feat: add teams (#848)

## Description

Add support for teams which will allow users to collaborate on
documents.

Teams features allows users to:

- Create, manage and transfer teams
- Manage team members
- Manage team emails
- Manage a shared team inbox and documents

These changes do NOT include the following, which are planned for a
future release:

- Team templates
- Team API
- Search menu integration

## Testing Performed

- Added E2E tests for general team management
- Added E2E tests to validate document counts

## Checklist

- [X] I have tested these changes locally and they work as expected.
- [X] I have added/updated tests that prove the effectiveness of these
changes.
- [ ] I have updated the documentation to reflect these changes, if
applicable.
- [X] I have followed the project's coding style guidelines.

packages/lib/server-only/team/accept-team-invitation.ts

@@ -0,0 +1,63 @@
+import { updateSubscriptionItemQuantity } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
+import { prisma } from '@documenso/prisma';
+
+import { IS_BILLING_ENABLED } from '../../constants/app';
+
+export type AcceptTeamInvitationOptions = {
+  userId: number;
+  teamId: number;
+};
+
+export const acceptTeamInvitation = async ({ userId, teamId }: AcceptTeamInvitationOptions) => {
+  await prisma.$transaction(async (tx) => {
+    const user = await tx.user.findFirstOrThrow({
+      where: {
+        id: userId,
+      },
+    });
+
+    const teamMemberInvite = await tx.teamMemberInvite.findFirstOrThrow({
+      where: {
+        teamId,
+        email: user.email,
+      },
+      include: {
+        team: {
+          include: {
+            subscription: true,
+          },
+        },
+      },
+    });
+
+    const { team } = teamMemberInvite;
+
+    await tx.teamMember.create({
+      data: {
+        teamId: teamMemberInvite.teamId,
+        userId: user.id,
+        role: teamMemberInvite.role,
+      },
+    });
+
+    await tx.teamMemberInvite.delete({
+      where: {
+        id: teamMemberInvite.id,
+      },
+    });
+
+    if (IS_BILLING_ENABLED && team.subscription) {
+      const numberOfSeats = await tx.teamMember.count({
+        where: {
+          teamId: teamMemberInvite.teamId,
+        },
+      });
+
+      await updateSubscriptionItemQuantity({
+        priceId: team.subscription.priceId,
+        subscriptionId: team.subscription.planId,
+        quantity: numberOfSeats,
+      });
+    }
+  });
+};

packages/lib/server-only/team/create-team-billing-portal.ts

@@ -0,0 +1,47 @@
+import { getPortalSession } from '@documenso/ee/server-only/stripe/get-portal-session';
+import { IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { prisma } from '@documenso/prisma';
+
+export type CreateTeamBillingPortalOptions = {
+  userId: number;
+  teamId: number;
+};
+
+export const createTeamBillingPortal = async ({
+  userId,
+  teamId,
+}: CreateTeamBillingPortalOptions) => {
+  if (!IS_BILLING_ENABLED) {
+    throw new Error('Billing is not enabled');
+  }
+
+  const team = await prisma.team.findFirstOrThrow({
+    where: {
+      id: teamId,
+      members: {
+        some: {
+          userId,
+          role: {
+            in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_BILLING'],
+          },
+        },
+      },
+    },
+    include: {
+      subscription: true,
+    },
+  });
+
+  if (!team.subscription) {
+    throw new Error('Team has no subscription');
+  }
+
+  if (!team.customerId) {
+    throw new Error('Team has no customerId');
+  }
+
+  return getPortalSession({
+    customerId: team.customerId,
+  });
+};

packages/lib/server-only/team/create-team-checkout-session.ts

@@ -0,0 +1,52 @@
+import { getCheckoutSession } from '@documenso/ee/server-only/stripe/get-checkout-session';
+import { getTeamPrices } from '@documenso/ee/server-only/stripe/get-team-prices';
+import { WEBAPP_BASE_URL } from '@documenso/lib/constants/app';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+
+export type CreateTeamPendingCheckoutSession = {
+  userId: number;
+  pendingTeamId: number;
+  interval: 'monthly' | 'yearly';
+};
+
+export const createTeamPendingCheckoutSession = async ({
+  userId,
+  pendingTeamId,
+  interval,
+}: CreateTeamPendingCheckoutSession) => {
+  const teamPendingCreation = await prisma.teamPending.findFirstOrThrow({
+    where: {
+      id: pendingTeamId,
+      ownerUserId: userId,
+    },
+    include: {
+      owner: true,
+    },
+  });
+
+  const prices = await getTeamPrices();
+  const priceId = prices[interval].priceId;
+
+  try {
+    const stripeCheckoutSession = await getCheckoutSession({
+      customerId: teamPendingCreation.customerId,
+      priceId,
+      returnUrl: `${WEBAPP_BASE_URL}/settings/teams`,
+      subscriptionMetadata: {
+        pendingTeamId: pendingTeamId.toString(),
+      },
+    });
+
+    if (!stripeCheckoutSession) {
+      throw new AppError(AppErrorCode.UNKNOWN_ERROR);
+    }
+
+    return stripeCheckoutSession;
+  } catch (e) {
+    console.error(e);
+
+    // Absorb all the errors incase Stripe throws something sensitive.
+    throw new AppError(AppErrorCode.UNKNOWN_ERROR, 'Something went wrong.');
+  }
+};

packages/lib/server-only/team/create-team-email-verification.ts

@@ -0,0 +1,132 @@
+import { createElement } from 'react';
+
+import { z } from 'zod';
+
+import { mailer } from '@documenso/email/mailer';
+import { render } from '@documenso/email/render';
+import { ConfirmTeamEmailTemplate } from '@documenso/email/templates/confirm-team-email';
+import { WEBAPP_BASE_URL } from '@documenso/lib/constants/app';
+import { FROM_ADDRESS, FROM_NAME } from '@documenso/lib/constants/email';
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { createTokenVerification } from '@documenso/lib/utils/token-verification';
+import { prisma } from '@documenso/prisma';
+import { Prisma } from '@documenso/prisma/client';
+
+export type CreateTeamEmailVerificationOptions = {
+  userId: number;
+  teamId: number;
+  data: {
+    email: string;
+    name: string;
+  };
+};
+
+export const createTeamEmailVerification = async ({
+  userId,
+  teamId,
+  data,
+}: CreateTeamEmailVerificationOptions) => {
+  try {
+    await prisma.$transaction(async (tx) => {
+      const team = await tx.team.findFirstOrThrow({
+        where: {
+          id: teamId,
+          members: {
+            some: {
+              userId,
+              role: {
+                in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+              },
+            },
+          },
+        },
+        include: {
+          teamEmail: true,
+          emailVerification: true,
+        },
+      });
+
+      if (team.teamEmail || team.emailVerification) {
+        throw new AppError(
+          AppErrorCode.INVALID_REQUEST,
+          'Team already has an email or existing email verification.',
+        );
+      }
+
+      const existingTeamEmail = await tx.teamEmail.findFirst({
+        where: {
+          email: data.email,
+        },
+      });
+
+      if (existingTeamEmail) {
+        throw new AppError(AppErrorCode.ALREADY_EXISTS, 'Email already taken by another team.');
+      }
+
+      const { token, expiresAt } = createTokenVerification({ hours: 1 });
+
+      await tx.teamEmailVerification.create({
+        data: {
+          token,
+          expiresAt,
+          email: data.email,
+          name: data.name,
+          teamId,
+        },
+      });
+
+      await sendTeamEmailVerificationEmail(data.email, token, team.name, team.url);
+    });
+  } catch (err) {
+    console.error(err);
+
+    if (!(err instanceof Prisma.PrismaClientKnownRequestError)) {
+      throw err;
+    }
+
+    const target = z.array(z.string()).safeParse(err.meta?.target);
+
+    if (err.code === 'P2002' && target.success && target.data.includes('email')) {
+      throw new AppError(AppErrorCode.ALREADY_EXISTS, 'Email already taken by another team.');
+    }
+
+    throw err;
+  }
+};
+
+/**
+ * Send an email to a user asking them to accept a team email request.
+ *
+ * @param email The email address to use for the team.
+ * @param token The token used to authenticate that the user has granted access.
+ * @param teamName The name of the team the user is being invited to.
+ * @param teamUrl The url of the team the user is being invited to.
+ */
+export const sendTeamEmailVerificationEmail = async (
+  email: string,
+  token: string,
+  teamName: string,
+  teamUrl: string,
+) => {
+  const assetBaseUrl = process.env.NEXT_PUBLIC_WEBAPP_URL || 'http://localhost:3000';
+
+  const template = createElement(ConfirmTeamEmailTemplate, {
+    assetBaseUrl,
+    baseUrl: WEBAPP_BASE_URL,
+    teamName,
+    teamUrl,
+    token,
+  });
+
+  await mailer.sendMail({
+    to: email,
+    from: {
+      name: FROM_NAME,
+      address: FROM_ADDRESS,
+    },
+    subject: `A request to use your email has been initiated by ${teamName} on Documenso`,
+    html: render(template),
+    text: render(template, { plainText: true }),
+  });
+};

