view only party

spec/requests/forms_spec.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+describe 'Submit Form' do
+  let(:account) { create(:account) }
+  let(:author) { create(:user, account:) }
+  let(:template) { create(:template, account:, author:, submitter_count: 2, only_field_types: %w[text]) }
+  let(:viewer_uuid) { template.submitters.second['uuid'] }
+  let(:submission) do
+    create(:submission, :with_submitters, template:).tap do |s|
+      s.update!(template_submitters: s.template_submitters.map do |ts|
+        ts['uuid'] == viewer_uuid ? ts.merge('is_viewer' => true) : ts
+      end)
+    end
+  end
+  let(:viewer) { submission.submitters.find { |e| e.uuid == viewer_uuid } }
+
+  describe 'PUT /s/:slug' do
+    it 'blocks form submission for a view-only party' do
+      put submit_form_path(slug: viewer.slug), params: { completed: 'true' }
+
+      expect(response).to have_http_status(:unprocessable_content)
+      expect(response.parsed_body['error']).to eq(I18n.t('form_is_view_only'))
+    end
+  end
+end

spec/requests/submissions_spec.rb

@@ -259,6 +259,35 @@ describe 'Submission API' do
     end
   end
 
+  describe 'view-only (CC) party' do
+    let(:viewer_template) { create(:template, account:, author:, submitter_count: 2, only_field_types: %w[text]) }
+    let(:viewer_uuid) { viewer_template.submitters.second['uuid'] }
+
+    before do
+      viewer_template.update!(fields: viewer_template.fields.reject { |f| f['submitter_uuid'] == viewer_uuid })
+    end
+
+    it 'stamps the field-less party as view-only on POST /api/submissions' do
+      post '/api/submissions', headers: { 'x-auth-token': author.access_token.token }, params: {
+        template_id: viewer_template.id,
+        submitters: [
+          { role: 'First Party', email: 'signer@example.com' },
+          { role: 'Second Party', email: 'viewer@example.com' }
+        ]
+      }.to_json
+
+      expect(response).to have_http_status(:ok)
+
+      submission = Submission.last
+      viewer = submission.submitters.find { |e| e.uuid == viewer_uuid }
+      signer = submission.submitters.find { |e| e.uuid != viewer_uuid }
+
+      expect(viewer.viewer?).to be(true)
+      expect(signer.viewer?).to be(false)
+      expect(submission.template_submitters.find { |e| e['uuid'] == viewer_uuid }['is_viewer']).to be(true)
+    end
+  end
+
   private
 
   def index_submission_body(submission)

spec/system/signing_form_spec.rb

@@ -1317,4 +1317,27 @@ RSpec.describe 'Signing Form' do
       expect(field_value(submitter, 'First Name')).to eq 'John Doe'
     end
   end
+
+  context 'when a view-only party opens the form' do
+    let(:template) { create(:template, account:, author:, submitter_count: 2, only_field_types: %w[text]) }
+    let(:viewer_uuid) { template.submitters.second['uuid'] }
+    let(:submission) do
+      create(:submission, template:).tap do |s|
+        s.update!(
+          template_fields: s.template_fields.reject { |f| f['submitter_uuid'] == viewer_uuid },
+          template_submitters: s.template_submitters.map do |ts|
+            ts['uuid'] == viewer_uuid ? ts.merge('is_viewer' => true) : ts
+          end
+        )
+      end
+    end
+    let(:viewer) { create(:submitter, submission:, uuid: viewer_uuid, account:, email: 'viewer@example.com') }
+
+    it 'opens the document form read-only for a view-only party' do
+      visit submit_form_path(slug: viewer.slug)
+
+      expect(page).to have_content(template.name)
+      expect(page).to have_no_css('#form_container')
+    end
+  end
 end