Merge from docusealco/wip

Author: AlexBTurchyn

.github/workflows/ci.yml

@@ -111,48 +111,39 @@ jobs:
   rspec:
     name: RSpec
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
+    container:
+      image: ruby:4.0.5-alpine
 
     services:
       postgres:
-        image: postgres:14
+        image: postgres:18
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
           POSTGRES_DB: docuseal_test
-        ports: ["5432:5432"]
         options: >-
-          --health-cmd pg_isready
+          --health-cmd "pg_isready -U postgres -d docuseal_test"
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
 
     steps:
+      - name: Install packages
+        run: apk add --no-cache build-base git libpq-dev yaml-dev nodejs yarn tar zstd gzip wget unzip vips leptonica chromium
       - uses: actions/checkout@v4
-      - name: Install Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: 4.0.5
-      - name: Set up Node
-        uses: actions/setup-node@v1
-        with:
-          node-version: 20.19.0
-      - name: Install Chrome
-        uses: browser-actions/setup-chrome@latest
-        with:
-          chrome-version: 125
       - name: Cache node_modules
         uses: actions/cache@v4
         with:
           path: node_modules
-          key: ${{ runner.os }}-node-${{ hashFiles('**/yarn.lock') }}
+          key: ${{ runner.os }}-musl-node-${{ hashFiles('**/yarn.lock') }}
       - name: Cache gems
         uses: actions/cache@v4
         with:
           path: vendor/bundle
-          key: ${{ runner.os }}-gem-${{ hashFiles('**/Gemfile.lock') }}
+          key: ${{ runner.os }}-musl-gem-${{ hashFiles('**/Gemfile.lock') }}
           restore-keys: |
-            ${{ runner.os }}-gem-
+            ${{ runner.os }}-musl-gem-
       - name: Install dependencies
         env:
           RAILS_ENV: test
@@ -161,17 +152,20 @@ jobs:
           bundle config path vendor/bundle
           bundle install --jobs 4 --retry 4
           yarn install
-          sudo apt-get update
-          sudo apt-get install -y libvips liblept5
-          wget -O pdfium-linux.tgz "https://github.com/bblanchon/pdfium-binaries/releases/latest/download/pdfium-linux-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tgz"
-          sudo tar -xzf pdfium-linux.tgz --strip-components=1 -C /usr/lib lib/libpdfium.so
-          rm -f pdfium-linux.tgz
+          wget -O pdfium-linux.zip "https://github.com/docusealco/pdfium-binaries/releases/download/20260813/pdfium-musl-$(uname -m).zip"
+          case "$(uname -m)" in
+            x86_64)  echo "c5c7dde243ecb66ab0819c8193515ef38ad53549fe260f3c2dfd93ea56eda2e7  pdfium-linux.zip" ;;
+            aarch64) echo "64c4483449b1b4dccc696ad0c5c96e0b7f74dcc57b4f23c676b7a70671b0bbb5  pdfium-linux.zip" ;;
+          esac | sha256sum -c -
+          unzip -q pdfium-linux.zip -d /tmp/pdfium-linux
+          cp /tmp/pdfium-linux/lib/libpdfium.so /usr/lib/libpdfium.so
+          rm -rf pdfium-linux.zip /tmp/pdfium-linux
       - name: Run
         env:
           RAILS_ENV: test
           NODE_ENV: test
           COVERAGE: true
-          DATABASE_URL: postgres://postgres:postgres@localhost:5432/docuseal_test
+          DATABASE_URL: postgres://postgres:postgres@postgres:5432/docuseal_test
         run: |
           bundle exec rake db:create
           bundle exec rake db:migrate

Dockerfile

@@ -9,10 +9,10 @@ RUN apk --no-cache add wget unzip && \
     wget https://raw.githubusercontent.com/impallari/DancingScript/master/OFL.txt && \
     wget https://raw.githubusercontent.com/notofonts/noto-fonts/refs/heads/main/LICENSE && \
     wget -O /model.onnx "https://github.com/docusealco/fields-detection/releases/download/2.0.0/model_704_int8.onnx" && \
-    wget -O pdfium-linux.zip "https://github.com/docusealco/pdfium-binaries/releases/download/20260613/pdfium-musl-$(uname -m).zip" && \
+    wget -O pdfium-linux.zip "https://github.com/docusealco/pdfium-binaries/releases/download/20260813/pdfium-musl-$(uname -m).zip" && \
     case "$(uname -m)" in \
-      x86_64)  echo "2c953ff72ee2dda07e7fc577e25841cc3d6464468a7c5adfaea574efcbc3b90b  pdfium-linux.zip" ;; \
-      aarch64) echo "23bbe287d2753fdb05741c7660647eb0ef0d2e4da2ce0722bfa9d9d455bd64e2  pdfium-linux.zip" ;; \
+      x86_64)  echo "c5c7dde243ecb66ab0819c8193515ef38ad53549fe260f3c2dfd93ea56eda2e7  pdfium-linux.zip" ;; \
+      aarch64) echo "64c4483449b1b4dccc696ad0c5c96e0b7f74dcc57b4f23c676b7a70671b0bbb5  pdfium-linux.zip" ;; \
     esac | sha256sum -c - && \
     mkdir -p /pdfium-linux && \
     unzip -q pdfium-linux.zip -d /pdfium-linux