packages/lib/server-only/team/create-team-member-invites.ts

@@ -0,0 +1,161 @@
+import { createElement } from 'react';
+
+import { nanoid } from 'nanoid';
+
+import { mailer } from '@documenso/email/mailer';
+import { render } from '@documenso/email/render';
+import type { TeamInviteEmailProps } from '@documenso/email/templates/team-invite';
+import { TeamInviteEmailTemplate } from '@documenso/email/templates/team-invite';
+import { WEBAPP_BASE_URL } from '@documenso/lib/constants/app';
+import { FROM_ADDRESS, FROM_NAME } from '@documenso/lib/constants/email';
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { isTeamRoleWithinUserHierarchy } from '@documenso/lib/utils/teams';
+import { prisma } from '@documenso/prisma';
+import { TeamMemberInviteStatus } from '@documenso/prisma/client';
+import type { TCreateTeamMemberInvitesMutationSchema } from '@documenso/trpc/server/team-router/schema';
+
+export type CreateTeamMemberInvitesOptions = {
+  userId: number;
+  userName: string;
+  teamId: number;
+  invitations: TCreateTeamMemberInvitesMutationSchema['invitations'];
+};
+
+/**
+ * Invite team members via email to join a team.
+ */
+export const createTeamMemberInvites = async ({
+  userId,
+  userName,
+  teamId,
+  invitations,
+}: CreateTeamMemberInvitesOptions) => {
+  const team = await prisma.team.findFirstOrThrow({
+    where: {
+      id: teamId,
+      members: {
+        some: {
+          userId,
+          role: {
+            in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+          },
+        },
+      },
+    },
+    include: {
+      members: {
+        select: {
+          role: true,
+          user: {
+            select: {
+              id: true,
+              email: true,
+            },
+          },
+        },
+      },
+      invites: true,
+    },
+  });
+
+  const teamMemberEmails = team.members.map((member) => member.user.email);
+  const teamMemberInviteEmails = team.invites.map((invite) => invite.email);
+  const currentTeamMember = team.members.find((member) => member.user.id === userId);
+
+  if (!currentTeamMember) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, 'User not part of team.');
+  }
+
+  const usersToInvite = invitations.filter((invitation) => {
+    // Filter out users that are already members of the team.
+    if (teamMemberEmails.includes(invitation.email)) {
+      return false;
+    }
+
+    // Filter out users that have already been invited to the team.
+    if (teamMemberInviteEmails.includes(invitation.email)) {
+      return false;
+    }
+
+    return true;
+  });
+
+  const unauthorizedRoleAccess = usersToInvite.some(
+    ({ role }) => !isTeamRoleWithinUserHierarchy(currentTeamMember.role, role),
+  );
+
+  if (unauthorizedRoleAccess) {
+    throw new AppError(
+      AppErrorCode.UNAUTHORIZED,
+      'User does not have permission to set high level roles',
+    );
+  }
+
+  const teamMemberInvites = usersToInvite.map(({ email, role }) => ({
+    email,
+    teamId,
+    role,
+    status: TeamMemberInviteStatus.PENDING,
+    token: nanoid(32),
+  }));
+
+  await prisma.teamMemberInvite.createMany({
+    data: teamMemberInvites,
+  });
+
+  const sendEmailResult = await Promise.allSettled(
+    teamMemberInvites.map(async ({ email, token }) =>
+      sendTeamMemberInviteEmail({
+        email,
+        token,
+        teamName: team.name,
+        teamUrl: team.url,
+        senderName: userName,
+      }),
+    ),
+  );
+
+  const sendEmailResultErrorList = sendEmailResult.filter(
+    (result): result is PromiseRejectedResult => result.status === 'rejected',
+  );
+
+  if (sendEmailResultErrorList.length > 0) {
+    console.error(JSON.stringify(sendEmailResultErrorList));
+
+    throw new AppError(
+      'EmailDeliveryFailed',
+      'Failed to send invite emails to one or more users.',
+      `Failed to send invites to ${sendEmailResultErrorList.length}/${teamMemberInvites.length} users.`,
+    );
+  }
+};
+
+type SendTeamMemberInviteEmailOptions = Omit<TeamInviteEmailProps, 'baseUrl' | 'assetBaseUrl'> & {
+  email: string;
+};
+
+/**
+ * Send an email to a user inviting them to join a team.
+ */
+export const sendTeamMemberInviteEmail = async ({
+  email,
+  ...emailTemplateOptions
+}: SendTeamMemberInviteEmailOptions) => {
+  const template = createElement(TeamInviteEmailTemplate, {
+    assetBaseUrl: WEBAPP_BASE_URL,
+    baseUrl: WEBAPP_BASE_URL,
+    ...emailTemplateOptions,
+  });
+
+  await mailer.sendMail({
+    to: email,
+    from: {
+      name: FROM_NAME,
+      address: FROM_ADDRESS,
+    },
+    subject: `You have been invited to join ${emailTemplateOptions.teamName} on Documenso`,
+    html: render(template),
+    text: render(template, { plainText: true }),
+  });
+};

