Merge from docusealco/wip

.github/workflows/docker.yml

@@ -1,13 +1,26 @@
 name: Build Docker Images
 
 on:
-  push:
+  workflow_dispatch:
-    tags:
+    inputs:
-      - "*.*.*"
+      version:
+        description: Version
+        type: string
+        required: true
+      image:
+        description: QEMU image
+        type: string
+        required: false
+        default: tonistiigi/binfmt:latest
+      os:
+        description: OS
+        type: string
+        required: false
+        default: ubuntu-24.04-arm
 
 jobs:
   build:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ${{ inputs.os }}
     timeout-minutes: 20
 
     steps:
@@ -16,23 +29,23 @@ jobs:
       with:
         submodules: recursive
 
-    -
+    - name: Docker meta
-      name: Docker meta
       id: meta
       uses: docker/metadata-action@v4
       with:
-        images: |
+        images: docuseal/docuseal
-          docuseal/docuseal
+        tags: latest,${{ inputs.version }}
-        tags: |
+
-          type=semver,pattern={{version}}
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
+      with:
+        image: ${{ inputs.image }}
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
     - name: Create .version file
-      run: echo ${{ github.ref_name }} > .version
+      run: echo ${{ inputs.version }} > .version
 
     - name: Login to Docker Hub
       uses: docker/login-action@v3

.rubocop.yml

@@ -68,6 +68,9 @@ RSpec/ExampleLength:
 RSpec/MultipleMemoizedHelpers:
   Max: 15
 
+RSpec/AnyInstance:
+  Enabled: false
+
 Metrics/BlockNesting:
   Max: 5
 

Dockerfile

@@ -50,7 +50,7 @@ ENV OPENSSL_CONF=/app/openssl_legacy.cnf
 
 WORKDIR /app
 
-RUN echo '@edge https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories && apk add --no-cache sqlite-dev libpq-dev mariadb-dev vips-dev@edge redis libheif@edge vips-heif@edge gcompat ttf-freefont && mkdir /fonts && rm /usr/share/fonts/freefont/FreeSans.otf
+RUN echo '@edge https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories && apk add --no-cache sqlite-dev libpq-dev mariadb-dev vips-dev@edge yaml-dev redis libheif@edge vips-heif@edge gcompat ttf-freefont && mkdir /fonts && rm /usr/share/fonts/freefont/FreeSans.otf
 
 RUN echo $'.include = /etc/ssl/openssl.cnf\n\
 \n\

Gemfile

@@ -11,6 +11,7 @@ gem 'azure-storage-blob', require: false
 gem 'bootsnap', require: false
 gem 'cancancan'
 gem 'csv'
+gem 'csv-safe'
 gem 'devise'
 gem 'devise-two-factor'
 gem 'dotenv', require: false

Gemfile.lock

@@ -1,29 +1,29 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (8.0.1)
+    actioncable (8.0.2.1)
-      actionpack (= 8.0.1)
+      actionpack (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (8.0.1)
+    actionmailbox (8.0.2.1)
-      actionpack (= 8.0.1)
+      actionpack (= 8.0.2.1)
-      activejob (= 8.0.1)
+      activejob (= 8.0.2.1)
-      activerecord (= 8.0.1)
+      activerecord (= 8.0.2.1)
-      activestorage (= 8.0.1)
+      activestorage (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       mail (>= 2.8.0)
-    actionmailer (8.0.1)
+    actionmailer (8.0.2.1)
-      actionpack (= 8.0.1)
+      actionpack (= 8.0.2.1)
-      actionview (= 8.0.1)
+      actionview (= 8.0.2.1)
-      activejob (= 8.0.1)
+      activejob (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (8.0.1)
+    actionpack (8.0.2.1)
-      actionview (= 8.0.1)
+      actionview (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       nokogiri (>= 1.8.5)
       rack (>= 2.2.4)
       rack-session (>= 1.0.1)
@@ -31,35 +31,35 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (8.0.1)
+    actiontext (8.0.2.1)
-      actionpack (= 8.0.1)
+      actionpack (= 8.0.2.1)
-      activerecord (= 8.0.1)
+      activerecord (= 8.0.2.1)
-      activestorage (= 8.0.1)
+      activestorage (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (8.0.1)
+    actionview (8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (8.0.1)
+    activejob (8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       globalid (>= 0.3.6)
-    activemodel (8.0.1)
+    activemodel (8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
-    activerecord (8.0.1)
+    activerecord (8.0.2.1)
-      activemodel (= 8.0.1)
+      activemodel (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       timeout (>= 0.4.0)
-    activestorage (8.0.1)
+    activestorage (8.0.2.1)
-      actionpack (= 8.0.1)
+      actionpack (= 8.0.2.1)
-      activejob (= 8.0.1)
+      activejob (= 8.0.2.1)
-      activerecord (= 8.0.1)
+      activerecord (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       marcel (~> 1.0)
-    activesupport (8.0.1)
+    activesupport (8.0.2.1)
       base64
       benchmark (>= 0.3)
       bigdecimal
@@ -104,9 +104,9 @@ GEM
       faraday_middleware (~> 1.0, >= 1.0.0.rc1)
       net-http-persistent (~> 4.0)
       nokogiri (~> 1, >= 1.10.8)
-    base64 (0.2.0)
+    base64 (0.3.0)
     bcrypt (3.1.20)
-    benchmark (0.4.0)
+    benchmark (0.4.1)
     better_html (2.1.1)
       actionview (>= 6.0)
       activesupport (>= 6.0)
@@ -114,7 +114,7 @@ GEM
       erubi (~> 1.4)
       parser (>= 2.4)
       smart_properties
-    bigdecimal (3.1.8)
+    bigdecimal (3.2.2)
     bindex (0.8.1)
     bootsnap (1.18.4)
       msgpack (~> 1.2)
@@ -141,8 +141,8 @@ GEM
     cldr-plurals-runtime-rb (1.1.0)
     cmdparse (3.0.7)
     coderay (1.1.3)
-    concurrent-ruby (1.3.4)
+    concurrent-ruby (1.3.5)
-    connection_pool (2.4.1)
+    connection_pool (2.5.3)
     crack (1.0.0)
       bigdecimal
       rexml
@@ -150,6 +150,8 @@ GEM
     css_parser (1.21.0)
       addressable
     csv (3.3.2)
+    csv-safe (3.3.1)
+      csv (~> 3.0)
     cuprite (0.15.1)
       capybara (~> 3.0)
       ferrum (~> 0.15.0)
@@ -174,8 +176,9 @@ GEM
       rake (>= 12.0.0, < 14.0.0)
     docile (1.4.1)
     dotenv (3.1.7)
-    drb (2.2.1)
+    drb (2.2.3)
     email_typo (0.2.3)
+    erb (5.0.2)
     erb_lint (0.7.0)
       activesupport
       better_html (>= 2.0.1)
@@ -270,23 +273,25 @@ GEM
       os (>= 0.9, < 2.0)
       signet (>= 0.16, < 2.a)
     hashdiff (1.1.2)
-    hexapdf (1.0.3)
+    hexapdf (1.4.0)
       cmdparse (~> 3.0, >= 3.0.3)
       geom2d (~> 0.4, >= 0.4.1)
       openssl (>= 2.2.1)
+      strscan (>= 3.1.2)
     htmlentities (4.3.4)
     httpclient (2.8.3)
-    i18n (1.14.6)
+    i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     image_processing (1.13.0)
       mini_magick (>= 4.9.5, < 5)
       ruby-vips (>= 2.0.17, < 3)
-    io-console (0.8.0)
+    io-console (0.8.1)
-    irb (1.14.3)
+    irb (1.15.2)
+      pp (>= 0.6.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     jmespath (1.6.2)
-    json (2.9.1)
+    json (2.13.2)
     jwt (2.9.3)
       base64
     language_server-protocol (3.17.0.3)
@@ -300,13 +305,13 @@ GEM
       letter_opener (~> 1.9)
       railties (>= 6.1)
       rexml
-    logger (1.6.4)
+    logger (1.7.0)
     lograge (0.14.0)
       actionpack (>= 4)
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.23.1)
+    loofah (2.24.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.8.1)
@@ -319,8 +324,8 @@ GEM
     method_source (1.1.0)
     mini_magick (4.13.2)
     mini_mime (1.1.5)
-    mini_portile2 (2.8.8)
+    mini_portile2 (2.8.9)
-    minitest (5.25.4)
+    minitest (5.25.5)
     msgpack (1.7.5)
     multi_json (1.15.0)
     multipart-post (2.4.1)
@@ -328,36 +333,36 @@ GEM
     mysql2 (0.5.6)
     net-http-persistent (4.0.5)
       connection_pool (~> 2.2)
-    net-imap (0.5.6)
+    net-imap (0.5.9)
       date
       net-protocol
     net-pop (0.1.2)
       net-protocol
     net-protocol (0.2.2)
       timeout
-    net-smtp (0.5.0)
+    net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.4)
-    nokogiri (1.18.8)
+    nokogiri (1.18.9)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.18.8-aarch64-linux-gnu)
+    nokogiri (1.18.9-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.18.8-aarch64-linux-musl)
+    nokogiri (1.18.9-aarch64-linux-musl)
       racc (~> 1.4)
-    nokogiri (1.18.8-arm64-darwin)
+    nokogiri (1.18.9-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.18.8-x86_64-linux-gnu)
+    nokogiri (1.18.9-x86_64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.18.8-x86_64-linux-musl)
+    nokogiri (1.18.9-x86_64-linux-musl)
       racc (~> 1.4)
-    oj (3.16.8)
+    oj (3.16.11)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
     openssl (3.3.0)
     orm_adapter (0.5.0)
     os (1.1.4)
-    ostruct (0.6.1)
+    ostruct (0.6.3)
     package_json (0.1.0)
     pagy (9.3.3)
     parallel (1.26.3)
@@ -365,6 +370,8 @@ GEM
       ast (~> 2.4.1)
       racc
     pg (1.5.9)
+    pp (0.6.2)
+      prettyprint
     premailer (1.27.0)
       addressable
       css_parser (>= 1.19.0)
@@ -375,42 +382,44 @@ GEM
       premailer (~> 1.7, >= 1.7.9)
     pretender (0.5.0)
       actionpack (>= 6.1)
+    prettyprint (0.2.0)
     pry (0.15.0)
       coderay (~> 1.1)
       method_source (~> 1.0)
     pry-rails (0.3.11)
       pry (>= 0.13.0)
-    psych (5.2.2)
+    psych (5.2.6)
       date
       stringio
     public_suffix (6.0.1)
     puma (6.5.0)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.1.16)
+    rack (3.2.0)
     rack-proxy (0.7.7)
       rack
-    rack-session (2.0.0)
+    rack-session (2.1.1)
+      base64 (>= 0.1.0)
       rack (>= 3.0.0)
-    rack-test (2.1.0)
+    rack-test (2.2.0)
       rack (>= 1.3)
     rackup (2.2.1)
       rack (>= 3)
-    rails (8.0.1)
+    rails (8.0.2.1)
-      actioncable (= 8.0.1)
+      actioncable (= 8.0.2.1)
-      actionmailbox (= 8.0.1)
+      actionmailbox (= 8.0.2.1)
-      actionmailer (= 8.0.1)
+      actionmailer (= 8.0.2.1)
-      actionpack (= 8.0.1)
+      actionpack (= 8.0.2.1)
-      actiontext (= 8.0.1)
+      actiontext (= 8.0.2.1)
-      actionview (= 8.0.1)
+      actionview (= 8.0.2.1)
-      activejob (= 8.0.1)
+      activejob (= 8.0.2.1)
-      activemodel (= 8.0.1)
+      activemodel (= 8.0.2.1)
-      activerecord (= 8.0.1)
+      activerecord (= 8.0.2.1)
-      activestorage (= 8.0.1)
+      activestorage (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       bundler (>= 1.15.0)
-      railties (= 8.0.1)
+      railties (= 8.0.2.1)
-    rails-dom-testing (2.2.0)
+    rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
@@ -424,22 +433,23 @@ GEM
       actionview (> 3.1)
       activesupport (> 3.1)
       railties (> 3.1)
-    railties (8.0.1)
+    railties (8.0.2.1)
-      actionpack (= 8.0.1)
+      actionpack (= 8.0.2.1)
-      activesupport (= 8.0.1)
+      activesupport (= 8.0.2.1)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
       thor (~> 1.0, >= 1.2.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.2.1)
+    rake (13.3.0)
-    rdoc (6.10.0)
+    rdoc (6.14.2)
+      erb
       psych (>= 4.0.0)
     redis-client (0.23.0)
       connection_pool
     regexp_parser (2.9.3)
-    reline (0.6.0)
+    reline (0.6.2)
       io-console (~> 0.5)
     representable (3.2.0)
       declarative (< 0.1.0)
@@ -451,7 +461,7 @@ GEM
       actionpack (>= 5.2)
       railties (>= 5.2)
     retriable (3.1.2)
-    rexml (3.4.0)
+    rexml (3.4.4)
     rotp (6.3.0)
     rouge (4.5.2)
     rqrcode (2.2.0)
@@ -538,10 +548,11 @@ GEM
     sqlite3 (2.5.0-arm64-darwin)
     sqlite3 (2.5.0-x86_64-linux-gnu)
     sqlite3 (2.5.0-x86_64-linux-musl)
-    stringio (3.1.2)
+    stringio (3.1.7)
     strip_attributes (1.14.1)
       activemodel (>= 3.0, < 9.0)
-    thor (1.3.2)
+    strscan (3.1.5)
+    thor (1.4.0)
     timeout (0.4.3)
     trailblazer-option (0.1.2)
     turbo-rails (2.0.11)
@@ -574,12 +585,13 @@ GEM
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.9.1)
-    websocket-driver (0.7.6)
+    websocket-driver (0.8.0)
+      base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.7.1)
+    zeitwerk (2.7.3)
 
 PLATFORMS
   aarch64-linux
@@ -602,6 +614,7 @@ DEPENDENCIES
   cancancan
   capybara
   csv
+  csv-safe
   cuprite
   debug
   devise

app/controllers/account_configs_controller.rb

@@ -15,6 +15,7 @@ class AccountConfigsController < ApplicationController
     AccountConfig::ESIGNING_PREFERENCE_KEY,
     AccountConfig::FORM_WITH_CONFETTI_KEY,
     AccountConfig::DOWNLOAD_LINKS_AUTH_KEY,
+    AccountConfig::DOWNLOAD_LINKS_EXPIRE_KEY,
     AccountConfig::FORCE_SSO_AUTH_KEY,
     AccountConfig::FLATTEN_RESULT_PDF_KEY,
     AccountConfig::ENFORCE_SIGNING_ORDER_KEY,

app/controllers/accounts_controller.rb

@@ -27,7 +27,7 @@ class AccountsController < ApplicationController
       unless URI.parse(@encrypted_config.value.to_s).class.in?([URI::HTTP, URI::HTTPS])
         @encrypted_config.errors.add(:value, I18n.t('should_be_a_valid_url'))
 
-        return render :show, status: :unprocessable_entity
+        return render :show, status: :unprocessable_content
       end
 
       @encrypted_config.save!
@@ -39,7 +39,7 @@ class AccountsController < ApplicationController
       redirect_to settings_account_path, notice: I18n.t('account_information_has_been_updated')
     end
   rescue ActiveRecord::RecordInvalid
-    render :show, status: :unprocessable_entity
+    render :show, status: :unprocessable_content
   end
 
   def destroy

app/controllers/api/active_storage_blobs_proxy_controller.rb

@@ -13,7 +13,7 @@ module Api
     def show
       blob_uuid, purp, exp = ApplicationRecord.signed_id_verifier.verified(params[:signed_uuid])
 
-      if blob_uuid.blank? || (purp.present? && purp != 'blob') || (exp && exp < Time.current.to_i)
+      if blob_uuid.blank? || purp != 'blob'
         Rollbar.error('Blob not found') if defined?(Rollbar)
 
         return head :not_found
@@ -24,8 +24,9 @@ module Api
       attachment = blob.attachments.take
 
       @record = attachment.record
+      @record = @record.record if @record.is_a?(ActiveStorage::Attachment)
 
-      authorization_check!(attachment) if exp.blank?
+      authorization_check!(attachment, @record, exp)
 
       if request.headers['Range'].present?
         send_blob_byte_range_data blob, request.headers['Range']
@@ -41,16 +42,22 @@ module Api
 
     private
 
-    def authorization_check!(attachment)
+    def authorization_check!(attachment, record, exp)
-      is_authorized = attachment.name.in?(%w[logo preview_images]) ||
+      return if attachment.name == 'logo'
-                      (current_user && attachment.record.account.id == current_user.account_id) ||
+      return if exp.to_i >= Time.current.to_i
-                      (current_user && !Docuseal.multitenant? && current_user.role == 'superadmin') ||
+      return if current_user && current_ability.can?(:read, record)
-                      !attachment.record.account.account_configs
-                                 .find_or_initialize_by(key: AccountConfig::DOWNLOAD_LINKS_AUTH_KEY).value
 
-      return if is_authorized
+      if exp.blank?
+        configs = record.account.account_configs.where(key: [AccountConfig::DOWNLOAD_LINKS_AUTH_KEY,
+                                                             AccountConfig::DOWNLOAD_LINKS_EXPIRE_KEY])
 
-      Rollbar.error('Blob aunauthorized') if defined?(Rollbar)
+        require_auth = configs.any? { |c| c.key == AccountConfig::DOWNLOAD_LINKS_AUTH_KEY && c.value }
+        require_ttl = configs.none? { |c| c.key == AccountConfig::DOWNLOAD_LINKS_EXPIRE_KEY && c.value == false }
+
+        return if !require_ttl && !require_auth
+      end
+
+      Rollbar.error('Blob unauthorized') if defined?(Rollbar)
 
       raise CanCan::AccessDenied
     end

app/controllers/api/api_base_controller.rb

@@ -16,7 +16,7 @@ module Api
     check_authorization
 
     rescue_from Params::BaseValidator::InvalidParameterError do |e|
-      render json: { error: e.message }, status: :unprocessable_entity
+      render json: { error: e.message }, status: :unprocessable_content
     end
 
     rescue_from RateLimit::LimitApproached do |e|
@@ -33,7 +33,7 @@ module Api
       rescue_from JSON::ParserError do |e|
         Rollbar.warning(e) if defined?(Rollbar)
 
-        render json: { error: "JSON parse error: #{e.message}" }, status: :unprocessable_entity
+        render json: { error: "JSON parse error: #{e.message}" }, status: :unprocessable_content
       end
     end
 

app/controllers/api/attachments_controller.rb

@@ -10,10 +10,21 @@ module Api
     def create
       submitter = Submitter.find_by!(slug: params[:submitter_slug])
 
-      if params[:type].in?(%w[initials signature]) && ImageUtils.blank?(Vips::Image.new_from_file(params[:file].path))
+      if params[:type].in?(%w[initials signature])
-        Rollbar.error("Empty signature: #{submitter.id}") if defined?(Rollbar)
+        image = Vips::Image.new_from_file(params[:file].path)
 
-        return render json: { error: "#{params[:type]} is empty" }, status: :unprocessable_entity
+        if ImageUtils.blank?(image)
+          Rollbar.error("Empty signature: #{submitter.id}") if defined?(Rollbar)
+
+          return render json: { error: "#{params[:type]} is empty" }, status: :unprocessable_content
+        end
+
+        if ImageUtils.error?(image)
+          Rollbar.error("Error signature: #{submitter.id}") if defined?(Rollbar)
+
+          return render json: { error: "#{params[:type]} error, try to sign on another device" },
+                        status: :unprocessable_content
+        end
       end
 
       attachment = Submitters.create_attachment!(submitter, params)

app/controllers/api/form_events_controller.rb

@@ -11,18 +11,21 @@ module Api
       params[:before] = Time.zone.at(params[:before].to_i) if params[:before].present?
 
       submitters = paginate(
-        submitters.preload(template: :folder, submission: [:submitters, { audit_trail_attachment: :blob,
+        submitters.preload(template: { folder: :parent_folder },
-                                                                          combined_document_attachment: :blob }],
+                           submission: [:submitters, { audit_trail_attachment: :blob,
+                                                       combined_document_attachment: :blob }],
                            documents_attachments: :blob, attachments_attachments: :blob),
         field: :completed_at
       )
 
+      expires_at = Accounts.link_expires_at(current_account)
+
       render json: {
         data: submitters.map do |s|
                 {
                   event_type: 'form.completed',
                   timestamp: s.completed_at,
-                  data: Submitters::SerializeForWebhook.call(s)
+                  data: Submitters::SerializeForWebhook.call(s, expires_at:)
                 }
               end,
         pagination: {

app/controllers/api/submission_documents_controller.rb

@@ -34,10 +34,12 @@ module Api
         associations: [:blob]
       ).call
 
+      expires_at = Accounts.link_expires_at(current_account)
+
       render json: {
         id: @submission.id,
         documents: documents.map do |attachment|
-          { name: attachment.filename.base, url: ActiveStorage::Blob.proxy_url(attachment.blob) }
+          { name: attachment.filename.base, url: ActiveStorage::Blob.proxy_url(attachment.blob, expires_at:) }
         end
       }
     end

app/controllers/api/submission_events_controller.rb

@@ -14,16 +14,19 @@ module Api
                                :created_by_user, :submission_events,
                                template: :folder,
                                submitters: { documents_attachments: :blob, attachments_attachments: :blob },
-                               audit_trail_attachment: :blob
+                               audit_trail_attachment: :blob,
+                               combined_document_attachment: :blob
                              ),
                              field: :completed_at)
 
