant? || submission.account.account_configs.exists?(key: :plan))
       SendSubmissionExpiredWebhookRequestJob.perform_in((2**attempt).minutes, {
-                                                          'submission_id' => submission.id,
-                                                          'webhook_url_id' => webhook_url.id,
+                                                          **params,
                                                           'attempt' => attempt + 1,
                                                           'last_status' => resp&.status.to_i
                                                         })

app/jobs/send_template_created_webhook_request_job.rb

@@ -16,13 +16,15 @@ class SendTemplateCreatedWebhookRequestJob
     return if webhook_url.url.blank? || webhook_url.events.exclude?('template.created')
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'template.created',
+                                                event_uuid: params['event_uuid'],
+                                                record: template,
+                                                attempt:,
                                                 data: Templates::SerializeForApi.call(template))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&
        (!Docuseal.multitenant? || template.account.account_configs.exists?(key: :plan))
       SendTemplateCreatedWebhookRequestJob.perform_in((2**attempt).minutes, {
-                                                        'template_id' => template.id,
-                                                        'webhook_url_id' => webhook_url.id,
+                                                        **params,
                                                         'attempt' => attempt + 1,
                                                         'last_status' => resp&.status.to_i
                                                       })

app/jobs/send_template_updated_webhook_request_job.rb

@@ -16,13 +16,15 @@ class SendTemplateUpdatedWebhookRequestJob
     return if webhook_url.url.blank? || webhook_url.events.exclude?('template.updated')
 
     resp = SendWebhookRequest.call(webhook_url, event_type: 'template.updated',
+                                                event_uuid: params['event_uuid'],
+                                                record: template,
+                                                attempt:,
                                                 data: Templates::SerializeForApi.call(template))
 
     if (resp.nil? || resp.status.to_i >= 400) && attempt <= MAX_ATTEMPTS &&
        (!Docuseal.multitenant? || template.account.account_configs.exists?(key: :plan))
       SendTemplateUpdatedWebhookRequestJob.perform_in((2**attempt).minutes, {
-                                                        'template_id' => template.id,
-                                                        'webhook_url_id' => webhook_url.id,
+                                                        **params,
                                                         'attempt' => attempt + 1,
                                                         'last_status' => resp&.status.to_i
                                                       })

app/jobs/send_test_webhook_request_job.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class SendTestWebhookRequestJob
+  include Sidekiq::Job
+
+  sidekiq_options retry: 0
+
+  USER_AGENT = 'DocuSeal.com Webhook'
+
+  def perform(params = {})
+    submitter = Submitter.find(params['submitter_id'])
+    webhook_url = WebhookUrl.find(params['webhook_url_id'])
+
+    return unless webhook_url && submitter
+
+    Faraday.post(webhook_url.url,
+                 {
+                   event_type: 'form.completed',
+                   timestamp: Time.current.iso8601,
+                   data: Submitters::SerializeForWebhook.call(submitter)
+                 }.to_json,
+                 'Content-Type' => 'application/json',
+                 'User-Agent' => USER_AGENT,
+                 **webhook_url.secret.to_h)
+  end
+end

app/mailers/template_mailer.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class TemplateMailer < ApplicationMailer
+  def otp_verification_email(template, email:)
+    @template = template
+
+    @otp_code = EmailVerificationCodes.generate([email.downcase.strip, template.slug].join(':'))
+
+    assign_message_metadata('otp_verification_email', template)
+
+    mail(to: email, subject: I18n.t('email_verification'))
+  end
+end

app/models/account.rb

@@ -33,6 +33,7 @@ class Account < ApplicationRecord
   has_many :account_linked_accounts, dependent: :destroy
   has_many :email_events, dependent: :destroy
   has_many :webhook_urls, dependent: :destroy
+  has_many :webhook_events, dependent: nil
   has_many :account_accesses, dependent: :destroy
   has_many :account_testing_accounts, -> { testing }, dependent: :destroy,
                                                       class_name: 'AccountLinkedAccount',

app/models/account_config.rb

@@ -42,7 +42,7 @@ class AccountConfig < ApplicationRecord
   FLATTEN_RESULT_PDF_KEY = 'flatten_result_pdf'
   WITH_SIGNATURE_ID = 'with_signature_id'
   WITH_AUDIT_VALUES_KEY = 'with_audit_values'
-  WITH_AUDIT_SUBMITTER_TIMEZONE_KEY = 'with_audit_submitter_timezone'
+  WITH_SUBMITTER_TIMEZONE_KEY = 'with_submitter_timezone'
   REQUIRE_SIGNING_REASON_KEY = 'require_signing_reason'
   REUSE_SIGNATURE_KEY = 'reuse_signature'
   COMBINE_PDF_RESULT_KEY = 'combine_pdf_result_key'

app/models/submission_event.rb

@@ -47,6 +47,7 @@ class SubmissionEvent < ApplicationRecord
     click_email: 'click_email',
     click_sms: 'click_sms',
     phone_verified: 'phone_verified',
+    email_verified: 'email_verified',
     start_form: 'start_form',
     start_verification: 'start_verification',
     complete_verification: 'complete_verification',

app/models/webhook_attempt.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# == Schema Information
+#
+# Table name: webhook_attempts
+#
+#  id                   :bigint           not null, primary key
+#  attempt              :integer          not null
+#  response_body        :text
+#  response_status_code :integer          not null
+#  created_at           :datetime         not null
+#  updated_at           :datetime         not null
+#  webhook_event_id     :bigint           not null
+#
+# Indexes
+#
+#  index_webhook_attempts_on_webhook_event_id  (webhook_event_id)
+#
+class WebhookAttempt < ApplicationRecord
+  belongs_to :webhook_event
+
+  def success?
+    [2, 3].include?(response_status_code.to_i / 100)
+  end
+end

app/models/webhook_event.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+# == Schema Information
+#
+# Table name: webhook_events
+#
+#  id             :bigint           not null, primary key
+#  event_type     :string           not null
+#  record_type    :string           not null
+#  status         :string           not null
+#  uuid           :string           not null
+#  created_at     :datetime         not null
+#  updated_at     :datetime         not null
+#  account_id     :bigint           not null
+#  record_id      :bigint           not null
+#  webhook_url_id :bigint           not null
+#
+# Indexes
+#
+#  index_webhook_events_error                       (webhook_url_id,id) WHERE ((status)::text = 'error'::text)
+#  index_webhook_events_on_uuid_and_webhook_url_id  (uuid,webhook_url_id) UNIQUE
+#  index_webhook_events_on_webhook_url_id_and_id    (webhook_url_id,id)
+#
+class WebhookEvent < ApplicationRecord
+  attribute :uuid, :string, default: -> { SecureRandom.uuid }
+
+  belongs_to :webhook_url, optional: true
+  belongs_to :account, optional: true
+  belongs_to :record, polymorphic: true, optional: true
+
+  has_many :webhook_attempts, dependent: nil
+end

app/models/webhook_url.rb

@@ -37,6 +37,7 @@ class WebhookUrl < ApplicationRecord
   ].freeze
 
   belongs_to :account
+  has_many :webhook_events, dependent: nil
 
   attribute :events, :string, default: -> { %w[form.viewed form.started form.completed form.declined] }
   attribute :secret, :string, default: -> { {} }

app/views/icons/_email_check.html.erb

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="<%= local_assigns[:class] %>" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" width="24" height="24" stroke-width="2">
+  <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+  <path d="M11 19h-6a2 2 0 0 1 -2 -2v-10a2 2 0 0 1 2 -2h14a2 2 0 0 1 2 2v6" />
+  <path d="M3 7l9 6l9 -6" />
+  <path d="M15 19l2 2l4 -4" />
+</svg>

app/views/icons/_start.html.erb

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="<%= local_assigns[:class] %>" wi width="44" height="44" viewBox="0 0 24 24" stroke-width="1.5" stroke="#000000" fill="none" stroke-linecap="round" stroke-linejoin="round">
+  <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+  <path d="M8.243 7.34l-6.38 .925l-.113 .023a1 1 0 0 0 -.44 1.684l4.622 4.499l-1.09 6.355l-.013 .11a1 1 0 0 0 1.464 .944l5.706 -3l5.693 3l.1 .046a1 1 0 0 0 1.352 -1.1l-1.091 -6.355l4.624 -4.5l.078 -.085a1 1 0 0 0 -.633 -1.62l-6.38 -.926l-2.852 -5.78a1 1 0 0 0 -1.794 0l-2.853 5.78z" stroke-width="0" fill="currentColor" />
+</svg>

app/views/scripts/_autosize_field.html.erb

@@ -2,12 +2,15 @@
   if (!window.customElements.get('autosize-field')) {
     window.customElements.define('autosize-field', class extends HTMLElement {
       connectedCallback() {
+        const originalFontValue = this.field.style.fontSize
+
         if (this.field.scrollHeight > this.field.clientHeight) {
-          this.field.classList.remove('text-[1.6vw]', 'lg:text-base');
-          this.field.classList.add('text-[1.0vw]', 'lg:text-[0.70rem]');
+          this.field.style.fontSize = `calc(${originalFontValue} / 1.5)`;
+          this.field.style.lineHeight = `calc(${this.field.style.fontSize} * 1.3)`;
 
           if (this.field.scrollHeight > this.field.clientHeight) {
-            this.field.classList.add('text-[0.8vw]', 'lg:text-[0.50rem]');
+            this.field.style.fontSize = `calc(${originalFontValue} / 2.0)`;
+            this.field.style.lineHeight = `calc(${this.field.style.fontSize} * 1.3)`;
           }
         }
       }

app/views/shared/_github.html.erb

@@ -1,3 +1,6 @@
-<a href="<%= Docuseal::GITHUB_URL %>" target="_blank" class="inline">
-  <img alt="GitHub Repo stars" src="https://www.docuseal.com/github-badge.svg" style="height: 22px">
+<a target="_blank" href="<%= Docuseal::GITHUB_URL %>" rel="noopener noreferrer nofollow" class="relative flex items-center rounded-full px-2 py-0.5 text-xs leading-4 mt-1 text-base-content border border-base-300 tooltip tooltip-bottom" data-tip="Give a star on GitHub">
+  <span class="flex items-center justify-between space-x-0.5 font-extrabold">
+    <%= svg_icon('start', class: 'h-3 w-3') %>
+    <span>9k</span>
+  </span>
 </a>

app/views/shared/_navbar.html.erb

@@ -5,7 +5,7 @@
       <%= render 'shared/title' %>
     </a>
     <span class="hidden sm:inline">
-      <%= render 'shared/github' %>
+      <%= render 'shared/github' if request.path.starts_with?('/settings') %>
     </span>
   </div>
   <% if signed_in? %>
@@ -79,7 +79,7 @@
     </div>
   <% else %>
     <div class="flex space-x-2">
-      <% if request.path != new_user_session_path %>
+      <% if request.path != new_user_session_path && request.path != setup_index_path %>
         <%= link_to new_user_session_path({ lang: params[:lang] }.compact_blank), class: 'font-medium text-lg' do %>
           <span class="flex items-center justify-center space-x-1">
             <%= svg_icon('login', class: 'w-6 h-6') %>