packages/lib/server-only/team/create-team.ts

@@ -0,0 +1,207 @@
+import type Stripe from 'stripe';
+import { z } from 'zod';
+
+import { createTeamCustomer } from '@documenso/ee/server-only/stripe/create-team-customer';
+import { getCommunityPlanPriceIds } from '@documenso/ee/server-only/stripe/get-community-plan-prices';
+import { mapStripeSubscriptionToPrismaUpsertAction } from '@documenso/ee/server-only/stripe/webhook/on-subscription-updated';
+import { IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { subscriptionsContainsActiveCommunityPlan } from '@documenso/lib/utils/billing';
+import { prisma } from '@documenso/prisma';
+import { Prisma, TeamMemberRole } from '@documenso/prisma/client';
+
+import { stripe } from '../stripe';
+
+export type CreateTeamOptions = {
+  /**
+   * ID of the user creating the Team.
+   */
+  userId: number;
+
+  /**
+   * Name of the team to display.
+   */
+  teamName: string;
+
+  /**
+   * Unique URL of the team.
+   *
+   * Used as the URL path, example: https://documenso.com/t/{teamUrl}/settings
+   */
+  teamUrl: string;
+};
+
+export type CreateTeamResponse =
+  | {
+      paymentRequired: false;
+    }
+  | {
+      paymentRequired: true;
+      pendingTeamId: number;
+    };
+
+/**
+ * Create a team or pending team depending on the user's subscription or application's billing settings.
+ */
+export const createTeam = async ({
+  userId,
+  teamName,
+  teamUrl,
+}: CreateTeamOptions): Promise<CreateTeamResponse> => {
+  const user = await prisma.user.findUniqueOrThrow({
+    where: {
+      id: userId,
+    },
+    include: {
+      Subscription: true,
+    },
+  });
+
+  let isPaymentRequired = IS_BILLING_ENABLED;
+  let customerId: string | null = null;
+
+  if (IS_BILLING_ENABLED) {
+    const communityPlanPriceIds = await getCommunityPlanPriceIds();
+
+    isPaymentRequired = !subscriptionsContainsActiveCommunityPlan(
+      user.Subscription,
+      communityPlanPriceIds,
+    );
+
+    customerId = await createTeamCustomer({
+      name: user.name ?? teamName,
+      email: user.email,
+    }).then((customer) => customer.id);
+  }
+
+  try {
+    // Create the team directly if no payment is required.
+    if (!isPaymentRequired) {
+      await prisma.team.create({
+        data: {
+          name: teamName,
+          url: teamUrl,
+          ownerUserId: user.id,
+          customerId,
+          members: {
+            create: [
+              {
+                userId,
+                role: TeamMemberRole.ADMIN,
+              },
+            ],
+          },
+        },
+      });
+
+      return {
+        paymentRequired: false,
+      };
+    }
+
+    // Create a pending team if payment is required.
+    const pendingTeam = await prisma.$transaction(async (tx) => {
+      const existingTeamWithUrl = await tx.team.findUnique({
+        where: {
+          url: teamUrl,
+        },
+      });
+
+      if (existingTeamWithUrl) {
+        throw new AppError(AppErrorCode.ALREADY_EXISTS, 'Team URL already exists.');
+      }
+
+      if (!customerId) {
+        throw new AppError(AppErrorCode.UNKNOWN_ERROR, 'Missing customer ID for pending teams.');
+      }
+
+      return await tx.teamPending.create({
+        data: {
+          name: teamName,
+          url: teamUrl,
+          ownerUserId: user.id,
+          customerId,
+        },
+      });
+    });
+
+    return {
+      paymentRequired: true,
+      pendingTeamId: pendingTeam.id,
+    };
+  } catch (err) {
+    console.error(err);
+
+    if (!(err instanceof Prisma.PrismaClientKnownRequestError)) {
+      throw err;
+    }
+
+    const target = z.array(z.string()).safeParse(err.meta?.target);
+
+    if (err.code === 'P2002' && target.success && target.data.includes('url')) {
+      throw new AppError(AppErrorCode.ALREADY_EXISTS, 'Team URL already exists.');
+    }
+
+    throw err;
+  }
+};
+
+export type CreateTeamFromPendingTeamOptions = {
+  pendingTeamId: number;
+  subscription: Stripe.Subscription;
+};
+
+export const createTeamFromPendingTeam = async ({
+  pendingTeamId,
+  subscription,
+}: CreateTeamFromPendingTeamOptions) => {
+  return await prisma.$transaction(async (tx) => {
+    const pendingTeam = await tx.teamPending.findUniqueOrThrow({
+      where: {
+        id: pendingTeamId,
+      },
+    });
+
+    await tx.teamPending.delete({
+      where: {
+        id: pendingTeamId,
+      },
+    });
+
+    const team = await tx.team.create({
+      data: {
+        name: pendingTeam.name,
+        url: pendingTeam.url,
+        ownerUserId: pendingTeam.ownerUserId,
+        customerId: pendingTeam.customerId,
+        members: {
+          create: [
+            {
+              userId: pendingTeam.ownerUserId,
+              role: TeamMemberRole.ADMIN,
+            },
+          ],
+        },
+      },
+    });
+
+    await tx.subscription.upsert(
+      mapStripeSubscriptionToPrismaUpsertAction(subscription, undefined, team.id),
+    );
+
+    // Attach the team ID to the subscription metadata for sanity reasons.
+    await stripe.subscriptions
+      .update(subscription.id, {
+        metadata: {
+          teamId: team.id.toString(),
+        },
+      })
+      .catch((e) => {
+        console.error(e);
+        // Non-critical error, but we want to log it so we can rectify it.
+        // Todo: Teams - Alert us.
+      });
+
+    return team;
+  });
+};

packages/lib/server-only/team/delete-team-email-verification.ts

@@ -0,0 +1,34 @@
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { prisma } from '@documenso/prisma';
+
+export type DeleteTeamEmailVerificationOptions = {
+  userId: number;
+  teamId: number;
+};
+
+export const deleteTeamEmailVerification = async ({
+  userId,
+  teamId,
+}: DeleteTeamEmailVerificationOptions) => {
+  await prisma.$transaction(async (tx) => {
+    await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        members: {
+          some: {
+            userId,
+            role: {
+              in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+            },
+          },
+        },
+      },
+    });
+
+    await tx.teamEmailVerification.delete({
+      where: {
+        teamId,
+      },
+    });
+  });
+};

packages/lib/server-only/team/delete-team-email.ts

@@ -0,0 +1,93 @@
+import { createElement } from 'react';
+
+import { mailer } from '@documenso/email/mailer';
+import { render } from '@documenso/email/render';
+import { TeamEmailRemovedTemplate } from '@documenso/email/templates/team-email-removed';
+import { WEBAPP_BASE_URL } from '@documenso/lib/constants/app';
+import { FROM_ADDRESS, FROM_NAME } from '@documenso/lib/constants/email';
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { prisma } from '@documenso/prisma';
+
+export type DeleteTeamEmailOptions = {
+  userId: number;
+  userEmail: string;
+  teamId: number;
+};
+
+/**
+ * Delete a team email.
+ *
+ * The user must either be part of the team with the required permissions, or the owner of the email.
+ */
+export const deleteTeamEmail = async ({ userId, userEmail, teamId }: DeleteTeamEmailOptions) => {
+  const team = await prisma.$transaction(async (tx) => {
+    const foundTeam = await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        OR: [
+          {
+            teamEmail: {
+              email: userEmail,
+            },
+          },
+          {
+            members: {
+              some: {
+                userId,
+                role: {
+                  in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+                },
+              },
+            },
+          },
+        ],
+      },
+      include: {
+        teamEmail: true,
+        owner: {
+          select: {
+            name: true,
+            email: true,
+          },
+        },
+      },
+    });
+
+    await tx.teamEmail.delete({
+      where: {
+        teamId,
+      },
+    });
+
+    return foundTeam;
+  });
+
+  try {
+    const assetBaseUrl = process.env.NEXT_PUBLIC_WEBAPP_URL || 'http://localhost:3000';
+
+    const template = createElement(TeamEmailRemovedTemplate, {
+      assetBaseUrl,
+      baseUrl: WEBAPP_BASE_URL,
+      teamEmail: team.teamEmail?.email ?? '',
+      teamName: team.name,
+      teamUrl: team.url,
+    });
+
+    await mailer.sendMail({
+      to: {
+        address: team.owner.email,
+        name: team.owner.name ?? '',
+      },
+      from: {
+        name: FROM_NAME,
+        address: FROM_ADDRESS,
+      },
+      subject: `Team email has been revoked for ${team.name}`,
+      html: render(template),
+      text: render(template, { plainText: true }),
+    });
+  } catch (e) {
+    // Todo: Teams - Alert us.
+    // We don't want to prevent a user from revoking access because an email could not be sent.
+  }
+};