+      expires_at = Accounts.link_expires_at(current_account)
+
       render json: {
         data: submissions.map do |s|
                 {
                   event_type: 'submission.completed',
                   timestamp: s.completed_at,
-                  data: Submissions::SerializeForApi.call(s, s.submitters)
+                  data: Submissions::SerializeForApi.call(s, s.submitters, expires_at:)
                 }
               end,
         pagination: {

app/controllers/api/submissions_controller.rb

@@ -14,14 +14,16 @@ module Api
       submissions = filter_submissions(submissions, params)
 
       submissions = paginate(submissions.preload(:created_by_user, :submitters,
-                                                 template: :folder,
+                                                 template: { folder: :parent_folder },
                                                  combined_document_attachment: :blob,
                                                  audit_trail_attachment: :blob))
 
+      expires_at = Accounts.link_expires_at(current_account)
+
       render json: {
         data: submissions.map do |s|
           Submissions::SerializeForApi.call(s, s.submitters, params,
-                                            with_events: false, with_documents: false, with_values: false)
+                                            with_events: false, with_documents: false, with_values: false, expires_at:)
         end,
         pagination: {
           count: submissions.size,
@@ -41,7 +43,7 @@ module Api
       end
 
       if @submission.audit_trail_attachment.blank? && submitters.all?(&:completed_at?)
-        @submission.audit_trail_attachment = Submissions::GenerateAuditTrail.call(@submission)
+        @submission.audit_trail_attachment = Submissions::EnsureAuditGenerated.call(@submission)
       end
 
       render json: Submissions::SerializeForApi.call(@submission, submitters, params)
@@ -50,12 +52,12 @@ module Api
     def create
       Params::SubmissionCreateValidator.call(params)
 
-      return render json: { error: 'Template not found' }, status: :unprocessable_entity if @template.nil?
+      return render json: { error: 'Template not found' }, status: :unprocessable_content if @template.nil?
 
       if @template.fields.blank?
         Rollbar.warning("Template does not contain fields: #{@template.id}") if defined?(Rollbar)
 
-        return render json: { error: 'Template does not contain fields' }, status: :unprocessable_entity
+        return render json: { error: 'Template does not contain fields' }, status: :unprocessable_content
       end
 
       params[:send_email] = true unless params.key?(:send_email)
@@ -82,7 +84,7 @@ module Api
            DownloadUtils::UnableToDownload => e
       Rollbar.warning(e) if defined?(Rollbar)
 
-      render json: { error: e.message }, status: :unprocessable_entity
+      render json: { error: e.message }, status: :unprocessable_content
     end
 
     def destroy
@@ -104,9 +106,10 @@ module Api
       submissions = submissions.where(slug: params[:slug]) if params[:slug].present?
 
       if params[:template_folder].present?
-        folder_ids = TemplateFolder.accessible_by(current_ability).where(name: params[:template_folder]).pluck(:id)
+        folders =
+          TemplateFolders.filter_by_full_name(TemplateFolder.accessible_by(current_ability), params[:template_folder])
 
-        submissions = submissions.joins(:template).where(template: { folder_id: folder_ids })
+        submissions = submissions.joins(:template).where(template: { folder_id: folders.pluck(:id) })
       end
 
       if params.key?(:archived)
@@ -181,14 +184,15 @@ module Api
         :send_email, :send_sms, :bcc_completed, :completed_redirect_url, :reply_to, :go_to_last,
         :require_phone_2fa, :expire_at, :name,
         {
+          variables: {},
           message: %i[subject body],
           submitters: [[:send_email, :send_sms, :completed_redirect_url, :uuid, :name, :email, :role,
                         :completed, :phone, :application_key, :external_id, :reply_to, :go_to_last,
-                        :require_phone_2fa,
+                        :require_phone_2fa, :order,
                         { metadata: {}, values: {}, roles: [], readonly_fields: [], message: %i[subject body],
                           fields: [:name, :uuid, :default_value, :value, :title, :description,
                                    :readonly, :required, :validation_pattern, :invalid_message,
-                                   { default_value: [], value: [], preferences: {} }] }]]
+                                   { default_value: [], value: [], preferences: {}, validation: {} }] }]]
         }
       ]
 

app/controllers/api/submitters_controller.rb

@@ -14,9 +14,11 @@ module Api
                            documents_attachments: :blob, attachments_attachments: :blob)
       )
 
+      expires_at = Accounts.link_expires_at(current_account)
+
       render json: {
         data: submitters.map do |s|
-                Submitters::SerializeForApi.call(s, with_template: true, with_events: true, params:)
+                Submitters::SerializeForApi.call(s, with_template: true, with_events: true, params:, expires_at:)
               end,
         pagination: {
           count: submitters.size,
@@ -34,7 +36,7 @@ module Api
 
     def update
       if @submitter.completed_at?
-        return render json: { error: 'Submitter has already completed the submission.' }, status: :unprocessable_entity
+        return render json: { error: 'Submitter has already completed the submission.' }, status: :unprocessable_content
       end
 
       submission = @submitter.submission
@@ -74,7 +76,7 @@ module Api
     rescue Submitters::NormalizeValues::BaseError, DownloadUtils::UnableToDownload => e
       Rollbar.warning(e) if defined?(Rollbar)
 
-      render json: { error: e.message }, status: :unprocessable_entity
+      render json: { error: e.message }, status: :unprocessable_content
     end
 
     def submitter_params

app/controllers/api/templates_clone_controller.rb

@@ -26,13 +26,15 @@ module Api
                                                           original_template: @template,
                                                           documents: params[:documents])
 
+      Templates.maybe_assign_access(cloned_template)
+
       cloned_template.save!
 
       WebhookUrls.enqueue_events(cloned_template, 'template.created')
 
       SearchEntries.enqueue_reindex(cloned_template)
 
-      render json: Templates::SerializeForApi.call(cloned_template, schema_documents)
+      render json: Templates::SerializeForApi.call(cloned_template, schema_documents:)
     end
   end
 end

app/controllers/api/templates_controller.rb

@@ -7,7 +7,7 @@ module Api
     def index
       templates = filter_templates(@templates, params)
 
-      templates = paginate(templates.preload(:author, :folder))
+      templates = paginate(templates.preload(:author, folder: :parent_folder))
 
       schema_documents =
         ActiveStorage::Attachment.where(record_id: templates.map(&:id),
@@ -24,13 +24,14 @@ module Api
                                         name: :preview_images)
                                  .preload(:blob)
 
+      expires_at = Accounts.link_expires_at(current_account)
+
       render json: {
         data: templates.map do |t|
-          Templates::SerializeForApi.call(
+          Templates::SerializeForApi.call(t,
-            t,
+                                          schema_documents: schema_documents.select { |e| e.record_id == t.id },
-            schema_documents.select { |e| e.record_id == t.id },
+                                          preview_image_attachments:,
-            preview_image_attachments
+                                          expires_at:)
-          )
         end,
         pagination: {
           count: templates.size,
@@ -92,9 +93,9 @@ module Api
       templates = templates.where(slug: params[:slug]) if params[:slug].present?
 
       if params[:folder].present?
-        folder_ids = TemplateFolder.accessible_by(current_ability).where(name: params[:folder]).pluck(:id)
+        folders = TemplateFolders.filter_by_full_name(TemplateFolder.accessible_by(current_ability), params[:folder])
 
-        templates = templates.where(folder_id: folder_ids)
+        templates = templates.where(folder_id: folders.pluck(:id))
       end
 
       templates
@@ -106,14 +107,15 @@ module Api
         :external_id,
         :shared_link,
         {
-          submitters: [%i[name uuid is_requester invite_by_uuid optional_invite_by_uuid linked_to_uuid email]],
+          submitters: [%i[name uuid is_requester invite_by_uuid optional_invite_by_uuid linked_to_uuid email order]],
           fields: [[:uuid, :submitter_uuid, :name, :type,
                     :required, :readonly, :default_value,
-                    :title, :description,
+                    :title, :description, :prefillable,
                     { preferences: {},
+                      default_value: [],
                       conditions: [%i[field_uuid value action operation]],
                       options: [%i[value uuid]],
-                      validation: %i[message pattern],
+                      validation: %i[message pattern min max step],
                       areas: [%i[x y w h cell_w attachment_uuid option_uuid page]] }]]
         }
       ]

app/controllers/api/tools_controller.rb

@@ -7,8 +7,8 @@ module Api
     def merge
       files = params[:files] || []
 
-      return render json: { error: 'Files are required' }, status: :unprocessable_entity if files.blank?
+      return render json: { error: 'Files are required' }, status: :unprocessable_content if files.blank?
-      return render json: { error: 'At least 2 files are required' }, status: :unprocessable_entity if files.size < 2
+      return render json: { error: 'At least 2 files are required' }, status: :unprocessable_content if files.size < 2
 
       render json: {
         data: Base64.encode64(PdfUtils.merge(files.map { |base64| StringIO.new(Base64.decode64(base64)) }).string)
@@ -35,7 +35,7 @@ module Api
         end
       }
     rescue HexaPDF::MalformedPDFError
-      render json: { error: 'Malformed PDF' }, status: :unprocessable_entity
+      render json: { error: 'Malformed PDF' }, status: :unprocessable_content
     end
   end
 end

app/controllers/email_smtp_settings_controller.rb

@@ -15,12 +15,12 @@ class EmailSmtpSettingsController < ApplicationController
 
       redirect_to settings_email_index_path, notice: I18n.t('changes_have_been_saved')
     else
-      render :index, status: :unprocessable_entity
+      render :index, status: :unprocessable_content
     end
   rescue StandardError => e
     flash[:alert] = e.message
 
-    render :index, status: :unprocessable_entity
+    render :index, status: :unprocessable_content
   end
 
   private

app/controllers/esign_settings_controller.rb

@@ -53,7 +53,7 @@ class EsignSettingsController < ApplicationController
       @cert_record.errors.add(:name, I18n.t('already_exists'))
 
       return render turbo_stream: turbo_stream.replace(:modal, template: 'esign_settings/new'),
-                    status: :unprocessable_entity
+                    status: :unprocessable_content
     end
 
     save_new_cert!(@encrypted_config, @cert_record)
@@ -64,7 +64,7 @@ class EsignSettingsController < ApplicationController
 
     @cert_record.errors.add(:password, e.message)
 
-    render turbo_stream: turbo_stream.replace(:modal, template: 'esign_settings/new'), status: :unprocessable_entity
+    render turbo_stream: turbo_stream.replace(:modal, template: 'esign_settings/new'), status: :unprocessable_content
   end
 
   def update

app/controllers/mfa_setup_controller.rb

@@ -24,7 +24,7 @@ class MfaSetupController < ApplicationController
 
       @error_message = I18n.t('code_is_invalid')
 
-      render turbo_stream: turbo_stream.replace(:mfa_form, partial: 'mfa_setup/form'), status: :unprocessable_entity
+      render turbo_stream: turbo_stream.replace(:mfa_form, partial: 'mfa_setup/form'), status: :unprocessable_content
     end
   end
 
@@ -36,7 +36,7 @@ class MfaSetupController < ApplicationController
     else
       @error_message = I18n.t('code_is_invalid')
 
-      render turbo_stream: turbo_stream.replace(:modal, template: 'mfa_setup/edit'), status: :unprocessable_entity
+      render turbo_stream: turbo_stream.replace(:modal, template: 'mfa_setup/edit'), status: :unprocessable_content
     end
   end
 

app/controllers/passwords_controller.rb

@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 
 class PasswordsController < Devise::PasswordsController
+  # rubocop:disable Rails/LexicallyScopedActionFilter
+  skip_before_action :require_no_authentication, only: %i[edit update]
+  # rubocop:enable Rails/LexicallyScopedActionFilter
+
   class Current < ActiveSupport::CurrentAttributes
     attribute :user
   end
@@ -16,4 +20,10 @@ class PasswordsController < Devise::PasswordsController
       Current.user = resource
     end
   end
+
+  private
+
+  def after_resetting_password_path_for(_)
+    new_session_path(resource_name)
+  end
 end

app/controllers/profile_controller.rb

@@ -11,16 +11,16 @@ class ProfileController < ApplicationController
     if current_user.update(contact_params)
       redirect_to settings_profile_index_path, notice: I18n.t('contact_information_has_been_update')
     else
-      render :index, status: :unprocessable_entity
+      render :index, status: :unprocessable_content
     end
   end
 
   def update_password
-    if current_user.update(password_params)
+    if current_user.update_with_password(password_params)
       bypass_sign_in(current_user)
       redirect_to settings_profile_index_path, notice: I18n.t('password_has_been_changed')
     else
-      render :index, status: :unprocessable_entity
+      render :index, status: :unprocessable_content
     end
   end
 
@@ -31,6 +31,6 @@ class ProfileController < ApplicationController
   end
 
   def password_params
-    params.require(:user).permit(:password, :password_confirmation)
+    params.require(:user).permit(:password, :password_confirmation, :current_password)
   end
 end

app/controllers/reveal_access_token_controller.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class RevealAccessTokenController < ApplicationController
+  def show
+    authorize!(:manage, current_user.access_token)
+  end
+
+  def create
+    authorize!(:manage, current_user.access_token)
+
+    if current_user.valid_password?(params[:password])
+      render turbo_stream: turbo_stream.replace(:access_token_container,
+                                                partial: 'reveal_access_token/access_token',
+                                                locals: { token: current_user.access_token.token })
+    else
+      render turbo_stream: turbo_stream.replace(:modal, template: 'reveal_access_token/show',
+                                                        locals: { error_message: I18n.t('wrong_password') }),
+             status: :unprocessable_content
+    end
+  end
+end

app/controllers/sessions_controller.rb

@@ -16,7 +16,7 @@ class SessionsController < Devise::SessionsController
     end
 
     if User.exists?(email:, otp_required_for_login: true) && sign_in_params[:otp_attempt].blank?
-      return render :otp, locals: { resource: User.new(sign_in_params) }, status: :unprocessable_entity
+      return render :otp, locals: { resource: User.new(sign_in_params) }, status: :unprocessable_content
     end
 
     super

app/controllers/setup_controller.rb

@@ -23,10 +23,10 @@ class SetupController < ApplicationController
     unless URI.parse(encrypted_config_params[:value].to_s).class.in?([URI::HTTP, URI::HTTPS])
       @encrypted_config.errors.add(:value, I18n.t('should_be_a_valid_url'))
 
-      return render :index, status: :unprocessable_entity
+      return render :index, status: :unprocessable_content
     end
 
-    return render :index, status: :unprocessable_entity unless @account.valid?
+    return render :index, status: :unprocessable_content unless @account.valid?
 
     if @user.save
       encrypted_configs = [
@@ -42,7 +42,7 @@ class SetupController < ApplicationController
 
       redirect_to newsletter_path
     else
-      render :index, status: :unprocessable_entity
+      render :index, status: :unprocessable_content
     end
   end
 

app/controllers/start_form_controller.rb

@@ -42,7 +42,7 @@ class StartFormController < ApplicationController
       if filter_undefined_submitters(@template).size > 1 && @submitter.new_record?
         @error_message = multiple_submitters_error_message
 
-        return render :show, status: :unprocessable_entity
+        return render :show, status: :unprocessable_content
       end
 
       if (is_new_record = @submitter.new_record?)
@@ -60,7 +60,7 @@ class StartFormController < ApplicationController
 
         redirect_to submit_form_path(@submitter.slug)
       else
-        render :show, status: :unprocessable_entity
+        render :show, status: :unprocessable_content
       end
     end
   end
@@ -206,7 +206,7 @@ class StartFormController < ApplicationController
   end
 
   def handle_require_2fa(submitter, is_new_record:)
-    return render :show, status: :unprocessable_entity if submitter.errors.present?
+    return render :show, status: :unprocessable_content if submitter.errors.present?
 
     is_otp_verified = Submitters.verify_link_otp!(params[:one_time_code], submitter)
 
@@ -223,7 +223,7 @@ class StartFormController < ApplicationController
 
         redirect_to submit_form_path(submitter.slug)
       else
-        render :show, status: :unprocessable_entity
+        render :show, status: :unprocessable_content
       end
     else
       Submitters.send_shared_link_email_verification_code(submitter, request:)

app/controllers/storage_settings_controller.rb

@@ -13,7 +13,7 @@ class StorageSettingsController < ApplicationController
 
       redirect_to settings_storage_index_path, notice: I18n.t('changes_have_been_saved')
     else
-      render :index, status: :unprocessable_entity
+      render :index, status: :unprocessable_content
     end
   end
 

app/controllers/submissions_controller.rb

@@ -32,10 +32,7 @@ class SubmissionsController < ApplicationController
   def create
     save_template_message(@template, params) if params[:save_message] == '1'
 
-    if params[:is_custom_message] != '1'
+    [params.delete(:subject), params.delete(:body)] if params[:is_custom_message] != '1'
-      params.delete(:subject)
-      params.delete(:body)
-    end
 
     submissions =
       if params[:emails].present?
@@ -46,11 +43,16 @@ class SubmissionsController < ApplicationController
                                        emails: params[:emails],
                                        params: params.merge('send_completed_email' => true))
       else
+        submissions_attrs = submissions_params[:submission].to_h.values
+
+        submissions_attrs, =
+          Submissions::NormalizeParamUtils.normalize_submissions_params!(submissions_attrs, @template)
+
         Submissions.create_from_submitters(template: @template,
                                            user: current_user,
                                            source: :invite,
                                            submitters_order: params[:preserve_order] == '1' ? 'preserved' : 'random',
-                                           submissions_attrs: submissions_params[:submission].to_h.values,
+                                           submissions_attrs:,
                                            params: params.merge('send_completed_email' => true))
       end
 
@@ -62,10 +64,9 @@ class SubmissionsController < ApplicationController
 
     redirect_to template_path(@template), notice: I18n.t('new_recipients_have_been_added')
   rescue Submissions::CreateFromSubmitters::BaseError => e
-    render turbo_stream: turbo_stream.replace(:submitters_error,
+    render turbo_stream: turbo_stream.replace(:submitters_error, partial: 'submissions/error',
-                                              partial: 'submissions/error',
+                                                                 locals: { error: e.message }),
-                                              locals: { error: e.message }),
+           status: :unprocessable_content
-           status: :unprocessable_entity
   end
 
   def destroy
@@ -95,7 +96,7 @@ class SubmissionsController < ApplicationController
   end
 
   def submissions_params
-    params.permit(submission: { submitters: [%i[uuid email phone name]] })
+    params.permit(submission: { submitters: [:uuid, :email, :phone, :name, { values: {} }] })
   end
 
   def load_template

app/controllers/submissions_download_controller.rb

@@ -70,7 +70,7 @@ class SubmissionsDownloadController < ApplicationController
     return if submitter.submission.submitters.order(:completed_at).last != submitter
 
     attachment = submitter.submission.combined_document_attachment
-    attachment ||= Submissions::GenerateCombinedAttachment.call(submitter)
+    attachment ||= Submissions::EnsureCombinedGenerated.call(submitter)
 
     filename_format = AccountConfig.find_or_initialize_by(account_id: submitter.account_id,
                                                           key: AccountConfig::DOCUMENT_FILENAME_FORMAT_KEY)&.value

app/controllers/submissions_export_controller.rb

@@ -10,11 +10,16 @@ class SubmissionsExportController < ApplicationController
                                                      attachments_attachments: :blob })
                               .order(id: :asc)
 
+    submissions = Submissions.search(current_user, submissions, params[:q], search_values: true)
+    submissions = Submissions::Filter.call(submissions, current_user, params)
+
+    expires_at = Accounts.link_expires_at(current_account)
+
     if params[:format] == 'csv'
-      send_data Submissions::GenerateExportFiles.call(submissions, format: params[:format]),
+      send_data Submissions::GenerateExportFiles.call(submissions, format: params[:format], expires_at:),
                 filename: "#{@template.name}.csv"
     elsif params[:format] == 'xlsx'
-      send_data Submissions::GenerateExportFiles.call(submissions, format: params[:format]),
+      send_data Submissions::GenerateExportFiles.call(submissions, format: params[:format], expires_at:),
                 filename: "#{@template.name}.xlsx"
     end
   end

app/controllers/submissions_filters_controller.rb

@@ -3,6 +3,7 @@
 class SubmissionsFiltersController < ApplicationController
   ALLOWED_NAMES = %w[
     author
+    folder
     completed_at
     status
     created_at

app/controllers/submit_form_controller.rb

@@ -48,20 +48,20 @@ class SubmitFormController < ApplicationController
 
   def update
     if @submitter.completed_at?
-      return render json: { error: I18n.t('form_has_been_completed_already') }, status: :unprocessable_entity
+      return render json: { error: I18n.t('form_has_been_completed_already') }, status: :unprocessable_content
     end
 
     if @submitter.submission.template&.archived_at? || @submitter.submission.archived_at?
-      return render json: { error: I18n.t('form_has_been_archived') }, status: :unprocessable_entity
+      return render json: { error: I18n.t('form_has_been_archived') }, status: :unprocessable_content
     end
 
     if @submitter.submission.expired?
-      return render json: { error: I18n.t('form_has_been_expired') }, status: :unprocessable_entity
+      return render json: { error: I18n.t('form_has_been_expired') }, status: :unprocessable_content
     end
 
     if @submitter.declined_at?
       return render json: { error: I18n.t('form_has_been_declined') },
-                    status: :unprocessable_entity
+                    status: :unprocessable_content
     end
 
     Submitters::SubmitValues.call(@submitter, params, request)
@@ -70,9 +70,9 @@ class SubmitFormController < ApplicationController
   rescue Submitters::SubmitValues::RequiredFieldError => e
     Rollbar.warning("Required field #{@submitter.id}: #{e.message}") if defined?(Rollbar)
 
-    render json: { field_uuid: e.message }, status: :unprocessable_entity
+    render json: { field_uuid: e.message }, status: :unprocessable_content
   rescue Submitters::SubmitValues::ValidationError => e
-    render json: { error: e.message }, status: :unprocessable_entity
+    render json: { error: e.message }, status: :unprocessable_content
   end
 
   def completed; end

app/controllers/submit_form_download_controller.rb

@@ -11,13 +11,13 @@ class SubmitFormDownloadController < ApplicationController
 
     return redirect_to submitter_download_index_path(@submitter.slug) if @submitter.completed_at?
 