app/views/shared/_navbar_buttons.html.erb

@@ -1,8 +1,8 @@
-<%= link_to Docuseal.multitenant? ? console_redirect_index_path(redir: "#{Docuseal::CONSOLE_URL}/plans") : "#{Docuseal::CLOUD_URL}/sign_up?#{{ redir: "#{Docuseal::CONSOLE_URL}/on_premises" }.to_query}", class: 'hidden md:inline-flex btn btn-warning btn-sm', data: { prefetch: false } do %>
-  <%= t('upgrade') %>
-<% end %>
 <% if signed_in? && current_user != true_user %>
-  <span class="hidden md:inline-flex h-3 border-r border-base-content"></span>
   <%= render 'shared/test_alert' %>
+<% elsif request.path.starts_with?('/settings') %>
+  <%= link_to "#{Docuseal::CLOUD_URL}/sign_up?#{{ redir: "#{Docuseal::CONSOLE_URL}/on_premises" }.to_query}", class: 'hidden md:inline-flex btn btn-warning btn-sm', data: { prefetch: false } do %>
+    <%= t('upgrade') %>
+  <% end %>
+  <span class="hidden md:inline-flex h-3 border-r border-base-content"></span>
 <% end %>
-<span class="hidden md:inline-flex h-3 border-r border-base-content"></span>

app/views/shared/_settings_nav.html.erb

@@ -66,7 +66,7 @@
         <li>
           <%= link_to Docuseal.multitenant? ? console_redirect_index_path(redir: "#{Docuseal::CONSOLE_URL}/plans") : "#{Docuseal::CLOUD_URL}/sign_up?#{{ redir: "#{Docuseal::CONSOLE_URL}/on_premises" }.to_query}", class: 'text-base hover:bg-base-300', data: { prefetch: false } do %>
             <%= t('plans') %>
-            <span class="badge badge-warning"><%= t('new') %></span>
+            <span class="badge badge-warning"><%= t('pro') %></span>
           <% end %>
         </li>
       <% end %>

app/views/shared/_templates_order_select.html.erb

@@ -1,4 +1,3 @@
-<% dashboard_templates_order = cookies.permanent[:dashboard_templates_order] || 'created_at' %>
 <form action="<%= url_for %>" method="get" class="dropdown dropdown-top hidden md:inline">
   <label tabindex="0" class="btn btn-sm h-10">
     <%= svg_icon('arrow_sort', class: 'w-5 h-5') %>
@@ -6,7 +5,7 @@
   <ul tabindex="0" class="dropdown-content z-[10] menu p-2 shadow bg-base-100 rounded-box mb-1 min-w-48">
     <toggle-cookies data-value="created_at" data-key="dashboard_templates_order">
       <li>
-        <button class="<%= 'bg-base-200' if dashboard_templates_order == 'created_at' %>">
+        <button class="<%= 'bg-base-200' if selected_order == 'created_at' %>">
           <%= svg_icon('sort_descending_numbers', class: 'w-4 h-4') %>
           <span class="whitespace-nowrap"><%= t('newest_first') %></span>
         </button>
@@ -15,7 +14,7 @@
     <% if local_assigns[:with_recently_used] != false %>
       <toggle-cookies data-value="used_at" data-key="dashboard_templates_order">
         <li>
-          <button class="<%= 'bg-base-200' if dashboard_templates_order == 'used_at' %>">
+          <button class="<%= 'bg-base-200' if selected_order == 'used_at' %>">
             <%= svg_icon('sort_descending_small_big', class: 'w-4 h-4') %>
             <span class="whitespace-nowrap"><%= t('recently_used') %></span>
           </button>
@@ -24,7 +23,7 @@
     <% end %>
     <toggle-cookies data-value="name" data-key="dashboard_templates_order">
       <li>
-        <button class="<%= 'bg-base-200' if dashboard_templates_order == 'name' %>">
+        <button class="<%= 'bg-base-200' if selected_order == 'name' %>">
           <%= svg_icon('sort_ascending_letters', class: 'w-4 h-4') %>
           <span class="whitespace-nowrap"><%= t('name_a_z') %></span>
         </button>

app/views/shared/_turbo_drawer.html.erb

@@ -14,7 +14,7 @@
           ×
         </span>
       <% end %>
-      <div class="w-full md:w-[620px] overflow-y-auto" style="max-height: calc(100vh - <%= local_assigns[:title] ? '45px' : '0px' %>)">
+      <div class="w-screen md:w-[620px] overflow-y-auto" style="max-height: calc(100vh - <%= local_assigns[:title] ? '45px' : '0px' %>)">
         <%= yield %>
       </div>
     </div>

app/views/start_form/email_verification.html.erb

@@ -0,0 +1,53 @@
+<% content_for(:html_title, "#{@template.name} | DocuSeal") %>
+<% I18n.with_locale(@template.account.locale) do %>
+  <% content_for(:html_description, t('account_name_has_invited_you_to_fill_and_sign_documents_online_effortlessly_with_a_secure_fast_and_user_friendly_digital_document_signing_solution', account_name: @template.account.name)) %>
+<% end %>
+<div class="max-w-md mx-auto px-2 mt-12 mb-4">
+  <div class="space-y-6 mx-auto">
+    <div class="space-y-6">
+      <div class="flex items-center justify-center">
+        <%= render 'start_form/banner' %>
+      </div>
+      <div class="flex items-center bg-base-200 rounded-xl p-4 mb-4">
+        <div class="flex items-center">
+          <div class="mr-3">
+            <%= svg_icon('writing_sign', class: 'w-10 h-10') %>
+          </div>
+          <div>
+            <p class="text-lg font-bold mb-1"><%= @template.name %></p>
+            <p dir="auto" class="text-sm"><%= t('invited_by_html', name: @template.account.name) %></p>
+          </div>
+        </div>
+      </div>
+    </div>
+    <div>
+      <%= t('we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue') %>
+    </div>
+    <%= form_for '', url: start_form_path(@template.slug), method: :put, html: { class: 'space-y-4', id: 'code_form' } do |f| %>
+      <div dir="auto" class="form-control !mt-0">
+        <%= f.hidden_field 'submitter[name]', value: params[:name] || @submitter&.name %>
+        <%= f.hidden_field 'submitter[email]', value: params[:email] || @submitter&.email %>
+        <%= f.hidden_field 'submitter[phone]', value: params[:phone] || @submitter&.phone %>
+        <%= f.text_field :one_time_code, required: true, class: 'base-input text-center', placeholder: 'XXX-XXX' %>
+        <div class="flex justify-between items-center mt-1">
+          <span>
+            <% if flash[:alert] %>
+              <span class="text-red-500">
+                <%= flash[:alert] %>
+              </span>
+            <% elsif flash[:notice] %>
+              <%= flash[:notice] %>
+            <% end %>
+          </span>
+          <span>
+            <label for="resend_code" id="resend_label" class="link"><%= t(:re_send_code) %></label>
+          </span>
+        </div>
+      </div>
+      <toggle-submit dir="auto" class="form-control">
+        <%= f.button button_title(title: t('submit')), class: 'base-button' %>
+      </toggle-submit>
+    <% end %>
+    <%= button_to t(:re_send_email), start_form_email_2fa_send_index_path, params: { slug: @template.slug, resend: true, submitter: { name: params[:name] || @submitter&.name, email: params[:email] || @submitter&.email, phone: params[:phone] || @submitter&.phone } }.compact, method: :post, id: 'resend_code', class: 'hidden' %>
+  </div>
+</div>

app/views/submissions/_value.html.erb

@@ -3,7 +3,8 @@
 <% color = field.dig('preferences', 'color') %>
 <% font = field.dig('preferences', 'font') %>
 <% font_type = field.dig('preferences', 'font_type') %>
-<field-value dir="auto" class="flex absolute text-[1.6vw] lg:text-base <%= 'font-mono' if font == 'Courier' %> <%= 'font-serif' if font == 'Times' %> <%= 'font-bold' if font_type == 'bold' || font_type == 'bold_italic' %> <%= 'italic' if font_type == 'italic' || font_type == 'bold_italic' %> <%= align == 'right' ? 'text-right' : (align == 'center' ? 'text-center' : '') %>" style="<%= "color: #{color}; " if color.present? %>width: <%= area['w'] * 100 %>%; height: <%= area['h'] * 100 %>%; left: <%= area['x'] * 100 %>%; top: <%= area['y'] * 100 %>%; <%= "font-size: clamp(4pt, 1.6vw, #{field['preferences']['font_size'].to_i * 1.23}pt); line-height: `clamp(6pt, 2.0vw, #{(field['preferences']['font_size'].to_i * 1.23) + 3}pt)`" if field.dig('preferences', 'font_size') %>">
+<% font_size_px = (field.dig('preferences', 'font_size').presence || Submissions::GenerateResultAttachments::FONT_SIZE).to_i * local_assigns.fetch(:font_scale) { 1000.0 / PdfUtils::US_LETTER_W } %>
+<field-value dir="auto" class="flex absolute <%= 'font-courier' if font == 'Courier' %> <%= 'font-times' if font == 'Times' %> <%= 'font-bold' if font_type == 'bold' || font_type == 'bold_italic' %> <%= 'italic' if font_type == 'italic' || font_type == 'bold_italic' %> <%= align == 'right' ? 'text-right' : (align == 'center' ? 'text-center' : '') %>" style="<%= "color: #{color}; " if color.present? %>width: <%= area['w'] * 100 %>%; height: <%= area['h'] * 100 %>%; left: <%= area['x'] * 100 %>%; top: <%= area['y'] * 100 %>%; font-size: <%= fs = "clamp(1pt, #{font_size_px / 10}vw, #{font_size_px}px)" %>; line-height: calc(<%= fs %> * 1.3); font-size: <%= fs = "#{font_size_px / 10}cqmin" %>; line-height: calc(<%= fs %> * 1.3)">
   <% if field['type'] == 'signature' %>
     <% is_narrow = area['h']&.positive? && (area['w'].to_f / area['h']) > 6 %>
     <div class="flex justify-between w-full h-full gap-1 <%= is_narrow && (local_assigns[:with_signature_id] || field.dig('preferences', 'reason_field_uuid').present?) ? 'flex-row' : 'flex-col' %>">

app/views/submissions/show.html.erb

@@ -1,6 +1,7 @@
 <% if params[:controller] == 'submissions_preview' %>
   <%= render 'submissions/preview_tags' %>
 <% end %>
+<% font_scale = 1040.0 / PdfUtils::US_LETTER_W %>
 <% with_signature_id, is_combined_enabled = AccountConfig.where(account_id: @submission.account_id, key: [AccountConfig::COMBINE_PDF_RESULT_KEY, AccountConfig::WITH_SIGNATURE_ID], value: true).then { |configs| [configs.any? { |e| e.key == AccountConfig::WITH_SIGNATURE_ID }, configs.any? { |e| e.key == AccountConfig::COMBINE_PDF_RESULT_KEY }] } %>
 <div style="max-width: 1600px" class="mx-auto pl-4">
   <div class="flex justify-between py-1.5 items-center pr-4 sticky top-0 md:relative z-10 bg-base-100">
@@ -94,11 +95,11 @@
           <% document = @submission.schema_documents.find { |e| e.uuid == item['attachment_uuid'] } %>
           <% document_annots_index = document.metadata.dig('pdf', 'annotations')&.group_by { |e| e['page'] } || {} %>
           <% preview_images_index = document.preview_images.loaded? ? document.preview_images.index_by { |e| e.filename.base.to_i } : {} %>
-          <% lazyload_metadata = document.preview_images.first&.metadata || {} %>
+          <% lazyload_metadata = document.preview_images.first&.metadata || Templates::ProcessDocument::US_LETTER_SIZE %>
           <% (document.metadata.dig('pdf', 'number_of_pages') || (document.preview_images.loaded? ? preview_images_index.size : document.preview_images.size)).times do |index| %>
             <% page = preview_images_index[index] || page_blob_struct.new(metadata: lazyload_metadata, url: preview_document_page_path(document.signed_uuid, "#{index}.jpg")) %>
-            <div id="<%= "page-#{document.uuid}-#{index}" %>" class="relative">
-              <img loading="lazy" src="<%= Docuseal::URL_CACHE.fetch([document.id, document.uuid, index].join(':'), expires_in: 10.minutes) { page.url } %>" width="<%= page.metadata['width'] %>" class="border rounded mb-4" height="<%= page.metadata['height'] %>">
+            <page-container id="<%= "page-#{document.uuid}-#{index}" %>" class="block before:border before:absolute before:top-0 before:bottom-0 before:left-0 before:right-0 before:rounded relative mb-4" style="container-type: size; aspect-ratio: <%= width = page.metadata['width'] %> / <%= height = page.metadata['height'] %>">
+              <img loading="lazy" src="<%= Docuseal::URL_CACHE.fetch([document.id, document.uuid, index].join(':'), expires_in: 10.minutes) { page.url } %>" width="<%= width %>" class="rounded" height="<%= height %>">
               <div class="top-0 bottom-0 left-0 right-0 absolute">
                 <% document_annots_index[index]&.each do |annot| %>
                   <%= render 'submissions/annotation', annot: %>
@@ -110,18 +111,18 @@
                   <% if (mask = field.dig('preferences', 'mask').presence) && signed_in? && can?(:read, @submission) %>
                     <span class="group">
                       <span class="hidden group-hover:inline">
-                        <%= render 'submissions/value', area:, field:, attachments_index:, value:, locale: @submission.account.locale, timezone: @submission.account.timezone, submitter: submitters_index[field['submitter_uuid']], with_signature_id: %>
+                        <%= render 'submissions/value', font_scale:, area:, field:, attachments_index:, value:, locale: @submission.account.locale, timezone: @submission.account.timezone, submitter: submitters_index[field['submitter_uuid']], with_signature_id: %>
                       </span>
                       <span class="group-hover:hidden">
-                        <%= render 'submissions/value', area:, field:, attachments_index:, value: Array.wrap(value).map { |e| TextUtils.mask_value(e, mask) }.join(', '), locale: @submission.account.locale, timezone: @submission.account.timezone, submitter: submitters_index[field['submitter_uuid']], with_signature_id: %>
+                        <%= render 'submissions/value', font_scale:, area:, field:, attachments_index:, value: Array.wrap(value).map { |e| TextUtils.mask_value(e, mask) }.join(', '), locale: @submission.account.locale, timezone: @submission.account.timezone, submitter: submitters_index[field['submitter_uuid']], with_signature_id: %>
                       </span>
                     </span>
                   <% else %>
-                    <%= render 'submissions/value', area:, field:, attachments_index:, value: mask.present? ? Array.wrap(value).map { |e| TextUtils.mask_value(e, mask) }.join(', ') : value, locale: @submission.account.locale, timezone: @submission.account.timezone, submitter: submitters_index[field['submitter_uuid']], with_signature_id: %>
+                    <%= render 'submissions/value', font_scale:, area:, field:, attachments_index:, value: mask.present? ? Array.wrap(value).map { |e| TextUtils.mask_value(e, mask) }.join(', ') : value, locale: @submission.account.locale, timezone: @submission.account.timezone, submitter: submitters_index[field['submitter_uuid']], with_signature_id: %>
                   <% end %>
                 <% end %>
               </div>
-            </div>
+            </page-container>
           <% end %>
         <% end %>
       </div>

app/views/submit_form/show.html.erb

@@ -7,6 +7,7 @@
 <% submitters_index = @submitter.submission.submitters.index_by(&:uuid) %>
 <% page_blob_struct = Struct.new(:url, :metadata, keyword_init: true) %>
 <% schema = Submissions.filtered_conditions_schema(@submitter.submission, values:, include_submitter_uuid: @submitter.uuid) %>
+<% font_scale = 1000.0 / PdfUtils::US_LETTER_W %>
 <div style="max-height: -webkit-fill-available;">
   <div id="scrollbox">
     <div class="mx-auto block pb-72" style="max-width: 1000px">
@@ -66,11 +67,11 @@
         <div id="document-<%= document.uuid %>">
           <% document_annots_index = document.metadata.dig('pdf', 'annotations')&.group_by { |e| e['page'] } || {} %>
           <% preview_images_index = document.preview_images.loaded? ? document.preview_images.index_by { |e| e.filename.base.to_i } : {} %>
-          <% lazyload_metadata = document.preview_images.last&.metadata || {} %>
+          <% lazyload_metadata = document.preview_images.last&.metadata || Templates::ProcessDocument::US_LETTER_SIZE %>
           <% (document.metadata.dig('pdf', 'number_of_pages') || (document.preview_images.loaded? ? preview_images_index.size : document.preview_images.size)).times do |index| %>
             <% page = preview_images_index[index] || page_blob_struct.new(metadata: lazyload_metadata, url: preview_document_page_path(document.signed_uuid, "#{index}.jpg")) %>
-            <div class="relative my-4 shadow-md">
-              <img loading="lazy" src="<%= page.url %>" width="<%= page.metadata['width'] %>" height="<%= page.metadata['height'] %>">
+            <page-container class="block relative my-4 shadow-md" style="container-type: size; aspect-ratio: <%= width = page.metadata['width'] %> / <%= height = page.metadata['height'] %>">
+              <img loading="lazy" src="<%= page.url %>" width="<%= width %>" height="<%= height %>">
               <div id="page-<%= [document.uuid, index].join('-') %>" class="top-0 bottom-0 left-0 right-0 absolute">
                 <% if annots = document_annots_index[index] %>
                   <%= render 'submit_form/annotations', annots: %>
@@ -83,10 +84,10 @@
                   <% next if field['conditions'].present? && values[field['uuid']].blank? && field['submitter_uuid'] != @submitter.uuid %>
                   <% next if field['conditions'].present? && field['submitter_uuid'] == @submitter.uuid %>
                   <% next if field.dig('preferences', 'formula').present? && field['submitter_uuid'] == @submitter.uuid %>
-                  <%= render 'submissions/value', area:, field:, attachments_index: @attachments_index, value: field.dig('preferences', 'mask').present? ? TextUtils.mask_value(value, field.dig('preferences', 'mask')) : value, locale: @submitter.account.locale, timezone: @submitter.account.timezone, submitter: submitters_index[field['submitter_uuid']], with_signature_id: @form_configs[:with_signature_id] %>
+                  <%= render 'submissions/value', font_scale:, area:, field:, attachments_index: @attachments_index, value: field.dig('preferences', 'mask').present? ? TextUtils.mask_value(value, field.dig('preferences', 'mask')) : value, locale: @submitter.account.locale, timezone: @submitter.account.timezone, submitter: submitters_index[field['submitter_uuid']], with_signature_id: @form_configs[:with_signature_id] %>
                 <% end %>
               </div>
-            </div>
+            </page-container>
           <% end %>
         </div>
       <% end %>

app/views/template_folders/show.html.erb

@@ -45,7 +45,7 @@
     </div>
     <% templates_order_select_html = capture do %>
       <% if params[:q].blank? && @pagy.pages > 1 %>
-        <%= render('shared/templates_order_select', with_recently_used: @pagy.count.present? && @pagy.count < 10_000) %>
+        <%= render 'shared/templates_order_select', with_recently_used: @pagy.count.present? && @pagy.count < 10_000 && !can?(:manage, :countless), selected_order: %>
       <% end %>
     <% end %>
     <%= render 'shared/pagination', pagy: @pagy, items_name: 'templates', right_additional_html: templates_order_select_html %>

app/views/template_mailer/otp_verification_email.html.erb

@@ -0,0 +1,3 @@
+<p><%= t('your_verification_code_to_access_the_name', name: @template.name) %></p>
+<p><b><%= @otp_code %></b></p>
+<p><%= t('please_reply_to_this_email_if_you_didnt_request_this') %></p>

app/views/templates_dashboard/index.html.erb

@@ -45,7 +45,7 @@
   <% end %>
   <% templates_order_select_html = capture do %>
     <% if params[:q].blank? && @pagy.pages > 1 %>
-      <%= render('shared/templates_order_select', with_recently_used: @pagy.count.present? && @pagy.count < 10_000) %>
+      <%= render 'shared/templates_order_select', with_recently_used: @pagy.count.present? && @pagy.count < 10_000 && !can?(:manage, :countless), selected_order: %>
     <% end %>
   <% end %>
   <% if @template_folders.present? %>

app/views/templates_preferences/_recipients.html.erb

@@ -15,7 +15,7 @@
               <%= tag.input name: ff.field_name(:email), value: ff.object.email, type: :email, class: 'base-input', multiple: true, autocomplete: 'off', placeholder: t('default_email'), disabled: ff.object.is_requester || ff.object.invite_by_uuid.present? || ff.object.optional_invite_by_uuid.present?, id: field_uuid = SecureRandom.uuid %>
             <% else %>
               <toggle-attribute data-target-id="<%= email_field_uuid = SecureRandom.uuid %>" data-class-name="hidden" data-value="email">
-                <%= ff.select :option, [[t('not_specified'), 'not_set'], (local_assigns[:with_submission_requester] != false ? [t('submission_requester'), 'is_requester'] : nil), [t('specified_email'), 'email'], *(template.submitters - [submitter]).flat_map { |e| [[t('invite_by_name', name: e['name']), "invite_by_#{e['uuid']}"], [t('invite_by_name', name: e['name']) + " (#{t(:optional).capitalize})", "optional_invite_by_#{e['uuid']}"]] }, *(template.submitters - [submitter]).map { |e| [t('same_as_name', name: e['name']), "linked_to_#{e['uuid']}"] }].compact, {}, class: 'base-select mb-3' %>
+                <%= ff.select :option, [[t('not_specified'), 'not_set'], (local_assigns[:with_submission_requester] == false ? nil : [t('submission_requester'), 'is_requester']), [t('specified_email'), 'email'], *(template.submitters - [submitter]).flat_map { |e| [[t('invite_by_name', name: e['name']), "invite_by_#{e['uuid']}"], [t('invite_by_name', name: e['name']) + " (#{t(:optional).capitalize})", "optional_invite_by_#{e['uuid']}"]] }, *(template.submitters - [submitter]).map { |e| [t('same_as_name', name: e['name']), "linked_to_#{e['uuid']}"] }].compact, {}, class: 'base-select mb-3' %>
               </toggle-attribute>
               <%= tag.input name: ff.field_name(:email), type: :email, value: ff.object.email, multiple: true, class: "base-input #{'hidden' if item.option != 'email'}", autocomplete: 'off', placeholder: t('default_email'), id: email_field_uuid %>
             <% end %>

app/views/templates_share_link/show.html.erb

@@ -41,5 +41,15 @@
         </div>
       </div>
     <% end %>
+    <% if Docuseal.multitenant? || Accounts.can_send_emails?(current_account) %>
+      <%= form_for @template, url: template_preferences_path(@template), method: :post, html: { autocomplete: 'off', class: 'mt-3' }, data: { close_on_submit: false } do |f| %>
+        <%= f.fields_for :preferences, Struct.new(:shared_link_2fa).new(@template.preferences['shared_link_2fa'] == true) do |ff| %>
+          <label for="template_preferences_shared_link_2fa" class="flex items-center my-4 justify-between gap-1 alert bg-base-100 border-base-300">
+            <span><%= t('request_email_otp_verification_with_shared_link') %></span>
+            <%= ff.check_box :shared_link_2fa, { checked: ff.object.shared_link_2fa == true, disabled: !can?(:update, @template), class: 'toggle', onchange: 'this.form.requestSubmit()' }, 'true', 'false' %>
+          </label>
+        <% end %>
+      <% end %>
+    <% end %>
   </div>
 <% end %>

app/views/webhook_events/_drawer_events.html.erb

@@ -0,0 +1,57 @@
+<div id="<%= dom_id(webhook_event, :drawer_events) %>">
+  <ol class="relative border-s border-base-300 space-y-6 ml-3">
+    <% webhook_attempts = webhook_event.webhook_attempts.sort_by { |e| -e.id } %>
+    <% if webhook_event.status == 'error' %>
+      <% last_attempt = webhook_attempts.select { |e| e.attempt < SendWebhookRequest::MANUAL_ATTEMPT }.max_by(&:attempt) %>
+      <% if webhook_event.webhook_attempts.none?(&:success?) && last_attempt.attempt <= 10 %>
+        <li class="ml-7">
+          <span class="btn btn-outline btn-xs btn-circle pointer-events-none absolute justify-center border-base-content-/60 text-base-content/60 bg-base-100" style="left: -12px;">
+            <%= svg_icon('clock', class: 'w-4 h-4 shrink-0') %>
+          </span>
+          <p class="leading-none text-base-content/90 pt-1">
+            <%= t('next_attempt_in_time_in_words', time_in_words: distance_of_time_in_words(Time.current, last_attempt.created_at + (2**last_attempt.attempt).minutes)) %>
+          </p>
+        </li>
+      <% end %>
+    <% end %>
+    <% if webhook_attempts.present? %>
+      <% webhook_attempts.each do |webhook_attempt| %>
+        <li class="ml-7">
+          <span class="btn btn-outline btn-xs btn-circle pointer-events-none absolute justify-center <%= webhook_attempt.success? ? 'btn-success bg-lime-50' : 'btn-error bg-red-50' %>" style="left: -12px;">
+            <%= svg_icon(webhook_attempt.success? ? 'check' : 'x', class: 'w-4 h-4 shrink-0') %>
+          </span>
+          <p class="leading-none text-sm text-base-content/60 pt-1">
+            <%= l(webhook_attempt.created_at.in_time_zone(current_account.timezone), format: :long, locale: current_account.locale) %>
+          </p>
+          <div class="mt-2">
+            <p class="text-sm font-bold text-base-content/80">
+              <span><%= Rack::Utils::HTTP_STATUS_CODES[webhook_attempt.response_status_code] %></span>
+              <% if webhook_attempt.response_status_code.positive? %>
+                <span>(<%= webhook_attempt.response_status_code %>)</span>
+              <% end %>
+            </p>
+            <% unless webhook_attempt.success? %>
+              <p class="text-sm text-base-content/80 mt-1">
+                <%= webhook_attempt.response_body.presence || Rack::Utils::HTTP_STATUS_CODES[webhook_attempt.response_status_code] %>
+              </p>
+            <% end %>
+          </div>
+        </li>
+      <% end %>
+    <% else %>
+      <li class="ml-7">
+        <span class="btn btn-outline btn-xs btn-circle pointer-events-none absolute justify-center btn-info bg-blue-50" style="left: -12px;">
+          <%= svg_icon('clock', class: 'w-4 h-4 shrink-0') %>
+        </span>
+        <p class="leading-none text-base-content/60 pt-1">
+          <%= l(webhook_event.created_at.in_time_zone(current_account.timezone), format: :long, locale: current_account.locale) %>
+        </p>
+      </li>
+    <% end %>
+  </ol>
+  <% unless webhook_event.status == 'pending' %>
+    <div class="absolute right-4 top-3">
+      <%= button_to button_title(title: t('resend'), disabled_with: t('awaiting'), icon: svg_icon('rotate', class: 'w-4 h-4'), icon_disabled: svg_icon('loader', class: 'w-4 h-4 animate-spin')), resend_settings_webhook_event_path(webhook_url.id, webhook_event.uuid), form: { id: button_uuid = SecureRandom.uuid }, params: { button_id: button_uuid }, class: 'btn btn-neutral btn-sm text-white', method: :post, onclick: '[this.form.requestSubmit(), this.disabled = true]' %>
+    </div>
+  <% end %>
+</div>

app/views/webhook_events/_event_row.html.erb

@@ -0,0 +1,28 @@
+<div id="<%= dom_id(webhook_event) %>" class="group relative hover:cursor-pointer hover:bg-base-200">
+  <a href="<%= settings_webhook_event_path(webhook_url.id, webhook_event.uuid) %>" data-turbo-frame="drawer" class="top-0 bottom-0 left-0 right-0 absolute"></a>
+  <div class="min-h-12 flex flex-col md:flex-row md:items-center md:justify-between gap-2 px-3 py-2">
+    <div class="flex items-center gap-4">
+      <% if webhook_event.status == 'success' %>
+        <div class="btn btn-outline btn-xs btn-success bg-lime-50 gap-1">
+          <%= svg_icon('check', class: 'w-4 h-4 shrink-0 stroke-2') %>
+          <%= webhook_event.webhook_attempts.max_by(&:id)&.response_status_code if local_assigns[:with_status] %>
+        </div>
+      <% elsif webhook_event.status == 'pending' %>
+        <div class="btn btn-outline btn-xs btn-info bg-blue-50 gap-1">
+          <%= svg_icon('clock', class: 'w-4 h-4 shrink-0 stroke-2') %>
+          <%= webhook_event.webhook_attempts.max_by(&:id)&.response_status_code if local_assigns[:with_status] %>
+        </div>
+      <% elsif webhook_event.status == 'error' %>
+        <div class="btn btn-outline btn-xs btn-error bg-red-50 gap-1">
+          <%= svg_icon('x', class: 'w-4 h-4 shrink-0') %>
+          <%= webhook_event.webhook_attempts.max_by(&:id)&.response_status_code if local_assigns[:with_status] %>
+        </div>
+      <% end %>
+      <div><%= webhook_event.event_type %></div>
+    </div>
+    <div class="flex items-center gap-3">
+      <%= button_to button_title(title: t('resend'), disabled_with: t('awaiting'), icon: svg_icon('rotate', class: 'w-4 h-4'), icon_disabled: svg_icon('loader', class: 'w-4 h-4 animate-spin')), resend_settings_webhook_event_path(webhook_url.id, webhook_event.uuid), form: { id: button_uuid = SecureRandom.uuid }, params: { button_id: button_uuid }, class: 'btn btn-neutral btn-xs h-2 text-white relative z-[1] hidden md:group-hover:inline-block', data: { turbo_frame: :drawer }, method: :post, onclick: "[this.form.requestSubmit(), this.disabled = true, this.classList.remove('hidden')]" %>
+      <span><%= l(webhook_event.created_at, locale: current_account.locale, format: :short) %></span>
+    </div>
+  </div>
+</div>

app/views/webhook_events/show.html.erb

@@ -0,0 +1,14 @@
+<%= render 'shared/turbo_drawer', title: @webhook_event.event_type, close_after_submit: false do %>
+  <div class="relative px-4 py-4">
+    <%= render 'drawer_events', webhook_url: @webhook_url, webhook_event: @webhook_event %>
+    <% if @data %>
+      <div class="mockup-code overflow-hidden relative pb-0 mt-6">
+        <% response = JSON.pretty_generate({ event_type: @webhook_event.event_type, timestamp: @webhook_event.created_at.as_json, data: @data }) %>
+        <span class="top-0 right-0 absolute">
+          <%= render 'shared/clipboard_copy', icon: 'copy', text: response, class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
+        </span>
+        <pre class="before:!m-0 pl-4 pb-4"><code class="overflow-hidden text-sm w-full"><%== HighlightCode.call(response, 'JSON', theme: 'base16.dark') %></code></pre>
+      </div>
+    <% end %>
+  </div>
+<% end %>