packages/lib/server-only/team/delete-team-invitations.ts

@@ -0,0 +1,47 @@
+import { prisma } from '@documenso/prisma';
+
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '../../constants/teams';
+
+export type DeleteTeamMemberInvitationsOptions = {
+  /**
+   * The ID of the user who is initiating this action.
+   */
+  userId: number;
+
+  /**
+   * The ID of the team to remove members from.
+   */
+  teamId: number;
+
+  /**
+   * The IDs of the invitations to remove.
+   */
+  invitationIds: number[];
+};
+
+export const deleteTeamMemberInvitations = async ({
+  userId,
+  teamId,
+  invitationIds,
+}: DeleteTeamMemberInvitationsOptions) => {
+  await prisma.$transaction(async (tx) => {
+    await tx.teamMember.findFirstOrThrow({
+      where: {
+        userId,
+        teamId,
+        role: {
+          in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+        },
+      },
+    });
+
+    await tx.teamMemberInvite.deleteMany({
+      where: {
+        id: {
+          in: invitationIds,
+        },
+        teamId,
+      },
+    });
+  });
+};

packages/lib/server-only/team/delete-team-members.ts

@@ -0,0 +1,102 @@
+import { updateSubscriptionItemQuantity } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
+import { IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { isTeamRoleWithinUserHierarchy } from '@documenso/lib/utils/teams';
+import { prisma } from '@documenso/prisma';
+
+export type DeleteTeamMembersOptions = {
+  /**
+   * The ID of the user who is initiating this action.
+   */
+  userId: number;
+
+  /**
+   * The ID of the team to remove members from.
+   */
+  teamId: number;
+
+  /**
+   * The IDs of the team members to remove.
+   */
+  teamMemberIds: number[];
+};
+
+export const deleteTeamMembers = async ({
+  userId,
+  teamId,
+  teamMemberIds,
+}: DeleteTeamMembersOptions) => {
+  await prisma.$transaction(async (tx) => {
+    // Find the team and validate that the user is allowed to remove members.
+    const team = await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        members: {
+          some: {
+            userId,
+            role: {
+              in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+            },
+          },
+        },
+      },
+      include: {
+        members: {
+          select: {
+            id: true,
+            userId: true,
+            role: true,
+          },
+        },
+        subscription: true,
+      },
+    });
+
+    const currentTeamMember = team.members.find((member) => member.userId === userId);
+    const teamMembersToRemove = team.members.filter((member) => teamMemberIds.includes(member.id));
+
+    if (!currentTeamMember) {
+      throw new AppError(AppErrorCode.NOT_FOUND, 'Team member record does not exist');
+    }
+
+    if (teamMembersToRemove.find((member) => member.userId === team.ownerUserId)) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, 'Cannot remove the team owner');
+    }
+
+    const isMemberToRemoveHigherRole = teamMembersToRemove.some(
+      (member) => !isTeamRoleWithinUserHierarchy(currentTeamMember.role, member.role),
+    );
+
+    if (isMemberToRemoveHigherRole) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, 'Cannot remove a member with a higher role');
+    }
+
+    // Remove the team members.
+    await tx.teamMember.deleteMany({
+      where: {
+        id: {
+          in: teamMemberIds,
+        },
+        teamId,
+        userId: {
+          not: team.ownerUserId,
+        },
+      },
+    });
+
+    if (IS_BILLING_ENABLED && team.subscription) {
+      const numberOfSeats = await tx.teamMember.count({
+        where: {
+          teamId,
+        },
+      });
+
+      await updateSubscriptionItemQuantity({
+        priceId: team.subscription.priceId,
+        subscriptionId: team.subscription.planId,
+        quantity: numberOfSeats,
+      });
+    }
+  });
+};

packages/lib/server-only/team/delete-team-pending.ts

@@ -0,0 +1,15 @@
+import { prisma } from '@documenso/prisma';
+
+export type DeleteTeamPendingOptions = {
+  userId: number;
+  pendingTeamId: number;
+};
+
+export const deleteTeamPending = async ({ userId, pendingTeamId }: DeleteTeamPendingOptions) => {
+  await prisma.teamPending.delete({
+    where: {
+      id: pendingTeamId,
+      ownerUserId: userId,
+    },
+  });
+};

packages/lib/server-only/team/delete-team-transfer-request.ts

@@ -0,0 +1,42 @@
+import { prisma } from '@documenso/prisma';
+
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '../../constants/teams';
+
+export type DeleteTeamTransferRequestOptions = {
+  /**
+   * The ID of the user deleting the transfer.
+   */
+  userId: number;
+
+  /**
+   * The ID of the team whose team transfer request should be deleted.
+   */
+  teamId: number;
+};
+
+export const deleteTeamTransferRequest = async ({
+  userId,
+  teamId,
+}: DeleteTeamTransferRequestOptions) => {
+  await prisma.$transaction(async (tx) => {
+    await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        members: {
+          some: {
+            userId,
+            role: {
+              in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['DELETE_TEAM_TRANSFER_REQUEST'],
+            },
+          },
+        },
+      },
+    });
+
+    await tx.teamTransferVerification.delete({
+      where: {
+        teamId,
+      },
+    });
+  });
+};

packages/lib/server-only/team/delete-team.ts

@@ -0,0 +1,42 @@
+import { prisma } from '@documenso/prisma';
+
+import { AppError } from '../../errors/app-error';
+import { stripe } from '../stripe';
+
+export type DeleteTeamOptions = {
+  userId: number;
+  teamId: number;
+};
+
+export const deleteTeam = async ({ userId, teamId }: DeleteTeamOptions) => {
+  await prisma.$transaction(async (tx) => {
+    const team = await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        ownerUserId: userId,
+      },
+      include: {
+        subscription: true,
+      },
+    });
+
+    if (team.subscription) {
+      await stripe.subscriptions
+        .cancel(team.subscription.planId, {
+          prorate: false,
+          invoice_now: true,
+        })
+        .catch((err) => {
+          console.error(err);
+          throw AppError.parseError(err);
+        });
+    }
+
+    await tx.team.delete({
+      where: {
+        id: teamId,
+        ownerUserId: userId,
+      },
+    });
+  });
+};