-    return head :unprocessable_entity if @submitter.declined_at? ||
+    return head :unprocessable_content if @submitter.declined_at? ||
-                                         @submitter.submission.archived_at? ||
+                                          @submitter.submission.archived_at? ||
-                                         @submitter.submission.expired? ||
+                                          @submitter.submission.expired? ||
-                                         @submitter.submission.template&.archived_at? ||
+                                          @submitter.submission.template&.archived_at? ||
-                                         AccountConfig.exists?(account_id: @submitter.account_id,
+                                          AccountConfig.exists?(account_id: @submitter.account_id,
-                                                               key: AccountConfig::ALLOW_TO_PARTIAL_DOWNLOAD_KEY,
+                                                                key: AccountConfig::ALLOW_TO_PARTIAL_DOWNLOAD_KEY,
-                                                               value: false)
+                                                                value: false)
 
     last_completed_submitter = @submitter.submission.submitters
                                          .where.not(id: @submitter.id)

app/controllers/submit_form_invite_controller.rb

@@ -7,7 +7,7 @@ class SubmitFormInviteController < ApplicationController
   def create
     submitter = Submitter.find_by!(slug: params[:submit_form_slug])
 
-    return head :unprocessable_entity unless can_invite?(submitter)
+    return head :unprocessable_content unless can_invite?(submitter)
 
     invite_submitters = filter_invite_submitters(submitter, 'invite_by_uuid')
     optional_invite_submitters = filter_invite_submitters(submitter, 'optional_invite_by_uuid')
@@ -34,7 +34,7 @@ class SubmitFormInviteController < ApplicationController
 
       head :ok
     else
-      head :unprocessable_entity
+      head :unprocessable_content
     end
   end
 

app/controllers/template_documents_controller.rb

@@ -5,7 +5,7 @@ class TemplateDocumentsController < ApplicationController
 
   def create
     if params[:blobs].blank? && params[:files].blank?
-      return render json: { error: I18n.t('file_is_missing') }, status: :unprocessable_entity
+      return render json: { error: I18n.t('file_is_missing') }, status: :unprocessable_content
     end
 
     old_fields_hash = @template.fields.hash
@@ -28,6 +28,6 @@ class TemplateDocumentsController < ApplicationController
       )
     }
   rescue Templates::CreateAttachments::PdfEncrypted
-    render json: { error: 'PDF encrypted', status: 'pdf_encrypted' }, status: :unprocessable_entity
+    render json: { error: 'PDF encrypted', status: 'pdf_encrypted' }, status: :unprocessable_content
   end
 end

app/controllers/template_folders_autocomplete_controller.rb

@@ -3,14 +3,31 @@
 class TemplateFoldersAutocompleteController < ApplicationController
   load_and_authorize_resource :template_folder, parent: false
 
-  LIMIT = 100
+  LIMIT = 30
 
   def index
-    templates_query = Template.accessible_by(current_ability).where(archived_at: nil)
+    parent_name, name =
+      if params[:parent_name].present?
+        [params[:parent_name], params[:q]]
+      else
+        params[:q].to_s.split(' /', 2).map(&:squish)
+      end
 
-    template_folders = @template_folders.where(id: templates_query.select(:folder_id))
+    if name
-    template_folders = TemplateFolders.search(template_folders, params[:q]).limit(LIMIT)
+      parent_folder = @template_folders.find_by(name: parent_name, parent_folder_id: nil)
+    else
+      name = parent_name
+    end
 
-    render json: template_folders.as_json(only: %i[name archived_at])
+    template_folders = TemplateFolders.filter_active_folders(@template_folders.where(parent_folder:),
+                                                             Template.accessible_by(current_ability))
+
+    name = name.to_s.downcase
+
+    template_folders = TemplateFolders.search(template_folders, name).order(id: :desc).limit(LIMIT)
+
+    render json: template_folders.preload(:parent_folder)
+                                 .sort_by { |e| e.name.downcase.index(name) || Float::MAX }
+                                 .as_json(only: %i[name archived_at], methods: %i[full_name])
   end
 end

app/controllers/template_folders_controller.rb

@@ -5,13 +5,39 @@ class TemplateFoldersController < ApplicationController
 
   helper_method :selected_order
 
-  def show
+  TEMPLATES_PER_PAGE = 12
-    @templates = @template_folder.templates.active.accessible_by(current_ability)
+  FOLDERS_PER_PAGE = 18
-                                 .preload(:author, :template_accesses)
-    @templates = Templates.search(current_user, @templates, params[:q])
-    @templates = Templates::Order.call(@templates, current_user, selected_order)
 
-    @pagy, @templates = pagy_auto(@templates, limit: 12)
+  def show
+    @templates = Template.active.accessible_by(current_ability)
+                         .where(folder: [@template_folder, *(params[:q].present? ? @template_folder.subfolders : [])])
+                         .preload(:author, :template_accesses)
+
+    @template_folders =
+      @template_folder.subfolders.where(id: Template.accessible_by(current_ability).active.select(:folder_id))
+
+    @template_folders = TemplateFolders.search(@template_folders, params[:q])
+    @template_folders = TemplateFolders.sort(@template_folders, current_user, selected_order)
+
+    if @templates.exists?
+      @templates = Templates.search(current_user, @templates, params[:q])
+      @templates = Templates::Order.call(@templates, current_user, selected_order)
+
+      limit =
+        if @template_folders.size < 4
+          TEMPLATES_PER_PAGE
+        else
+          (@template_folders.size < 7 ? 9 : 6)
+        end
+
+      @pagy, @templates = pagy_auto(@templates, limit:)
+
+      load_related_submissions if params[:q].present? && @templates.blank?
+    else
+      @pagy, @template_folders = pagy(@template_folders, limit: FOLDERS_PER_PAGE)
+
+      @templates = @templates.none
+    end
   end
 
   def edit; end
@@ -40,4 +66,21 @@ class TemplateFoldersController < ApplicationController
   def template_folder_params
     params.require(:template_folder).permit(:name)
   end
+
+  def load_related_submissions
+    @related_submissions =
+      Submission.accessible_by(current_ability)
+                .where(archived_at: nil)
+                .where(template_id: current_account.templates.active
+                                                   .where(folder: [@template_folder, *@template_folder.subfolders])
+                                                   .select(:id))
+                .preload(:template_accesses, :created_by_user,
+                         template: :author,
+                         submitters: :start_form_submission_events)
+
+    @related_submissions = Submissions.search(current_user, @related_submissions, params[:q])
+                                      .order(id: :desc)
+
+    @related_submissions_pagy, @related_submissions = pagy_auto(@related_submissions, limit: 5)
+  end
 end

app/controllers/templates_archived_controller.rb

@@ -4,9 +4,27 @@ class TemplatesArchivedController < ApplicationController
   load_and_authorize_resource :template, parent: false
 
   def index
-    @templates = @templates.where.not(archived_at: nil).preload(:author, :folder, :template_accesses).order(id: :desc)
+    @templates = @templates.where.not(archived_at: nil)
+                           .preload(:author, :template_accesses, folder: :parent_folder)
+                           .order(id: :desc)
+
     @templates = Templates.search(current_user, @templates, params[:q])
 
     @pagy, @templates = pagy_auto(@templates, limit: 12)
+
+    return unless params[:q].present? && @templates.blank?
+
+    @related_submissions =
+      Submission.accessible_by(current_ability)
+                .joins(:template)
+                .where.not(templates: { archived_at: nil })
+                .preload(:template_accesses, :created_by_user,
+                         template: :author,
+                         submitters: :start_form_submission_events)
+
+    @related_submissions = Submissions.search(current_user, @related_submissions, params[:q])
+                                      .order(id: :desc)
+
+    @related_submissions_pagy, @related_submissions = pagy_auto(@related_submissions, limit: 5)
   end
 end

app/controllers/templates_clone_and_replace_controller.rb

@@ -4,7 +4,7 @@ class TemplatesCloneAndReplaceController < ApplicationController
   load_and_authorize_resource :template
 
   def create
-    return head :unprocessable_entity if params[:files].blank?
+    return head :unprocessable_content if params[:files].blank?
 
     ActiveRecord::Associations::Preloader.new(
       records: [@template],
@@ -17,6 +17,8 @@ class TemplatesCloneAndReplaceController < ApplicationController
 
     documents = Templates::ReplaceAttachments.call(cloned_template, params, extract_fields: true)
 
+    Templates.maybe_assign_access(cloned_template)
+
     cloned_template.save!
 
     Templates::CloneAttachments.call(template: cloned_template, original_template: @template,
@@ -31,7 +33,7 @@ class TemplatesCloneAndReplaceController < ApplicationController
   rescue Templates::CreateAttachments::PdfEncrypted
     respond_to do |f|
       f.html { render turbo_stream: turbo_stream.append(params[:form_id], html: helpers.tag.prompt_password) }
-      f.json { render json: { error: 'PDF encrypted', status: 'pdf_encrypted' }, status: :unprocessable_entity }
+      f.json { render json: { error: 'PDF encrypted', status: 'pdf_encrypted' }, status: :unprocessable_content }
     end
   end
 end

app/controllers/templates_controller.rb

@@ -69,6 +69,8 @@ class TemplatesController < ApplicationController
       @template.account = current_account
     end
 
+    Templates.maybe_assign_access(@template)
+
     if @template.save
       Templates::CloneAttachments.call(template: @template, original_template: @base_template) if @base_template
 
@@ -78,7 +80,7 @@ class TemplatesController < ApplicationController
 
       maybe_redirect_to_template(@template)
     else
-      render turbo_stream: turbo_stream.replace(:modal, template: 'templates/new'), status: :unprocessable_entity
+      render turbo_stream: turbo_stream.replace(:modal, template: 'templates/new'), status: :unprocessable_content
     end
   end
 
@@ -117,14 +119,15 @@ class TemplatesController < ApplicationController
     params.require(:template).permit(
       :name,
       { schema: [[:attachment_uuid, :name, { conditions: [%i[field_uuid value action operation]] }]],
-        submitters: [%i[name uuid is_requester linked_to_uuid invite_by_uuid optional_invite_by_uuid email]],
+        submitters: [%i[name uuid is_requester linked_to_uuid invite_by_uuid optional_invite_by_uuid email order]],
         fields: [[:uuid, :submitter_uuid, :name, :type,
                   :required, :readonly, :default_value,
-                  :title, :description,
+                  :title, :description, :prefillable,
                   { preferences: {},
+                    default_value: [],
                     conditions: [%i[field_uuid value action operation]],
                     options: [%i[value uuid]],
-                    validation: %i[message pattern],
+                    validation: %i[message pattern min max step],
                     areas: [%i[x y w h cell_w attachment_uuid option_uuid page]] }]] }
     )
   end

app/controllers/templates_dashboard_controller.rb

@@ -11,10 +11,11 @@ class TemplatesDashboardController < ApplicationController
   helper_method :selected_order
 
   def index
-    @template_folders = @template_folders.where(id: @templates.active.select(:folder_id))
+    @template_folders =
+      TemplateFolders.filter_active_folders(@template_folders.where(parent_folder_id: nil), @templates)
 
     @template_folders = TemplateFolders.search(@template_folders, params[:q])
-    @template_folders = sort_template_folders(@template_folders, current_user, selected_order)
+    @template_folders = TemplateFolders.sort(@template_folders, current_user, selected_order)
 
     @pagy, @template_folders = pagy(
       @template_folders,
@@ -68,40 +69,6 @@ class TemplatesDashboardController < ApplicationController
     Templates.search(current_user, rel, params[:q])
   end
 
-  def sort_template_folders(template_folders, current_user, order)
-    case order
-    when 'used_at'
-      subquery =
-        Template.left_joins(:submissions)
-                .group(:folder_id)
-                .where(account_id: current_user.account_id)
-                .select(
-                  :folder_id,
-                  Template.arel_table[:updated_at].maximum.as('updated_at_max'),
-                  Submission.arel_table[:created_at].maximum.as('submission_created_at_max')
-                )
-
-      template_folders = template_folders.joins(
-        Template.arel_table
-                .join(subquery.arel.as('templates'), Arel::Nodes::OuterJoin)
-                .on(TemplateFolder.arel_table[:id].eq(Template.arel_table[:folder_id]))
-                .join_sources
-      )
-
-      template_folders.order(
-        Arel::Nodes::Case.new
-                         .when(Template.arel_table[:submission_created_at_max].gt(Template.arel_table[:updated_at_max]))
-                         .then(Template.arel_table[:submission_created_at_max])
-                         .else(Template.arel_table[:updated_at_max])
-                         .desc
-      )
-    when 'name'
-      template_folders.order(name: :asc)
-    else
-      template_folders.order(id: :desc)
-    end
-  end
-
   def selected_order
     @selected_order ||=
       if cookies.permanent[:dashboard_templates_order].blank? ||

app/controllers/templates_debug_controller.rb

@@ -3,6 +3,8 @@
 class TemplatesDebugController < ApplicationController
   load_and_authorize_resource :template
 
+  DEBUG_FILE = ''
+
   def show
     attachment = @template.documents.first
 
@@ -16,6 +18,8 @@ class TemplatesDebugController < ApplicationController
 
     @template.update!(fields: Templates::ProcessDocument.normalize_attachment_fields(@template, [attachment]))
 
+    debug_file if DEBUG_FILE.present?
+
     ActiveRecord::Associations::Preloader.new(
       records: [@template],
       associations: [schema_documents: { preview_images_attachments: :blob }]
@@ -31,4 +35,27 @@ class TemplatesDebugController < ApplicationController
 
     render 'templates/edit', layout: 'plain'
   end
+
+  def debug_file
+    tempfile = Tempfile.new
+    tempfile.binmode
+    tempfile.write(File.read(DEBUG_FILE))
+    tempfile.rewind
+
+    filename = File.basename(DEBUG_FILE)
+
+    file = ActionDispatch::Http::UploadedFile.new(
+      tempfile:,
+      filename:,
+      type: Marcel::MimeType.for(tempfile)
+    )
+
+    params = { files: [file] }
+
+    documents = Templates::CreateAttachments.call(@template, params)
+
+    schema = documents.map { |doc| { attachment_uuid: doc.uuid, name: doc.filename.base } }
+
+    @template.update!(schema:)
+  end
 end

app/controllers/templates_folders_controller.rb

@@ -6,7 +6,9 @@ class TemplatesFoldersController < ApplicationController
   def edit; end
 
   def update
-    @template.folder = TemplateFolders.find_or_create_by_name(current_user, params[:name])
+    name = [params[:parent_name], params[:name]].compact_blank.join(' / ')
+
+    @template.folder = TemplateFolders.find_or_create_by_name(current_user, name)
 
     if @template.save
       redirect_back(fallback_location: template_path(@template), notice: I18n.t('document_template_has_been_moved'))

app/controllers/templates_preferences_controller.rb

@@ -27,7 +27,7 @@ class TemplatesPreferencesController < ApplicationController
                       completed_redirect_url validate_unique_submitters
                       require_all_submitters submitters_order require_phone_2fa
                       default_expire_at_duration shared_link_2fa
-                      default_expire_at
+                      default_expire_at request_email_enabled
                       completed_notification_email_subject completed_notification_email_body
                       completed_notification_email_enabled completed_notification_email_attach_audit] +
                       [completed_message: %i[title body],

app/controllers/templates_prefillable_fields_controller.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class TemplatesPrefillableFieldsController < ApplicationController
+  PREFILLABLE_FIELD_TYPES = %w[text number cells date checkbox select radio phone].freeze
+
+  load_and_authorize_resource :template
+
+  def create
+    authorize!(:update, @template)
+
+    field = @template.fields.find { |f| f['uuid'] == params[:field_uuid] }
+
+    if params[:prefillable] == 'false'
+      field.delete('prefillable')
+      field.delete('readonly')
+    elsif params[:prefillable] == 'true'
+      field['prefillable'] = true
+      field['readonly'] = true
+    end
+
+    @template.save!
+
+    render turbo_stream: turbo_stream.replace(:prefillable_fields_list, partial: 'list',
+                                                                        locals: { template: @template })
+  end
+end

app/controllers/templates_recipients_controller.rb

@@ -9,6 +9,10 @@ class TemplatesRecipientsController < ApplicationController
     @template.submitters =
       submitters_params.map { |s| s.reject { |_, v| v.is_a?(String) && v.blank? } }
 
+    if @template.submitters.each_with_index.all? { |s, index| s['order'] == index }
+      @template.submitters.each { |s| s.delete('order') }
+    end
+
     @template.save!
 
     render json: { submitters: @template.submitters }
@@ -18,7 +22,7 @@ class TemplatesRecipientsController < ApplicationController
 
   def submitters_params
     permit_params = { submitters: [%i[name uuid is_requester optional_invite_by_uuid
-                                      invite_by_uuid linked_to_uuid email option]] }
+                                      invite_by_uuid linked_to_uuid email option order]] }
 
     params.require(:template).permit(permit_params).fetch(:submitters, {}).values.filter_map do |s|
       next if s[:uuid].blank?
@@ -29,6 +33,7 @@ class TemplatesRecipientsController < ApplicationController
         s.delete(:is_requester)
       end
 
+      s[:order] = s[:order].to_i if s[:order].present?
       s.delete(:invite_by_uuid) if s[:invite_by_uuid].blank?
       s.delete(:optional_invite_by_uuid) if s[:optional_invite_by_uuid].blank?
 

app/controllers/templates_uploads_controller.rb

@@ -46,6 +46,8 @@ class TemplatesUploadsController < ApplicationController
     template.folder = TemplateFolders.find_or_create_by_name(current_user, params[:folder_name])
     template.name = File.basename((url_params || params)[:files].first.original_filename, '.*')
 
+    Templates.maybe_assign_access(template)
+
     template.save!
 
     template

app/controllers/users_controller.rb

@@ -27,9 +27,10 @@ class UsersController < ApplicationController
     if User.accessible_by(current_ability).exists?(email: @user.email)
       @user.errors.add(:email, I18n.t('already_exists'))
 
-      return render turbo_stream: turbo_stream.replace(:modal, template: 'users/new'), status: :unprocessable_entity
+      return render turbo_stream: turbo_stream.replace(:modal, template: 'users/new'), status: :unprocessable_content
     end
 
+    @user.password = SecureRandom.hex if @user.password.blank?
     @user.role = User::ADMIN_ROLE unless role_valid?(@user.role)
 
     if @user.save
@@ -37,7 +38,7 @@ class UsersController < ApplicationController
 
       redirect_back fallback_location: settings_users_path, notice: I18n.t('user_has_been_invited')
     else
-      render turbo_stream: turbo_stream.replace(:modal, template: 'users/new'), status: :unprocessable_entity
+      render turbo_stream: turbo_stream.replace(:modal, template: 'users/new'), status: :unprocessable_content
     end
   end
 
@@ -54,10 +55,10 @@ class UsersController < ApplicationController
       @user.account = account
     end
 
-    if @user.update(attrs.except(current_user == @user ? :role : nil))
+    if @user.update(attrs.except(*(current_user == @user ? %i[password otp_required_for_login role] : %i[password])))
       redirect_back fallback_location: settings_users_path, notice: I18n.t('user_has_been_updated')
     else
-      render turbo_stream: turbo_stream.replace(:modal, template: 'users/edit'), status: :unprocessable_entity
+      render turbo_stream: turbo_stream.replace(:modal, template: 'users/edit'), status: :unprocessable_content
     end
   end
 
