From 97d91d8f27698c9e12f1dff9b1972779f2c40eb6 Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Mon, 10 Aug 2026 12:06:42 +0300
Subject: [PATCH] fix view only download

---
 .../submit_form_completed_download_controller.rb  | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/app/controllers/submit_form_completed_download_controller.rb b/app/controllers/submit_form_completed_download_controller.rb
index fc27ab71..a555625b 100644
--- a/app/controllers/submit_form_completed_download_controller.rb
+++ b/app/controllers/submit_form_completed_download_controller.rb
@@ -10,14 +10,11 @@ class SubmitFormCompletedDownloadController < ApplicationController
   def index
     @submitter = Submitter.find_signed(params[:sig], purpose: :download_completed) if params[:sig].present?
 
-    signature_valid =
-      if @submitter&.slug == submitter_slug
-        true
-      else
-        @submitter = nil
-      end
+    signature_valid = @submitter&.slug == submitter_slug
 
-    @submitter ||= Submitter.completed.find_by!(slug: submitter_slug)
+    @submitter = Submitter.find_by!(slug: submitter_slug) unless signature_valid
+
+    return head :not_found unless completed_submitter?(@submitter)
 
     Submissions::EnsureResultGenerated.call(@submitter) if @submitter.completed_at?
 
@@ -60,6 +57,10 @@ class SubmitFormCompletedDownloadController < ApplicationController
     end
   end
 
+  def completed_submitter?(submitter)
+    submitter.completed_at? || (submitter.viewer? && submitter.submission.completed_at?)
+  end
+
   def current_user_submitter?(submitter)
     current_user && current_ability.can?(:read, submitter)
   end