packages/lib/server-only/team/find-team-invoices.ts

@@ -0,0 +1,52 @@
+import { getInvoices } from '@documenso/ee/server-only/stripe/get-invoices';
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+
+export interface FindTeamInvoicesOptions {
+  userId: number;
+  teamId: number;
+}
+
+export const findTeamInvoices = async ({ userId, teamId }: FindTeamInvoicesOptions) => {
+  const team = await prisma.team.findUniqueOrThrow({
+    where: {
+      id: teamId,
+      members: {
+        some: {
+          userId,
+          role: {
+            in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+          },
+        },
+      },
+    },
+  });
+
+  if (!team.customerId) {
+    throw new AppError(AppErrorCode.NOT_FOUND, 'Team has no customer ID.');
+  }
+
+  const results = await getInvoices({ customerId: team.customerId });
+
+  if (!results) {
+    return null;
+  }
+
+  return {
+    ...results,
+    data: results.data.map((invoice) => ({
+      invoicePdf: invoice.invoice_pdf,
+      hostedInvoicePdf: invoice.hosted_invoice_url,
+      status: invoice.status,
+      subtotal: invoice.subtotal,
+      total: invoice.total,
+      amountPaid: invoice.amount_paid,
+      amountDue: invoice.amount_due,
+      created: invoice.created,
+      paid: invoice.paid,
+      quantity: invoice.lines.data[0].quantity ?? 0,
+      currency: invoice.currency,
+    })),
+  };
+};

packages/lib/server-only/team/find-team-member-invites.ts

@@ -0,0 +1,91 @@
+import { P, match } from 'ts-pattern';
+
+import { prisma } from '@documenso/prisma';
+import type { TeamMemberInvite } from '@documenso/prisma/client';
+import { Prisma } from '@documenso/prisma/client';
+
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '../../constants/teams';
+import type { FindResultSet } from '../../types/find-result-set';
+
+export interface FindTeamMemberInvitesOptions {
+  userId: number;
+  teamId: number;
+  term?: string;
+  page?: number;
+  perPage?: number;
+  orderBy?: {
+    column: keyof TeamMemberInvite;
+    direction: 'asc' | 'desc';
+  };
+}
+
+export const findTeamMemberInvites = async ({
+  userId,
+  teamId,
+  term,
+  page = 1,
+  perPage = 10,
+  orderBy,
+}: FindTeamMemberInvitesOptions) => {
+  const orderByColumn = orderBy?.column ?? 'email';
+  const orderByDirection = orderBy?.direction ?? 'desc';
+
+  // Check that the user belongs to the team they are trying to find invites in.
+  const userTeam = await prisma.team.findUniqueOrThrow({
+    where: {
+      id: teamId,
+      members: {
+        some: {
+          userId,
+          role: {
+            in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+          },
+        },
+      },
+    },
+  });
+
+  const termFilters: Prisma.TeamMemberInviteWhereInput | undefined = match(term)
+    .with(P.string.minLength(1), () => ({
+      email: {
+        contains: term,
+        mode: Prisma.QueryMode.insensitive,
+      },
+    }))
+    .otherwise(() => undefined);
+
+  const whereClause: Prisma.TeamMemberInviteWhereInput = {
+    ...termFilters,
+    teamId: userTeam.id,
+  };
+
+  const [data, count] = await Promise.all([
+    prisma.teamMemberInvite.findMany({
+      where: whereClause,
+      skip: Math.max(page - 1, 0) * perPage,
+      take: perPage,
+      orderBy: {
+        [orderByColumn]: orderByDirection,
+      },
+      // Exclude token attribute.
+      select: {
+        id: true,
+        teamId: true,
+        email: true,
+        role: true,
+        createdAt: true,
+      },
+    }),
+    prisma.teamMemberInvite.count({
+      where: whereClause,
+    }),
+  ]);
+
+  return {
+    data,
+    count,
+    currentPage: Math.max(page, 1),
+    perPage,
+    totalPages: Math.ceil(count / perPage),
+  } satisfies FindResultSet<typeof data>;
+};

packages/lib/server-only/team/find-team-members.ts

@@ -0,0 +1,100 @@
+import { P, match } from 'ts-pattern';
+
+import { prisma } from '@documenso/prisma';
+import type { TeamMember } from '@documenso/prisma/client';
+import { Prisma } from '@documenso/prisma/client';
+
+import type { FindResultSet } from '../../types/find-result-set';
+
+export interface FindTeamMembersOptions {
+  userId: number;
+  teamId: number;
+  term?: string;
+  page?: number;
+  perPage?: number;
+  orderBy?: {
+    column: keyof TeamMember | 'name';
+    direction: 'asc' | 'desc';
+  };
+}
+
+export const findTeamMembers = async ({
+  userId,
+  teamId,
+  term,
+  page = 1,
+  perPage = 10,
+  orderBy,
+}: FindTeamMembersOptions) => {
+  const orderByColumn = orderBy?.column ?? 'name';
+  const orderByDirection = orderBy?.direction ?? 'desc';
+
+  // Check that the user belongs to the team they are trying to find members in.
+  const userTeam = await prisma.team.findUniqueOrThrow({
+    where: {
+      id: teamId,
+      members: {
+        some: {
+          userId,
+        },
+      },
+    },
+  });
+
+  const termFilters: Prisma.TeamMemberWhereInput | undefined = match(term)
+    .with(P.string.minLength(1), () => ({
+      user: {
+        name: {
+          contains: term,
+          mode: Prisma.QueryMode.insensitive,
+        },
+      },
+    }))
+    .otherwise(() => undefined);
+
+  const whereClause: Prisma.TeamMemberWhereInput = {
+    ...termFilters,
+    teamId: userTeam.id,
+  };
+
+  let orderByClause: Prisma.TeamMemberOrderByWithRelationInput = {
+    [orderByColumn]: orderByDirection,
+  };
+
+  // Name field is nested in the user so we have to handle it differently.
+  if (orderByColumn === 'name') {
+    orderByClause = {
+      user: {
+        name: orderByDirection,
+      },
+    };
+  }
+
+  const [data, count] = await Promise.all([
+    prisma.teamMember.findMany({
+      where: whereClause,
+      skip: Math.max(page - 1, 0) * perPage,
+      take: perPage,
+      orderBy: orderByClause,
+      include: {
+        user: {
+          select: {
+            name: true,
+            email: true,
+          },
+        },
+      },
+    }),
+    prisma.teamMember.count({
+      where: whereClause,
+    }),
+  ]);
+
+  return {
+    data,
+    count,
+    currentPage: Math.max(page, 1),
+    perPage,
+    totalPages: Math.ceil(count / perPage),
+  } satisfies FindResultSet<typeof data>;
+};

packages/lib/server-only/team/find-teams-pending.ts

@@ -0,0 +1,58 @@
+import { prisma } from '@documenso/prisma';
+import type { Team } from '@documenso/prisma/client';
+import { Prisma } from '@documenso/prisma/client';
+
+export interface FindTeamsPendingOptions {
+  userId: number;
+  term?: string;
+  page?: number;
+  perPage?: number;
+  orderBy?: {
+    column: keyof Team;
+    direction: 'asc' | 'desc';
+  };
+}
+
+export const findTeamsPending = async ({
+  userId,
+  term,
+  page = 1,
+  perPage = 10,
+  orderBy,
+}: FindTeamsPendingOptions) => {
+  const orderByColumn = orderBy?.column ?? 'name';
+  const orderByDirection = orderBy?.direction ?? 'desc';
+
+  const whereClause: Prisma.TeamPendingWhereInput = {
+    ownerUserId: userId,
+  };
+
+  if (term && term.length > 0) {
+    whereClause.name = {
+      contains: term,
+      mode: Prisma.QueryMode.insensitive,
+    };
+  }
+
+  const [data, count] = await Promise.all([
+    prisma.teamPending.findMany({
+      where: whereClause,
+      skip: Math.max(page - 1, 0) * perPage,
+      take: perPage,
+      orderBy: {
+        [orderByColumn]: orderByDirection,
+      },
+    }),
+    prisma.teamPending.count({
+      where: whereClause,
+    }),
+  ]);
+
+  return {
+    data,
+    count,
+    currentPage: Math.max(page, 1),
+    perPage,
+    totalPages: Math.ceil(count / perPage),
+  };
+};