@@ -83,7 +84,7 @@ class UsersController < ApplicationController
 
   def user_params
     if params.key?(:user)
-      permitted_params = %i[email first_name last_name password archived_at]
+      permitted_params = %i[email first_name last_name password archived_at otp_required_for_login]
 
       permitted_params << :role if role_valid?(params.dig(:user, :role))
 

app/controllers/users_send_reset_password_controller.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class UsersSendResetPasswordController < ApplicationController
+  load_and_authorize_resource :user
+
+  LIMIT_DURATION = 10.minutes
+
+  def update
+    authorize!(:manage, @user)
+
+    if @user.reset_password_sent_at && @user.reset_password_sent_at > LIMIT_DURATION.ago
+      redirect_back fallback_location: settings_users_path, notice: I18n.t('email_has_been_sent_already')
+    else
+      @user.send_reset_password_instructions
+
+      redirect_back fallback_location: settings_users_path,
+                    notice: I18n.t('an_email_with_password_reset_instructions_has_been_sent')
+    end
+  end
+end

app/javascript/application.js

@@ -37,6 +37,8 @@ import AppTour from './elements/app_tour'
 import DashboardDropzone from './elements/dashboard_dropzone'
 import RequiredCheckboxGroup from './elements/required_checkbox_group'
 import PageContainer from './elements/page_container'
+import EmailEditor from './elements/email_editor'
+import MountOnClick from './elements/mount_on_click'
 
 import * as TurboInstantClick from './lib/turbo_instant_click'
 
@@ -109,6 +111,8 @@ safeRegisterElement('dashboard-dropzone', DashboardDropzone)
 safeRegisterElement('check-on-click', CheckOnClick)
 safeRegisterElement('required-checkbox-group', RequiredCheckboxGroup)
 safeRegisterElement('page-container', PageContainer)
+safeRegisterElement('email-editor', EmailEditor)
+safeRegisterElement('mount-on-click', MountOnClick)
 
 safeRegisterElement('template-builder', class extends HTMLElement {
   connectedCallback () {

app/javascript/elements/dashboard_dropzone.js

@@ -15,6 +15,7 @@ export default targetable(class extends HTMLElement {
   static [target.static] = [
     'form',
     'fileDropzone',
+    'folderDropzone',
     'fileDropzoneLoading'
   ]
 
@@ -25,12 +26,13 @@ export default targetable(class extends HTMLElement {
     window.addEventListener('dragleave', this.onWindowDragleave)
 
     this.fileDropzone?.addEventListener('drop', this.onDropFile)
+    this.folderDropzone?.addEventListener('drop', this.onDropNewFolder)
 
     this.folderCards.forEach((el) => el.addEventListener('drop', (e) => this.onDropFolder(e, el)))
     this.templateCards.forEach((el) => el.addEventListener('drop', this.onDropTemplate))
     this.templateCards.forEach((el) => el.addEventListener('dragstart', this.onTemplateDragStart))
 
-    return [this.fileDropzone, ...this.folderCards, ...this.templateCards].forEach((el) => {
+    return [this.fileDropzone, this.folderDropzone, ...this.folderCards, ...this.templateCards].forEach((el) => {
       el?.addEventListener('dragover', this.onDragover)
       el?.addEventListener('dragleave', this.onDragleave)
     })
@@ -46,6 +48,10 @@ export default targetable(class extends HTMLElement {
   onTemplateDragStart = (e) => {
     const id = e.target.href.split('/').pop()
 
+    this.folderCards.forEach((el) => el.classList.remove('bg-base-200', 'before:hidden'))
+    this.folderDropzone?.classList?.remove('hidden')
+    window.flash?.remove()
+
     e.dataTransfer.effectAllowed = 'move'
 
     if (id) {
@@ -104,7 +110,7 @@ export default targetable(class extends HTMLElement {
       } else {
         const formData = new FormData()
 
-        formData.append('name', el.innerText.trim())
+        formData.append('name', el.dataset.fullName)
 
         fetch(`/templates/${templateId}/folder`, {
           method: 'PUT',
@@ -176,6 +182,24 @@ export default targetable(class extends HTMLElement {
     }
   }
 
+  onDropNewFolder (e) {
+    e.preventDefault()
+
+    const templateId = e.dataTransfer.getData('template_id')
+
+    const a = document.createElement('a')
+
+    a.href = `/templates/${templateId}/folder/edit?autocomplete=false`
+    a.dataset.turboFrame = 'modal'
+    a.classList.add('hidden')
+
+    document.body.append(a)
+
+    a.click()
+
+    a.remove()
+  }
+
   onDragleave () {
     this.style.backgroundColor = null
 
@@ -199,6 +223,7 @@ export default targetable(class extends HTMLElement {
 
     this.isDrag = true
 
+    window.flash?.remove()
     this.fileDropzone?.classList?.remove('hidden')
 
     this.hiddenOnDrag.forEach((el) => { el.style.display = 'none' })
@@ -212,6 +237,7 @@ export default targetable(class extends HTMLElement {
     this.isDrag = false
 
     this.fileDropzone?.classList?.add('hidden')
+    this.folderDropzone?.classList?.add('hidden')
 
     this.hiddenOnDrag.forEach((el) => { el.style.display = null })
 

app/javascript/elements/email_editor.js

@@ -0,0 +1,131 @@
+import { target, targetable } from '@github/catalyst/lib/targetable'
+
+let loaderPromise = null
+
+function loadCodeMirror () {
+  if (!loaderPromise) {
+    loaderPromise = Promise.all([
+      import(/* webpackChunkName: "email-editor" */ '@codemirror/view'),
+      import(/* webpackChunkName: "email-editor" */ '@codemirror/commands'),
+      import(/* webpackChunkName: "email-editor" */ '@codemirror/language'),
+      import(/* webpackChunkName: "email-editor" */ '@codemirror/lang-html'),
+      import(/* webpackChunkName: "email-editor" */ '@specious/htmlflow')
+    ]).then(([view, commands, language, html, htmlflow]) => {
+      return {
+        minimalSetup: [
+          commands.history(),
+          language.syntaxHighlighting(language.defaultHighlightStyle, { fallback: true }),
+          view.keymap.of([...commands.defaultKeymap, ...commands.historyKeymap])
+        ],
+        EditorView: view.EditorView,
+        html: html.html,
+        htmlflow: htmlflow.default || htmlflow
+      }
+    })
+  }
+
+  return loaderPromise
+}
+
+export default targetable(class extends HTMLElement {
+  static [target.static] = [
+    'codeViewTab',
+    'previewViewTab',
+    'editorContainer',
+    'previewIframe'
+  ]
+
+  connectedCallback () {
+    this.mount()
+
+    if (this.input.value) {
+      this.showPreviewView()
+    } else {
+      this.showCodeView()
+    }
+
+    this.previewViewTab.addEventListener('click', this.showPreviewView)
+    this.codeViewTab.addEventListener('click', this.showCodeView)
+  }
+
+  showCodeView = () => {
+    this.editorView.dispatch({
+      changes: { from: 0, to: this.editorView.state.doc.length, insert: this.input.value }
+    })
+
+    this.previewViewTab.classList.remove('tab-active', 'tab-bordered')
+    this.previewViewTab.classList.add('pb-[3px]')
+    this.codeViewTab.classList.remove('pb-[3px]')
+    this.codeViewTab.classList.add('tab-active', 'tab-bordered')
+    this.editorContainer.classList.remove('hidden')
+    this.previewIframe.classList.add('hidden')
+  }
+
+  showPreviewView = () => {
+    this.previewIframe.srcdoc = this.input.value
+
+    this.codeViewTab.classList.remove('tab-active', 'tab-bordered')
+    this.codeViewTab.classList.add('pb-[3px]')
+    this.previewViewTab.classList.remove('pb-[3px]')
+    this.previewViewTab.classList.add('tab-active', 'tab-bordered')
+    this.editorContainer.classList.add('hidden')
+    this.previewIframe.classList.remove('hidden')
+  }
+
+  async mount () {
+    this.input = this.querySelector('input[type="hidden"]')
+    this.input.style.display = 'none'
+
+    const { EditorView, minimalSetup, html, htmlflow } = await loadCodeMirror()
+
+    this.editorView = new EditorView({
+      doc: this.input.value,
+      parent: this.editorContainer,
+      extensions: [
+        html(),
+        minimalSetup,
+        EditorView.lineWrapping,
+        EditorView.updateListener.of(update => {
+          if (update.docChanged) this.input.value = update.state.doc.toString()
+        }),
+        EditorView.theme({
+          '&': {
+            backgroundColor: 'white',
+            color: 'black',
+            fontSize: '14px',
+            fontFamily: 'monospace'
+          },
+          '&.cm-focused': {
+            outline: 'none'
+          },
+          '&.cm-editor': {
+            borderRadius: '0.375rem',
+            border: 'none'
+          },
+          '.cm-gutters': {
+            display: 'none'
+          }
+        })
+      ]
+    })
+
+    this.previewIframe.srcdoc = this.editorView.state.doc.toString()
+
+    this.previewIframe.onload = () => {
+      const previewIframeDoc = this.previewIframe.contentDocument
+
+      if (previewIframeDoc.body) {
+        previewIframeDoc.body.contentEditable = true
+      }
+
+      const contentDocument = this.previewIframe.contentDocument || this.previewIframe.contentWindow.document
+
+      contentDocument.body.addEventListener('input', async () => {
+        const html = contentDocument.documentElement.outerHTML.replace(' contenteditable="true"', '')
+        const prettifiedHtml = await htmlflow(html)
+
+        this.input.value = prettifiedHtml
+      })
+    }
+  }
+})

app/javascript/elements/folder_autocomplete.js

@@ -2,6 +2,8 @@ import autocomplete from 'autocompleter'
 
 export default class extends HTMLElement {
   connectedCallback () {
+    if (this.dataset.enabled === 'false') return
+
     autocomplete({
       input: this.input,
       preventSubmit: this.dataset.submitOnSelect === 'true' ? 0 : 1,
@@ -14,12 +16,16 @@ export default class extends HTMLElement {
   }
 
   onSelect = (item) => {
-    this.input.value = item.name
+    this.input.value = this.dataset.parentName ? item.name : item.full_name
   }
 
   fetch = (text, resolve) => {
     const queryParams = new URLSearchParams({ q: text })
 
+    if (this.dataset.parentName) {
+      queryParams.append('parent_name', this.dataset.parentName)
+    }
+
     fetch('/template_folders_autocomplete?' + queryParams).then(async (resp) => {
       const items = await resp.json()
 
@@ -34,7 +40,7 @@ export default class extends HTMLElement {
 
     div.setAttribute('dir', 'auto')
 
-    div.textContent = item.name
+    div.textContent = this.dataset.parentName ? item.name : item.full_name
 
     return div
   }

app/javascript/elements/mount_on_click.js

@@ -0,0 +1,11 @@
+export default class extends HTMLElement {
+  connectedCallback () {
+    this.addEventListener('click', () => {
+      document.body.append(this.template.content)
+    })
+  }
+
+  get template () {
+    return document.getElementById(this.dataset.templateId)
+  }
+}

app/javascript/elements/page_container.js

@@ -1,14 +1,12 @@
 export default class extends HTMLElement {
   connectedCallback () {
-    this.image.addEventListener('load', (e) => {
+    const image = this.querySelector('img')
-      this.image.setAttribute('width', e.target.naturalWidth)
+
-      this.image.setAttribute('height', e.target.naturalHeight)
+    image.addEventListener('load', (e) => {
+      image.setAttribute('width', e.target.naturalWidth)
+      image.setAttribute('height', e.target.naturalHeight)
 
       this.style.aspectRatio = `${e.target.naturalWidth} / ${e.target.naturalHeight}`
     })
   }
-
-  get image () {
-    return this.querySelector('img')
-  }
 }

app/javascript/elements/submit_form.js

@@ -4,6 +4,10 @@ export default class extends HTMLElement {
       this.interval = setInterval(() => {
         this.querySelector('form').requestSubmit()
       }, parseInt(this.dataset.interval))
+    } else if (this.dataset.on) {
+      this.lastElementChild.addEventListener(this.dataset.on, () => {
+        this.lastElementChild.form.requestSubmit()
+      })
     } else {
       this.querySelector('form').requestSubmit()
     }

app/javascript/elements/toggle_visible.js

@@ -7,5 +7,9 @@ export default actionable(class extends HTMLElement {
     elementIds.forEach((elementId) => {
       document.getElementById(elementId).classList.toggle('hidden', (event.target.dataset.toggleId || event.target.value) !== elementId)
     })
+
+    if (this.dataset.focusId) {
+      document.getElementById(this.dataset.focusId)?.focus()
+    }
   }
 })

app/javascript/submission_form/area.vue

@@ -29,8 +29,15 @@
         {{ optionValue(option) }}
       </template>
       <template v-else>
-        {{ field.title || field.name || fieldNames[field.type] }}
+        <MarkdownContent
-        <template v-if="field.type === 'checkbox' && !field.name">
+          v-if="field.title"
+          :text-only="true"
+          :string="field.title"
+        />
+        <template v-else>
+          {{ field.name || fieldNames[field.type] }}
+        </template>
+        <template v-if="field.type === 'checkbox' && !field.name && !field.title">
           {{ fieldIndex + 1 }}
         </template>
         <template v-else-if="!field.required && field.type !== 'checkbox'">
@@ -56,11 +63,11 @@
     <div
       v-else-if="field.type === 'signature' && signature"
       class="flex justify-between h-full gap-1 overflow-hidden w-full"
-      :class="isNarrow && (withSignatureId || field.preferences?.reason_field_uuid) ? 'flex-row' : 'flex-col'"
+      :class="isNarrow && (isShowSignatureId || field.preferences?.reason_field_uuid) ? 'flex-row' : 'flex-col'"
     >
       <div
         class="flex overflow-hidden"
-        :class="isNarrow && (withSignatureId || field.preferences?.reason_field_uuid) ? 'w-1/2' : 'flex-grow'"
+        :class="isNarrow && (isShowSignatureId || field.preferences?.reason_field_uuid) ? 'w-1/2' : 'flex-grow'"
         style="min-height: 50%"
       >
         <img
@@ -69,7 +76,7 @@
         >
       </div>
       <div
-        v-if="withSignatureId || field.preferences?.reason_field_uuid"
+        v-if="isShowSignatureId || field.preferences?.reason_field_uuid"
         class="text-[1vw] lg:text-[0.55rem] lg:leading-[0.65rem]"
         :class="isNarrow ? 'w-1/2' : 'w-full'"
       >
@@ -222,12 +229,14 @@
 </template>
 
 <script>
+import MarkdownContent from './markdown_content'
 import { IconTextSize, IconWritingSign, IconCalendarEvent, IconPhoto, IconCheckbox, IconPaperclip, IconSelect, IconCircleDot, IconChecks, IconCheck, IconColumns3, IconPhoneCheck, IconLetterCaseUpper, IconCreditCard, IconRubberStamp, IconSquareNumber1, IconId } from '@tabler/icons-vue'
 
 export default {
   name: 'FieldArea',
   components: {
     IconPaperclip,
+    MarkdownContent,
     IconCheck
   },
   inject: ['t'],
@@ -333,6 +342,13 @@ export default {
         verification: this.t('verify_id')
       }
     },
+    isShowSignatureId () {
+      if ([true, false].includes(this.field.preferences?.with_signature_id)) {
+        return this.field.preferences.with_signature_id
+      } else {
+        return this.withSignatureId
+      }
+    },
     alignClasses () {
       if (!this.field.preferences) {
         return { 'items-center': true }
@@ -415,10 +431,14 @@ export default {
     },
     formattedDate () {
       if (this.field.type === 'date' && this.modelValue) {
-        return this.formatDate(
+        try {
-          this.modelValue === '{{date}}' ? new Date() : new Date(this.modelValue),
+          return this.formatDate(
-          this.field.preferences?.format || (this.locale.endsWith('-US') ? 'MM/DD/YYYY' : 'DD/MM/YYYY')
+            this.modelValue === '{{date}}' ? new Date() : new Date(this.modelValue),
-        )
+            this.field.preferences?.format || (this.locale.endsWith('-US') ? 'MM/DD/YYYY' : 'DD/MM/YYYY')
+          )
+        } catch {
+          return this.modelValue
+        }
       } else {
         return ''
       }
@@ -460,9 +480,6 @@ export default {
     fontScale () {
       return 1000 / 612.0
     },
-    ladscapeScale () {
-      return 8.5 / 11.0
-    },
     computedStyle () {
       const { x, y, w, h } = this.area
 

app/javascript/submission_form/completed.vue

@@ -25,7 +25,7 @@
     <div class="space-y-3 mt-5">
       <a
         v-if="completedButton.url"
-        :href="sanitizeHref(completedButton.url)"
+        :href="sanitizeUrl(completedButton.url)"
         rel="noopener noreferrer nofollow"
         class="white-button flex items-center w-full completed-form-completed-button"
       >
@@ -102,6 +102,7 @@
 <script>
 import { IconCircleCheck, IconBrandGithub, IconMail, IconDownload, IconInnerShadowTop, IconLogin } from '@tabler/icons-vue'
 import MarkdownContent from './markdown_content'
+import { sanitizeUrl } from '@braintree/sanitize-url'
 
 export default {
   name: 'FormCompleted',
@@ -198,6 +199,7 @@ export default {
     })
   },
   methods: {
+    sanitizeUrl,
     sendCopyToEmail () {
       this.isSendingCopy = true
 
@@ -252,11 +254,6 @@ export default {
         this.isDownloading = false
       })
     },
-    sanitizeHref (href) {
-      if (href && href.trim().match(/^((?:https?:\/\/)|\/)/)) {
-        return href.replace(/javascript:/g, '')
-      }
-    },
     downloadSafariIos (urls) {
       const fileRequests = urls.map((url) => {
         return fetch(url).then(async (resp) => {

app/javascript/submission_form/date_step.vue

@@ -26,6 +26,7 @@
         </template>
       </label>
       <button
+        v-if="withToday"
         class="btn btn-outline btn-sm !normal-case font-normal set-current-date-button"
         @click.prevent="[setCurrentDate(), $emit('focus')]"
       >
@@ -46,6 +47,8 @@
         :id="field.uuid"
         ref="input"
         v-model="value"
+        :min="validationMin"
+        :max="validationMax"
         class="base-input !text-2xl text-center w-full"
         :required="field.required"
         type="date"
@@ -89,6 +92,44 @@ export default {
   },
   emits: ['update:model-value', 'focus', 'submit'],
   computed: {
+    dateNowString () {
+      const today = new Date()
+
+      const yyyy = today.getFullYear()
+      const mm = String(today.getMonth() + 1).padStart(2, '0')
+      const dd = String(today.getDate()).padStart(2, '0')
+
+      return `${yyyy}-${mm}-${dd}`
+    },
+    validationMin () {
+      if (this.field.validation?.min) {
+        return ['{{date}}', '{date}'].includes(this.field.validation.min) ? this.dateNowString : this.field.validation.min
+      } else {
+        return ''
+      }
+    },
+    validationMax () {
+      if (this.field.validation?.max) {
+        return ['{{date}}', '{date}'].includes(this.field.validation.max) ? this.dateNowString : this.field.validation.max
+      } else {
+        return ''
+      }
+    },
+    withToday () {
+      const todayDate = new Date().setHours(0, 0, 0, 0)
+
+      if (this.validationMin) {
+        if (new Date(this.validationMin).setHours(0, 0, 0, 0) <= todayDate) {
+          return this.validationMax ? (new Date(this.validationMax).setHours(0, 0, 0, 0) >= todayDate) : true
+        } else {
+          return false
+        }
+      } else if (this.validationMax) {
+        return new Date(this.validationMax).setHours(0, 0, 0, 0) >= todayDate
+      } else {
+        return true
+      }
+    },
     value: {
       set (value) {
         this.$emit('update:model-value', value)

app/javascript/submission_form/dropzone.vue

@@ -112,11 +112,23 @@ export default {
     onSelectFiles (e) {
       e.preventDefault()
 
-      this.uploadFiles(this.$refs.input.files).then(() => {
+      const files = Array.from(this.$refs.input.files).filter((f) => {
-        if (this.$refs.input) {
+        if (this.accept === 'image/*') {
-          this.$refs.input.value = ''
+          return f.type.startsWith('image')
+        } else {
+          return true
         }
       })
+
+      if (this.accept === 'image/*' && !files.length) {
+        alert(this.t('please_upload_an_image_file'))
+      } else {
+        this.uploadFiles(files).then(() => {
+          if (this.$refs.input) {
+            this.$refs.input.value = ''
+          }
+        })
+      }
     },
     async uploadFiles (files) {
       this.isLoading = true

app/javascript/submission_form/form.vue

@@ -572,6 +572,7 @@ import FormCompleted from './completed'
 import { IconInnerShadowTop, IconArrowsDiagonal, IconWritingSign, IconArrowsDiagonalMinimize2 } from '@tabler/icons-vue'
 import AppearsOn from './appears_on'
 import i18n from './i18n'
+import { sanitizeUrl } from '@braintree/sanitize-url'
 
 const isEmpty = (obj) => {
   if (obj == null) return true
@@ -1014,7 +1015,11 @@ export default {
           const aArea = (fieldAreasIndex[aField.uuid] ||= [...(aField.areas || [])].sort(sortArea)[0])
           const bArea = (fieldAreasIndex[bField.uuid] ||= [...(bField.areas || [])].sort(sortArea)[0])
 
-          return sortArea(aArea, bArea)
+          if (aArea && bArea) {
+            return sortArea(aArea, bArea)
+          } else {
+            return 0
+          }
         })
       }
 
