{"record":{"id":"f8364cb88e524462","repo":"docusealco/docuseal","slug":"read-only-field","errorCode":null,"errorMessage":"Read-only field","messagePattern":"Read-only field","errorType":"validation","errorClass":"Submitters::SubmitValues::ValidationError","httpStatus":422,"severity":"error","filePath":"lib/submitters/submit_values.rb","lineNumber":507,"sourceCode":"\n        SubmissionEvents.create_with_tracking_data(submitter, 'invite_party', request, { uuid: submitter.uuid })\n\n        is_invited = true\n      end\n\n      submission.update!(submitters_order: :preserved) if is_invited\n\n      submitter\n    end\n\n    def validate_value!(_value, field, _params, submitter, _request)\n      raise ValidationError, 'Missing field' unless field\n      raise ValidationError, 'Invalid field' if field['submitter_uuid'] != submitter.uuid\n\n      if field['readonly'] == true\n        Rollbar.warning(\"Readonly field #{submitter.id}: #{field['uuid']}\") if defined?(Rollbar)\n\n        raise ValidationError, 'Read-only field'\n      end\n\n      true\n    end\n  end\nend\n","sourceCodeStart":489,"sourceCodeEnd":514,"githubUrl":"https://github.com/docusealco/docuseal/blob/004a22c1c88109c7ba0b567df011a8cb13894001/lib/submitters/submit_values.rb#L489-L514","documentation":"Raised by Submitters::SubmitValues.validate_value! when the values hash writes to a field whose readonly attribute is exactly true. Readonly fields (e.g. the auto-created decline-reason text field, prefilled/computed fields) are display-only; the attempted write is also logged to Rollbar as 'Readonly field' when Rollbar is defined.","triggerScenarios":"Submitting a value for a field configured readonly: true in the template — commonly the auto-created 'Reason' field (created with 'readonly' => true) or any field an admin locked after prefilling defaults.","commonSituations":"An integration prefills readonly defaults and then posts the whole values object back; the auto-created reason field from a previous decline keeps being included in later submits; a UI bug leaves an input enabled for a locked field; template switched a field to readonly but the client still sends it.","solutions":["Remove readonly fields from the values payload (slice to writable fields before submitting)","If the field must be editable, set readonly to false in the template field definition","Never write values for internally created fields such as decline-reason fields — they are readonly by design"],"exampleFix":"# before\nvalues = values.merge('readonly_field_uuid' => 'new value') # raises 'Read-only field'\n# after\nwritable = submitter.submission.template_fields.reject { |f| f['readonly'] == true }\nvalues = values.slice(*writable.map { |f| f['uuid'] })","handlingStrategy":"validation","validationCode":"writable_uuids = submitter.submission.template_fields\n                            .reject { |f| f['readonly'] == true }\n                            .map { |f| f['uuid'] }\nvalues = values.slice(*writable_uuids)","typeGuard":"def writable_field?(uuid, submission)\n  field = submission.fields_uuid_index[uuid]\n  !field.nil? && field['readonly'] != true\nend","tryCatchPattern":"begin\n  Submitters::SubmitValues.call(submitter, params, request)\nrescue Submitters::SubmitValues::ValidationError => e\n  # e.message == 'Read-only field' -> client tried to write a locked field\n  render json: { error: e.message }, status: :unprocessable_entity\nend","preventionTips":["Track which fields are readonly in the form schema and disable those inputs","When prefilling defaults server-side, keep a separate readonly set and never echo it back in submit payloads","Alert on the Rollbar 'Readonly field' warning — it indicates a client sending locked fields"],"tags":["ruby","rails","e-signature","form-validation","readonly"],"backgroundTag":"readonly-field-write","analyzedSha":"004a22c1c88109c7ba0b567df011a8cb13894001","analyzedAt":"2026-08-21T13:38:23.343Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}