view only party

app/controllers/api/submission_documents_controller.rb

@@ -30,7 +30,7 @@ module Api
     private
 
     def build_completed_documents(submission, merge: false)
-      last_submitter = submission.submitters.max_by(&:completed_at)
+      last_submitter = submission.submitters.select(&:completed_at?).max_by(&:completed_at)
 
       if merge
         if submission.merged_document_attachment.blank?

app/controllers/api/submissions_controller.rb

@@ -80,8 +80,9 @@ module Api
       Submissions.send_signature_requests(submissions)
 
       submissions.each do |submission|
-        if submission.submitters.all?(&:completed_at?) && Submissions.maybe_update_completed_at(submission)
-          last_submitter = submission.submitters.max_by(&:completed_at)
+        if submission.submitters.all? { |s| s.viewer? || s.completed_at? } &&
+           Submissions.maybe_update_completed_at(submission)
+          last_submitter = submission.submitters.reject(&:viewer?).max_by(&:completed_at)
         end
 
         submission.submitters.each do |submitter|

app/controllers/submissions_controller.rb

@@ -87,6 +87,8 @@ class SubmissionsController < ApplicationController
   private
 
   def create_submissions(template, submissions_params, params)
+    normalize_message_submitter_uuids!(params)
+
     submissions_attrs = submissions_params[:submission].to_h.values
 
     submissions_attrs, _, new_fields =
@@ -111,4 +113,23 @@ class SubmissionsController < ApplicationController
   def submissions_params
     params.permit(submission: { submitters: [:uuid, :email, :phone, :name, { values: {} }] })
   end
+
+  def normalize_message_submitter_uuids!(params)
+    return if params[:request_email_per_submitter] == '1'
+
+    uuids = params[:email_message_submitter_uuids]
+
+    return if uuids.blank?
+    return if params[:subject].blank? && params[:body].blank?
+
+    params[:submitter_preferences] =
+      Array.wrap(uuids).index_with { { 'subject' => params[:subject], 'body' => params[:body] } }
+
+    params[:request_email_per_submitter] = '1'
+
+    params.delete(:subject)
+    params.delete(:body)
+
+    params
+  end
 end

app/controllers/submit_form_controller.rb

@@ -71,6 +71,12 @@ class SubmitFormController < ApplicationController
                     status: :unprocessable_content
     end
 
+    if @submitter.viewer?
+      Rollbar.warning("Submit viewer: #{@submitter.id}") if defined?(Rollbar)
+
+      return render json: { error: I18n.t('form_is_view_only') }, status: :unprocessable_content
+    end
+
     Submitters::SubmitValues.call(@submitter, params, request)
 
     head :ok

app/controllers/submit_form_decline_controller.rb

@@ -13,6 +13,7 @@ class SubmitFormDeclineController < ApplicationController
                                                             @submitter.submission.archived_at? ||
                                                             @submitter.submission.expired? ||
                                                             @submitter.submission.template&.archived_at? ||
+                                                            @submitter.viewer? ||
                                                             !Submitters::AuthorizedForForm.call(@submitter,
                                                                                                 current_user,
                                                                                                 request)

app/controllers/submit_form_delegate_controller.rb

@@ -12,6 +12,7 @@ class SubmitFormDelegateController < ApplicationController
                                                             @submitter.submission.archived_at? ||
                                                             @submitter.submission.expired? ||
                                                             @submitter.submission.template&.archived_at? ||
+                                                            @submitter.viewer? ||
                                                             !Submitters::AuthorizedForForm.call(@submitter,
                                                                                                 current_user,
                                                                                                 request)

app/controllers/submit_form_draw_signature_controller.rb

@@ -12,6 +12,8 @@ class SubmitFormDrawSignatureController < ApplicationController
 
     return redirect_to submit_form_completed_path(@submitter.slug) if @submitter.completed_at?
 
+    return redirect_to submit_form_path(@submitter.slug) if @submitter.viewer?
+
     if @submitter.submission.template&.archived_at? || @submitter.submission.archived_at? ||
        !Submitters::AuthorizedForForm.call(@submitter, current_user, request)
       return redirect_to submit_form_path(@submitter.slug)

app/controllers/submit_form_invite_controller.rb

@@ -48,6 +48,7 @@ class SubmitFormInviteController < ApplicationController
       !submitter.submission.archived_at? &&
       !submitter.submission.expired? &&
       !submitter.submission.template&.archived_at? &&
+      !submitter.viewer? &&
       Submitters::AuthorizedForForm.call(submitter, current_user, request)
   end
 

app/controllers/submitters_controller.rb

@@ -58,7 +58,7 @@ class SubmittersController < ApplicationController
     if params[:send_email] == '1' && submitter.email.present?
       is_sent_recently = Docuseal.multitenant? &&
                          EmailEvent.exists?(email: submitter.email,
-                                            tag: 'submitter_invitation',
+                                            tag: %w[submitter_invitation submitter_view_invitation],
                                             emailable: submitter,
                                             event_type: 'send',
                                             created_at: 4.hours.ago..Time.current)

app/controllers/templates_preferences_controller.rb

@@ -5,6 +5,8 @@ class TemplatesPreferencesController < ApplicationController
 
   RESETTABLE_PREFERENCE_KEYS = {
     AccountConfig::SUBMITTER_INVITATION_EMAIL_KEY => %w[request_email_subject request_email_body submitters],
+    AccountConfig::SUBMITTER_VIEW_INVITATION_EMAIL_KEY => %w[invitation_view_email_subject
+                                                             invitation_view_email_body],
     AccountConfig::SUBMITTER_INVITATION_REMINDER_EMAIL_KEY => %w[invitation_reminder_email_subject
                                                                  invitation_reminder_email_body],
     AccountConfig::SUBMITTER_DOCUMENTS_COPY_EMAIL_KEY => %w[documents_copy_email_subject documents_copy_email_body],
@@ -48,12 +50,12 @@ class TemplatesPreferencesController < ApplicationController
   def template_params
     params.require(:template).permit(
       preferences: %i[bcc_completed request_email_subject request_email_body
+                      invitation_view_email_subject invitation_view_email_body
                       invitation_reminder_email_subject invitation_reminder_email_body
                       documents_copy_email_subject documents_copy_email_body
                       documents_copy_email_enabled documents_copy_email_attach_audit
                       documents_copy_email_attach_documents documents_copy_email_reply_to
-                      completed_notification_email_attach_documents
-                      completed_redirect_url validate_unique_submitters
+                      completed_notification_email_attach_documents completed_redirect_url validate_unique_submitters
                       require_all_submitters submitters_order require_phone_2fa require_email_2fa
                       default_expire_at_duration shared_link_2fa default_expire_at request_email_enabled
                       completed_notification_email_subject completed_notification_email_body