@@ -1476,7 +1481,7 @@ export default {
       }
 
       if (this.completedRedirectUrl) {
-        window.location.href = this.completedRedirectUrl
+        window.location.href = sanitizeUrl(this.completedRedirectUrl)
       }
     }
   }

app/javascript/submission_form/formula_areas.vue

@@ -58,6 +58,13 @@ export default {
   computed: {
     isInlineSize () {
       return CSS.supports('container-type: size')
+    },
+    fieldsUuidIndex () {
+      return this.fields.reduce((acc, field) => {
+        acc[field.uuid] = field
+
+        return acc
+      }, {})
     }
   },
   async mounted () {
@@ -96,8 +103,19 @@ export default {
     findPageElementForArea (area) {
       return (this.$root.$el?.parentNode?.getRootNode() || document).getElementById(`page-${area.attachment_uuid}-${area.page}`)
     },
+    normalizeFormula (formula, depth = 0) {
+      if (depth > 10) return formula
+
+      return formula.replace(/{{(.*?)}}/g, (match, uuid) => {
+        if (this.fieldsUuidIndex[uuid]) {
+          return `(${this.normalizeFormula(this.fieldsUuidIndex[uuid].preferences.formula, depth + 1)})`
+        } else {
+          return match
+        }
+      })
+    },
     calculateFormula (field) {
-      const transformedFormula = field.preferences.formula.replace(/{{(.*?)}}/g, (match, uuid) => {
+      const transformedFormula = this.normalizeFormula(field.preferences.formula).replace(/{{(.*?)}}/g, (match, uuid) => {
         return this.readonlyValues[uuid] || this.values[uuid] || 0.0
       })
 

app/javascript/submission_form/markdown_content.vue

@@ -1,35 +1,32 @@
 <template>
   <span>
-    <template
+    <span v-if="textOnly">
-      v-for="(item, index) in items"
+      {{ dom.body.textContent }}
-      :key="index"
+    </span>
-    >
+    <template v-else>
-      <a
-        v-if="item.startsWith('<a') && item.endsWith('</a>')"
-        :href="sanitizeHref(extractAttr(item, 'href'))"
-        rel="noopener noreferrer nofollow"
-        :class="extractAttr(item, 'class') || 'link'"
-        target="_blank"
-      >
-        {{ extractText(item) }}
-      </a>
-      <b
-        v-else-if="item.startsWith('<b>') || item.startsWith('<strong>')"
-      >
-        {{ extractText(item) }}
-      </b>
-      <i
-        v-else-if="item.startsWith('<i>') || item.startsWith('<em>')"
-      >
-        {{ extractText(item) }}
-      </i>
-      <br
-        v-else-if="item === '<br>' || item === '\n'"
-      >
       <template
-        v-else
+        v-for="(item, index) in nodes || dom.body.childNodes"
+        :key="index"
       >
-        {{ item }}
+        <a
+          v-if="item.tagName === 'A' && item.getAttribute('href') !== 'undefined'"
+          :href="sanitizeUrl(item.getAttribute('href'))"
+          rel="noopener noreferrer nofollow"
+          :class="item.getAttribute('class') || 'link'"
+          target="_blank"
+        >
+          <MarkdownContent :nodes="item.childNodes" />
+        </a>
+        <component
+          :is="item.tagName"
+          v-else-if="safeTags.includes(item.tagName)"
+        >
+          <MarkdownContent :nodes="item.childNodes" />
+        </component>
+        <br v-else-if="item.tagName === 'BR' || item.nodeValue === '\n'">
+        <template v-else>
+          {{ item.textContent }}
+        </template>
       </template>
     </template>
   </span>
@@ -37,8 +34,7 @@
 
 <script>
 import snarkdown from 'snarkdown'
-
+import { sanitizeUrl } from '@braintree/sanitize-url'
-const htmlSplitRegexp = /(<a.+?<\/a>|<i>.+?<\/i>|<b>.+?<\/b>|<em>.+?<\/em>|<strong>.+?<\/strong>|<br>)/
 
 export default {
   name: 'MarkdownContent',
@@ -47,10 +43,23 @@ export default {
       type: String,
       required: false,
       default: ''
+    },
+    nodes: {
+      type: [Array, Object],
+      require: false,
+      default: null
+    },
+    textOnly: {
+      type: Boolean,
+      required: false,
+      default: false
     }
   },
   computed: {
-    items () {
+    safeTags () {
+      return ['UL', 'I', 'EM', 'B', 'STRONG', 'P']
+    },
+    dom () {
       const linkParts = this.string.split(/(https?:\/\/[^\s)]+)/g)
 
       const text = linkParts.map((part, index) => {
@@ -61,25 +70,11 @@ export default {
         }
       }).join('')
 
-      return snarkdown(text.replace(/\n/g, '<br>')).split(htmlSplitRegexp)
+      return new DOMParser().parseFromString(snarkdown(text.replace(/\n/g, '<br>')), 'text/html')
     }
   },
   methods: {
-    sanitizeHref (href) {
+    sanitizeUrl
-      if (href && href.trim().match(/^((?:https?:\/\/)|\/)/)) {
-        return href.replace(/javascript:/g, '')
-      }
-    },
-    extractAttr (text, attr) {
-      if (text.includes(attr)) {
-        return text.split(attr).pop().split('"')[1]
-      }
-    },
-    extractText (text) {
-      if (text) {
-        return text.match(/>(.+?)</)?.[1]
-      }
-    }
   }
 }
 </script>

app/javascript/submission_form/number_step.vue

@@ -39,8 +39,10 @@
       :id="field.uuid"
       v-model="number"
       type="number"
+      :step="field.validation?.step || 'any'"
+      :min="field.validation?.min"
+      :max="field.validation?.max"
       class="base-input !text-2xl w-full"
-      step="any"
       :required="field.required"
       :placeholder="`${t('type_here_')}${field.required ? '' : ` (${t('optional')})`}`"
       :name="`values[${field.uuid}]`"

app/javascript/submission_form/signature_step.vue

@@ -21,7 +21,7 @@
       </label>
       <div class="space-x-2 flex flex-none">
         <span
-          v-if="isTextSignature && format !== 'typed' && format !== 'upload'"
+          v-if="isTextSignature && format !== 'typed_or_upload' && format !== 'typed' && format !== 'upload'"
           class="tooltip"
           :data-tip="t('draw_signature')"
         >
@@ -38,7 +38,7 @@
           </a>
         </span>
         <span
-          v-else-if="withTypedSignature && format !== 'typed' && format !== 'drawn' && format !== 'upload'"
+          v-else-if="withTypedSignature && format !== 'drawn_or_upload' && format !== 'typed_or_upload' && format !== 'typed' && format !== 'drawn' && format !== 'upload'"
           class="tooltip ml-2"
           :class="{ 'hidden sm:inline': modelValue || computedPreviousValue }"
           :data-tip="t('type_text')"
@@ -85,8 +85,8 @@
           {{ t(format === 'upload' ? 'reupload' : 'redraw') }}
         </a>
         <span
-          v-if="withQrButton && !modelValue && !computedPreviousValue && format !== 'typed' && format !== 'upload'"
+          v-if="withQrButton && !modelValue && !computedPreviousValue && format !== 'typed_or_upload' && format !== 'typed' && format !== 'upload'"
-          class=" tooltip"
+          class="tooltip before:translate-x-[-90%]"
           :data-tip="t('drawn_signature_on_a_touchscreen_device')"
         >
           <a
@@ -395,7 +395,7 @@ export default {
       isShowQr: false,
       isOtherReason: false,
       isUsePreviousValue: true,
-      isTextSignature: this.field.preferences?.format === 'typed',
+      isTextSignature: this.field.preferences?.format === 'typed' || this.field.preferences?.format === 'typed_or_upload',
       uploadImageInputKey: Math.random().toString()
     }
   },

app/javascript/submission_form/verification_step.vue

@@ -149,12 +149,17 @@ export default {
       return fetch(this.baseUrl + `/api/identity_verification/${this.field.uuid}`, {
         method: 'PUT',
         body: JSON.stringify({
-          submitter_slug: this.submitterSlug
+          submitter_slug: this.submitterSlug,
+          redirect_url: document.location.href
         }),
         headers: { 'Content-Type': 'application/json' }
       }).then(async (resp) => {
         this.eidEasyData = await resp.json()
 
+        if (this.eidEasyData.check_completed) {
+          this.$emit('submit')
+        }
+
         if (this.eidEasyData.available_methods[0] === 'itsme-qes-signature' &&
             this.eidEasyData.available_methods.length === 1) {
           const redirectUrl = new URL('https://id.eideasy.com/sign_contract_external')
@@ -178,15 +183,23 @@ export default {
       })
     },
     async submit () {
-      return fetch(this.baseUrl + '/api/identity_verification', {
+      const resp = await fetch(this.baseUrl + '/api/identity_verification', {
         method: 'POST',
         body: JSON.stringify({
           submitter_slug: this.submitterSlug
         }),
         headers: { 'Content-Type': 'application/json' }
-      }).then(async (resp) => {
-        return resp
       })
+
+      if (resp.status === 404) {
+        throw new Error('Verification not completed yet')
+      }
+
+      if (resp.ok) {
+        return resp
+      } else {
+        throw new Error('Verification failed')
+      }
     }
   }
 }

app/javascript/template_builder/area.vue

@@ -72,11 +72,11 @@
         @blur="onNameBlur"
       >{{ optionIndexText }} {{ (defaultField ? (defaultField.title || field.title || field.name) : field.name) || defaultName }}</span>
       <div
-        v-if="isSettingsFocus || (isValueInput && field.type !== 'heading') || (isNameFocus && !['checkbox', 'phone'].includes(field.type))"
+        v-if="isSettingsFocus || isSelectInput || (isValueInput && field.type !== 'heading') || (isNameFocus && !['checkbox', 'phone'].includes(field.type))"
         class="flex items-center ml-1.5"
       >
         <input
-          v-if="!isValueInput"
+          v-if="!isValueInput && !isSelectInput"
           :id="`required-checkbox-${field.uuid}`"
           v-model="field.required"
           type="checkbox"
@@ -84,14 +84,14 @@
           @mousedown.prevent
         >
         <label
-          v-if="!isValueInput"
+          v-if="!isValueInput && !isSelectInput"
           :for="`required-checkbox-${field.uuid}`"
           class="label text-xs"
           @click.prevent="field.required = !field.required"
           @mousedown.prevent
         >{{ t('required') }}</label>
         <input
-          v-if="isValueInput"
+          v-if="isValueInput || isSelectInput"
           :id="`readonly-checkbox-${field.uuid}`"
           type="checkbox"
           class="checkbox checkbox-xs no-animation rounded"
@@ -100,7 +100,7 @@
           @mousedown.prevent
         >
         <label
-          v-if="isValueInput"
+          v-if="isValueInput || isSelectInput"
           :for="`readonly-checkbox-${field.uuid}`"
           class="label text-xs"
           @click.prevent="field.readonly = !(field.readonly ?? true)"
@@ -140,6 +140,8 @@
               :background-color="'white'"
               :with-required="false"
               :with-areas="false"
+              :with-signature-id="withSignatureId"
+              :with-prefillable="withPrefillable"
               @click-formula="isShowFormulaModal = true"
               @click-font="isShowFontModal = true"
               @click-description="isShowDescriptionModal = true"
@@ -162,30 +164,39 @@
       ref="touchValueTarget"
       class="flex h-full w-full field-area"
       dir="auto"
-      :class="[isValueInput ? 'bg-opacity-50' : 'bg-opacity-80', field.type === 'heading' ? 'bg-gray-50' : bgColors[submitterIndex % bgColors.length], isDefaultValuePresent || isValueInput || (withFieldPlaceholder && field.areas) ? fontClasses : 'justify-center items-center']"
+      :class="[isValueInput ? 'cursor-text' : '', isValueInput || isCheckboxInput || isSelectInput ? 'bg-opacity-50' : 'bg-opacity-80', field.type === 'heading' ? 'bg-gray-50' : bgColors[submitterIndex % bgColors.length], isDefaultValuePresent || isValueInput || (withFieldPlaceholder && field.areas) ? fontClasses : 'justify-center items-center']"
       @click="focusValueInput"
     >
       <span
         v-if="field"
         class="flex justify-center items-center space-x-1"
-        :class="{ 'w-full': ['cells', 'checkbox'].includes(field.type), 'h-full': !isValueInput && !isDefaultValuePresent }"
+        :class="{ 'w-full': isWFullType, 'h-full': !isValueInput && !isDefaultValuePresent }"
       >
         <div
-          v-if="isDefaultValuePresent || isValueInput || (withFieldPlaceholder && field.areas && field.type !== 'checkbox')"
+          v-if="isDefaultValuePresent || isValueInput || isSelectInput || (withFieldPlaceholder && field.areas && field.type !== 'checkbox')"
-          :class="{ 'w-full h-full': ['cells', 'checkbox'].includes(field.type) }"
+          :class="{ 'w-full h-full': isWFullType }"
           :style="fontStyle"
         >
           <div
             ref="textContainer"
             class="flex items-center px-0.5"
             :style="{ color: field.preferences?.color }"
-            :class="{ 'w-full h-full': ['cells', 'checkbox'].includes(field.type) }"
+            :class="{ 'w-full h-full': isWFullType }"
           >
             <IconCheck
               v-if="field.type == 'checkbox'"
               class="aspect-square mx-auto"
               :class="{ '!w-auto !h-full': area.w > area.h, '!w-full !h-auto': area.w <= area.h }"
             />
+            <template
+              v-else-if="(field.type === 'radio' || field.type === 'multiple') && field?.areas?.length > 1"
+            >
+              <IconCheck
+                v-if="field.type === 'multiple' ? field.default_value.includes(buildAreaOptionValue(area)) : buildAreaOptionValue(area) === field.default_value"
+                class="aspect-square mx-auto"
+                :class="{ '!w-auto !h-full': area.w > area.h, '!w-full !h-auto': area.w <= area.h }"
+              />
+            </template>
             <span
               v-else-if="field.type === 'number' && !isValueInput && (field.default_value || field.default_value == 0)"
               class="whitespace-pre-wrap"
@@ -208,14 +219,39 @@
                 {{ char }}
               </div>
             </div>
+            <select
+              v-else-if="isSelectInput"
+              ref="defaultValueSelect"
+              class="bg-transparent outline-none focus:outline-none w-full"
+              @change="[field.default_value = $event.target.value, field.readonly = !!field.default_value?.length, save()]"
+              @focus="selectedAreaRef.value = area"
+              @keydown.enter="onDefaultValueEnter"
+            >
+              <option
+                :disabled="!field.default_value?.length"
+                :selected="!field.default_value?.length"
+                :value="''"
+              >
+                {{ t(field.default_value?.length ? 'none' : 'select') }}
+              </option>
+              <option
+                v-for="(option, index) in field.options"
+                :key="index"
+                :selected="field.default_value === option.value"
+                :value="option.value"
+              >
+                {{ option.value }}
+              </option>
+            </select>
             <span
               v-else
               ref="defaultValue"
               :contenteditable="isValueInput"
-              class="whitespace-pre-wrap outline-none empty:before:content-[attr(placeholder)] before:text-gray-400"
+              class="whitespace-pre-wrap outline-none empty:before:content-[attr(placeholder)] before:text-base-content/30"
               :class="{ 'cursor-text': isValueInput }"
-              :placeholder="withFieldPlaceholder && !isValueInput ? defaultField?.title || field.title || field.name || defaultName : t('type_value')"
+              :placeholder="withFieldPlaceholder && !isValueInput ? defaultField?.title || field.title || field.name || defaultName : (field.type === 'date' ? field.preferences?.format || t('type_value') : t('type_value'))"
               @blur="onDefaultValueBlur"
+              @focus="selectedAreaRef.value = area"
               @paste.prevent="onPaste"
               @keydown.enter="onDefaultValueEnter"
             >{{ field.default_value }}</span>
@@ -223,7 +259,7 @@
         </div>
         <component
           :is="fieldIcons[field.type]"
-          v-else
+          v-else-if="!isCheckboxInput"
           width="100%"
           height="100%"
           class="max-h-10 opacity-50"
@@ -231,12 +267,12 @@
       </span>
     </div>
     <div
-      v-if="!isValueInput"
+      v-if="!isValueInput && !isSelectInput"
       ref="touchTarget"
       class="absolute top-0 bottom-0 right-0 left-0"
       :class="isDragged ? 'cursor-grab' : 'cursor-pointer'"
       @dblclick="maybeToggleDefaultValue"
-      @click="maybeToggleCheckboxValue"
+      @click="inputMode && maybeToggleCheckboxValue()"
     />
     <span
       v-if="field?.type && editable"
@@ -251,6 +287,7 @@
       <FormulaModal
         :field="field"
         :editable="editable && !defaultField"
+        :default-field="defaultField"
         :build-default-name="buildDefaultName"
         @close="isShowFormulaModal = false"
       />
@@ -262,6 +299,7 @@
       <FontModal
         :field="field"
         :editable="editable && !defaultField"
+        :default-field="defaultField"
         :build-default-name="buildDefaultName"
         @close="isShowFontModal = false"
       />
@@ -273,6 +311,7 @@
       <ConditionsModal
         :item="field"
         :build-default-name="buildDefaultName"
+        :default-field="defaultField"
         @close="isShowConditionsModal = false"
       />
     </Teleport>
@@ -283,6 +322,7 @@
       <DescriptionModal
         :field="field"
         :editable="editable && !defaultField"
+        :default-field="defaultField"
         :build-default-name="buildDefaultName"
         @close="isShowDescriptionModal = false"
       />
@@ -347,6 +387,16 @@ export default {
       required: false,
       default: false
     },
+    withSignatureId: {
+      type: Boolean,
+      required: false,
+      default: null
+    },
+    withPrefillable: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
     defaultSubmitters: {
       type: Array,
       required: false,
@@ -386,6 +436,9 @@ export default {
     fieldNames: FieldType.computed.fieldNames,
     fieldLabels: FieldType.computed.fieldLabels,
     fieldIcons: FieldType.computed.fieldIcons,
+    isWFullType () {
+      return ['cells', 'checkbox', 'radio', 'multiple', 'select'].includes(this.field.type)
+    },
     fontStyle () {
       let fontSize = ''
 
@@ -405,6 +458,13 @@ export default {
 
       return { fontSize, lineHeight: `calc(${fontSize} * ${this.lineHeight})` }
     },
+    optionsUuidIndex () {
+      return this.field.options.reduce((acc, option) => {
+        acc[option.uuid] = option
+
+        return acc
+      }, {})
+    },
     fontSizePx () {
       return parseInt(this.field?.preferences?.font_size || 11) * this.fontScale
     },
@@ -414,18 +474,18 @@ export default {
     fontScale () {
       return 1040 / 612.0
     },
-    ladscapeScale () {
-      return 8.5 / 11.0
-    },
     isDefaultValuePresent () {
-      if (this.field?.type === 'radio' && this.field?.areas?.length > 1) {
+      return this.field?.default_value || this.field?.default_value === 0
-        return false
+    },
-      } else {
+    isSelectInput () {
-        return this.field?.default_value || this.field?.default_value === 0
+      return this.inputMode && (this.field.type === 'select' || (this.field.type === 'radio' && this.field.areas?.length < 2))
-      }
+    },
+    isCheckboxInput () {
+      return this.inputMode && (this.field.type === 'checkbox' || (['radio', 'multiple'].includes(this.field.type) && this.area.option_uuid))
     },
     isValueInput () {
-      return (this.field.type === 'heading' && this.isHeadingSelected) || this.isContenteditable || (this.inputMode && ['text', 'number', 'date'].includes(this.field.type))
+      return (this.field.type === 'heading' && this.isHeadingSelected) || this.isContenteditable ||
+        (this.inputMode && (['text', 'number'].includes(this.field.type) || (this.field.type === 'date' && this.field.default_value !== '{{date}}')))
     },
     modalContainerEl () {
       return this.$el.getRootNode().querySelector('#docuseal_modal_container')
@@ -540,6 +600,11 @@ export default {
     closeDropdown () {
       this.$el.getRootNode().activeElement.blur()
     },
+    buildAreaOptionValue (area) {
+      const option = this.optionsUuidIndex[area.option_uuid]
+
+      return option.value || `${this.t('option')} ${this.field.options.indexOf(option) + 1}`
+    },
     maybeToggleDefaultValue () {
       if (!this.editable) {
         return
@@ -549,22 +614,41 @@ export default {
         this.isContenteditable = true
 
         this.focusValueInput()
-      } else if (this.field.type === 'checkbox') {
-        this.field.readonly = !this.field.readonly
-        this.field.default_value === true ? delete this.field.default_value : this.field.default_value = true
-
-        this.save()
       } else if (this.field.type === 'date') {
         this.field.readonly = !this.field.readonly
         this.field.default_value === '{{date}}' ? delete this.field.default_value : this.field.default_value = '{{date}}'
 
         this.save()
+      } else {
+        this.maybeToggleCheckboxValue()
       }
     },
     maybeToggleCheckboxValue () {
-      if (this.inputMode && this.field.type === 'checkbox') {
+      if (this.field.type === 'checkbox') {
-        this.field.readonly = !this.field.readonly
         this.field.default_value === true ? delete this.field.default_value : this.field.default_value = true
+        this.field.readonly = this.field.default_value === true
+
+        this.save()
+      } else if (this.field.type === 'radio' && this.area.option_uuid) {
+        const value = this.buildAreaOptionValue(this.area)
+
+        this.field.default_value === value ? delete this.field.default_value : this.field.default_value = value
+
+        this.field.readonly = !!this.field.default_value?.length
+
+        this.save()
+      } else if (this.field.type === 'multiple' && this.area.option_uuid) {
+        const value = this.buildAreaOptionValue(this.area)
+
+        if (this.field.default_value?.includes(value)) {
+          this.field.default_value.splice(this.field.default_value.indexOf(value), 1)
+
+          if (!this.field.default_value?.length) delete this.field.default_value
+        } else {
+          Array.isArray(this.field.default_value) ? this.field.default_value.push(value) : this.field.default_value = [value]
+        }
+
+        this.field.readonly = !!this.field.default_value?.length
 
         this.save()
       }
@@ -740,7 +824,7 @@ export default {
       }
     },
     drag (e) {
-      if (e.target.id === 'mask') {
+      if (e.target.id === 'mask' && this.editable) {
         this.isDragged = true
 
         this.area.x = (e.offsetX - this.dragFrom.x) / e.target.clientWidth
@@ -756,7 +840,9 @@ export default {
 
       e.preventDefault()
 
