adjust conditions

app/controllers/api/templates_clone_controller.rb

@@ -5,7 +5,7 @@ module Api
     load_and_authorize_resource :template
 
     def create
-      authorize!(:manage, @template)
+      authorize!(:create, @template)
 
       ActiveRecord::Associations::Preloader.new(
         records: [@template],

app/controllers/submissions_archived_controller.rb

@@ -7,9 +7,7 @@ class SubmissionsArchivedController < ApplicationController
     @submissions = @submissions.joins(:template)
     @submissions = @submissions.where.not(archived_at: nil)
                                .or(@submissions.where.not(templates: { archived_at: nil }))
-                               .preload(:created_by_user, template: :author)
-
-    @submissions = @submissions.preload(:template_accesses) unless current_user.role.in?(%w[admin superadmin])
+                               .preload(:template_accesses, :created_by_user, template: :author)
 
     @submissions = Submissions.search(@submissions, params[:q], search_template: true)
     @submissions = Submissions::Filter.call(@submissions, current_user, params)

app/controllers/submissions_dashboard_controller.rb

@@ -8,9 +8,7 @@ class SubmissionsDashboardController < ApplicationController
 
     @submissions = @submissions.where(archived_at: nil)
                                .where(templates: { archived_at: nil })
-                               .preload(:created_by_user, template: :author)
-
-    @submissions = @submissions.preload(:template_accesses) unless current_user.role.in?(%w[admin superadmin])
+                               .preload(:template_accesses, :created_by_user, template: :author)
 
     @submissions = Submissions.search(@submissions, params[:q], search_template: true)
     @submissions = Submissions::Filter.call(@submissions, current_user, params)

app/controllers/templates_controller.rb

@@ -21,9 +21,7 @@ class TemplatesController < ApplicationController
                     submissions.order(id: :desc)
                   end
 
-    submissions = submissions.preload(:template_accesses) unless current_user.role.in?(%w[admin superadmin])
-
-    @pagy, @submissions = pagy(submissions.preload(submitters: :start_form_submission_events))
+    @pagy, @submissions = pagy(submissions.preload(:template_accesses, submitters: :start_form_submission_events))
   rescue ActiveRecord::RecordNotFound
     redirect_to root_path
   end

app/controllers/templates_dashboard_controller.rb

@@ -45,13 +45,15 @@ class TemplatesDashboardController < ApplicationController
     rel = templates.active.preload(:author, :template_accesses)
 
     if params[:q].blank?
-      if Docuseal.multitenant? && !current_account.testing?
-        rel = rel.where(folder_id: current_account.default_template_folder.id)
-      else
-        shared_template_ids =
-          TemplateSharing.where(account_id: [current_account.id, TemplateSharing::ALL_ID]).select(:template_id)
+      if Docuseal.multitenant? ? current_account.testing? : current_account.linked_account_account
+        shared_account_ids = [current_user.account_id]
+        shared_account_ids << TemplateSharing::ALL_ID if !Docuseal.multitenant? && !current_account.testing?
+
+        shared_template_ids = TemplateSharing.where(account_id: shared_account_ids).select(:template_id)
 
         rel = rel.where(folder_id: current_account.default_template_folder.id).or(rel.where(id: shared_template_ids))
+      else
+        rel = rel.where(folder_id: current_account.default_template_folder.id)
       end
     end
 

app/javascript/elements/dashboard_dropzone.js

@@ -60,6 +60,7 @@ export default targetable(class extends HTMLElement {
       dragPreview.style.width = `${rect.width}px`
       dragPreview.style.height = `${height}px`
       dragPreview.style.position = 'absolute'
+      dragPreview.style.top = '-1000px'
       dragPreview.style.pointerEvents = 'none'
       dragPreview.style.opacity = '0.9'
 

app/javascript/elements/toggle_visible.js

@@ -5,7 +5,7 @@ export default actionable(class extends HTMLElement {
     const elementIds = JSON.parse(this.dataset.elementIds)
 
     elementIds.forEach((elementId) => {
-      document.getElementById(elementId).classList.toggle('hidden', event.target.value !== elementId)
+      document.getElementById(elementId).classList.toggle('hidden', (event.target.dataset.toggleId || event.target.value) !== elementId)
     })
   }
 })

app/models/submitter.rb

@@ -54,7 +54,7 @@ class Submitter < ApplicationRecord
   has_many_attached :documents
   has_many_attached :attachments
   has_many_attached :preview_documents
-  has_many :template_accesses, through: :template
+  has_many :template_accesses, through: :submission
   has_many :email_events, as: :emailable, dependent: (Docuseal.multitenant? ? nil : :destroy)
 