packages/lib/server-only/team/find-teams.ts

@@ -0,0 +1,76 @@
+import type { FindResultSet } from '@documenso/lib/types/find-result-set';
+import { prisma } from '@documenso/prisma';
+import type { Team } from '@documenso/prisma/client';
+import { Prisma } from '@documenso/prisma/client';
+
+export interface FindTeamsOptions {
+  userId: number;
+  term?: string;
+  page?: number;
+  perPage?: number;
+  orderBy?: {
+    column: keyof Team;
+    direction: 'asc' | 'desc';
+  };
+}
+
+export const findTeams = async ({
+  userId,
+  term,
+  page = 1,
+  perPage = 10,
+  orderBy,
+}: FindTeamsOptions) => {
+  const orderByColumn = orderBy?.column ?? 'name';
+  const orderByDirection = orderBy?.direction ?? 'desc';
+
+  const whereClause: Prisma.TeamWhereInput = {
+    members: {
+      some: {
+        userId,
+      },
+    },
+  };
+
+  if (term && term.length > 0) {
+    whereClause.name = {
+      contains: term,
+      mode: Prisma.QueryMode.insensitive,
+    };
+  }
+
+  const [data, count] = await Promise.all([
+    prisma.team.findMany({
+      where: whereClause,
+      skip: Math.max(page - 1, 0) * perPage,
+      take: perPage,
+      orderBy: {
+        [orderByColumn]: orderByDirection,
+      },
+      include: {
+        members: {
+          where: {
+            userId,
+          },
+        },
+      },
+    }),
+    prisma.team.count({
+      where: whereClause,
+    }),
+  ]);
+
+  const maskedData = data.map((team) => ({
+    ...team,
+    currentTeamMember: team.members[0],
+    members: undefined,
+  }));
+
+  return {
+    data: maskedData,
+    count,
+    currentPage: Math.max(page, 1),
+    perPage,
+    totalPages: Math.ceil(count / perPage),
+  } satisfies FindResultSet<typeof maskedData>;
+};

packages/lib/server-only/team/get-team-email-by-email.ts

@@ -0,0 +1,22 @@
+import { prisma } from '@documenso/prisma';
+
+export type GetTeamEmailByEmailOptions = {
+  email: string;
+};
+
+export const getTeamEmailByEmail = async ({ email }: GetTeamEmailByEmailOptions) => {
+  return await prisma.teamEmail.findFirst({
+    where: {
+      email,
+    },
+    include: {
+      team: {
+        select: {
+          id: true,
+          name: true,
+          url: true,
+        },
+      },
+    },
+  });
+};

packages/lib/server-only/team/get-team-invitations.ts

@@ -0,0 +1,22 @@
+import { prisma } from '@documenso/prisma';
+
+export type GetTeamInvitationsOptions = {
+  email: string;
+};
+
+export const getTeamInvitations = async ({ email }: GetTeamInvitationsOptions) => {
+  return await prisma.teamMemberInvite.findMany({
+    where: {
+      email,
+    },
+    include: {
+      team: {
+        select: {
+          id: true,
+          name: true,
+          url: true,
+        },
+      },
+    },
+  });
+};

packages/lib/server-only/team/get-team-members.ts

@@ -0,0 +1,33 @@
+import { prisma } from '@documenso/prisma';
+
+export type GetTeamMembersOptions = {
+  userId: number;
+  teamId: number;
+};
+
+/**
+ * Get all team members for a given team.
+ */
+export const getTeamMembers = async ({ userId, teamId }: GetTeamMembersOptions) => {
+  return await prisma.teamMember.findMany({
+    where: {
+      team: {
+        id: teamId,
+        members: {
+          some: {
+            userId: userId,
+          },
+        },
+      },
+    },
+    include: {
+      user: {
+        select: {
+          id: true,
+          email: true,
+          name: true,
+        },
+      },
+    },
+  });
+};

packages/lib/server-only/team/get-team.ts

@@ -0,0 +1,95 @@
+import { prisma } from '@documenso/prisma';
+import type { Prisma } from '@documenso/prisma/client';
+
+export type GetTeamByIdOptions = {
+  userId?: number;
+  teamId: number;
+};
+
+/**
+ * Get a team given a teamId.
+ *
+ * Provide an optional userId to check that the user is a member of the team.
+ */
+export const getTeamById = async ({ userId, teamId }: GetTeamByIdOptions) => {
+  const whereFilter: Prisma.TeamWhereUniqueInput = {
+    id: teamId,
+  };
+
+  if (userId !== undefined) {
+    whereFilter['members'] = {
+      some: {
+        userId,
+      },
+    };
+  }
+
+  const result = await prisma.team.findUniqueOrThrow({
+    where: whereFilter,
+    include: {
+      teamEmail: true,
+      members: {
+        where: {
+          userId,
+        },
+        select: {
+          role: true,
+        },
+      },
+    },
+  });
+
+  const { members, ...team } = result;
+
+  return {
+    ...team,
+    currentTeamMember: userId !== undefined ? members[0] : null,
+  };
+};
+
+export type GetTeamByUrlOptions = {
+  userId: number;
+  teamUrl: string;
+};
+
+/**
+ * Get a team given a team URL.
+ */
+export const getTeamByUrl = async ({ userId, teamUrl }: GetTeamByUrlOptions) => {
+  const whereFilter: Prisma.TeamWhereUniqueInput = {
+    url: teamUrl,
+  };
+
+  if (userId !== undefined) {
+    whereFilter['members'] = {
+      some: {
+        userId,
+      },
+    };
+  }
+
+  const result = await prisma.team.findUniqueOrThrow({
+    where: whereFilter,
+    include: {
+      teamEmail: true,
+      emailVerification: true,
+      transferVerification: true,
+      subscription: true,
+      members: {
+        where: {
+          userId,
+        },
+        select: {
+          role: true,
+        },
+      },
+    },
+  });
+
+  const { members, ...team } = result;
+
+  return {
+    ...team,
+    currentTeamMember: members[0],
+  };
+};

packages/lib/server-only/team/get-teams.ts

@@ -0,0 +1,33 @@
+import { prisma } from '@documenso/prisma';
+
+export type GetTeamsOptions = {
+  userId: number;
+};
+export type GetTeamsResponse = Awaited<ReturnType<typeof getTeams>>;
+
+export const getTeams = async ({ userId }: GetTeamsOptions) => {
+  const teams = await prisma.team.findMany({
+    where: {
+      members: {
+        some: {
+          userId,
+        },
+      },
+    },
+    include: {
+      members: {
+        where: {
+          userId,
+        },
+        select: {
+          role: true,
+        },
+      },
+    },
+  });
+
+  return teams.map(({ members, ...team }) => ({
+    ...team,
+    currentTeamMember: members[0],
+  }));
+};