-      this.isDragged = true
+      if (this.editable) {
+        this.isDragged = true
+      }
 
       const rect = e.target.getBoundingClientRect()
 
@@ -809,7 +895,9 @@ export default {
 
       e.preventDefault()
 
-      this.isDragged = true
+      if (this.editable) {
+        this.isDragged = true
+      }
 
       const rect = e.target.getBoundingClientRect()
 

app/javascript/template_builder/builder.vue

@@ -330,6 +330,8 @@
                 :input-mode="inputMode"
                 :default-fields="[...defaultRequiredFields, ...defaultFields]"
                 :allow-draw="!onlyDefinedFields || drawField"
+                :with-signature-id="withSignatureId"
+                :with-prefillable="withPrefillable"
                 :data-document-uuid="document.uuid"
                 :default-submitters="defaultSubmitters"
                 :drag-field-placeholder="fieldsDragFieldRef.value || dragField"
@@ -436,6 +438,8 @@
             :default-required-fields="defaultRequiredFields"
             :field-types="fieldTypes"
             :with-sticky-submitters="withStickySubmitters"
+            :with-signature-id="withSignatureId"
+            :with-prefillable="withPrefillable"
             :only-defined-fields="onlyDefinedFields"
             :editable="editable"
             :show-tour-start-form="showTourStartForm"
@@ -563,6 +567,11 @@ export default {
       required: false,
       default: false
     },
+    withSignatureId: {
+      type: Boolean,
+      required: false,
+      default: null
+    },
     backgroundColor: {
       type: String,
       required: false,
@@ -651,7 +660,7 @@ export default {
     acceptFileTypes: {
       type: String,
       required: false,
-      default: 'image/*, application/pdf'
+      default: 'image/*, application/pdf, application/zip'
     },
     baseUrl: {
       type: String,
@@ -794,6 +803,13 @@ export default {
     language () {
       return this.locale.split('-')[0].toLowerCase()
     },
+    withPrefillable () {
+      if (this.template.fields) {
+        return this.template.fields.some((f) => f.prefillable)
+      } else {
+        return false
+      }
+    },
     isInlineSize () {
       return CSS.supports('container-type: size')
     },
@@ -1049,7 +1065,7 @@ export default {
       }
 
       if (['select', 'multiple', 'radio'].includes(type)) {
-        field.options = [{ value: '', uuid: v4() }]
+        field.options = [{ value: '', uuid: v4() }, { value: '', uuid: v4() }]
       }
 
       if (type === 'stamp') {
@@ -1068,6 +1084,11 @@ export default {
         }
       }
 
+      if (type === 'signature' && [true, false].includes(this.withSignatureId)) {
+        field.preferences ||= {}
+        field.preferences.with_signature_id = this.withSignatureId
+      }
+
       this.template.fields.push(field)
 
       this.save()
@@ -1088,7 +1109,7 @@ export default {
         }
 
         if (['select', 'multiple', 'radio'].includes(type)) {
-          field.options = [{ value: '', uuid: v4() }]
+          field.options = [{ value: '', uuid: v4() }, { value: '', uuid: v4() }]
         }
 
         if (type === 'stamp') {
@@ -1244,24 +1265,31 @@ export default {
       if (!field.areas.length) {
         this.template.fields.splice(this.template.fields.indexOf(field), 1)
 
-        this.template.fields.forEach((f) => {
+        this.removeFieldConditions(field)
-          (f.conditions || []).forEach((c) => {
+      }
+
+      this.save()
+    },
+    removeFieldConditions (field) {
+      this.template.fields.forEach((f) => {
+        if (f.conditions) {
+          f.conditions.forEach((c) => {
             if (c.field_uuid === field.uuid) {
               f.conditions.splice(f.conditions.indexOf(c), 1)
             }
           })
-        })
+        }
+      })
 
-        this.template.schema.forEach((item) => {
+      this.template.schema.forEach((item) => {
-          (item.conditions || []).forEach((c) => {
+        if (item.conditions) {
+          item.conditions.forEach((c) => {
             if (c.field_uuid === field.uuid) {
               item.conditions.splice(item.conditions.indexOf(c), 1)
             }
           })
-        })
+        }
-      }
+      })
-
-      this.save()
     },
     pasteField () {
       const field = this.template.fields.find((f) => f.areas?.includes(this.copiedArea))
@@ -1280,7 +1308,13 @@ export default {
           this.copiedArea.option_uuid ||= field.options[0].uuid
           area.option_uuid = v4()
 
-          field.options.push({ uuid: area.option_uuid })
+          const lastOption = field.options[field.options.length - 1]
+
+          if (!field.areas.find((a) => lastOption.uuid === a.option_uuid)) {
+            area.option_uuid = lastOption.uuid
+          } else {
+            field.options.push({ uuid: area.option_uuid })
+          }
 
           field.areas.push(area)
         } else {
@@ -1456,7 +1490,7 @@ export default {
           if (this.dragField?.options?.length) {
             field.options = this.dragField.options.map(option => ({ value: option, uuid: v4() }))
           } else {
-            field.options = [{ value: '', uuid: v4() }]
+            field.options = [{ value: '', uuid: v4() }, { value: '', uuid: v4() }]
           }
         }
 
@@ -1474,6 +1508,11 @@ export default {
           field.preferences ||= {}
           field.preferences.format ||= this.defaultDateFormat
         }
+
+        if (field.type === 'signature' && [true, false].includes(this.withSignatureId)) {
+          field.preferences ||= {}
+          field.preferences.with_signature_id = this.withSignatureId
+        }
       }
 
       const fieldArea = {
@@ -1683,8 +1722,15 @@ export default {
           })
         })
 
-        this.template.fields =
+        this.template.fields = this.template.fields.reduce((acc, f) => {
-          this.template.fields.filter((f) => !removedFieldUuids.includes(f.uuid) || f.areas?.length)
+          if (removedFieldUuids.includes(f.uuid) && !f.areas?.length) {
+            this.removeFieldConditions(f)
+          } else {
+            acc.push(f)
+          }
+
+          return acc
+        }, [])
 
         this.save()
       }

app/javascript/template_builder/conditions_modal.vue

@@ -9,7 +9,7 @@
     <div class="modal-box pt-4 pb-6 px-6 mt-20 max-h-none w-full max-w-xl">
       <div class="flex justify-between items-center border-b pb-2 mb-2 font-medium">
         <span class="modal-title">
-          {{ t('condition') }} - {{ item.name || buildDefaultName(item, template.fields) }}
+          {{ t('condition') }} - {{ (defaultField ? (defaultField.title || item.title || item.name) : item.name) || buildDefaultName(item, template.fields) }}
         </span>
         <a
           href="#"
@@ -160,6 +160,11 @@ export default {
       type: Object,
       required: true
     },
+    defaultField: {
+      type: Object,
+      required: false,
+      default: null
+    },
     buildDefaultName: {
       type: Function,
       required: true

app/javascript/template_builder/controls.vue

@@ -66,7 +66,7 @@ export default {
     acceptFileTypes: {
       type: String,
       required: false,
-      default: 'image/*, application/pdf'
+      default: 'image/*, application/pdf, application/zip'
     },
     withReplaceButton: {
       type: Boolean,

app/javascript/template_builder/description_modal.vue

@@ -9,7 +9,7 @@
     <div class="modal-box pt-4 pb-6 px-6 mt-20 max-h-none w-full max-w-xl">
       <div class="flex justify-between items-center border-b pb-2 mb-2 font-medium">
         <span class="modal-title">
-          {{ field.name || buildDefaultName(field, template.fields) }}
+          {{ (defaultField ? (defaultField.title || field.title || field.name) : field.name) || buildDefaultName(field, template.fields) }}
         </span>
         <a
           href="#"
@@ -73,6 +73,11 @@ export default {
       type: Object,
       required: true
     },
+    defaultField: {
+      type: Object,
+      required: false,
+      default: null
+    },
     editable: {
       type: Boolean,
       required: false,

app/javascript/template_builder/document.vue

@@ -10,6 +10,8 @@
       :data-page="index"
       :areas="areasIndex[index]"
       :allow-draw="allowDraw"
+      :with-signature-id="withSignatureId"
+      :with-prefillable="withPrefillable"
       :is-drag="isDrag"
       :with-field-placeholder="withFieldPlaceholder"
       :default-fields="defaultFields"
@@ -66,6 +68,16 @@ export default {
       required: false,
       default: false
     },
+    withSignatureId: {
+      type: Boolean,
+      required: false,
+      default: null
+    },
+    withPrefillable: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
     drawFieldType: {
       type: String,
       required: false,

app/javascript/template_builder/dropzone.vue

@@ -107,7 +107,7 @@ export default {
     acceptFileTypes: {
       type: String,
       required: false,
-      default: 'image/*, application/pdf'
+      default: 'image/*, application/pdf, application/zip'
     }
   },
   emits: ['success', 'error', 'loading'],
@@ -131,7 +131,7 @@ export default {
     message () {
       if (this.isLoading) {
         return this.t('uploading')
-      } else if (this.acceptFileTypes === 'image/*, application/pdf') {
+      } else if (this.acceptFileTypes === 'image/*, application/pdf, application/zip') {
         return this.title || this.t('add_pdf_documents_or_images')
       } else {
         return this.title || this.t('add_documents_or_images')
@@ -146,7 +146,7 @@ export default {
   methods: {
     upload: Upload.methods.upload,
     onDropFiles (e) {
-      if (this.acceptFileTypes !== 'image/*, application/pdf' || [...e.dataTransfer.files].every((f) => f.type.match(/(?:image\/)|(?:application\/pdf)/))) {
+      if (this.acceptFileTypes !== 'image/*, application/pdf, application/zip' || [...e.dataTransfer.files].every((f) => f.type.match(/(?:image\/)|(?:application\/pdf)|(?:application\/zip)/))) {
         this.$refs.input.files = e.dataTransfer.files
 
         this.upload()

app/javascript/template_builder/field.vue

@@ -125,6 +125,8 @@
                 :field="field"
                 :default-field="defaultField"
                 :editable="editable"
+                :with-signature-id="withSignatureId"
+                :with-prefillable="withPrefillable"
                 :background-color="dropdownBgColor"
                 @click-formula="isShowFormulaModal = true"
                 @click-font="isShowFontModal = true"
@@ -149,7 +151,7 @@
         </div>
       </div>
       <div
-        v-if="field.options && withOptions"
+        v-if="field.options && withOptions && (isExpandOptions || field.options.length < 5)"
         ref="options"
         class="border-t border-base-300 mx-2 pt-2 space-y-1.5"
         draggable="true"
@@ -214,12 +216,30 @@
         />
         <button
           v-else-if="field.options && editable && !defaultField"
-          class="text-center text-sm w-full pb-1"
+          class="field-add-option text-center text-sm w-full pb-1"
           @click="addOption"
         >
           + {{ t('add_option') }}
         </button>
       </div>
+      <div
+        v-else-if="field.options && withOptions && !isExpandOptions && field.options.length > 4"
+        class="border-t border-base-300 mx-2 space-y-1.5"
+      >
+        <button
+          class="field-expand-options text-center text-sm w-full py-1 flex space-x-0.5 justify-center items-center"
+          @click="isExpandOptions = true"
+        >
+          <span class="lowercase">
+            {{ field.options.length }} {{ t('options') }}
+          </span>
+          <IconChevronDown
+            class="ml-2 mr-2 mt-0.5"
+            width="15"
+            height="15"
+          />
+        </button>
+      </div>
     </div>
     <Teleport
       v-if="isShowFormulaModal"
@@ -228,6 +248,7 @@
       <FormulaModal
         :field="field"
         :editable="editable && !defaultField"
+        :default-field="defaultField"
         :build-default-name="buildDefaultName"
         @close="isShowFormulaModal = false"
       />
@@ -239,6 +260,7 @@
       <FontModal
         :field="field"
         :editable="editable && !defaultField"
+        :default-field="defaultField"
         :build-default-name="buildDefaultName"
         @close="isShowFontModal = false"
       />
@@ -249,6 +271,7 @@
     >
       <ConditionsModal
         :item="field"
+        :default-field="defaultField"
         :build-default-name="buildDefaultName"
         @close="isShowConditionsModal = false"
       />
@@ -260,6 +283,7 @@
       <DescriptionModal
         :field="field"
         :editable="editable && !defaultField"
+        :default-field="defaultField"
         :build-default-name="buildDefaultName"
         @close="isShowDescriptionModal = false"
       />
@@ -276,7 +300,7 @@ import FormulaModal from './formula_modal'
 import FontModal from './font_modal'
 import ConditionsModal from './conditions_modal'
 import DescriptionModal from './description_modal'
-import { IconRouteAltLeft, IconMathFunction, IconNewSection, IconTrashX, IconSettings } from '@tabler/icons-vue'
+import { IconRouteAltLeft, IconMathFunction, IconNewSection, IconTrashX, IconSettings, IconChevronDown } from '@tabler/icons-vue'
 import { v4 } from 'uuid'
 
 export default {
@@ -286,6 +310,7 @@ export default {
     IconSettings,
     FieldSettings,
     PaymentSettings,
+    IconChevronDown,
     IconNewSection,
     FormulaModal,
     FontModal,
@@ -302,6 +327,16 @@ export default {
       type: Object,
       required: true
     },
+    withSignatureId: {
+      type: Boolean,
+      required: false,
+      default: null
+    },
+    withPrefillable: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
     withOptions: {
       type: Boolean,
       required: false,
@@ -321,6 +356,7 @@ export default {
   emits: ['set-draw', 'remove', 'scroll-to'],
   data () {
     return {
+      isExpandOptions: false,
       isNameFocus: false,
       showPaymentModal: false,
       isShowFormulaModal: false,
@@ -415,6 +451,8 @@ export default {
       this.$el.getRootNode().activeElement.blur()
     },
     addOption () {
+      this.isExpandOptions = true
+
       this.field.options.push({ value: '', uuid: v4() })
 
       this.$nextTick(() => {

app/javascript/template_builder/field_settings.vue

@@ -1,31 +1,4 @@
 <template>
-  <div
-    v-if="field.type === 'number'"
-    class="py-1.5 px-1 relative"
-    @click.stop
-  >
-    <select
-      :placeholder="t('format')"
-      class="select select-bordered select-xs font-normal w-full max-w-xs !h-7 !outline-0 bg-transparent"
-      @change="[field.preferences ||= {}, field.preferences.format = $event.target.value, save()]"
-    >
-      <option
-        v-for="format in numberFormats"
-        :key="format"
-        :value="format"
-        :selected="format === field.preferences?.format || (format === 'none' && !field.preferences?.format)"
-      >
-        {{ formatNumber(123456789.567, format) }}
-      </option>
-    </select>
-    <label
-      :style="{ backgroundColor }"
-      class="absolute -top-1 left-2.5 px-1 h-4"
-      style="font-size: 8px"
-    >
-      {{ t('format') }}
-    </label>
-  </div>
   <div
     v-if="field.type === 'verification'"
     class="py-1.5 px-1 relative"
@@ -217,6 +190,77 @@
       </label>
     </div>
   </div>
+  <div
+    v-if="field.type === 'number'"
+    class="py-1.5 px-1 relative flex space-x-1"
+    @click.stop
+  >
+    <div class="w-1/2 relative">
+      <input
+        :placeholder="t('min')"
+        type="number"
+        min="0"
+        :value="field.validation?.min"
+        class="input input-bordered w-full input-xs h-7 !outline-0 bg-transparent"
+        @input="[field.validation ||= {}, $event.target.value ? field.validation.min = $event.target.value : delete field.validation.min]"
+        @blur="save"
+      >
+      <label
+        v-if="field.validation?.min"
+        :style="{ backgroundColor }"
+        class="absolute -top-2.5 left-1.5 px-1 h-4"
+        style="font-size: 8px"
+      >
+        {{ t('min') }}
+      </label>
+    </div>
+    <div class="w-1/2 relative">
+      <input
+        :placeholder="t('max')"
+        type="number"
+        min="1"
+        class="input input-bordered w-full input-xs h-7 !outline-0 bg-transparent"
+        :value="field.validation?.max"
+        @input="[field.validation ||= {}, $event.target.value ? field.validation.max = $event.target.value : delete field.validation.max]"
+        @blur="save"
+      >
+      <label
+        v-if="field.validation?.max"
+        :style="{ backgroundColor }"
+        class="absolute -top-2.5 left-1.5 px-1 h-4"
+        style="font-size: 8px"
+      >
+        {{ t('max') }}
+      </label>
+    </div>
+  </div>
+  <div
+    v-if="field.type === 'number'"
+    class="py-1.5 px-1 relative"
+    @click.stop
+  >
+    <select
+      :placeholder="t('format')"
+      class="select select-bordered select-xs font-normal w-full max-w-xs !h-7 !outline-0 bg-transparent"
+      @change="[field.preferences ||= {}, field.preferences.format = $event.target.value, save()]"
+    >
+      <option
+        v-for="format in numberFormats"
+        :key="format"
+        :value="format"
+        :selected="format === field.preferences?.format || (format === 'none' && !field.preferences?.format)"
+      >
+        {{ formatNumber(123456789.567, format) }}
+      </option>
+    </select>
+    <label
+      :style="{ backgroundColor }"
+      class="absolute -top-1 left-2.5 px-1 h-4"
+      style="font-size: 8px"
+    >
+      {{ t('format') }}
+    </label>
+  </div>
   <div
     v-if="['text', 'cells'].includes(field.type) && field.validation && !validations[field.validation.pattern] && !lengthValidation"
     class="py-1.5 px-1 relative"
@@ -304,7 +348,7 @@
         {{ t('any') }}
       </option>
       <option
-        v-for="type in ['drawn', 'typed', 'drawn_or_typed', 'upload']"
+        v-for="type in ['drawn', 'typed', 'drawn_or_typed', 'drawn_or_upload', 'upload']"
         :key="type"
         :value="type"
         :selected="field.preferences?.format === type"
@@ -320,6 +364,21 @@
       {{ t('format') }}
     </label>
   </div>
+  <li
+    v-if="[true, false].includes(withSignatureId) && field.type === 'signature'"
+    @click.stop
+  >
+    <label class="cursor-pointer py-1.5">
+      <input
+        :checked="field.preferences?.with_signature_id"
+        type="checkbox"
+        :disabled="!editable || (defaultField && [true, false].includes(defaultField.required))"
+        class="toggle toggle-xs"
+        @change="[field.preferences ||= {}, field.preferences.with_signature_id = $event.target.checked, save()]"
+      >
+      <span class="label-text">{{ t('signature_id') }}</span>
+    </label>
+  </li>
   <li
     v-if="withRequired && field.type !== 'phone' && field.type !== 'stamp' && field.type !== 'verification'"
     @click.stop
@@ -378,7 +437,7 @@
     </label>
   </li>
   <li
-    v-if="['text', 'number'].includes(field.type) && !defaultField"
+    v-if="['text', 'number'].includes(field.type)"
     @click.stop
   >
     <label class="cursor-pointer py-1.5">
@@ -386,11 +445,27 @@
         v-model="field.readonly"
         type="checkbox"
         class="toggle toggle-xs"
+        :disabled="!editable || (defaultField && [true, false].includes(defaultField.readonly))"
         @update:model-value="save"
       >
       <span class="label-text">{{ t('read_only') }}</span>
     </label>
   </li>
+  <li
+    v-if="withPrefillable && ['text', 'number', 'cells', 'date', 'checkbox', 'select', 'radio', 'phone'].includes(field['type'])"
+    @click.stop
+  >
+    <label class="cursor-pointer py-1.5">
+      <input
+        v-model="field.prefillable"
+        type="checkbox"
+        :disabled="!editable || (defaultField && [true, false].includes(defaultField.prefillable))"
+        class="toggle toggle-xs"
+        @update:model-value="save"
+      >
+      <span class="label-text">{{ t('prefillable') }}</span>
+    </label>
+  </li>
   <hr
     v-if="field.type != 'stamp'"
     class="pb-0.5 mt-0.5"
@@ -525,6 +600,11 @@ export default {
       type: Object,
       required: true
     },
+    withSignatureId: {
+      type: Boolean,
+      required: false,
+      default: null
+    },
     backgroundColor: {
       type: String,
       required: false,
@@ -535,6 +615,11 @@ export default {
       required: false,
       default: null
     },
+    withPrefillable: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
     withRequired: {
       type: Boolean,
       required: false,

