Secure public access and e-signing

Sign a Delivery Note on the public page

Capture the recipient’s one-time drawn signature through the code-backed public workflow.

Audience: Delivery recipientsPermission: Valid token for an open noteModule v1.0.0
Exact navigationSecure public Delivery Note link → Signature area → Confirm Delivery

What this guide covers

Capture the recipient’s one-time drawn signature through the code-backed public workflow. This guide follows the supplied Delivery Note module’s live hooks, controller actions, model rules, views and stored side effects.

Exact step-by-step process

  1. Review all delivery details and items.
  2. Draw a signature in the canvas using mouse, touch or pointer input.
  3. If required, use Clear and redraw.
  4. Select the confirmation button once.
  5. Wait for the page to reload as a sealed signed document.
  6. Check the signed confirmation email when Recipient Email was stored.

Fields, choices and supported possibilities

  • HTML canvas powered by Signature Pad 4.0.0 from the configured CDN
  • Hidden signature field receives a data-URI image
  • CRM CSRF hidden field is included when available
  • Canvas intrinsic size: 500 × 220 pixels with responsive display sizing

Code-backed validations and workflow rules

  • The browser blocks submit when the pad is empty.
  • The server also rejects an empty signature.
  • The current public form does not ask for signatory name or email.
  • The first accepted signature changes status to signed and prevents another signature.
  • The active model checks that signature content is non-empty but does not independently validate the data-URI prefix, image type or dimensions; the supported browser flow must remain the only public signing interface.

Expected result and verification

  • The note is sealed with signature image, timestamp, IP, user agent and a SHA-256 signature hash.

Checks, security and troubleshooting

  • Sign only after checking quantities and recipient details; the signed note cannot be edited or voided.
Stay within the supported flowDo not force database values, expose secure tokens, bypass permission checks, replace a stored signature or invent a status or interface that the supplied code does not implement.