app/views/webhook_settings/show.html.erb

@@ -79,8 +79,49 @@
         <% end %>
       </div>
     </div>
-    <% submitter = current_account.submitters.where.not(completed_at: nil).order(:id).last %>
-    <% if submitter %>
+    <% if @webhook_events.present? || params[:status].present? %>
+      <div class="mt-6">
+        <h2 id="log" class="text-3xl font-bold"><%= t('events_log') %></h2>
+        <div class="tabs border-b mt-4">
+          <%= link_to t('all'), url_for(params.to_unsafe_h.except(:status)), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status].blank? ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
+          <%= link_to t('successed'), url_for(params.to_unsafe_h.merge(status: 'success')), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status] == 'success' ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
+          <%= link_to t('failed'), url_for(params.to_unsafe_h.merge(status: 'error')), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status] == 'error' ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
+        </div>
+        <% if @webhook_events.present? %>
+          <div class="divide-y divide-base-300 rounded-lg">
+            <%= render partial: 'webhook_events/event_row', collection: @webhook_events, as: :webhook_event, locals: { webhook_url: @webhook_url } %>
+          </div>
+        <% else %>
+          <div class="text-center py-4">
+            <%= t('there_are_no_events') %>
+          </div>
+        <% end %>
+        <% if @pagy.pages > 1 %>
+          <div class="flex my-4 justify-center md:justify-between">
+            <div class="hidden md:block text-sm">
+              <%= "#{@pagy.from}-#{@pagy.to} events" %>
+            </div>
+            <div class="flex items-center space-x-1.5">
+              <div class="join">
+                <% if @pagy.prev %>
+                  <%= link_to '«', url_for(page: @pagy.prev, anchor: 'log'), class: 'join-item btn min-h-full h-10' %>
+                <% else %>
+                  <span class="join-item btn btn-disabled !bg-base-200 min-h-full h-10">«</span>
+                <% end %>
+                <span class="join-item btn font-medium uppercase min-h-full h-10">
+                  <%= "Page #{@pagy.page}" %>
+                </span>
+                <% if @pagy.next %>
+                  <%= link_to '»', url_for(page: @pagy.next, anchor: 'log'), class: 'join-item btn min-h-full h-10' %>
+                <% else %>
+                  <span class="join-item btn btn-disabled !bg-base-200 min-h-full h-10">»</span>
+                <% end %>
+              </div>
+            </div>
+          </div>
+        <% end %>
+      </div>
+    <% elsif (submitter = current_account.submitters.where.not(completed_at: nil).order(:id).last) && can?(:read, submitter) %>
       <div class="space-y-4 mt-4">
         <div class="collapse collapse-open bg-base-200 px-1">
           <div class="p-4 text-xl font-medium">
@@ -98,7 +139,7 @@
               <span class="top-0 right-0 absolute">
                 <%= render 'shared/clipboard_copy', icon: 'copy', text: code = JSON.pretty_generate({ event_type: 'form.completed', timestamp: Time.current.iso8601, data: Submitters::SerializeForWebhook.call(submitter) }).gsub(/^/, '  ').sub(/^\s+/, ''), class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
               </span>
-              <pre><code class="overflow-hidden w-full"><%= code %></code></pre>
+              <pre><code class="overflow-hidden w-full"><%== HighlightCode.call(code, 'JSON', theme: 'base16.dark') %></code></pre>
             </div>
           </div>
         </div>

config/brakeman.ignore

@@ -1,7 +1,7 @@
 {
   "ignored_warnings": [
     {
-      "fingerprint": "25f4ce5fee1e1180fa1919dc4ee78db3ab3457a956e4679503aa745771a43836",
+      "fingerprint": "bbd1bdad94998e53a48921859065e06cd1595502d4dc40362afcaa90307b591a",
       "note": "Permitted parameters are necessary for creating submitters via API"
     },
     {
@@ -19,6 +19,10 @@
     {
       "fingerprint": "5f52190d03ee922bba9792012d8fcbeb7d4736006bb899b3be9cc10d679e0af1",
       "note": "Safe Param"
+    },
+    {
+      "fingerprint": "dbbfb4a4ace7f43d8247cbb44afa8b628e005e6194ca5552e029b200f725a2d5",
+      "message": "Unescaped find_by!(uuid: params[:id]) is not risky"
     }
   ]
 }

config/initializers/rouge.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Rouge
+  autoload :InheritableHash, 'rouge/util'
+  autoload :Token, 'rouge/token'
+  autoload :Lexer, 'rouge/lexer'
+  autoload :RegexLexer, 'rouge/regex_lexer'
+
+  module Lexers
+    autoload :JSON, 'rouge/lexers/json'
+  end
+
+  autoload :Formatter, 'rouge/formatter'
+
+  module Formatters
+    autoload :HTML, 'rouge/formatters/html'
+    autoload :HTMLInline, 'rouge/formatters/html_inline'
+  end
+
+  autoload :Theme, 'rouge/theme'
+end

config/locales/i18n.yml

@@ -20,6 +20,7 @@ en: &en
   language_ko: 한국어
   language_ja: 日本語
   hi_there: Hi there
+  pro: Pro
   thanks: Thanks
   private: Private
   default_parties: Default parties
@@ -763,6 +764,21 @@ en: &en
   link_form_fields: Link form fields
   at_least_one_field_must_be_displayed_in_the_form: At least one field must be displayed in the form.
   this_template_has_multiple_parties_which_prevents_the_use_of_a_sharing_link: This template has multiple parties, which prevents the use of a shared link as it's unclear which party is responsible for specific fields. To resolve this, define the default party details.
+  events_log: Events Log
+  successed: Successed
+  failed: Failed
+  there_are_no_events: There are no events
+  resend: Resend
+  next_attempt_in_time_in_words: Next attempt in %{time_in_words}
+  request_email_otp_verification_with_shared_link: Request email OTP verification with shared link
+  sms_rate_limit_exceeded: SMS rate limit exceeded
+  invalid_phone_number: Invalid phone number
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Please contact the requester to specify your phone number for two-factor authentication.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: We've sent a one-time verification code to your email address. Please enter the code below to continue.
+  re_send_code: Re-send Code
+  email_verification: Email verification
+  your_verification_code_to_access_the_name: 'Your verification code to access the "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Please reply to this email if you didn't request this.
   submission_sources:
     api: API
     bulk: Bulk Send
@@ -780,6 +796,7 @@ en: &en
     click_email_by_html: '<b>Email link clicked</b> by %{submitter_name}'
     click_sms_by_html: '<b>SMS link clicked</b> by %{submitter_name}'
     phone_verified_by_html: '<b>Phone verified</b> by %{submitter_name}'
+    email_verified_by_html: '<b>Email verified</b> by %{submitter_name}'
     start_form_by_html: '<b>Submission started</b> by %{submitter_name}'
     view_form_by_html: '<b>Form viewed</b> by %{submitter_name}'
     invite_party_by_html: '<b>Invited</b> %{invited_submitter_name} by %{submitter_name}'
@@ -863,8 +880,12 @@ en: &en
     items:
       range_with_total: "%{from}-%{to} of %{count} items"
       range_without_total: "%{from}-%{to} items"
+    events:
+      range_with_total: "%{from}-%{to} of %{count} events"
+      range_without_total: "%{from}-%{to} events"
 
 es: &es
+  pro: Pro
   default_parties: Partes predeterminadas
   authenticate_embedded_form_preview_with_token: Autenticar vista previa del formulario incrustado con token
   require_all_recipients: Requerir a todos los destinatarios
@@ -1609,6 +1630,21 @@ es: &es
   link_form_fields: Vincular campos del formulario
   at_least_one_field_must_be_displayed_in_the_form: Al menos un campo debe mostrarse en el formulario.
   this_template_has_multiple_parties_which_prevents_the_use_of_a_sharing_link: Esta plantilla tiene varias partes, lo que impide el uso de un enlace compartido porque no está claro qué parte es responsable de campos específicos. Para resolverlo, define los detalles predeterminados de la parte.
+  events_log: Registro de eventos
+  successed: Exitoso
+  failed: Fallido
+  there_are_no_events: No hay eventos
+  resend: Reenviar
+  next_attempt_in_time_in_words: Próximo intento en %{time_in_words}
+  request_email_otp_verification_with_shared_link: Solicitar verificación OTP por correo electrónico con enlace compartido
+  sms_rate_limit_exceeded: Límite de SMS excedido
+  invalid_phone_number: Número de teléfono inválido
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Contacte al solicitante para especificar su número para la autenticación de dos factores.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: Enviamos un código de verificación único a su correo electrónico. Ingréselo a continuación para continuar.
+  re_send_code: Reenviar código
+  email_verification: Verificación por correo electrónico
+  your_verification_code_to_access_the_name: 'Su código de verificación para acceder a "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Por favor, responda este correo si no solicitó esto.
   submission_sources:
     api: API
     bulk: Envío masivo
@@ -1626,6 +1662,7 @@ es: &es
     click_email_by_html: '<b>Enlace del correo electrónico clicado</b> por %{submitter_name}'
     click_sms_by_html: '<b>Enlace del SMS clicado</b> por %{submitter_name}'
     phone_verified_by_html: '<b>Teléfono verificado</b> por %{submitter_name}'
+    email_verified_by_html: '<b>Correo electrónico verificado</b> por %{submitter_name}'
     start_form_by_html: '<b>Envío iniciado</b> por %{submitter_name}'
     view_form_by_html: '<b>Formulario visto</b> por %{submitter_name}'
     invite_party_by_html: '<b>Invitado</b> %{invited_submitter_name} por %{submitter_name}'
@@ -1709,8 +1746,12 @@ es: &es
     items:
       range_with_total: "%{from}-%{to} de %{count} elementos"
       range_without_total: "%{from}-%{to} elementos"
+    events:
+      range_with_total: "%{from}-%{to} de %{count} eventos"
+      range_without_total: "%{from}-%{to} eventos"
 
