adjust view only

app/controllers/api/submitters_controller.rb

@@ -101,7 +101,7 @@ module Api
     private
 
     def maybe_return_submitter_error
-      if @submitter.completed_at?
+      if @submitter.completed_at? || @submitter.submission.completed_at?
         return render json: { error: 'Submitter has already completed the submission.' }, status: :unprocessable_content
       end
 

app/controllers/send_submission_email_controller.rb

@@ -16,18 +16,16 @@ class SendSubmissionEmailController < ApplicationController
       @submitter =
         Submitter.completed.where(submission: template.submissions).find_by(email: params[:email].to_s.downcase)
     elsif params[:submission_slug]
-      submission = Submission.find_by(slug: params[:submission_slug])
+      submission = Submission.find_by!(slug: params[:submission_slug])
 
-      if submission
-        @submitter = Submitter.completed.find_by(submission: submission, email: params[:email].to_s.downcase)
-      end
+      @submitter = submission.submitters.order(:completed_at).find_by(email: params[:email].to_s.downcase)
 
       return redirect_to submissions_preview_completed_path(params[:submission_slug], status: :error) unless @submitter
     else
-      @submitter = Submitter.completed.find_by!(slug: params[:submitter_slug])
+      @submitter = Submitter.find_by!(slug: params[:submitter_slug])
     end
 
-    if @submitter
+    if @submitter && completed_submitter?(@submitter)
       RateLimit.call("send-email-#{@submitter.id}", limit: 2, ttl: 5.minutes)
 
       SubmitterMailer.documents_copy_email(@submitter, sig: true).deliver_later! if can_send?(@submitter)
@@ -41,6 +39,10 @@ class SendSubmissionEmailController < ApplicationController
 
   private
 
+  def completed_submitter?(submitter)
+    submitter.completed_at? || (submitter.viewer? && submitter.submission.completed_at?)
+  end
+
   def can_send?(submitter)
     return false if submitter.account.archived_at?
     return false if EmailEvent.exists?(tag: :submitter_documents_copy, email: submitter.email, emailable: submitter,

app/controllers/start_form_controller.rb

@@ -141,8 +141,7 @@ class StartFormController < ApplicationController
 
     submitter ||=
       Submitter
-      .where(submission: template.submissions.where(expire_at: Time.current..)
-                                 .or(template.submissions.where(expire_at: nil)).where(archived_at: nil))
+      .where(submission: template.submissions.non_expired.active)
       .order(id: :desc)
       .where(declined_at: nil)
       .where(external_id: nil)
@@ -150,6 +149,8 @@ class StartFormController < ApplicationController
       .then { |rel| params[:resubmit].present? || params[:selfsign].present? ? rel.where(completed_at: nil) : rel }
       .find_or_initialize_by(find_params)
 
+    submitter = Submitter.new(find_params) if submitter.submission&.completed_at? && submitter.viewer?
+
     submitter.name = required_params['name'] if submitter.new_record?
 
     unless @resubmit_submitter

app/controllers/submit_form_completed_download_controller.rb

@@ -19,7 +19,7 @@ class SubmitFormCompletedDownloadController < ApplicationController
 
     @submitter ||= Submitter.find_by!(slug: submitter_slug)
 
-    Submissions::EnsureResultGenerated.call(@submitter)
+    Submissions::EnsureResultGenerated.call(@submitter) if @submitter.completed_at?
 
     last_submitter = @submitter.submission.submitters.where.not(completed_at: nil).order(:completed_at).last
 
@@ -28,11 +28,7 @@ class SubmitFormCompletedDownloadController < ApplicationController
     Submissions::EnsureResultGenerated.call(last_submitter)
 
     if !signature_valid && !current_user_submitter?(last_submitter)
-      unless Submitters::AuthorizedForForm.call(@submitter, current_user, request)
-        Rollbar.info("2FA download error: #{last_submitter.id}") if defined?(Rollbar)
-
-        return head :not_found
-      end
+      return head :not_found unless Submitters::AuthorizedForForm.call(@submitter, current_user, request)
 
       if last_submitter.completed_at < TTL.ago
         Rollbar.info("TTL: #{last_submitter.id}") if defined?(Rollbar)

app/controllers/submit_form_controller.rb

@@ -18,7 +18,10 @@ class SubmitFormController < ApplicationController
     submission = @submitter.submission
 
     return render :email_2fa unless Submitters::AuthorizedForForm.pass_email_2fa?(@submitter, request)
-    return redirect_to submit_form_completed_path(@submitter.slug) if @submitter.completed_at?
+
+    if @submitter.completed_at? || submission.completed_at?
+      return redirect_to submit_form_completed_path(@submitter.slug)
+    end
 
     @form_configs = Submitters::FormConfigs.call(@submitter, CONFIG_KEYS)
 

app/controllers/submit_form_download_controller.rb

@@ -14,6 +14,7 @@ class SubmitFormDownloadController < ApplicationController
     return head :unprocessable_content if @submitter.declined_at? ||
                                           @submitter.submission.archived_at? ||
                                           @submitter.submission.expired? ||
+                                          @submitter.submission.completed_at? ||
                                           @submitter.submission.template&.archived_at? ||
                                           AccountConfig.exists?(account_id: @submitter.account_id,
                                                                 key: AccountConfig::ALLOW_TO_PARTIAL_DOWNLOAD_KEY,

app/controllers/submit_form_metadata_controller.rb

@@ -7,13 +7,7 @@ class SubmitFormMetadataController < ApplicationController
   def index
     @submitter = Submitter.find_by!(slug: params[:submit_form_slug])
 
-    return head :not_found if @submitter.declined_at? ||
-                              @submitter.completed_at? ||
-                              @submitter.submission.archived_at? ||
-                              @submitter.submission.expired? ||
-                              @submitter.submission.template&.archived_at? ||
-                              @submitter.account.archived_at? ||
-                              !Submitters::AuthorizedForForm.call(@submitter, current_user, request)
+    return head :not_found unless authorized_submitter?(@submitter)
 
     submission = @submitter.submission
     values = submission.submitters.reduce({}) { |acc, sub| acc.merge(sub.values) }
@@ -34,4 +28,17 @@ class SubmitFormMetadataController < ApplicationController
 
     render json: { text_runs: }
   end
+
+  private
+
+  def authorized_submitter?(submitter)
+    !submitter.declined_at? &&
+      !submitter.completed_at? &&
+      !submitter.submission.archived_at? &&
+      !submitter.submission.completed_at? &&
+      !submitter.submission.expired? &&
+      !submitter.submission.template&.archived_at? &&
+      !submitter.account.archived_at? &&
+      Submitters::AuthorizedForForm.call(submitter, current_user, request)
+  end
 end

app/controllers/submitters_controller.rb

@@ -50,7 +50,7 @@ class SubmittersController < ApplicationController
 
   def submitter_editable?(submission)
     !@submitter.submission_events.exists?(event_type: 'start_form') &&
-      !@submitter.completed_at? && !@submitter.declined_at? &&
+      !@submitter.completed_at? && !@submitter.declined_at? && !submission.completed_at? &&
       !submission.archived_at? && !submission.expired? && !submission.template&.archived_at?
   end