Gemfile.lock

@@ -271,7 +271,7 @@ GEM
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     jmespath (1.6.2)
-    json (2.21.1)
+    json (2.21.2)
     jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)

app/controllers/templates_uploads_controller.rb

@@ -6,7 +6,9 @@ class TemplatesUploadsController < ApplicationController
   layout 'plain'
 
   def show
-    redirect_to root_path if params[:url].blank?
+    url_uri = Addressable::URI.parse(params[:url].to_s)
+
+    redirect_to root_path if url_uri.normalized_scheme != 'https' || url_uri.host.blank?
   end
 
   def create

app/controllers/verify_pdf_signature_controller.rb

@@ -4,16 +4,16 @@ class VerifyPdfSignatureController < ApplicationController
   skip_authorization_check
 
   def create
-    pdfs =
+    trusted_certs = Accounts.load_trusted_certs(current_account)
+
+    signatures =
       params[:files].map do |file|
-        HexaPDF::Document.new(io: file.open)
+        VerifyPdfSignature.call(file.open, trusted_certs)
       end
 
-    trusted_certs = Accounts.load_trusted_certs(current_account)
-
     render turbo_stream: turbo_stream.replace('result', partial: 'result',
-                                                        locals: { pdfs:, files: params[:files], trusted_certs: })
-  rescue HexaPDF::MalformedPDFError
+                                                        locals: { signatures:, files: params[:files] })
+  rescue Pdfium::PdfiumError
     render turbo_stream: turbo_stream.replace('result', html: helpers.tag.div(I18n.t('invalid_pdf'), id: 'result'))
   end
 end

app/jobs/process_submitter_completion_job.rb

@@ -123,13 +123,18 @@ def enqueue_completed_emails(submitter)
 
     user = submission.created_by_user || template.author
 
+    copy_email_configs = AccountConfigs.find_or_initialize_for_key(submitter.account,
+                                                                   AccountConfig::SUBMITTER_DOCUMENTS_COPY_EMAIL_KEY)
+
+    is_copy_email_enabled = documents_copy_email_enabled?(submitter, copy_email_configs)
+
     if submitter.account.users.exists?(id: user.id) && submission.preferences['send_email'] != false &&
        (!template || template.preferences['completed_notification_email_enabled'] != false)
       user_submitter = submission.submitters.find { |s| s.email == user.email }
 
       is_sent_to_user =
         if user.role != 'integration' &&
-           (!user_submitter || user_submitter.preferences['send_email'] == false) &&
+           (!user_submitter || user_submitter.preferences['send_email'] == false || !is_copy_email_enabled) &&
            user.user_configs.find_by(key: UserConfig::RECEIVE_COMPLETED_EMAIL)&.value != false
           SubmitterMailer.completed_email(submitter, user).deliver_later!
 
@@ -139,11 +144,11 @@ def enqueue_completed_emails(submitter)
       enqueue_bcc_completed_emails(submitter, user, is_sent_to_user)
     end
 
-    maybe_enqueue_copy_emails(submitter)
+    enqueue_copy_emails(submitter, copy_email_configs) if is_copy_email_enabled
   end
 
   def enqueue_bcc_completed_emails(submitter, user, is_sent_to_user)
-    bcc_addresses = build_bcc_addresses(submitter.submission)
+    bcc_addresses = build_bcc_addresses(submitter.submission).uniq
 
     raise TooManyBcc, submitter.account_id if Docuseal.multitenant? && bcc_addresses.size > BCC_LIMIT
 
@@ -154,14 +159,13 @@ def enqueue_bcc_completed_emails(submitter, user, is_sent_to_user)
     end
   end
 
-  def maybe_enqueue_copy_emails(submitter)
-    return if submitter.template&.preferences&.dig('documents_copy_email_enabled') == false
+  def documents_copy_email_enabled?(submitter, configs)
+    return false if submitter.template&.preferences&.dig('documents_copy_email_enabled') == false
 
-    configs = AccountConfigs.find_or_initialize_for_key(submitter.account,
-                                                        AccountConfig::SUBMITTER_DOCUMENTS_COPY_EMAIL_KEY)
-
-    return if configs.value['enabled'] == false
+    configs.value['enabled'] != false
+  end
 