 it: &it
+  pro: Pro
   default_parties: Parti predefiniti
   authenticate_embedded_form_preview_with_token: "Autentica l'anteprima del modulo incorporato con il token"
   require_all_recipients: Richiedi tutti i destinatari
@@ -2453,6 +2494,22 @@ it: &it
   link_form_fields: Collega i campi del modulo
   at_least_one_field_must_be_displayed_in_the_form: Almeno un campo deve essere visualizzato nel modulo.
   this_template_has_multiple_parties_which_prevents_the_use_of_a_sharing_link: Questo modello ha più parti, il che impedisce l’uso di un link di condivisione perché non è chiaro quale parte sia responsabile di campi specifici. Per risolvere, definisci i dettagli predefiniti della parte.
+  events_log: Registro eventi
+  successed: Riuscito
+  failed: Fallito
+  there_are_no_events: Nessun evento
+  resend: Invia di nuovo
+  next_attempt_in_time_in_words: Prossimo tentativo tra %{time_in_words}
+  this_template_has_multiple_parties_which_prevents_the_use_of_a_sharing_link: "Questo modello ha più parti, il che impedisce l'uso di un link di condivisione perché non è chiaro quale parte sia responsabile di campi specifici. Per risolvere, definisci i dettagli predefiniti della parte."
+  request_email_otp_verification_with_shared_link: "Richiedi la verifica OTP tramite email con link condiviso"
+  sms_rate_limit_exceeded: Limite SMS superato
+  invalid_phone_number: Numero di telefono non valido
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Contatta il richiedente per specificare il tuo numero per l'autenticazione a due fattori.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: Abbiamo inviato un codice di verifica una tantum alla tua email. Inseriscilo qui sotto per continuare.
+  re_send_code: Invia di nuovo il codice
+  email_verification: Verifica email
+  your_verification_code_to_access_the_name: 'Il tuo codice per accedere a "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Rispondi a questa email se non hai richiesto questo.
   submission_sources:
     api: API
     bulk: Invio massivo
@@ -2470,6 +2527,7 @@ it: &it
     click_email_by_html: "<b>Link dell'e-mail cliccato</b> da %{submitter_name}"
     click_sms_by_html: "<b>Link dell'SMS cliccato</b> da %{submitter_name}"
     phone_verified_by_html: '<b>Telefono verificato</b> da %{submitter_name}'
+    email_verified_by_html: '<b>Email verificata</b> da %{submitter_name}'
     start_form_by_html: '<b>Invio iniziato</b> da %{submitter_name}'
     view_form_by_html: '<b>Modulo visualizzato</b> da %{submitter_name}'
     invite_party_by_html: '<b>Invitato</b> %{invited_submitter_name} da %{submitter_name}'
@@ -2553,8 +2611,12 @@ it: &it
     items:
       range_with_total: "%{from}-%{to} di %{count} elementi"
       range_without_total: "%{from}-%{to} elementi"
+    events:
+      range_with_total: "%{from}-%{to} di %{count} eventi"
+      range_without_total: "%{from}-%{to} eventi"
 
 fr: &fr
+  pro: Pro
   default_parties: Parties par défaut
   authenticate_embedded_form_preview_with_token: Authentifier l’aperçu du formulaire intégré avec un jeton
   require_all_recipients: Exiger tous les destinataires
@@ -3300,6 +3362,22 @@ fr: &fr
   link_form_fields: Lier les champs du formulaire
   at_least_one_field_must_be_displayed_in_the_form: Au moins un champ doit être affiché dans le formulaire.
   this_template_has_multiple_parties_which_prevents_the_use_of_a_sharing_link: Ce modèle contient plusieurs parties, ce qui empêche l’utilisation d’un lien de partage car il n’est pas clair quelle partie est responsable de certains champs. Pour résoudre cela, définissez les détails de la partie par défaut.
+  events_log: Journal des événements
+  successed: Réussi
+  failed: Échoué
+  there_are_no_events: Aucun événement
+  resend: Renvoyer
+  next_attempt_in_time_in_words: Nouvelle tentative dans %{time_in_words}
+  this_template_has_multiple_parties_which_prevents_the_use_of_a_sharing_link: "Ce modèle contient plusieurs parties, ce qui empêche l'utilisation d'un lien de partage car il n'est pas clair quelle partie est responsable de certains champs. Pour résoudre cela, définissez les détails de la partie par défaut."
+  request_email_otp_verification_with_shared_link: "Demander une vérification OTP par e-mail avec un lien de partage"
+  sms_rate_limit_exceeded: Limite de SMS dépassée
+  invalid_phone_number: Numéro de téléphone invalide
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Veuillez contacter l'expéditeur pour spécifier votre numéro pour l'authentification à deux facteurs.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: Un code de vérification unique a été envoyé à votre adresse email. Veuillez le saisir ci-dessous pour continuer.
+  re_send_code: Renvoyer le code
+  email_verification: Vérification de l'email
+  your_verification_code_to_access_the_name: 'Votre code pour accéder à "%{name}" :'
+  please_reply_to_this_email_if_you_didnt_request_this: Veuillez répondre à cet email si vous n'avez pas fait cette demande.
   submission_sources:
     api: API
     bulk: Envoi en masse
@@ -3317,6 +3395,7 @@ fr: &fr
     click_email_by_html: "<b>Lien de l'e-mail cliqué</b> par %{submitter_name}"
     click_sms_by_html: '<b>Lien du SMS cliqué</b> par %{submitter_name}'
     phone_verified_by_html: '<b>Téléphone vérifié</b> par %{submitter_name}'
+    email_verified_by_html: '<b>Email vérifié</b> par %{submitter_name}'
     start_form_by_html: '<b>Soumission commencée</b> par %{submitter_name}'
     view_form_by_html: '<b>Formulaire consulté</b> par %{submitter_name}'
     invite_party_by_html: '<b>Invité</b> %{invited_submitter_name} par %{submitter_name}'
@@ -3400,8 +3479,12 @@ fr: &fr
     items:
       range_with_total: "%{from} à %{to} sur %{count} éléments"
       range_without_total: "%{from} à %{to} éléments"
+    events:
+      range_with_total: "%{from} à %{to} sur %{count} événements"
+      range_without_total: "%{from} à %{to} événements"
 
 pt: &pt
+  pro: Pro
   default_parties: Partes padrão
   authenticate_embedded_form_preview_with_token: Autenticar visualização incorporada do formulário com token
   require_all_recipients: Exigir todos os destinatários
@@ -4146,6 +4229,21 @@ pt: &pt
   link_form_fields: Vincular campos do formulário
   at_least_one_field_must_be_displayed_in_the_form: Pelo menos um campo deve ser exibido no formulário.
   this_template_has_multiple_parties_which_prevents_the_use_of_a_sharing_link: Este modelo tem várias partes, o que impede o uso de um link de compartilhamento, pois não está claro qual parte é responsável por campos específicos. Para resolver isso, defina os detalhes padrão da parte.
+  events_log: Registro de eventos
+  successed: Sucesso
+  failed: Falhou
+  there_are_no_events: Nenhum evento
+  resend: Reenviar
+  next_attempt_in_time_in_words: Próxima tentativa em %{time_in_words}
+  request_email_otp_verification_with_shared_link: Solicitar verificação de OTP por e-mail com link compartilhado
+  sms_rate_limit_exceeded: Limite de SMS excedido
+  invalid_phone_number: Número de telefone inválido
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Entre em contato com o solicitante para especificar seu número para autenticação de dois fatores.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: Enviamos um código de verificação único para seu e-mail. Insira-o abaixo para continuar.
+  re_send_code: Reenviar código
+  email_verification: Verificação de e-mail
+  your_verification_code_to_access_the_name: 'Seu código de verificação para acessar "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Responda a este e-mail se você não solicitou isso.
   submission_sources:
     api: API
     bulk: Envio em massa
@@ -4163,6 +4261,7 @@ pt: &pt
     click_email_by_html: '<b>Link do e-mail clicado</b> por %{submitter_name}'
     click_sms_by_html: '<b>Link do SMS clicado</b> por %{submitter_name}'
     phone_verified_by_html: '<b>Telefone verificado</b> por %{submitter_name}'
+    email_verified_by_html: '<b>Email verificado</b> por %{submitter_name}'
     start_form_by_html: '<b>Submissão iniciada</b> por %{submitter_name}'
     view_form_by_html: '<b>Formulário visualizado</b> por %{submitter_name}'
     invite_party_by_html: '<b>Convidado</b> %{invited_submitter_name} por %{submitter_name}'
@@ -4247,8 +4346,12 @@ pt: &pt
     items:
       range_with_total: "%{from}-%{to} de %{count} itens"
       range_without_total: "%{from}-%{to} itens"
+    events:
+      range_with_total: "%{from}-%{to} de %{count} eventos"
+      range_without_total: "%{from}-%{to} eventos"
 
 de: &de
+  pro: Pro
   default_parties: Standardparteien
   authenticate_embedded_form_preview_with_token: Authentifizieren Sie die eingebettete Formularvorschau mit Token
   require_all_recipients: Alle Empfänger erforderlich
@@ -4993,6 +5096,21 @@ de: &de
   link_form_fields: Formularfelder verknüpfen
   at_least_one_field_must_be_displayed_in_the_form: Mindestens ein Feld muss im Formular angezeigt werden.
   this_template_has_multiple_parties_which_prevents_the_use_of_a_sharing_link: Diese Vorlage enthält mehrere Parteien, was die Verwendung eines Freigabelinks verhindert, da unklar ist, welche Partei für bestimmte Felder verantwortlich ist. Um dies zu beheben, definieren Sie die Standardparteidetails.
+  events_log: Ereignisprotokoll
+  successed: Erfolgreich
+  failed: Fehlgeschlagen
+  there_are_no_events: Keine Ereignisse vorhanden
+  resend: Erneut senden
+  next_attempt_in_time_in_words: Nächster Versuch in %{time_in_words}
+  request_email_otp_verification_with_shared_link: Fordern Sie die E-Mail-OTP-Verifizierung mit Freigabelink an
+  sms_rate_limit_exceeded: SMS-Limit überschritten
+  invalid_phone_number: Ungültige Telefonnummer
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Kontaktieren Sie den Absender, um Ihre Telefonnummer für die Zwei-Faktor-Authentifizierung anzugeben.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: Wir haben einen einmaligen Verifizierungscode an Ihre E-Mail-Adresse gesendet. Bitte geben Sie ihn unten ein, um fortzufahren.
+  re_send_code: Code erneut senden
+  email_verification: E-Mail-Verifizierung
+  your_verification_code_to_access_the_name: 'Ihr Verifizierungscode für den Zugriff auf "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Antworten Sie auf diese E-Mail, wenn Sie dies nicht angefordert haben.
   submission_sources:
     api: API
     bulk: Massenversand
@@ -5010,6 +5128,7 @@ de: &de
     click_email_by_html: '<b>E-Mail-Link angeklickt</b> von %{submitter_name}'
     click_sms_by_html: '<b>SMS-Link angeklickt</b> von %{submitter_name}'
     phone_verified_by_html: '<b>Telefon verifiziert</b> von %{submitter_name}'
+    email_verified_by_html: '<b>Email verifiziert</b> von %{submitter_name}'
     start_form_by_html: '<b>Einreichung gestartet</b> von %{submitter_name}'
     view_form_by_html: '<b>Formular angesehen</b> von %{submitter_name}'
     invite_party_by_html: '<b>Eingeladen</b> %{invited_submitter_name} von %{submitter_name}'
@@ -5093,6 +5212,9 @@ de: &de
     items:
       range_with_total: "%{from}-%{to} von %{count} Elementen"
       range_without_total: "%{from}-%{to} Elemente"
+    events:
+      range_with_total: "%{from}-%{to} von %{count} Ereignissen"
+      range_without_total: "%{from}-%{to} Ereignisse"
 
 pl:
   require_phone_2fa_to_open: Wymagaj uwierzytelniania telefonicznego 2FA do otwarcia
@@ -5173,6 +5295,15 @@ pl:
   select_data_residency: Wybierz lokalizację danych
   company_name: Nazwa firmy
   optional: opcjonalne
+  submit: Prześlij
+  sms_rate_limit_exceeded: Przekroczono limit wiadomości SMS
+  invalid_phone_number: Nieprawidłowy numer telefonu
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Skontaktuj się z nadawcą, aby podać numer telefonu do uwierzytelniania dwuskładnikowego.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: Wysłaliśmy jednorazowy kod weryfikacyjny na Twój adres e-mail. Wprowadź go poniżej, aby kontynuować.
+  re_send_code: Wyślij ponownie kod
+  email_verification: Weryfikacja e-mail
+  your_verification_code_to_access_the_name: 'Twój kod weryfikacyjny do uzyskania dostępu do "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Odpowiedz na ten e-mail, jeśli nie prosiłeś o to.
 