packages/lib/server-only/team/leave-team.ts

@@ -0,0 +1,59 @@
+import { updateSubscriptionItemQuantity } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
+import { IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
+import { prisma } from '@documenso/prisma';
+
+export type LeaveTeamOptions = {
+  /**
+   * The ID of the user who is leaving the team.
+   */
+  userId: number;
+
+  /**
+   * The ID of the team the user is leaving.
+   */
+  teamId: number;
+};
+
+export const leaveTeam = async ({ userId, teamId }: LeaveTeamOptions) => {
+  await prisma.$transaction(async (tx) => {
+    const team = await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        ownerUserId: {
+          not: userId,
+        },
+      },
+      include: {
+        subscription: true,
+      },
+    });
+
+    await tx.teamMember.delete({
+      where: {
+        userId_teamId: {
+          userId,
+          teamId,
+        },
+        team: {
+          ownerUserId: {
+            not: userId,
+          },
+        },
+      },
+    });
+
+    if (IS_BILLING_ENABLED && team.subscription) {
+      const numberOfSeats = await tx.teamMember.count({
+        where: {
+          teamId,
+        },
+      });
+
+      await updateSubscriptionItemQuantity({
+        priceId: team.subscription.priceId,
+        subscriptionId: team.subscription.planId,
+        quantity: numberOfSeats,
+      });
+    }
+  });
+};

packages/lib/server-only/team/request-team-ownership-transfer.ts

@@ -0,0 +1,106 @@
+import { createElement } from 'react';
+
+import { mailer } from '@documenso/email/mailer';
+import { render } from '@documenso/email/render';
+import { TeamTransferRequestTemplate } from '@documenso/email/templates/team-transfer-request';
+import { WEBAPP_BASE_URL } from '@documenso/lib/constants/app';
+import { FROM_ADDRESS, FROM_NAME } from '@documenso/lib/constants/email';
+import { createTokenVerification } from '@documenso/lib/utils/token-verification';
+import { prisma } from '@documenso/prisma';
+
+export type RequestTeamOwnershipTransferOptions = {
+  /**
+   * The ID of the user initiating the transfer.
+   */
+  userId: number;
+
+  /**
+   * The name of the user initiating the transfer.
+   */
+  userName: string;
+
+  /**
+   * The ID of the team whose ownership is being transferred.
+   */
+  teamId: number;
+
+  /**
+   * The user ID of the new owner.
+   */
+  newOwnerUserId: number;
+
+  /**
+   * Whether to clear any current payment methods attached to the team.
+   */
+  clearPaymentMethods: boolean;
+};
+
+export const requestTeamOwnershipTransfer = async ({
+  userId,
+  userName,
+  teamId,
+  newOwnerUserId,
+}: RequestTeamOwnershipTransferOptions) => {
+  // Todo: Clear payment methods disabled for now.
+  const clearPaymentMethods = false;
+
+  await prisma.$transaction(async (tx) => {
+    const team = await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        ownerUserId: userId,
+        members: {
+          some: {
+            userId: newOwnerUserId,
+          },
+        },
+      },
+    });
+
+    const newOwnerUser = await tx.user.findFirstOrThrow({
+      where: {
+        id: newOwnerUserId,
+      },
+    });
+
+    const { token, expiresAt } = createTokenVerification({ minute: 10 });
+
+    const teamVerificationPayload = {
+      teamId,
+      token,
+      expiresAt,
+      userId: newOwnerUserId,
+      name: newOwnerUser.name ?? '',
+      email: newOwnerUser.email,
+      clearPaymentMethods,
+    };
+
+    await tx.teamTransferVerification.upsert({
+      where: {
+        teamId,
+      },
+      create: teamVerificationPayload,
+      update: teamVerificationPayload,
+    });
+
+    const template = createElement(TeamTransferRequestTemplate, {
+      assetBaseUrl: WEBAPP_BASE_URL,
+      baseUrl: WEBAPP_BASE_URL,
+      senderName: userName,
+      teamName: team.name,
+      teamUrl: team.url,
+      token,
+    });
+
+    await mailer.sendMail({
+      to: newOwnerUser.email,
+      from: {
+        name: FROM_NAME,
+        address: FROM_ADDRESS,
+      },
+      subject: `You have been requested to take ownership of team ${team.name} on Documenso`,
+      html: render(template),
+      text: render(template, { plainText: true }),
+    });
+  });
+};

packages/lib/server-only/team/resend-team-email-verification.ts

@@ -0,0 +1,65 @@
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { AppError } from '@documenso/lib/errors/app-error';
+import { createTokenVerification } from '@documenso/lib/utils/token-verification';
+import { prisma } from '@documenso/prisma';
+
+import { sendTeamEmailVerificationEmail } from './create-team-email-verification';
+
+export type ResendTeamMemberInvitationOptions = {
+  userId: number;
+  teamId: number;
+};
+
+/**
+ * Resend a team email verification with a new token.
+ */
+export const resendTeamEmailVerification = async ({
+  userId,
+  teamId,
+}: ResendTeamMemberInvitationOptions) => {
+  await prisma.$transaction(async (tx) => {
+    const team = await tx.team.findUniqueOrThrow({
+      where: {
+        id: teamId,
+        members: {
+          some: {
+            userId,
+            role: {
+              in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+            },
+          },
+        },
+      },
+      include: {
+        emailVerification: true,
+      },
+    });
+
+    if (!team) {
+      throw new AppError('TeamNotFound', 'User is not a member of the team.');
+    }
+
+    const { emailVerification } = team;
+
+    if (!emailVerification) {
+      throw new AppError(
+        'VerificationNotFound',
+        'No team email verification exists for this team.',
+      );
+    }
+
+    const { token, expiresAt } = createTokenVerification({ hours: 1 });
+
+    await tx.teamEmailVerification.update({
+      where: {
+        teamId,
+      },
+      data: {
+        token,
+        expiresAt,
+      },
+    });
+
+    await sendTeamEmailVerificationEmail(emailVerification.email, token, team.name, team.url);
+  });
+};

packages/lib/server-only/team/resend-team-member-invitation.ts

@@ -0,0 +1,76 @@
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { AppError } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+
+import { sendTeamMemberInviteEmail } from './create-team-member-invites';
+
+export type ResendTeamMemberInvitationOptions = {
+  /**
+   * The ID of the user who is initiating this action.
+   */
+  userId: number;
+
+  /**
+   * The name of the user who is initiating this action.
+   */
+  userName: string;
+
+  /**
+   * The ID of the team.
+   */
+  teamId: number;
+
+  /**
+   * The IDs of the invitations to resend.
+   */
+  invitationId: number;
+};
+
+/**
+ * Resend an email for a given team member invite.
+ */
+export const resendTeamMemberInvitation = async ({
+  userId,
+  userName,
+  teamId,
+  invitationId,
+}: ResendTeamMemberInvitationOptions) => {
+  await prisma.$transaction(async (tx) => {
+    const team = await tx.team.findUniqueOrThrow({
+      where: {
+        id: teamId,
+        members: {
+          some: {
+            userId,
+            role: {
+              in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+            },
+          },
+        },
+      },
+    });
+
+    if (!team) {
+      throw new AppError('TeamNotFound', 'User is not a valid member of the team.');
+    }
+
+    const teamMemberInvite = await tx.teamMemberInvite.findUniqueOrThrow({
+      where: {
+        id: invitationId,
+        teamId,
+      },
+    });
+
+    if (!teamMemberInvite) {
+      throw new AppError('InviteNotFound', 'No invite exists for this user.');
+    }
+
+    await sendTeamMemberInviteEmail({
+      email: teamMemberInvite.email,
+      token: teamMemberInvite.token,
+      teamName: team.name,
+      teamUrl: team.url,
+      senderName: userName,
+    });
+  });
+};