+  def enqueue_copy_emails(submitter, configs)
     to = submitter.submission.submitters.reject { |e| e.preferences['send_email'] == false }
                   .sort_by { |e| e.completed_at || Time.current }.select(&:email?).map(&:friendly_name)
 

app/views/submissions_filters/_filter_modal.html.erb

@@ -1,5 +1,7 @@
+<% path_uri = Addressable::URI.parse(params[:path].to_s) %>
+<% path = url_for(**Rails.application.routes.recognize_path(path_uri.path, method: :get)) %>
 <%= render 'shared/turbo_modal', title: local_assigns[:title] do %>
-  <%= form_for '', url: params[:path], method: :get, data: { turbo_frame: :_top }, html: { autocomplete: :off } do |f| %>
+  <%= form_for '', url: path, method: :get, data: { turbo_frame: :_top }, html: { autocomplete: :off } do |f| %>
     <%= hidden_field_tag :q, params[:q] if params[:q].present? %>
     <% local_assigns[:default_params].each do |key, value| %>
       <%= hidden_field_tag(key, value) if value.present? %>
@@ -10,7 +12,7 @@
     </div>
     <% if params[:with_remove] %>
       <div class="text-center w-full mt-4">
-        <%= link_to t('remove_filter'), "#{params[:path]}?#{request.query_parameters.slice('q').merge(local_assigns[:default_params]).to_query}", class: 'link', data: { turbo_frame: :_top } %>
+        <%= link_to t('remove_filter'), "#{path}?#{request.query_parameters.slice('q').merge(local_assigns[:default_params]).to_query}", class: 'link', data: { turbo_frame: :_top } %>
       </div>
     <% end %>
   <% end %>

app/views/verify_pdf_signature/_result.html.erb

@@ -1,7 +1,7 @@
 <div id="result">
-  <% files.zip(pdfs).each do |file, pdf| %>
+  <% files.zip(signatures).each do |file, file_signatures| %>
     <div class="mb-4 border border-base-300 rounded-md py-2 px-3">
-      <% if pdf.signatures.to_a.size == 0 %>
+      <% if file_signatures.size == 0 %>
         <div class="text-sm">
           <%= file.original_filename %>
         </div>
@@ -11,54 +11,41 @@
       <% else %>
         <div class="flex items-center space-x-1 border-b border-dashed border-base-300 pb-2">
           <%= svg_icon('file_text', class: 'w-5 h-5 inline') %>
-          <span><%= file.original_filename %> - <%= pluralize(pdf.signatures.to_a.size, 'Signature') %></span>
+          <span><%= file.original_filename %> - <%= pluralize(file_signatures.size, 'Signature') %></span>
         </div>
-        <% pdf.signatures.to_a.each do |signature| %>
+        <% file_signatures.each do |signature| %>
           <div class="mt-3">
             <div class="space-y-1 font-medium pb-2 text-xl">
-              <% signature.verify(trusted_certs:).messages.map(&:content).each do |message| %>
+              <% signature.messages.each do |message| %>
                 <p class="flex space-x-1 items-center">
-                  <% if message == 'Signature verification failed' %>
+                  <% if message.status == :error %>
                     <%= svg_icon('x_circle', class: 'w-6 h-6 text-red-500') %>
-                  <% elsif message == 'Signature valid' %>
+                  <% elsif message.status == :success %>
                     <%= svg_icon('circle_check', class: 'w-6 h-6 text-green-500') %>
+                  <% elsif message.status == :warning %>
+                    <%= svg_icon('alert_circle', class: 'w-6 h-6 text-yellow-500') %>
                   <% end %>
                   <span>
-                    <%= message %>
+                    <%= message.text %>
                   </span>
                 </p>
-                <% if message == 'Signature valid' %>
-                  <p class="flex space-x-1 items-center">
-                    <% if trusted_certs.any? { |e| e.public_key.to_der == signature.signature_handler.signer_certificate.public_key.to_der } %>
-                      <%= svg_icon('circle_check', class: 'w-6 h-6 text-green-500') %>
-                      <span>
-                        <%= t('signed_with_trusted_certificate') %>
-                      </span>
-                    <% else %>
-                      <%= svg_icon('x_circle', class: 'w-6 h-6 text-red-500') %>
-                      <span>
-                        <%= t('signed_with_external_certificate') %>
-                      </span>
-                    <% end %>
-                  </p>
-                <% end %>
               <% end %>
             </div>
             <div class="flex items-center space-x-1">
               <%= svg_icon('user', class: 'w-5 h-5 inline') %>
-              <span><%= signature.signing_reason %></span>
+              <span><%= signature.reason %></span>
             </div>
             <div class="flex items-center space-x-1">
               <%= svg_icon('calendar', class: 'w-5 h-5 inline') %>
               <span><%= l(signature.signing_time.in_time_zone(current_account.timezone), format: :long, locale: current_account.locale) %></span>
             </div>
             <div class="flex items-center space-x-1">
               <%= svg_icon('certificate', class: 'w-5 h-5 inline') %>
-              <span><%= signature.signer_name.force_encoding('UTF-8') %></span>
+              <span><%= signature.common_name %></span>
             </div>
             <div class="flex items-center space-x-1">
               <%= svg_icon('lock_access', class: 'w-5 h-5 inline') %>
-              <span><%= signature.signature_type %></span>
+              <span><%= signature.type %></span>
             </div>
           </div>
         <% end %>

config/application.rb

@@ -19,6 +19,8 @@ module DocuSeal
   class Application < Rails::Application
     config.load_defaults 8.1
 
+    config.active_support.message_serializer = :json
+
     config.autoload_lib(ignore: %w[assets tasks puma])
 
     config.active_storage.routes_prefix = ''