app/javascript/template_builder/fields.vue

@@ -26,6 +26,8 @@
       :field="field"
       :type-index="fields.filter((f) => f.type === field.type).indexOf(field)"
       :editable="editable"
+      :with-signature-id="withSignatureId"
+      :with-prefillable="withPrefillable"
       :default-field="defaultFieldsIndex[field.name]"
       :draggable="editable"
       @dragstart="[fieldsDragFieldRef.value = field, removeDragOverlay($event), setDragPlaceholder($event)]"
@@ -253,6 +255,16 @@ export default {
       required: false,
       default: null
     },
+    withSignatureId: {
+      type: Boolean,
+      required: false,
+      default: null
+    },
+    withPrefillable: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
     template: {
       type: Object,
       required: true

app/javascript/template_builder/font_modal.vue

@@ -9,7 +9,7 @@
     <div class="modal-box pt-4 pb-6 px-6 mt-20 max-h-none w-full max-w-xl">
       <div class="flex justify-between items-center border-b pb-2 mb-2 font-medium">
         <span class="modal-title">
-          {{ t('font') }} - {{ field.name || buildDefaultName(field, template.fields) }}
+          {{ t('font') }} - {{ (defaultField ? (defaultField.title || field.title || field.name) : field.name) || buildDefaultName(field, template.fields) }}
         </span>
         <a
           href="#"
@@ -163,7 +163,7 @@
             class="flex border border-base-content/20 rounded-xl bg-white px-4 h-16 modal-field-font-preview"
             :style="{
               color: preferences.color || 'black',
-              fontSize: (preferences.font_size || 12) + 'pt',
+              fontSize: (preferences.font_size || 11) + 'pt',
             }"
             :class="textClasses"
           >
@@ -202,6 +202,11 @@ export default {
       type: Object,
       required: true
     },
+    defaultField: {
+      type: Object,
+      required: false,
+      default: null
+    },
     editable: {
       type: Boolean,
       required: false,

app/javascript/template_builder/formula_modal.vue

@@ -9,7 +9,7 @@
     <div class="modal-box pt-4 pb-6 px-6 mt-20 max-h-none w-full max-w-xl">
       <div class="flex justify-between items-center border-b pb-2 mb-2 font-medium">
         <span class="modal-title">
-          {{ t('formula') }} - {{ field.name || buildDefaultName(field, template.fields) }}
+          {{ t('formula') }} - {{ (defaultField ? (defaultField.title || field.title || field.name) : field.name) || buildDefaultName(field, template.fields) }}
         </span>
         <a
           href="#"
@@ -28,14 +28,21 @@
             class="link"
           >{{ t('available_in_pro') }}</a>
         </div>
-        <div class="flex-inline mb-2 gap-2 space-y-1">
+        <div class="flex flex-wrap mb-2 gap-y-1 pt-1">
           <button
             v-for="f in fields"
             :key="f.uuid"
-            class="mr-1 btn btn-neutral btn-outline border-base-content/20 btn-sm normal-case font-normal bg-white !rounded-xl"
+            class="mr-1 flex btn btn-neutral btn-outline border-base-content/20 btn-sm normal-case font-normal bg-white !rounded-xl"
             @click.prevent="insertTextUnderCursor(`{{${f.name || buildDefaultName(f, template.fields)}}}`)"
           >
+            <IconMathFunction
+              v-if="f.preferences?.formula"
+              width="17"
+              height="17"
+              stroke-width="1.5"
+            />
             <IconCodePlus
+              v-else
               width="20"
               height="20"
               stroke-width="1.5"
@@ -57,7 +64,7 @@
           <div class="mb-3 mt-1">
             <div
               target="blank"
-              class="text-sm mb-2 inline space-x-2"
+              class="text-sm mb-2 inline space-x-2 font-mono"
             >
               <button
                 class="bg-base-200 px-2 rounded-xl"
@@ -83,12 +90,6 @@
               >
                 /
               </button>
-              <button
-                class="bg-base-200 px-2 rounded-xl"
-                @click="insertTextUnderCursor(' % ')"
-              >
-                %
-              </button>
               <button
                 class="bg-base-200 px-2 rounded-xl"
                 @click="insertTextUnderCursor('^')"
@@ -122,12 +123,13 @@
 </template>
 
 <script>
-import { IconCodePlus } from '@tabler/icons-vue'
+import { IconCodePlus, IconMathFunction } from '@tabler/icons-vue'
 
 export default {
   name: 'FormulaModal',
   components: {
-    IconCodePlus
+    IconCodePlus,
+    IconMathFunction
   },
   inject: ['t', 'save', 'template', 'withFormula'],
   props: {
@@ -135,6 +137,11 @@ export default {
       type: Object,
       required: true
     },
+    defaultField: {
+      type: Object,
+      required: false,
+      default: null
+    },
     editable: {
       type: Boolean,
       required: false,
@@ -154,7 +161,7 @@ export default {
   computed: {
     fields () {
       return this.template.fields.reduce((acc, f) => {
-        if (f !== this.field && ['number'].includes(f.type) && (!f.preferences?.formula || f.submitter_uuid !== this.field.submitter_uuid)) {
+        if (f !== this.field && ['number'].includes(f.type) && (!f.preferences?.formula || !f.preferences.formula.includes(this.field.uuid))) {
           acc.push(f)
         }
 
@@ -224,9 +231,11 @@ export default {
 
       this.formula = newText
 
-      textarea.setSelectionRange(cursorPos + textToInsert.length, cursorPos + textToInsert.length)
+      this.$nextTick(() => {
+        textarea.setSelectionRange(cursorPos + textToInsert.length, cursorPos + textToInsert.length)
 
-      textarea.focus()
+        textarea.focus()
+      })
     },
     resizeTextarea () {
       const textarea = this.$refs.textarea

app/javascript/template_builder/hover_dropzone.vue

@@ -2,6 +2,8 @@
   <div
     v-if="isDragging || isLoading"
     class="modal modal-open"
+    @dragover.prevent
+    @drop.prevent="$emit('error')"
   >
     <div class="flex flex-col gap-2 p-4 items-center bg-base-100 h-full max-h-[85vh] max-w-6xl rounded-2xl w-full">
       <Dropzone
@@ -76,7 +78,7 @@ export default {
     acceptFileTypes: {
       type: String,
       required: false,
-      default: 'image/*, application/pdf'
+      default: 'image/*, application/pdf, application/zip'
     }
   },
   emits: ['add', 'replace', 'replace-and-clone', 'error'],

app/javascript/template_builder/i18n.js

@@ -1,4 +1,6 @@
 const en = {
+  prefillable: 'Prefillable',
+  signature_id: 'Signature ID',
   error_message: 'Error message',
   length: 'Length',
   min: 'Min',
@@ -58,6 +60,7 @@ const en = {
   any: 'Any',
   drawn: 'Drawn',
   drawn_or_typed: 'Drawn or Typed',
+  drawn_or_upload: 'Drawn or Upload',
   upload: 'Upload',
   formula: 'Formula',
   typed: 'Typed',
@@ -80,6 +83,7 @@ const en = {
   copy_to_all_pages: 'Copy to All Pages',
   add_option: 'Add option',
   option: 'Option',
+  options: 'Options',
   condition: 'Condition',
   first_party: 'First Party',
   second_party: 'Second Party',
@@ -172,6 +176,8 @@ const en = {
 }
 
 const es = {
+  prefillable: 'Rellenable',
+  signature_id: 'ID de Firma',
   error_message: 'Mensaje de error',
   length: 'Longitud',
   min: 'Mín',
@@ -250,6 +256,7 @@ const es = {
   copy_to_all_pages: 'Copiar a todas las páginas',
   add_option: 'Agregar opción',
   option: 'Opción',
+  options: 'Opciones',
   first_party: 'Primera Parte',
   second_party: 'Segunda Parte',
   third_party: 'Tercera Parte',
@@ -318,6 +325,7 @@ const es = {
   any: 'Cualquier',
   drawn: 'Dibujado',
   drawn_or_typed: 'Dibujado o Escrito',
+  drawn_or_upload: 'Dibujado o Subido',
   upload: 'Subir',
   typed: 'Escrito',
   none: 'Ninguno',
@@ -345,6 +353,8 @@ const es = {
 }
 
 const it = {
+  prefillable: 'Precompilabile',
+  signature_id: 'ID firma',
   error_message: 'Messaggio di errore',
   length: 'Lunghezza',
   min: 'Min',
@@ -404,6 +414,7 @@ const it = {
   any: 'Qualsiasi',
   drawn: 'Disegnato',
   drawn_or_typed: 'Disegnato o Digitato',
+  drawn_or_upload: 'Disegnato o Caricato',
   upload: 'Caricare',
   formula: 'Formula',
   typed: 'Digitato',
@@ -426,6 +437,7 @@ const it = {
   copy_to_all_pages: 'Copia in tutte le pagine',
   add_option: 'Aggiungi opzione',
   option: 'Opzione',
+  options: 'Opzioni',
   condition: 'Condizione',
   first_party: 'Prima parte',
   second_party: 'Seconda parte',
@@ -518,6 +530,8 @@ const it = {
 }
 
 const pt = {
+  prefillable: 'Pré-preenchível',
+  signature_id: 'ID da Assinatura',
   error_message: 'Mensagem de erro',
   length: 'Comprimento',
   min: 'Mín',
@@ -596,6 +610,7 @@ const pt = {
   copy_to_all_pages: 'Copiar para todas as páginas',
   add_option: 'Adicionar opção',
   option: 'Opção',
+  options: 'Opções',
   first_party: 'Primeira Parte',
   second_party: 'Segunda Parte',
   third_party: 'Terceira Parte',
@@ -664,6 +679,7 @@ const pt = {
   any: 'Qualquer',
   drawn: 'Desenhado',
   drawn_or_typed: 'Desenhado ou Digitado',
+  drawn_or_upload: 'Desenhado ou Enviado',
   upload: 'Carregar',
   typed: 'Digitado',
   none: 'Nenhum',
@@ -691,6 +707,8 @@ const pt = {
 }
 
 const fr = {
+  prefillable: 'Pré-remplissable',
+  signature_id: 'ID de signature',
   error_message: 'Message d\'erreur',
   length: 'Longueur',
   min: 'Min',
@@ -768,6 +786,7 @@ const fr = {
   copy_to_all_pages: 'Copier sur toutes les pages',
   add_option: 'Ajouter une option',
   option: 'Option',
+  options: 'Options',
   first_party: 'Première partie',
   second_party: 'Deuxième partie',
   third_party: 'Troisième partie',
@@ -837,6 +856,7 @@ const fr = {
   any: 'Tout',
   drawn: 'Dessiné',
   drawn_or_typed: 'Dessiné ou Tapé',
+  drawn_or_upload: 'Dessiné ou Téléchargé',
   upload: 'Téléverser',
   typed: 'Tapé',
   none: 'Aucun',
@@ -864,6 +884,8 @@ const fr = {
 }
 
 const de = {
+  prefillable: 'Vorausfüllbar',
+  signature_id: 'Signatur-ID',
   error_message: 'Fehlermeldung',
   length: 'Länge',
   min: 'Min',
@@ -941,6 +963,7 @@ const de = {
   copy_to_all_pages: 'Auf alle Seiten kopieren',
   add_option: 'Option hinzufügen',
   option: 'Option',
+  options: 'Options',
   first_party: 'Erste Partei',
   second_party: 'Zweite Partei',
   third_party: 'Dritte Partei',
@@ -1010,6 +1033,7 @@ const de = {
   any: 'Jede',
   drawn: 'Gezeichnet',
   drawn_or_typed: 'Gezeichnet oder getippt',
+  drawn_or_upload: 'Gezeichnet oder hochgeladen',
   upload: 'Upload',
   typed: 'Getippt',
   none: 'Keine',

app/javascript/template_builder/page.vue

@@ -1,7 +1,7 @@
 <template>
   <div
     class="relative select-none mb-4 before:border before:rounded before:top-0 before:bottom-0 before:left-0 before:right-0 before:absolute"
-    :class="{ 'cursor-crosshair': allowDraw, 'touch-none': !!drawField }"
+    :class="{ 'cursor-crosshair': allowDraw && editable, 'touch-none': !!drawField }"
     style="container-type: size"
     :style="{ aspectRatio: `${width} / ${height}`}"
   >
@@ -27,6 +27,8 @@
         :field="item.field"
         :editable="editable"
         :with-field-placeholder="withFieldPlaceholder"
+        :with-signature-id="withSignatureId"
+        :with-prefillable="withPrefillable"
         :default-field="defaultFieldsIndex[item.field.name]"
         :default-submitters="defaultSubmitters"
         :max-page="totalPages - 1"
@@ -78,6 +80,16 @@ export default {
       required: false,
       default: null
     },
+    withSignatureId: {
+      type: Boolean,
+      required: false,
+      default: null
+    },
+    withPrefillable: {
+      type: Boolean,
+      required: false,
+      default: false
+    },
     areas: {
       type: Array,
       required: false,

app/javascript/template_builder/preview.vue

@@ -157,7 +157,7 @@ export default {
     acceptFileTypes: {
       type: String,
       required: false,
-      default: 'image/*, application/pdf'
+      default: 'image/*, application/pdf, application/zip'
     },
     withReplaceButton: {
       type: Boolean,

app/javascript/template_builder/replace.vue

@@ -35,7 +35,7 @@ export default {
     acceptFileTypes: {
       type: String,
       required: false,
-      default: 'image/*, application/pdf'
+      default: 'image/*, application/pdf, application/zip'
     }
   },
   emits: ['success'],

app/javascript/template_builder/upload.vue

@@ -57,7 +57,7 @@ export default {
     acceptFileTypes: {
       type: String,
       required: false,
-      default: 'image/*, application/pdf'
+      default: 'image/*, application/pdf, application/zip'
     }
   },
   emits: ['success', 'error'],

app/jobs/process_submitter_completion_job.rb

@@ -14,10 +14,10 @@ class ProcessSubmitterCompletionJob
 
     if is_all_completed && submitter.completed_at == submitter.submission.submitters.maximum(:completed_at)
       if submitter.submission.account.account_configs.exists?(key: AccountConfig::COMBINE_PDF_RESULT_KEY, value: true)
-        Submissions::GenerateCombinedAttachment.call(submitter)
+        Submissions::EnsureCombinedGenerated.call(submitter)
       end
 
-      Submissions::GenerateAuditTrail.call(submitter.submission)
+      Submissions::EnsureAuditGenerated.call(submitter.submission)
 
       enqueue_completed_emails(submitter)
     end
@@ -38,12 +38,19 @@ class ProcessSubmitterCompletionJob
 
     submission = submitter.submission
 
+    complete_verification_events, sms_events =
+      submitter.submission_events.where(event_type: %i[send_sms send_2fa_sms complete_verification])
+               .partition { |e| e.event_type == 'complete_verification' }
+
+    complete_verification_event = complete_verification_events.first
+
     completed_submitter.assign_attributes(
       submission_id: submitter.submission_id,
       account_id: submission.account_id,
       template_id: submission.template_id,
       source: submission.source,
-      sms_count: submitter.submission_events.where(event_type: %w[send_sms send_2fa_sms]).count,
+      sms_count: sms_events.sum { |e| e.data['segments'] || 1 },
+      verification_method: complete_verification_event&.data&.dig('method'),
       completed_at: submitter.completed_at
     )
 
@@ -135,19 +142,33 @@ class ProcessSubmitterCompletionJob
   end
 
   def enqueue_next_submitter_request_notification(submitter)
-    next_submitter_item =
+    submission = submitter.submission
-      submitter.submission.template_submitters.find do |e|
+    submitters_index = submission.submitters.index_by(&:uuid)
-        sub = submitter.submission.submitters.find { |s| s.uuid == e['uuid'] }
 
-        next unless sub
+    next_submitter_items =
+      if submission.template_submitters.any? { |s| s['order'] }
+        submitter_groups =
+          submission.template_submitters.group_by.with_index { |s, index| s['order'] || index }
 
-        sub.completed_at.blank? && sub.sent_at.blank?
+        current_group_index = submitter_groups.find { |_, group| group.any? { |s| s['uuid'] == submitter.uuid } }&.first
+
+        if submitter_groups[current_group_index + 1] &&
+           submitters_index.values_at(*submitter_groups[current_group_index].pluck('uuid'))
+                           .compact.all?(&:completed_at?)
+          submitter_groups[current_group_index + 1]
+        end
+      else
+        submission.template_submitters.find do |e|
+          sub = submitters_index[e['uuid']]
+
+          next unless sub
+
+          sub.completed_at.blank? && sub.sent_at.blank?
+        end
       end
 
-    return unless next_submitter_item
+    next_submitters = submitters_index.values_at(*Array.wrap(next_submitter_items).pluck('uuid')).compact
 
-    next_submitter = submitter.submission.submitters.find { |s| s.uuid == next_submitter_item['uuid'] }
+    Submitters.send_signature_requests(next_submitters)
-
-    Submitters.send_signature_requests([next_submitter])
   end
 end

app/jobs/send_submitter_invitation_email_job.rb

@@ -6,6 +6,7 @@ class SendSubmitterInvitationEmailJob
   def perform(params = {})
     submitter = Submitter.find(params['submitter_id'])
 
+    return if submitter.completed_at?
     return if submitter.submission.source == 'invite' && !Accounts.can_send_emails?(submitter.account, on_events: true)
 
     unless Accounts.can_send_invitation_emails?(submitter.account)

app/mailers/submitter_mailer.rb

@@ -30,6 +30,7 @@ class SubmitterMailer < ApplicationMailer
                @submitter.template&.preferences&.dig('request_email_subject').presence
 
     @email_config = AccountConfigs.find_for_account(@current_account, AccountConfig::SUBMITTER_INVITATION_EMAIL_KEY)
+    @body ||= fetch_config_email_body(@email_config, @submitter)
 
     assign_message_metadata('submitter_invitation', @submitter)
 
@@ -71,7 +72,7 @@ class SubmitterMailer < ApplicationMailer
     @subject ||= @email_config.value['subject'] if @email_config
 
     @body = template_preferences['completed_notification_email_body'].presence
-    @body ||= @email_config.value['body'] if @email_config
+    @body ||= fetch_config_email_body(@email_config, @submitter)
 
     assign_message_metadata('submitter_completed', @submitter)
 
@@ -127,7 +128,7 @@ class SubmitterMailer < ApplicationMailer
     @subject ||= @email_config.value['subject'] if @email_config
 
     @body = template_preferences['documents_copy_email_body'].presence
-    @body ||= @email_config.value['body'] if @email_config
+    @body ||= fetch_config_email_body(@email_config, @submitter)
 
     assign_message_metadata('submitter_documents_copy', @submitter)
     reply_to = build_submitter_reply_to(submitter, email_config: @email_config, documents_copy_email: true)
@@ -246,4 +247,8 @@ class SubmitterMailer < ApplicationMailer
       user.friendly_name
     end
   end
+
+  def fetch_config_email_body(email_config, _submitter = nil)
+    email_config ? email_config.value['body'].presence : nil
+  end
 end

app/mailers/template_mailer.rb

@@ -2,6 +2,7 @@
 
 class TemplateMailer < ApplicationMailer
   def otp_verification_email(template, email:)
+    @current_account = template.account
     @template = template
 