packages/lib/server-only/team/transfer-team-ownership.ts

@@ -0,0 +1,88 @@
+import type Stripe from 'stripe';
+
+import { transferTeamSubscription } from '@documenso/ee/server-only/stripe/transfer-team-subscription';
+import { mapStripeSubscriptionToPrismaUpsertAction } from '@documenso/ee/server-only/stripe/webhook/on-subscription-updated';
+import { IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
+import { prisma } from '@documenso/prisma';
+import { TeamMemberRole } from '@documenso/prisma/client';
+
+export type TransferTeamOwnershipOptions = {
+  token: string;
+};
+
+export const transferTeamOwnership = async ({ token }: TransferTeamOwnershipOptions) => {
+  await prisma.$transaction(async (tx) => {
+    const teamTransferVerification = await tx.teamTransferVerification.findFirstOrThrow({
+      where: {
+        token,
+      },
+      include: {
+        team: {
+          include: {
+            subscription: true,
+          },
+        },
+      },
+    });
+
+    const { team, userId: newOwnerUserId } = teamTransferVerification;
+
+    await tx.teamTransferVerification.delete({
+      where: {
+        teamId: team.id,
+      },
+    });
+
+    const newOwnerUser = await tx.user.findFirstOrThrow({
+      where: {
+        id: newOwnerUserId,
+        teamMembers: {
+          some: {
+            teamId: team.id,
+          },
+        },
+      },
+      include: {
+        Subscription: true,
+      },
+    });
+
+    let teamSubscription: Stripe.Subscription | null = null;
+
+    if (IS_BILLING_ENABLED) {
+      teamSubscription = await transferTeamSubscription({
+        user: newOwnerUser,
+        team,
+        clearPaymentMethods: teamTransferVerification.clearPaymentMethods,
+      });
+    }
+
+    if (teamSubscription) {
+      await tx.subscription.upsert(
+        mapStripeSubscriptionToPrismaUpsertAction(teamSubscription, undefined, team.id),
+      );
+    }
+
+    await tx.team.update({
+      where: {
+        id: team.id,
+      },
+      data: {
+        ownerUserId: newOwnerUserId,
+        members: {
+          update: {
+            where: {
+              userId_teamId: {
+                teamId: team.id,
+                userId: newOwnerUserId,
+              },
+            },
+            data: {
+              role: TeamMemberRole.ADMIN,
+            },
+          },
+        },
+      },
+    });
+  });
+};

packages/lib/server-only/team/update-team-email.ts

@@ -0,0 +1,42 @@
+import { prisma } from '@documenso/prisma';
+
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '../../constants/teams';
+
+export type UpdateTeamEmailOptions = {
+  userId: number;
+  teamId: number;
+  data: {
+    name: string;
+  };
+};
+
+export const updateTeamEmail = async ({ userId, teamId, data }: UpdateTeamEmailOptions) => {
+  await prisma.$transaction(async (tx) => {
+    await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        members: {
+          some: {
+            userId,
+            role: {
+              in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+            },
+          },
+        },
+        teamEmail: {
+          isNot: null,
+        },
+      },
+    });
+
+    await tx.teamEmail.update({
+      where: {
+        teamId,
+      },
+      data: {
+        // Note: Never allow the email to be updated without re-verifying via email.
+        name: data.name,
+      },
+    });
+  });
+};

packages/lib/server-only/team/update-team-member.ts

@@ -0,0 +1,92 @@
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { isTeamRoleWithinUserHierarchy } from '@documenso/lib/utils/teams';
+import { prisma } from '@documenso/prisma';
+import type { TeamMemberRole } from '@documenso/prisma/client';
+
+export type UpdateTeamMemberOptions = {
+  userId: number;
+  teamId: number;
+  teamMemberId: number;
+  data: {
+    role: TeamMemberRole;
+  };
+};
+
+export const updateTeamMember = async ({
+  userId,
+  teamId,
+  teamMemberId,
+  data,
+}: UpdateTeamMemberOptions) => {
+  await prisma.$transaction(async (tx) => {
+    // Find the team and validate that the user is allowed to update members.
+    const team = await tx.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+        members: {
+          some: {
+            userId,
+            role: {
+              in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+            },
+          },
+        },
+      },
+      include: {
+        members: {
+          select: {
+            id: true,
+            userId: true,
+            role: true,
+          },
+        },
+      },
+    });
+
+    const currentTeamMember = team.members.find((member) => member.userId === userId);
+    const teamMemberToUpdate = team.members.find((member) => member.id === teamMemberId);
+
+    if (!teamMemberToUpdate || !currentTeamMember) {
+      throw new AppError(AppErrorCode.NOT_FOUND, 'Team member does not exist');
+    }
+
+    if (teamMemberToUpdate.userId === team.ownerUserId) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, 'Cannot update the owner');
+    }
+
+    const isMemberToUpdateHigherRole = !isTeamRoleWithinUserHierarchy(
+      currentTeamMember.role,
+      teamMemberToUpdate.role,
+    );
+
+    if (isMemberToUpdateHigherRole) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, 'Cannot update a member with a higher role');
+    }
+
+    const isNewMemberRoleHigherThanCurrentRole = !isTeamRoleWithinUserHierarchy(
+      currentTeamMember.role,
+      data.role,
+    );
+
+    if (isNewMemberRoleHigherThanCurrentRole) {
+      throw new AppError(
+        AppErrorCode.UNAUTHORIZED,
+        'Cannot give a member a role higher than the user initating the update',
+      );
+    }
+
+    return await tx.teamMember.update({
+      where: {
+        id: teamMemberId,
+        teamId,
+        userId: {
+          not: team.ownerUserId,
+        },
+      },
+      data: {
+        role: data.role,
+      },
+    });
+  });
+};

packages/lib/server-only/team/update-team.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+
+import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+import { Prisma } from '@documenso/prisma/client';
+
+export type UpdateTeamOptions = {
+  userId: number;
+  teamId: number;
+  data: {
+    name?: string;
+    url?: string;
+  };
+};
+
+export const updateTeam = async ({ userId, teamId, data }: UpdateTeamOptions) => {
+  try {
+    await prisma.$transaction(async (tx) => {
+      const foundPendingTeamWithUrl = await tx.teamPending.findFirst({
+        where: {
+          url: data.url,
+        },
+      });
+
+      if (foundPendingTeamWithUrl) {
+        throw new AppError(AppErrorCode.ALREADY_EXISTS, 'Team URL already exists.');
+      }
+
+      const team = await tx.team.update({
+        where: {
+          id: teamId,
+          members: {
+            some: {
+              userId,
+              role: {
+                in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_TEAM'],
+              },
+            },
+          },
+        },
+        data: {
+          url: data.url,
+          name: data.name,
+        },
+      });
+
+      return team;
+    });
+  } catch (err) {
+    console.error(err);
+
+    if (!(err instanceof Prisma.PrismaClientKnownRequestError)) {
+      throw err;
+    }
+
+    const target = z.array(z.string()).safeParse(err.meta?.target);
+
+    if (err.code === 'P2002' && target.success && target.data.includes('url')) {
+      throw new AppError(AppErrorCode.ALREADY_EXISTS, 'Team URL already exists.');
+    }
+
+    throw err;
+  }
+};