 uk:
   require_phone_2fa_to_open: Вимагати двофакторну автентифікацію через телефон для відкриття
@@ -5253,6 +5384,15 @@ uk:
   select_data_residency: Виберіть місце зберігання даних
   company_name: Назва компанії
   optional: необов’язково
+  submit: Надіслати
+  sms_rate_limit_exceeded: Перевищено ліміт SMS
+  invalid_phone_number: Невірний номер телефону
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Зв’яжіться з відправником, щоб вказати номер телефону для двофакторної автентифікації.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: Ми надіслали одноразовий код підтвердження на вашу електронну пошту. Введіть його нижче, щоб продовжити.
+  re_send_code: Надіслати код повторно
+  email_verification: Підтвердження електронної пошти
+  your_verification_code_to_access_the_name: 'Ваш код доступу до "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Відповідайте на цей лист, якщо ви цього не запитували.
 
 cs:
   require_phone_2fa_to_open: Vyžadovat otevření pomocí telefonního 2FA
@@ -5333,6 +5473,15 @@ cs:
   select_data_residency: Vyberte umístění dat
   company_name: Název společnosti
   optional: volitelné
+  submit: Odeslat
+  sms_rate_limit_exceeded: Překročena hranice SMS
+  invalid_phone_number: Neplatné telefonní číslo
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Kontaktujte odesílatele kvůli zadání vašeho čísla pro dvoufázové ověření.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: Poslali jsme jednorázový ověřovací kód na váš e-mail. Zadejte ho níže pro pokračování.
+  re_send_code: Znovu odeslat kód
+  email_verification: Ověření e-mailu
+  your_verification_code_to_access_the_name: 'Váš ověřovací kód pro přístup k "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Odpovězte na tento e-mail, pokud jste o to nežádali.
 
 he:
   require_phone_2fa_to_open: דרוש אימות דו-שלבי באמצעות טלפון לפתיחה
@@ -5413,6 +5562,15 @@ he:
   select_data_residency: בחר מיקום נתונים
   company_name: שם החברה
   optional: אופציונלי
+  submit: 'שלח'
+  sms_rate_limit_exceeded: 'חריגה ממגבלת SMS'
+  invalid_phone_number: 'מספר טלפון לא תקין'
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: 'פנה לשולח כדי לציין את מספרך לאימות דו-שלבי.'
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: 'שלחנו קוד אימות חד-פעמי לדוא"ל שלך. הזן את הקוד למטה כדי להמשיך.'
+  re_send_code: 'שלח קוד מחדש'
+  email_verification: 'אימות דוא"ל'
+  your_verification_code_to_access_the_name: 'קוד האימות שלך לגישה ל-%{name}:'
+  please_reply_to_this_email_if_you_didnt_request_this: 'השב למייל זה אם לא ביקשת זאת.'
 
 nl:
   require_phone_2fa_to_open: Vereis telefoon 2FA om te openen
@@ -5493,6 +5651,15 @@ nl:
   select_data_residency: Selecteer gegevenslocatie
   company_name: Bedrijfsnaam
   optional: optioneel
+  submit: Verzenden
+  sms_rate_limit_exceeded: SMS-limiet overschreden
+  invalid_phone_number: Ongeldig telefoonnummer
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: Neem contact op met de aanvrager om uw nummer voor twee-factor-authenticatie op te geven.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: We hebben een eenmalige verificatiecode naar je e-mailadres gestuurd. Voer de code hieronder in om verder te gaan.
+  re_send_code: Code opnieuw verzenden
+  email_verification: E-mailverificatie
+  your_verification_code_to_access_the_name: 'Je verificatiecode voor toegang tot "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: Reageer op deze e-mail als je dit niet hebt aangevraagd.
 
 ar:
   require_phone_2fa_to_open: "تطلب فتح عبر تحقق الهاتف ذو العاملين"
@@ -5573,6 +5740,15 @@ ar:
   select_data_residency: اختر موقع تخزين البيانات
   company_name: اسم الشركة
   optional: اختياري
+  submit: 'إرسال'
+  sms_rate_limit_exceeded: 'تم تجاوز حد رسائل SMS'
+  invalid_phone_number: 'رقم الهاتف غير صالح'
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: 'يرجى الاتصال بالمرسل لتحديد رقم هاتفك للمصادقة الثنائية.'
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: 'أرسلنا رمز تحقق لمرة واحدة إلى بريدك الإلكتروني. الرجاء إدخاله أدناه للمتابعة.'
+  re_send_code: 'إعادة إرسال الرمز'
+  email_verification: 'التحقق من البريد الإلكتروني'
+  your_verification_code_to_access_the_name: 'رمز التحقق الخاص بك للوصول إلى "%{name}":'
+  please_reply_to_this_email_if_you_didnt_request_this: 'يرجى الرد على هذا البريد إذا لم تطلب ذلك.'
 
 ko:
   require_phone_2fa_to_open: 휴대폰 2FA를 열 때 요구함
@@ -5653,6 +5829,15 @@ ko:
   select_data_residency: 데이터 저장 위치 선택
   company_name: 회사 이름
   optional: 선택 사항
+  submit: 제출
+  sms_rate_limit_exceeded: SMS 제한 초과
+  invalid_phone_number: 잘못된 전화번호입니다
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: 이중 인증을 위해 전화번호를 지정하려면 요청자에게 문의하세요.
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: 일회용 인증 코드를 이메일로 보냈습니다. 계속하려면 아래에 입력하세요.
+  re_send_code: 코드 재전송
+  email_verification: 이메일 인증
+  your_verification_code_to_access_the_name: '"%{name}"에 액세스하기 위한 인증 코드:'
+  please_reply_to_this_email_if_you_didnt_request_this: 요청하지 않았다면 이 이메일에 회신하세요.
 
 ja:
   require_phone_2fa_to_open: 電話による2段階認証が必要です
@@ -5733,6 +5918,15 @@ ja:
   select_data_residency: データ保存場所を選択
   company_name: 会社名
   optional: 任意
+  submit: 送信
+  sms_rate_limit_exceeded: SMSの送信制限を超えました
+  invalid_phone_number: 無効な電話番号です
+  please_contact_the_requester_to_specify_your_phone_number_for_two_factor_authentication: 二要素認証のため、リクエスターに電話番号を指定してください。
+  we_sent_a_one_time_verification_code_to_your_email_address_please_enter_the_code_below_to_continue: ワンタイム認証コードをメールアドレスに送信しました。続行するには、以下にコードを入力してください。
+  re_send_code: コードを再送信
+  email_verification: メール認証
+  your_verification_code_to_access_the_name: '"%{name}"へのアクセスコード：'
+  please_reply_to_this_email_if_you_didnt_request_this: このリクエストを行っていない場合は、このメールに返信してください。
 
 en-US:
   <<: *en

config/routes.rb

@@ -133,6 +133,7 @@ Rails.application.routes.draw do
   end
 
   resource :resubmit_form, controller: 'start_form', only: :update
+  resources :start_form_email_2fa_send, only: :create
 
   resources :submit_form, only: %i[], path: '' do
     get :success, on: :collection
@@ -179,6 +180,11 @@ Rails.application.routes.draw do
     resources :api, only: %i[index create], controller: 'api_settings'
     resources :webhooks, only: %i[index show new create update destroy], controller: 'webhook_settings' do
       post :resend
+
+      resources :events, only: %i[show], controller: 'webhook_events' do
+        post :resend, on: :member
+        post :refresh, on: :member
+      end
     end
     resource :account, only: %i[show update destroy]
     resources :profile, only: %i[index] do

db/migrate/20250627130628_create_webhook_events_and_attempts.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+class CreateWebhookEventsAndAttempts < ActiveRecord::Migration[8.0]
+  def change
+    create_table :webhook_events do |t|
+      t.string :uuid, null: false
+      t.bigint :webhook_url_id, null: false
+      t.bigint :account_id, null: false
+      t.bigint :record_id, null: false
+      t.string :record_type, null: false
+      t.string :event_type, null: false
+      t.string :status, null: false
+
+      t.index %i[uuid webhook_url_id], unique: true
+      t.index %i[webhook_url_id id]
+      t.index %i[webhook_url_id id], where: "status = 'error'", name: 'index_webhook_events_error'
+
+      t.timestamps
+    end
+
+    create_table :webhook_attempts do |t|
+      t.bigint :webhook_event_id, null: false, index: true
+      t.text :response_body
+      t.integer :response_status_code, null: false
+      t.integer :attempt, null: false
+
+      t.timestamps
+    end
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2025_06_18_085322) do
+ActiveRecord::Schema[8.0].define(version: 2025_06_27_130628) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "btree_gin"
   enable_extension "plpgsql"
@@ -437,6 +437,31 @@ ActiveRecord::Schema[8.0].define(version: 2025_06_18_085322) do
     t.index ["uuid"], name: "index_users_on_uuid", unique: true
   end
 
+  create_table "webhook_attempts", force: :cascade do |t|
+    t.bigint "webhook_event_id", null: false
+    t.text "response_body"
+    t.integer "response_status_code", null: false
+    t.integer "attempt", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["webhook_event_id"], name: "index_webhook_attempts_on_webhook_event_id"
+  end
+
+  create_table "webhook_events", force: :cascade do |t|
+    t.string "uuid", null: false
+    t.bigint "webhook_url_id", null: false
+    t.bigint "account_id", null: false
+    t.bigint "record_id", null: false
+    t.string "record_type", null: false
+    t.string "event_type", null: false
+    t.string "status", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["uuid", "webhook_url_id"], name: "index_webhook_events_on_uuid_and_webhook_url_id", unique: true
+    t.index ["webhook_url_id", "id"], name: "index_webhook_events_error", where: "((status)::text = 'error'::text)"
+    t.index ["webhook_url_id", "id"], name: "index_webhook_events_on_webhook_url_id_and_id"
+  end
+
   create_table "webhook_urls", force: :cascade do |t|
     t.bigint "account_id", null: false
     t.text "url", null: false

lib/abilities/template_conditions.rb

@@ -13,7 +13,7 @@ module Abilities
         TemplateSharing.where({ ability:, account_id: [user.account_id, TemplateSharing::ALL_ID] }.compact)
                        .select(:template_id)
 