   has_many :document_generation_events, dependent: :destroy

app/views/icons/_lock_access.html.erb

@@ -1,9 +1,3 @@
 <svg xmlns="http://www.w3.org/2000/svg" class="<%= local_assigns[:class] %>" width="44" height="44" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
-   <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
-   <path d="M4 8v-2a2 2 0 0 1 2 -2h2"></path>
-   <path d="M4 16v2a2 2 0 0 0 2 2h2"></path>
-   <path d="M16 4h2a2 2 0 0 1 2 2v2"></path>
-   <path d="M16 20h2a2 2 0 0 0 2 -2v-2"></path>
-   <path d="M8 11m0 1a1 1 0 0 1 1 -1h6a1 1 0 0 1 1 1v3a1 1 0 0 1 -1 1h-6a1 1 0 0 1 -1 -1z"></path>
-   <path d="M10 11v-2a2 2 0 1 1 4 0v2"></path>
+  <path stroke="none" d="M0 0h24v24H0z" fill="none" /><path d="M4 8v-2a2 2 0 0 1 2 -2h2" /><path d="M4 16v2a2 2 0 0 0 2 2h2" /><path d="M16 4h2a2 2 0 0 1 2 2v2" /><path d="M16 20h2a2 2 0 0 0 2 -2v-2" /><path d="M8 11m0 1a1 1 0 0 1 1 -1h6a1 1 0 0 1 1 1v3a1 1 0 0 1 -1 1h-6a1 1 0 0 1 -1 -1z" /><path d="M10 11v-2a2 2 0 1 1 4 0v2" />
 </svg>

config/locales/i18n.yml

@@ -21,6 +21,7 @@ en: &en
   language_ja: 日本語
   hi_there: Hi there
   thanks: Thanks
+  private: Private
   bcc_recipients: BCC recipients
   resend_pending: Re-send pending
   always_enforce_signing_order: Always enforce the signing order
@@ -823,6 +824,7 @@ en: &en
       read: Read your data
 
 es: &es
+  private: Privado
   resend_pending: Reenviar pendiente
   ensure_unique_recipients: Asegurar destinatarios únicos
   require_phone_2fa_to_open: Requiere 2FA por teléfono para abrir
@@ -1627,6 +1629,7 @@ es: &es
       read: Leer tus datos
 
 it: &it
+  private: Privato
   resend_pending: Reinvia in sospeso
   ensure_unique_recipients: Assicurarsi destinatari unici
   require_phone_2fa_to_open: Richiedi l'autenticazione a due fattori tramite telefono per aprire
@@ -2430,6 +2433,7 @@ it: &it
       read: Leggi i tuoi dati
 
 fr: &fr
+  private: Privé
   resend_pending: Renvoyer en attente
   ensure_unique_recipients: Assurer l'unicité des destinataires
   require_phone_2fa_to_open: Requiert une 2FA par téléphone pour ouvrir
@@ -3235,6 +3239,7 @@ fr: &fr
       read: Lire vos données
 
 pt: &pt
+  private: Privado
   resend_pending: Re-enviar pendente
   ensure_unique_recipients: Garantir destinatários únicos
   require_phone_2fa_to_open: Necessário autenticação de dois fatores via telefone para abrir
@@ -4040,6 +4045,7 @@ pt: &pt
       read: Ler seus dados
 
 de: &de
+  private: Privat
   resend_pending: Ausstehende erneut senden
   ensure_unique_recipients: Stellen Sie einzigartige Empfänger sicher
   require_phone_2fa_to_open: Telefon-2FA zum Öffnen erforderlich

lib/abilities/template_conditions.rb

@@ -5,26 +5,31 @@ module Abilities
     module_function
 
     def collection(user, ability: nil)
-      template_ids = Template.where(account_id: user.account_id).select(:id)
+      templates = Template.where(account_id: user.account_id)
+
+      return templates unless user.account.testing?
 
       shared_ids =
-        TemplateSharing.where({ ability:,
-                                account_id: [user.account_id, TemplateSharing::ALL_ID] }.compact)
+        TemplateSharing.where({ ability:, account_id: [user.account_id, TemplateSharing::ALL_ID] }.compact)
                        .select(:template_id)
 
-      join_query = Template.arel_table
-                           .join(Arel::Nodes::TableAlias.new(template_ids.arel.union(shared_ids.arel), 'union_ids'))
-                           .on(Template.arel_table[:id].eq(Arel::Table.new(:union_ids)[:id]))
+      join_query =
+        Template.arel_table
+                .join(Arel::Nodes::TableAlias.new(templates.select(:id).arel.union(shared_ids.arel), 'union_ids'))
+                .on(Template.arel_table[:id].eq(Arel::Table.new(:union_ids)[:id]))
 
       Template.joins(join_query.join_sources.first)
     end
 
     def entity(template, user:, ability: nil)
+      return true if template.account_id.blank?
       return true if template.account_id == user.account_id
+      return false unless user.account.linked_account_account
+      return false if template.template_sharings.to_a.blank?
 
       account_ids = [user.account_id, TemplateSharing::ALL_ID]
 
-      template.template_sharings.any? do |e|
+      template.template_sharings.to_a.any? do |e|
         e.account_id.in?(account_ids) && (ability.nil? || e.ability == 'manage' || e.ability == ability)
       end
     end

lib/ability.rb

@@ -4,13 +4,11 @@ class Ability
   include CanCan::Ability
 
   def initialize(user)
-    can :manage, Template, account_id: user.account_id
-
-    can %i[read update create], Template,
-        Abilities::TemplateConditions.collection(user) do |template|
+    can %i[read create update], Template, Abilities::TemplateConditions.collection(user) do |template|
       Abilities::TemplateConditions.entity(template, user:, ability: 'manage')
     end
 
+    can :destroy, Template, account_id: user.account_id
     can :manage, TemplateFolder, account_id: user.account_id
     can :manage, TemplateSharing, template: { account_id: user.account_id }
     can :manage, Submission, account_id: user.account_id