# 最简启动 — SQLite + 本地磁盘存储
docker run --name docuseal \
  -p 3000:3000 \
  -v .:/data \
  docuseal/docuseal

# 生产级启动 — PostgreSQL + 自动 HTTPS
curl -O https://raw.githubusercontent.com/
  docusealco/docuseal/master/
  docker-compose.yml

# 设置你的域名，Caddy 自动签发 SSL 证书
sudo HOST=sign.yourcompany.com \
  docker compose up -d

FROM ruby:4.0.1-alpine AS download

WORKDIR /fonts
RUN wget GoNotoKurrent-Regular.ttf \
  && wget DancingScript-Regular.otf \
  && wget model_704_int8.onnx \
  && wget pdfium-linux.tgz

FROM ruby:4.0.1-alpine AS webpack
RUN apk add nodejs yarn \
  && yarn install
RUN ./bin/shakapacker

FROM ruby:4.0.1-alpine AS app
RUN apk add libpq vips redis \
  onnxruntime
COPY --from=download /fonts/ /fonts/
COPY --from=webpack /app/public/packs ./
CMD ["bundle", "exec", "puma"]

{
  "uuid": "a1b2c3d4",
  "submitter_uuid": "sub-001",
  "name": "employee_signature",
  "type": "signature",
  "required": true,
  "readonly": false,
  "title": "Employee Signature",
  "description": "Please sign here",
  "default_value": null,
  "areas": [{
    "uuid": "area-001",
    "x": 0.15,
    "y": 0.72,
    "w": 0.30,
    "h": 0.08,
    "page": 1,
    "attachment_uuid": "doc-001"
  }],
  "conditions": [],
  "validation": {}
}

class Template < ApplicationRecord
  belongs_to :author,
    class_name: 'User'
  belongs_to :account
  belongs_to :folder,
    class_name: 'TemplateFolder'

  serialize :preferences,
    coder: JSON
  serialize :fields,
    coder: JSON
  serialize :schema,
    coder: JSON
  serialize :submitters,
    coder: JSON

  has_many_attached :documents
  has_many :submissions,
    dependent: :destroy
  has_many :template_versions,
    dependent: :destroy

  attribute :slug,
    default: -> {
      SecureRandom.base58(14)
    }
end

// submitters JSON 结构
[
  {
    "name": "First Party",
    "uuid": "sub-001",
    "is_requester": true
  },
  {
    "name": "Second Party",
    "uuid": "sub-002",
    "invite_by": "email"
  }
]

// 字段绑定到角色
{
  "name": "party1_signature",
  "submitter_uuid": "sub-001"
}

# app/models/submitter.rb
def status
  if declined_at?
    'declined'
  elsif completed_at?
    'completed'
  elsif opened_at?
    'opened'
  elsif sent_at?
    'sent'
  else
    'awaiting'
  end
end

# app/controllers/submit_form_controller.rb
class SubmitFormController
  skip_before_action
    :authenticate_user!
  skip_authorization_check

  def show
    return render :email_2fa
      unless authorized?
    return redirect_to :completed
      if submitter.completed_at?
    return render :awaiting
      if enforce_order?
  end

  def update
    return error if completed?
    return error if archived?
    return error if expired?
    return error if declined?

    Submitters::SubmitValues.call(
      submitter, params, request
    )
    head :ok
  end
end

# 创建签署提交的 API 调用示例
curl -X POST \
  https://sign.example.com/api/submissions \
  -H "X-Auth-Token: YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": 42,
    "send_email": true,
    "submitters": [{
      "email": "alice@example.com",
      "name": "Alice Chen",
      "uuid": "sub-001",
      "values": {
        "company_name": "Acme Corp"
      }
    }]
  }'

# app/controllers/api/submissions_controller.rb
def create
  Params::SubmissionCreateValidator
    .call(params)

  submissions = if emails?
    Submissions.create_from_emails(
      template:, user:,
      source: :api,
      emails:, params:
    )
  else
    Submissions.create_from_submitters(
      template:, user:,
      source: :api,
      submitters_order:,
      submissions_attrs:
    )
  end

  WebhookUrls.enqueue_events(
    submissions,
    'submission.created'
  )
end

# WebhookUrl 模型中的签名配置
class WebhookUrl < ApplicationRecord
  EVENTS = %w[
    form.viewed
    form.started
    form.completed
    form.declined
    submission.created
    submission.completed
    submission.expired
    submission.archived
    template.created
    template.updated
    template.archived
  ]

  encrypts :url,
    :secret,
    :hmac_secret

  def set_hmac_secret
    self.hmac_secret ||=
      WebhookUrls::Signatures
        .generate_secret
  end
end

# app/controllers/api/tools_controller.rb
def verify
  file = Base64.decode64(
    params[:file]
  )
  pdf = HexaPDF::Document.new(
    io: StringIO.new(file)
  )

  trusted_certs =
    Accounts.load_trusted_certs(
      current_account
    )

  is_checksum_found =
    CompletedDocument.exists?(
      sha256: Digest::SHA256
        .digest(file)
        .then { |d|
          Base64.urlsafe_encode64(d)
        }
    )

  render json: {
    checksum_status:
      is_checksum_found ?
        'verified' :
        'not_found',
    signatures:
      pdf.signatures.map { |sig|
        {
          signer_name:
            sig.signer_name,
          signing_time:
            sig.signing_time,
          signature_type:
            sig.signature_type,
          verification_result:
            sig.verify(
              trusted_certs:
            )
        }
      }
  }
end

# docker-compose.yml 生产配置
services:
  app:
    image: docuseal/docuseal:latest
    environment:
      - DATABASE_URL=
        postgresql://user:pass@postgres/db
      - FORCE_SSL=${HOST}
    volumes:
      - ./docuseal:/data/docuseal

  postgres:
    image: postgres:18
    environment:
      POSTGRES_USER: docuseal
      POSTGRES_PASSWORD:
        ${DB_PASSWORD}
    volumes:
      - pg_data:/var/lib/postgresql

  caddy:
    image: caddy:latest
    command:
      caddy reverse-proxy
        --from $HOST --to app:3000
    ports:
      - 80:80
      - 443:443

<!-- 嵌入式签署 HTML 示例 -->
<script
  src="https://sign.example.com/js/embed.js"
  data-token="SUBMITTER_TOKEN"
  data-slug="SUBMITTER_SLUG">
</script>

# 后端：创建嵌入式签署会话
POST /api/submissions/init
{
  "template_id": 42,
  "send_email": false,
  "submitters": [{
    "email": "user@example.com",
    "embedded": true
  }]
}