compliance: add unauthenticated /source route (AGPLv3 sec 13), bundle CHANGES.md

app/controllers/source_controller.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# AGPLv3 Section 13 (network use) compliance: this route stays reachable
+# without sign-in or setup, unauthenticated, so the corresponding source
+# is available before any user interacts with the deployed instance.
+class SourceController < ApplicationController
+  skip_before_action :authenticate_user!, raise: false
+  skip_before_action :maybe_redirect_to_setup, raise: false
+  skip_authorization_check
+
+  layout 'plain'
+
+  SOURCE_REPO_URL = ENV.fetch('DID_SOURCE_REPO_URL', 'https://repo.diditvi.com/didadmin/docuseal')
+  SOURCE_COMMIT = ENV.fetch('DID_SOURCE_COMMIT', 'unknown')
+
+  def index
+    @source_repo_url = SOURCE_REPO_URL
+    @source_commit = SOURCE_COMMIT
+    @license = File.read(Rails.root.join('LICENSE'))
+    @additional_terms = File.read(Rails.root.join('LICENSE_ADDITIONAL_TERMS'))
+    @changes = File.read(Rails.root.join('CHANGES.md'))
+  end
+end