add signature verification

app/controllers/api/attachments_controller.rb

@@ -12,7 +12,7 @@ module Api
       attachment = ActiveStorage::Attachment.create!(
         blob:,
         name: params[:name],
-        record: submitter || current_account
+        record: submitter
       )
 
       render json: attachment.as_json(only: %i[uuid], methods: %i[url filename content_type])

app/controllers/esign_settings_controller.rb

@@ -1,26 +1,25 @@
 # frozen_string_literal: true
 
 class EsignSettingsController < ApplicationController
-  before_action :load_encrypted_config
-
   def create
-    attachment = ActiveStorage::Attachment.find_by!(uuid: params[:attachment_uuid])
+    blobs =
+      params[:blob_signed_ids].map do |sid|
+        ActiveStorage::Blob.find_signed(sid)
+      end
 
-    pdf = HexaPDF::Document.new(io: StringIO.new(attachment.download))
+    pdfs =
+      blobs.map do |blob|
+        HexaPDF::Document.new(io: StringIO.new(blob.download))
+      end
 
-    pdf.signatures
-  end
+    cert = EncryptedConfig.find_by(account: current_account, key: EncryptedConfig::ESIGN_CERTS_KEY).value
 
-  private
+    trusted_certs = [OpenSSL::X509::Certificate.new(cert['cert']),
+                     OpenSSL::X509::Certificate.new(cert['sub_ca']),
+                     OpenSSL::X509::Certificate.new(cert['root_ca'])]
 
-  def load_encrypted_config
-    @encrypted_config =
-      EncryptedConfig.find_or_initialize_by(account: current_account, key: EncryptedConfig::ESIGN_CERTS_KEY)
-  end
-
-  def storage_configs
-    params.require(:encrypted_config).permit(value: {}).tap do |e|
-      e[:value].compact_blank!
-    end
+    render turbo_stream: turbo_stream.replace('result', partial: 'result', locals: { pdfs:, blobs:, trusted_certs: })
+  rescue HexaPDF::MalformedPDFError
+    render turbo_stream: turbo_stream.replace('result', html: helpers.tag.div('Invalid PDF', id: 'result'))
   end
 end

app/controllers/submit_form_controller.rb

@@ -10,6 +10,8 @@ class SubmitFormController < ApplicationController
       Submitter.preload(submission: { template: { documents_attachments: { preview_images_attachments: :blob } } })
                .find_by!(slug: params[:slug])
 
+    cookies.signed[:submitter_sid] = @submitter.signed_id
+
     redirect_to submit_form_completed_path(@submitter.slug) if @submitter.completed_at?
   end
 
@@ -18,7 +20,7 @@ class SubmitFormController < ApplicationController
     submitter.values.merge!(normalized_values)
     submitter.completed_at = Time.current if params[:completed] == 'true'
 
-    submitter.save
+    submitter.save!
 
     head :ok
   end