- Logo upload: Admins can upload an org logo via Settings > Personalization.
Logo is stored via ActiveStorage (has_one_attached :logo on Account), served
publicly for signing pages (existing blob proxy exemption for 'logo' reused),
and displayed in the navbar replacing the default DocuSeal wordmark when set.
- Editor role: New role with full document lifecycle (upload, field editing,
send for signature, manage submissions) but cannot delete/archive templates.
Cannot manage users, account settings, webhooks, or API tokens.
- Viewer role: New read-only role. Can browse templates and submissions, and
download completed signed documents. No create/update/destroy on any resource.
- Role select UI: Enabled Editor and Viewer options (previously disabled behind
a Pro paywall link). Removed upgrade prompt from self-hosted fork.
- Admin guard: Added require_admin! helper to ApplicationController, applied to
UsersController and PersonalizationSettingsController so non-admins are
redirected instead of hitting CanCan authorization errors.
- i18n: Added access_denied and remove_logo English locale keys.
No DB migration needed — role column is an existing plain string field.
Ricky Gray
123c4c58d1