     @otp_code = EmailVerificationCodes.generate([email.downcase.strip, template.slug].join(':'))

app/models/account_config.rb

@@ -38,9 +38,12 @@ class AccountConfig < ApplicationRecord
   FORM_PREFILL_SIGNATURE_KEY = 'form_prefill_signature'
   ESIGNING_PREFERENCE_KEY = 'esigning_preference'
   DOWNLOAD_LINKS_AUTH_KEY = 'download_links_auth'
+  DOWNLOAD_LINKS_EXPIRE_KEY = 'download_links_expire'
   FORCE_SSO_AUTH_KEY = 'force_sso_auth'
   FLATTEN_RESULT_PDF_KEY = 'flatten_result_pdf'
   WITH_SIGNATURE_ID = 'with_signature_id'
+  WITH_FILE_LINKS_KEY = 'with_file_links'
+  WITH_SIGNATURE_ID_REASON_KEY = 'with_signature_id_reason'
   WITH_AUDIT_VALUES_KEY = 'with_audit_values'
   WITH_SUBMITTER_TIMEZONE_KEY = 'with_submitter_timezone'
   REQUIRE_SIGNING_REASON_KEY = 'require_signing_reason'

app/models/completed_submitter.rb

@@ -4,16 +4,17 @@
 #
 # Table name: completed_submitters
 #
-#  id            :bigint           not null, primary key
+#  id                  :bigint           not null, primary key
-#  completed_at  :datetime         not null
+#  completed_at        :datetime         not null
-#  sms_count     :integer          not null
+#  sms_count           :integer          not null
-#  source        :string           not null
+#  source              :string           not null
-#  created_at    :datetime         not null
+#  verification_method :string
-#  updated_at    :datetime         not null
+#  created_at          :datetime         not null
-#  account_id    :bigint           not null
+#  updated_at          :datetime         not null
-#  submission_id :bigint           not null
+#  account_id          :bigint           not null
-#  submitter_id  :bigint           not null
+#  submission_id       :bigint           not null
-#  template_id   :bigint
+#  submitter_id        :bigint           not null
+#  template_id         :bigint
 #
 # Indexes
 #
@@ -29,5 +30,5 @@ class CompletedSubmitter < ApplicationRecord
   has_many :completed_documents, dependent: :destroy,
                                  primary_key: :submitter_id,
                                  foreign_key: :submitter_id,
-                                 inverse_of: :submitter
+                                 inverse_of: :completed_submitter
 end

app/models/email_event.rb

@@ -20,7 +20,7 @@
 #
 #  index_email_events_on_account_id_and_event_datetime  (account_id,event_datetime)
 #  index_email_events_on_email                          (email)
-#  index_email_events_on_email_event_types              (email) WHERE ((event_type)::text = ANY ((ARRAY['bounce'::character varying, 'soft_bounce'::character varying, 'complaint'::character varying, 'soft_complaint'::character varying])::text[]))
+#  index_email_events_on_email_event_types              (email) WHERE ((event_type)::text = ANY ((ARRAY['bounce'::character varying, 'soft_bounce'::character varying, 'permanent_bounce'::character varying, 'complaint'::character varying, 'soft_complaint'::character varying])::text[]))
 #  index_email_events_on_emailable                      (emailable_type,emailable_id)
 #  index_email_events_on_message_id                     (message_id)
 #

app/models/lock_event.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# == Schema Information
+#
+# Table name: lock_events
+#
+#  id         :bigint           not null, primary key
+#  event_name :string           not null
+#  key        :string           not null
+#  created_at :datetime         not null
+#  updated_at :datetime         not null
+#
+# Indexes
+#
+#  index_lock_events_on_event_name_and_key  (event_name,key) UNIQUE WHERE ((event_name)::text = ANY ((ARRAY['start'::character varying, 'complete'::character varying])::text[]))
+#  index_lock_events_on_key                 (key)
+#
+class LockEvent < ApplicationRecord
+  enum :event_name, {
+    complete: 'complete',
+    fail: 'fail',
+    start: 'start',
+    retry: 'retry'
+  }, scope: false
+end

app/models/submission.rb

@@ -15,6 +15,8 @@
 #  template_fields     :text
 #  template_schema     :text
 #  template_submitters :text
+#  variables           :text
+#  variables_schema    :text
 #  created_at          :datetime         not null
 #  updated_at          :datetime         not null
 #  account_id          :bigint           not null
@@ -50,6 +52,8 @@ class Submission < ApplicationRecord
   serialize :template_fields, coder: JSON
   serialize :template_schema, coder: JSON
   serialize :template_submitters, coder: JSON
+  serialize :variables_schema, coder: JSON
+  serialize :variables, coder: JSON
   serialize :preferences, coder: JSON
 
   attribute :source, :string, default: 'link'
@@ -114,16 +118,16 @@ class Submission < ApplicationRecord
     @fields_uuid_index ||= (template_fields || template.fields).index_by { |f| f['uuid'] }
   end
 
-  def audit_trail_url
+  def audit_trail_url(expires_at: nil)
     return if audit_trail.blank?
 
-    ActiveStorage::Blob.proxy_url(audit_trail.blob)
+    ActiveStorage::Blob.proxy_url(audit_trail.blob, expires_at:)
   end
   alias audit_log_url audit_trail_url
 
-  def combined_document_url
+  def combined_document_url(expires_at: nil)
     return if combined_document.blank?
 
-    ActiveStorage::Blob.proxy_url(combined_document.blob)
+    ActiveStorage::Blob.proxy_url(combined_document.blob, expires_at:)
   end
 end

app/models/template.rb

@@ -4,22 +4,23 @@
 #
 # Table name: templates
 #
-#  id          :bigint           not null, primary key
+#  id               :bigint           not null, primary key
-#  archived_at :datetime
+#  archived_at      :datetime
-#  fields      :text             not null
+#  fields           :text             not null
-#  name        :string           not null
+#  name             :string           not null
-#  preferences :text             not null
+#  preferences      :text             not null
-#  schema      :text             not null
+#  schema           :text             not null
-#  shared_link :boolean          default(FALSE), not null
+#  shared_link      :boolean          default(FALSE), not null
-#  slug        :string           not null
+#  slug             :string           not null
-#  source      :text             not null
+#  source           :text             not null
-#  submitters  :text             not null
+#  submitters       :text             not null
-#  created_at  :datetime         not null
+#  variables_schema :text
-#  updated_at  :datetime         not null
+#  created_at       :datetime         not null
-#  account_id  :bigint           not null
+#  updated_at       :datetime         not null
-#  author_id   :bigint           not null
+#  account_id       :bigint           not null
-#  external_id :string
+#  author_id        :bigint           not null
-#  folder_id   :bigint           not null
+#  external_id      :string
+#  folder_id        :bigint           not null
 #
 # Indexes
 #
@@ -57,6 +58,7 @@ class Template < ApplicationRecord
 
   serialize :preferences, coder: JSON
   serialize :fields, coder: JSON
+  serialize :variables_schema, coder: JSON
   serialize :schema, coder: JSON
   serialize :submitters, coder: JSON
 
@@ -72,12 +74,14 @@ class Template < ApplicationRecord
   scope :active, -> { where(archived_at: nil) }
   scope :archived, -> { where.not(archived_at: nil) }
 
-  delegate :name, to: :folder, prefix: true
-
   def application_key
     external_id
   end
 
+  def folder_name
+    folder.full_name
+  end
+
   private
 
   def maybe_set_default_folder

app/models/template_folder.rb

@@ -4,36 +4,50 @@
 #
 # Table name: template_folders
 #
-#  id          :bigint           not null, primary key
+#  id               :bigint           not null, primary key
-#  archived_at :datetime
+#  archived_at      :datetime
-#  name        :string           not null
+#  name             :string           not null
-#  created_at  :datetime         not null
+#  created_at       :datetime         not null
-#  updated_at  :datetime         not null
+#  updated_at       :datetime         not null
-#  account_id  :bigint           not null
+#  account_id       :bigint           not null
-#  author_id   :bigint           not null
+#  author_id        :bigint           not null
+#  parent_folder_id :bigint
 #
 # Indexes
 #
-#  index_template_folders_on_account_id  (account_id)
+#  index_template_folders_on_account_id        (account_id)
-#  index_template_folders_on_author_id   (author_id)
+#  index_template_folders_on_author_id         (author_id)
+#  index_template_folders_on_parent_folder_id  (parent_folder_id)
 #
 # Foreign Keys
 #
 #  fk_rails_...  (account_id => accounts.id)
 #  fk_rails_...  (author_id => users.id)
+#  fk_rails_...  (parent_folder_id => template_folders.id)
 #
 class TemplateFolder < ApplicationRecord
   DEFAULT_NAME = 'Default'
 
   belongs_to :author, class_name: 'User'
   belongs_to :account
+  belongs_to :parent_folder, class_name: 'TemplateFolder', optional: true
 
   has_many :templates, dependent: :destroy, foreign_key: :folder_id, inverse_of: :folder
+  has_many :subfolders, class_name: 'TemplateFolder', foreign_key: :parent_folder_id, inverse_of: :parent_folder,
+                        dependent: :destroy
   has_many :active_templates, -> { where(archived_at: nil) },
            class_name: 'Template', dependent: :destroy, foreign_key: :folder_id, inverse_of: :folder
 
   scope :active, -> { where(archived_at: nil) }
 
+  def full_name
+    if parent_folder_id?
+      [parent_folder.name, name].join(' / ')
+    else
+      name
+    end
+  end
+
   def default?
     name == DEFAULT_NAME
   end

app/views/accounts/show.html.erb

@@ -50,11 +50,16 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('force_2fa_with_authenticator_app') %>
+                <span class="text-left"><%= t('force_2fa_with_authenticator_app') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('require_two_factor_authentication_2fa_with_an_authenticator_app_e_g_google_authenticator_authy_all_users_signing_documents_must_pass_the_second_factor_verification_using_a_secure_code_in_addition_to_their_password') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value, onchange: 'this.form.requestSubmit()' %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -62,11 +67,16 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('add_signature_id_to_the_documents') %>
+                <span class="text-left"><%= t('add_signature_id_to_the_documents') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('add_a_unique_signature_id_and_timestamp_to_each_signature_for_audit_and_traceability_purposes_along_with_the_timestamp_part_of_docuseals_21_cfr_part_11_compliance_settings') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value, onchange: 'this.form.requestSubmit()', disabled: can?(:manage, :cfr) %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value, disabled: can?(:manage, :cfr) %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -74,11 +84,16 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('require_signing_reason') %>
+                <span class="text-left"><%= t('require_signing_reason') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('require_signer_to_provide_a_reason_for_signing_before_completing_their_signature_e_g_approvals_certifications_part_of_docuseals_21_cfr_part_11_compliance_settings') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value, onchange: 'this.form.requestSubmit()', disabled: can?(:manage, :cfr) %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value, disabled: can?(:manage, :cfr) %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -86,11 +101,16 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('allow_typed_text_signatures') %>
+                <span class="text-left"><%= t('allow_typed_text_signatures') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('allow_signers_to_create_signatures_by_typing_their_name_instead_of_drawing_or_uploading_one') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value != false, onchange: 'this.form.requestSubmit()' %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value != false %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -98,11 +118,16 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('allow_to_resubmit_completed_forms') %>
+                <span class="text-left"><%= t('allow_to_resubmit_completed_forms') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('allow_signers_to_resubmit_forms_after_completion_useful_when_corrections_or_multiple_submissions_are_needed') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value != false, onchange: 'this.form.requestSubmit()' %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value != false %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -110,11 +135,16 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('allow_to_decline_documents') %>
+                <span class="text-left"><%= t('allow_to_decline_documents') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('allow_recipients_to_decline_signing_a_document_the_decline_reason_notification_will_be_sent_to_the_signature_requester') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value != false, onchange: 'this.form.requestSubmit()' %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value != false %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -122,11 +152,33 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('remember_and_pre_fill_signatures') %>
+                <span class="text-left"><%= t('remember_and_pre_fill_signatures') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('save_a_users_signature_and_automatically_pre_fill_it_in_future_signing_sessions') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value != false, onchange: 'this.form.requestSubmit()' %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value != false %>
+              </submit-form>
+            </div>
+          <% end %>
+        <% end %>
+        <% account_config = AccountConfig.find_or_initialize_by(account: current_account, key: AccountConfig::DOWNLOAD_LINKS_EXPIRE_KEY) %>
+        <% if can?(:manage, account_config) %>
+          <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
+            <%= f.hidden_field :key %>
+            <div class="flex items-center justify-between gap-4 py-2.5">
+              <div class="flex items-center space-x-1">
+                <span class="text-left"><%= t('expirable_file_download_links') %></span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('make_document_download_links_expire_after_40_minutes_to_prevent_long_term_access_and_enhance_security') %>">
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value != false %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -134,11 +186,16 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('require_authentication_for_file_download_links') %>
+                <span class="text-left"><%= t('require_authentication_for_file_download_links') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('require_authentication_with_user_login_or_api_key_to_access_the_document_download_links') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value, onchange: 'this.form.requestSubmit()' %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -146,11 +203,16 @@
         <% if can?(:manage, account_config) %>
           <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
             <%= f.hidden_field :key %>
-            <div class="flex items-center justify-between py-2.5">
+            <div class="flex items-center justify-between gap-4 py-2.5">
-              <span>
+              <div class="flex items-center space-x-1">
-                <%= t('combine_completed_documents_and_audit_log') %>
+                <span class="text-left"><%= t('combine_completed_documents_and_audit_log') %></span>
-              </span>
+                <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('combine_signed_documents_and_the_audit_log_into_a_single_pdf_file_for_easier_recordkeeping_and_compliance') %>">
-              <%= f.check_box :value, class: 'toggle', checked: account_config.value, onchange: 'this.form.requestSubmit()' %>
+                  <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                </span>
+              </div>
+              <submit-form data-on="change" class="flex">
+                <%= f.check_box :value, class: 'toggle', checked: account_config.value %>
+              </submit-form>
             </div>
           <% end %>
         <% end %>
@@ -159,22 +221,27 @@
           <% if can?(:manage, account_config) %>
             <%= form_for account_config, url: account_configs_path, method: :post do |f| %>
               <%= f.hidden_field :key %>
-              <div class="flex items-center justify-between py-2.5">
+              <div class="flex items-center justify-between gap-4 py-2.5">
-                <span>
+                <div class="flex items-center space-x-1">
-                  <%= t('always_enforce_signing_order') %>
+                  <span class="text-left"><%= t('always_enforce_signing_order') %></span>
-                </span>
+                  <span class="tooltip tooltip-top flex cursor-pointer" data-tip="<%= t('make_the_recipients_signing_order_always_enforced_so_that_the_second_signer_can_start_signing_their_part_only_after_the_first_signer_has_completed_signing') %>">
-                <%= f.check_box :value, class: 'toggle', checked: account_config.value, onchange: 'this.form.requestSubmit()' %>
+                    <%= svg_icon('info_circle', class: 'hidden md:inline-block w-4 h-4 shrink-0') %>
+                  </span>
+                </div>
+                <submit-form data-on="change" class="flex">
+                  <%= f.check_box :value, class: 'toggle', checked: account_config.value %>
+                </submit-form>
               </div>
             <% end %>
           <% end %>
         <% end %>
         <%= render 'extra_preferences' %>
         <% if !Docuseal.multitenant? && SearchEntry.table_exists? && (!Docuseal.fulltext_search? || params[:reindex] == 'true') && can?(:manage, EncryptedConfig) %>
-          <div class="flex items-center justify-between py-2.5">
+          <div class="flex items-center justify-between gap-4 py-2.5">
             <span>
-              Efficient search with search index
+              <%= t('efficient_search_with_search_index') %>
             </span>
-            <%= button_to params[:reindex] == 'true' ? 'Reindex' : 'Build Search Index', settings_search_entries_reindex_index_path, method: :post, class: 'btn btn-sm btn-neutral text-white px-4' %>
+            <%= button_to params[:reindex] == 'true' ? t('reindex') : t('build_search_index'), settings_search_entries_reindex_index_path, method: :post, class: 'btn btn-sm btn-neutral text-white px-4' %>
           </div>
         <% end %>
       </div>

app/views/api_settings/index.html.erb

@@ -11,10 +11,21 @@
         <div class="flex flex-col md:flex-row gap-4">
           <div class="flex w-full space-x-4">
             <% token = current_user.access_token.token %>
-            <masked-input class="block w-full" data-token="<%= token %>">
+            <% obscured_token = current_user.access_token.token.sub(token[5..], '*' * token[5..].size) %>
-              <input id="api_key" type="text" value="<%= token.sub(token[5..], '*' * token[5..].size) %>" class="input font-mono input-bordered w-full" autocomplete="off" readonly>
+            <% if current_account.testing? %>
-            </masked-input>
+              <masked-input class="block w-full" data-token="<%= token %>">
-            <%= render 'shared/clipboard_copy', icon: 'copy', text: token, class: 'base-button', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
+                <input id="api_key" type="text" value="<%= obscured_token %>" class="input font-mono input-bordered w-full" autocomplete="off" readonly>
+              </masked-input>
+              <%= render 'shared/clipboard_copy', icon: 'copy', text: token, class: 'base-button', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
+            <% else %>
+              <a id="access_token_container" href="<%= settings_reveal_access_token_path %>" data-turbo-frame="modal" class="flex w-full space-x-4">
+                <input id="api_key" type="text" value="<%= obscured_token %>" class="input font-mono input-bordered w-full" autocomplete="off" readonly>
+                <div class="base-button">
+                  <%= svg_icon('copy', class: 'w-6 h-6 text-white') %>
+                  <span class="hidden md:inline"><%= t('copy') %></span>
+                </div>
+              </a>
+            <% end %>
           </div>
           <%= button_to button_title(title: t('rotate'), disabled_with: t('rotate'), icon: svg_icon('reload', class: 'w-6 h-6')), settings_api_index_path, class: 'white-button w-full', data: { turbo_confirm: t('remove_existing_api_token_and_generated_a_new_one_are_you_sure_') } %>
         </div>
@@ -35,7 +46,7 @@
         <div class="collapse-content" style="display: inherit">
           <div class="mockup-code overflow-hidden">
             <% text = capture do %>curl --location '<%= api_submissions_url %>' \
-       --header 'X-Auth-Token: <%= current_user.access_token.token %>' \
+       --header 'X-Auth-Token: API_TOKEN' \
        --data-raw '{
          "template_id": <%= current_account.templates.last&.id || 1 %>,
          "submitters": [
@@ -53,7 +64,7 @@
             <span class="top-0 right-0 absolute">
               <%= render 'shared/clipboard_copy', icon: 'copy', text:, class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
             </span>
-            <pre data-prefix="$"><code class="overflow-hidden w-full"><%= text %></code></pre>
+            <pre data-prefix="$"><code class="overflow-hidden w-full"><%== HighlightCode.call(text, 'Shell', theme: 'base16.dark') %></code></pre>
           </div>
         </div>
       </div>
@@ -71,7 +82,7 @@
         <div class="collapse-content" style="display: inherit">
           <div class="mockup-code overflow-hidden">
             <% text = capture do %>curl --location '<%= api_submissions_emails_url %>' \
-       --header 'X-Auth-Token: <%= current_user.access_token.token %>' \
+       --header 'X-Auth-Token: API_TOKEN' \
        --data-raw '{
            "template_id": <%= current_account.templates.last&.id || 1 %>,
            "emails":  "<%= current_user.email.sub('@', '+test@') %>, <%= current_user.email.sub('@', '+test2@') %>"
@@ -79,7 +90,7 @@
             <span class="top-0 right-0 absolute">
               <%= render 'shared/clipboard_copy', icon: 'copy', text:, class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
             </span>
-            <pre data-prefix="$"><code class="overflow-hidden w-full"><%= text %></code></pre>
+            <pre data-prefix="$"><code class="overflow-hidden w-full"><%== HighlightCode.call(text, 'Shell', theme: 'base16.dark') %></code></pre>
           </div>
         </div>
       </div>
@@ -97,11 +108,11 @@
         <div class="collapse-content" style="display: inherit">
           <div class="mockup-code overflow-hidden">
             <% text = capture do %>curl '<%= api_template_url(current_account.templates&.last || 1) %>' \
-       --header 'X-Auth-Token: <%= current_user.access_token.token %>'<% end.to_str %>
+       --header 'X-Auth-Token: API_TOKEN'<% end.to_str %>
             <span class="top-0 right-0 absolute">
               <%= render 'shared/clipboard_copy', icon: 'copy', text:, class: 'btn btn-ghost text-white', icon_class: 'w-6 h-6 text-white', copy_title: t('copy'), copied_title: t('copied') %>
             </span>
-            <pre data-prefix="$"><code class="overflow-hidden w-full"><%= text %></code></pre>
+            <pre data-prefix="$"><code class="overflow-hidden w-full"><%== HighlightCode.call(text, 'Shell', theme: 'base16.dark') %></code></pre>
           </div>
         </div>
       </div>

app/views/devise/sessions/otp.html.erb

@@ -2,15 +2,22 @@
   <h1 class="text-4xl font-bold text-center mt-8">
     <%= t('sign_in') %>
   </h1>
-  <%= form_for(resource, as: resource_name, html: { class: 'space-y-6' }, data: { turbo: params[:redir].blank? }, url: session_path(resource_name)) do |f| %>
+  <% if local_assigns[:access_error].present? %>
-    <%= f.hidden_field :email %>
+    <div class="alert mt-6">
-    <%= f.hidden_field :password %>
+      <%= svg_icon('x_circle', class: 'w-6 h-6 text-red-500') %>
-    <% if params[:redir].present? %>
+      <span><%= local_assigns[:access_error] %></span>
-      <%= hidden_field_tag :redir, params[:redir] %>
-    <% end %>
-    <%= render 'otp_form', **local_assigns %>
-    <div class="form-control">
-      <%= f.button button_title(title: t('sign_in'), disabled_with: t('signing_in')), class: 'base-button' %>
     </div>
+  <% else %>
+    <%= form_for(resource, as: resource_name, html: { class: 'space-y-6' }, data: { turbo: params[:redir].blank? }, url: session_path(resource_name)) do |f| %>
+      <%= f.hidden_field :email %>
+      <%= f.hidden_field :password %>
+      <% if params[:redir].present? %>
+        <%= hidden_field_tag :redir, params[:redir] %>
+      <% end %>
+      <%= render 'otp_form', **local_assigns %>
+      <div class="form-control">
+        <%= f.button button_title(title: t('sign_in'), disabled_with: t('signing_in')), class: 'base-button' %>
+      </div>
+    <% end %>
   <% end %>
 </div>