Skip to content

fix(audit): name a signer after a User only for their own login - #34

Closed
batonac wants to merge 1 commit into
developfrom
fix/signer-name-fallback
Closed

batonac wants to merge 1 commit into
developfrom
fix/signer-name-fallback

Conversation

@batonac

@batonac batonac commented Oct 23, 2026

Copy link
Copy Markdown
Member

Follow-up review fix for #33 (record a guest signer's name and email from the web form).

Change

With a Signer Name Field set but left empty, _collect_audit_data fell back to the full name of the User whose address the signer typed into the Signer Email Field. That address is whatever the guest typed, so a guest could enter another person's address and be recorded, and shown on the timeline card as "Document signed by ", under the other person's name.

Design

  • A web form with a Signer Name Field asks the signer for their name. If they leave it empty, a User's full name is used only when the signer's email is the logged-in user's own (frappe.session.user). Otherwise no name is recorded.
  • A web form without a Signer Name Field keeps the earlier behaviour (name looked up from a matching User), as the decision requires when the setting is unset.
  • Docs and comments now say that the link's email parameter is recorded as the signer's only on a web form without a Signer Email Field: README (Configuration, get_esign_link under "For developers", How It Works), the get_esign_link docstring and the comment in send_esign_email.

No money, payroll, permission or migration paths are touched.

Verification

  • test_signer_fields_fall_back_when_empty_or_unset now checks both cases. A guest who types a User's address with an empty name gets no name, which fails on the old code (it recorded "esign-signer"). The same address while logged in as that User still gets the User's name.
  • frappe-test --ci: 105 tests pass, coverage 98.5%, testmap complete, ty clean.
  • prek run --all-files is clean.
  • No visible UI change, so no screenshots need regenerating.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SvdEeMiewirZ3ifFoUix5F

With a Signer Name Field set and left empty, the audit trail took the
name of the User whose address the signer typed into the email field.
A guest could type another person's address and be recorded, and shown
on the timeline card, under that User's name. A web form with a Signer
Name Field now falls back to a User's name only when the signer's email
is the logged-in user's own. Without one, the lookup is unchanged.

Also say in the README, get_esign_link and send_esign_email that the
link's email parameter is recorded as the signer's only on a web form
without a Signer Email Field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SvdEeMiewirZ3ifFoUix5F
@batonac

batonac commented Oct 23, 2026

Copy link
Copy Markdown
Member Author

Superseded by #35, which removes the User-name fallback outright (the signer's name is recorded only as typed).

@batonac batonac closed this Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant