From 2dd38260ba1e0ac37abc4300081df9038387eaae Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Sun, 9 Aug 2026 19:51:07 +0300
Subject: [PATCH] guard email 2fa send

---
 .../start_form_email_2fa_send_controller.rb   | 22 +++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/app/controllers/start_form_email_2fa_send_controller.rb b/app/controllers/start_form_email_2fa_send_controller.rb
index 6359debd..eb20dfc7 100644
--- a/app/controllers/start_form_email_2fa_send_controller.rb
+++ b/app/controllers/start_form_email_2fa_send_controller.rb
@@ -6,9 +6,10 @@ class StartFormEmail2faSendController < ApplicationController
   skip_before_action :authenticate_user!
   skip_authorization_check
 
-  def create
-    @template = Template.find_by!(slug: params[:slug])
+  before_action :load_template
+  before_action :authorize_start!
 
+  def create
     @submitter = @template.submissions.new(account_id: @template.account_id)
                           .submitters.new(**submitter_params, account_id: @template.account_id)
 
@@ -25,6 +26,23 @@ class StartFormEmail2faSendController < ApplicationController
 
   private
 
+  def load_template
+    @template = Template.find_by!(slug: params[:slug])
+  end
+
+  def authorize_start!
+    is_archived = @template.archived_at? || @template.account.archived_at?
+
+    return redirect_to start_form_path(@template.slug) if is_archived
+
+    return if (@template.shared_link? || (current_user && current_ability.can?(:read, @template))) &&
+              @template.preferences['shared_link_2fa'] == true
+
+    Rollbar.warning("Not shared template: #{@template.id}") if defined?(Rollbar)
+
+    redirect_to start_form_path(@template.slug)
+  end
+
   def submitter_params
     params.require(:submitter).permit(:name, :email, :phone)
   end