-      Template.where(Template.arel_table[:id].in(templates.select(:id).arel.union(shared_ids.arel)))
+      Template.where(Template.arel_table[:id].in(templates.select(:id).arel.union(:all, shared_ids.arel)))
     end
 
     def entity(template, user:, ability: nil)

lib/docuseal.rb

@@ -88,6 +88,10 @@ module Docuseal
     true
   end
 
+  def pdf_format
+    @pdf_format ||= ENV['PDF_FORMAT'].to_s.downcase
+  end
+
   def trusted_certs
     @trusted_certs ||=
       ENV['TRUSTED_CERTS'].to_s.gsub('\\n', "\n").split("\n\n").map do |base64|

lib/email_verification_codes.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module EmailVerificationCodes
+  DRIFT_BEHIND = 5.minutes
+
+  module_function
+
+  def generate(value)
+    totp = ROTP::TOTP.new(build_totp_secret(value))
+
+    totp.at(Time.current)
+  end
+
+  def verify(code, value)
+    totp = ROTP::TOTP.new(build_totp_secret(value))
+
+    totp.verify(code, drift_behind: DRIFT_BEHIND)
+  end
+
+  def build_totp_secret(value)
+    ROTP::Base32.encode(
+      Digest::SHA1.digest(
+        [Rails.application.secret_key_base, value].join(':')
+      )
+    )
+  end
+end

lib/highlight_code.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module HighlightCode
+  module_function
+
+  def call(code, lexer, theme: 'base16.light')
+    require 'rouge/themes/base16' unless Rouge::Theme.registry[theme]
+
+    formatter = Rouge::Formatters::HTMLInline.new(theme)
+    lexer = Rouge::Lexers.const_get(lexer.to_sym).new
+    formatted_code = formatter.format(lexer.lex(code))
+    formatted_code = formatted_code.gsub('background-color: #181818', '') if theme == 'base16.dark'
+    formatted_code
+  end
+end

lib/image_utils.rb

@@ -4,8 +4,10 @@ module ImageUtils
   module_function
 
   def blank?(image)
-    min = (0...image.bands).map { |i| image.stats.getpoint(0, i)[0] }
-    max = (0...image.bands).map { |i| image.stats.getpoint(1, i)[0] }
+    stats = image.stats
+
+    min = (0...image.bands).map { |i| stats.getpoint(0, i)[0] }
+    max = (0...image.bands).map { |i| stats.getpoint(1, i)[0] }
 
     return true if min.all?(255) && max.all?(255)
     return true if min.all?(0) && max.all?(0)

lib/pdf_utils.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 module PdfUtils
+  DEFAULT_DPI = 72
+  US_LETTER_W = DEFAULT_DPI * 8.5
+
   module_function
 
   def encrypted?(data, password: nil)

lib/search_entries.rb

@@ -56,7 +56,7 @@ module SearchEntries
         end
 
       [sql, number, number.length > 1 ? number.delete_prefix('0') : number, keyword]
-    elsif keyword.match?(/[^\p{L}\d&@.\-]/) || keyword.match?(/\A['"].*['"]\z/)
+    elsif keyword.match?(/[^\p{L}\d&@.\-]/) || keyword.match?(/\A['"].*['"]\z/) || keyword.match?(/[.\-]{2,}/)
       ['tsvector @@ plainto_tsquery(?)', TextUtils.transliterate(keyword.downcase)]
     else
       keyword = TextUtils.transliterate(keyword.downcase).squish
@@ -132,12 +132,14 @@ module SearchEntries
     return if submitter.email.blank? && submitter.phone.blank? && submitter.name.blank?
 
     email_phone_name = [
-      [submitter.email.to_s, submitter.email.to_s.split('@').last].join(' ').delete("\0"),
-      [submitter.phone.to_s.gsub(/\D/, ''),
-       submitter.phone.to_s.gsub(PhoneCodes::REGEXP, '').gsub(/\D/, '')].uniq.join(' ').delete("\0"),
+      submitter.email.to_s.then { |e| [e, e.split('@').last] }.join(' ').delete("\0"),
+      submitter.phone.to_s.then { |e| [e.gsub(/\D/, ''), e.gsub(PhoneCodes::REGEXP, '').gsub(/\D/, '')] }
+               .uniq.join(' ').delete("\0"),
       TextUtils.transliterate(submitter.name).delete("\0")
     ]
 
+    values_string = build_submitter_values_string(submitter)
+
     sql = SearchEntry.sanitize_sql_array(
       [
         "SELECT setweight(to_tsvector(?), 'A') || setweight(to_tsvector(?), 'B') ||
@@ -145,9 +147,7 @@ module SearchEntries
                 setweight(to_tsvector('simple', ?), 'A') ||
                 setweight(to_tsvector('simple', ?), 'B') ||
                 setweight(to_tsvector('simple', ?), 'C') as ngram".squish,
-        *email_phone_name,
-        build_submitter_values_string(submitter),
-        *email_phone_name
+        *email_phone_name, values_string, *email_phone_name
       ]
     )
 
@@ -155,6 +155,9 @@ module SearchEntries
 
     entry.account_id = submitter.account_id
     entry.tsvector, ngram = SearchEntry.connection.select_rows(sql).first
+
+    add_hyphens(entry, values_string)
+
     entry.ngram = build_ngram(ngram)
 
     return if entry.tsvector.blank?
@@ -189,11 +192,7 @@ module SearchEntries
     entry.account_id = template.account_id
     entry.tsvector, ngram = SearchEntry.connection.select_rows(sql).first
 
-    hyphens = text.scan(/\b[^\s]*?\d-[^\s]+?\b/) + text.scan(/\b[^\s]+-\d[^\s]*?\b/)
-
-    hyphens.uniq.each_with_index do |item, index|
-      entry.tsvector += " '#{item.delete("'")}':#{index + 1}" unless entry.tsvector.include?(item)
-    end
+    add_hyphens(entry, text)
 
     entry.ngram = build_ngram(ngram)
 
@@ -220,11 +219,7 @@ module SearchEntries
     entry.account_id = submission.account_id
     entry.tsvector, ngram = SearchEntry.connection.select_rows(sql).first
 
-    hyphens = text.scan(/\b[^\s]*?\d-[^\s]+?\b/) + text.scan(/\b[^\s]+-\d[^\s]*?\b/)
-
-    hyphens.uniq.each_with_index do |item, index|
-      entry.tsvector += " '#{item.delete("'")}':#{index + 1}" unless entry.tsvector.include?(item)
-    end
+    add_hyphens(entry, text)
 
     entry.ngram = build_ngram(ngram)
 
@@ -239,6 +234,16 @@ module SearchEntries
     retry
   end
 
+  def add_hyphens(entry, text)
+    hyphens = text.scan(/\b[^\s]*?\d-[^\s]+?\b/) + text.scan(/\b[^\s]+-\d[^\s]*?\b/)
+
+    hyphens.uniq.each_with_index do |item, index|
+      entry.tsvector += " '#{item.delete("'")}':#{index + 1}" unless entry.tsvector.include?(item)
+    end
+
+    entry
+  end
+
   def build_ngram(ngram)
     ngrams =
       ngram.split(/\s(?=')/).each_with_object([]) do |item, acc|

lib/send_webhook_request.rb

@@ -5,12 +5,16 @@ module SendWebhookRequest
 
   LOCALHOSTS = %w[0.0.0.0 127.0.0.1 localhost].freeze
 
+  MANUAL_ATTEMPT = 99_999
+  AUTOMATED_RETRY_RANGE = 1..MANUAL_ATTEMPT - 1
+
   HttpsError = Class.new(StandardError)
   LocalhostError = Class.new(StandardError)
 
   module_function
 
-  def call(webhook_url, event_type:, data:)
+  # rubocop:disable Metrics/AbcSize
+  def call(webhook_url, event_uuid:, event_type:, record:, data:, attempt: 0)
     uri = begin
       URI(webhook_url.url)
     rescue URI::Error
@@ -24,21 +28,81 @@ module SendWebhookRequest
       raise LocalhostError, "Can't send to localhost." if uri.host.in?(LOCALHOSTS)
     end
 
-    Faraday.post(uri) do |req|
+    webhook_event = create_webhook_event(webhook_url, event_uuid:, event_type:, record:)
+
+    return if AUTOMATED_RETRY_RANGE.cover?(attempt.to_i) && webhook_event&.status == 'success'
+
+    response = Faraday.post(uri) do |req|
       req.headers['Content-Type'] = 'application/json'
       req.headers['User-Agent'] = USER_AGENT
       req.headers.merge!(webhook_url.secret.to_h) if webhook_url.secret.present?
 
       req.body = {
         event_type: event_type,
-        timestamp: Time.current,
+        timestamp: webhook_event&.created_at || Time.current,
         data: data
       }.to_json
 
       req.options.read_timeout = 8
       req.options.open_timeout = 8
     end
-  rescue Faraday::Error
+
+    handle_response(webhook_event, response:, attempt:)
+  rescue Faraday::SSLError, Faraday::TimeoutError, Faraday::ConnectionFailed => e
+    handle_error(webhook_event, attempt:, error_message: e.class.name.split('::').last)
+  rescue Faraday::Error => e
+    handle_error(webhook_event, attempt:, error_message: e.message&.truncate(100))
+  end
+  # rubocop:enable Metrics/AbcSize
+
+  def create_webhook_event(webhook_url, event_uuid:, event_type:, record:)
+    return if event_uuid.blank?
+
+    WebhookEvent.create_with(
+      event_type:,
+      record:,
+      account_id: webhook_url.account_id,
+      status: 'pending'
+    ).find_or_create_by!(webhook_url:, uuid: event_uuid)
+  end
+
+  def handle_response(webhook_event, response:, attempt:)
+    return response unless webhook_event
+
+    is_error = response.status.to_i >= 400
+
+    WebhookAttempt.create!(
+      webhook_event:,
+      response_body: is_error ? response.body&.truncate(100) : nil,
+      response_status_code: response.status,
+      attempt:
+    )
+
+    webhook_event.update!(status: is_error ? 'error' : 'success')
+
+    response
+  rescue StandardError
+    raise if Rails.env.local?
+
+    nil
+  end
+
+  def handle_error(webhook_event, error_message:, attempt:)
+    return unless webhook_event
+
+    WebhookAttempt.create!(
+      webhook_event:,
+      response_body: error_message,
+      response_status_code: 0,
+      attempt:
+    )
+
+    webhook_event.update!(status: 'error')
+
+    nil
+  rescue StandardError
+    raise if Rails.env.local?
+
     nil
   end
 end