chore: merge main, resolve biome formatting conflicts

Merge origin/main into feat/external-2fa-codes. Resolve formatting conflicts caused by biome rollout; preserve both feature streams: PR's external 2FA token + signing-session 2FA proof additions plus main's RateLimit/RecipientExpired/signingReminders/date-auto-insert. In complete-document-with-token.ts, drop the duplicate early field-fetching block introduced when main moved that logic later with date auto-insert support; keep the EXTERNAL_TWO_FACTOR_AUTH check using derivedRecipientActionAuth.
2026-07-25 09:25:08 +10:00 · 2026-05-12 11:46:11 +00:00
parent 9194884fbe
commit 138d663c25
1959 changed files with 93488 additions and 47038 deletions
@@ -1,18 +1,18 @@
-import { sValidator } from '@hono/standard-validator';
-import { EnvelopeType } from '@prisma/client';
-import { Hono } from 'hono';
-
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { getEnvelopeById } from '@documenso/lib/server-only/envelope/get-envelope-by-id';
 import { getApiTokenByToken } from '@documenso/lib/server-only/public-api/get-api-token-by-token';
 import { buildTeamWhereQuery } from '@documenso/lib/utils/teams';
 import { prisma } from '@documenso/prisma';
+import { sValidator } from '@hono/standard-validator';
+import { EnvelopeType } from '@prisma/client';
+import { Hono } from 'hono';

 import type { HonoEnv } from '../../router';
 import { handleEnvelopeItemFileRequest } from '../files/files.helpers';
 import {
  ZDownloadDocumentRequestParamsSchema,
  ZDownloadEnvelopeItemRequestParamsSchema,
+  ZDownloadEnvelopeItemRequestQuerySchema,
 } from './download.types';

 export const downloadRoute = new Hono<HonoEnv>()
@@ -23,11 +23,13 @@ export const downloadRoute = new Hono<HonoEnv>()
  .get(
    '/envelope/item/:envelopeItemId/download',
    sValidator('param', ZDownloadEnvelopeItemRequestParamsSchema),
+    sValidator('query', ZDownloadEnvelopeItemRequestQuerySchema),
    async (c) => {
      const logger = c.get('logger');

      try {
-        const { envelopeItemId, version } = c.req.valid('param');
+        const { envelopeItemId } = c.req.valid('param');
+        const { version } = c.req.valid('query');
        const authorizationHeader = c.req.header('authorization');

        // Support for both "Authorization: Bearer api_xxx" and "Authorization: api_xxx"
@@ -65,7 +67,16 @@ export const downloadRoute = new Hono<HonoEnv>()
            },
          },
          include: {
-            envelope: true,
+            envelope: {
+              include: {
+                recipients: {
+                  select: {
+                    role: true,
+                    signingStatus: true,
+                  },
+                },
+              },
+            },
            documentData: true,
          },
        });
@@ -78,23 +89,36 @@ export const downloadRoute = new Hono<HonoEnv>()
          return c.json({ error: 'Document data not found' }, 404);
        }

-        return await handleEnvelopeItemFileRequest({
+        const baseOptions = {
          title: envelopeItem.title,
-          status: envelopeItem.envelope.status,
          documentData: envelopeItem.documentData,
-          version: version || 'signed',
          isDownload: true,
          context: c,
+        } as const;
+
+        if (version === 'pending') {
+          return await handleEnvelopeItemFileRequest({
+            ...baseOptions,
+            version,
+            envelopeItemId: envelopeItem.id,
+            envelope: envelopeItem.envelope,
+          });
+        }
+
+        return await handleEnvelopeItemFileRequest({
+          ...baseOptions,
+          version,
+          status: envelopeItem.envelope.status,
        });
      } catch (error) {
        logger.error(error);

        if (error instanceof AppError) {
-          if (error.code === AppErrorCode.UNAUTHORIZED) {
-            return c.json({ error: error.message }, 401);
-          }
+          const { status, body } = AppError.toRestAPIError(error);

-          return c.json({ error: error.message }, 400);
+          // Preserve the existing `{ error }` shape for backwards compatibility;
+          // `code` is added as a new field for callers that want to branch on it.
+          return c.json({ error: body.message, code: error.code }, status);
        }

        return c.json({ error: 'Internal server error' }, 500);
@@ -105,88 +129,84 @@ export const downloadRoute = new Hono<HonoEnv>()
   * Download a document by its ID.
   * Requires API key authentication via Authorization header.
   */
-  .get(
-    '/document/:documentId/download',
-    sValidator('param', ZDownloadDocumentRequestParamsSchema),
-    async (c) => {
-      const logger = c.get('logger');
+  .get('/document/:documentId/download', sValidator('param', ZDownloadDocumentRequestParamsSchema), async (c) => {
+    const logger = c.get('logger');

-      try {
-        const { documentId, version } = c.req.valid('param');
-        const authorizationHeader = c.req.header('authorization');
+    try {
+      const { documentId, version } = c.req.valid('param');
+      const authorizationHeader = c.req.header('authorization');

-        // Support for both "Authorization: Bearer api_xxx" and "Authorization: api_xxx"
-        const [token] = (authorizationHeader || '').split('Bearer ').filter((s) => s.length > 0);
+      // Support for both "Authorization: Bearer api_xxx" and "Authorization: api_xxx"
+      const [token] = (authorizationHeader || '').split('Bearer ').filter((s) => s.length > 0);

-        if (!token) {
-          throw new AppError(AppErrorCode.UNAUTHORIZED, {
-            message: 'API token was not provided',
-          });
-        }
-
-        const apiToken = await getApiTokenByToken({ token });
-
-        if (apiToken.user.disabled) {
-          throw new AppError(AppErrorCode.UNAUTHORIZED, {
-            message: 'User is disabled',
-          });
-        }
-
-        logger.info({
-          auth: 'api',
-          source: 'apiV2',
-          path: c.req.path,
-          userId: apiToken.user.id,
-          apiTokenId: apiToken.id,
-          documentId,
-          version,
+      if (!token) {
+        throw new AppError(AppErrorCode.UNAUTHORIZED, {
+          message: 'API token was not provided',
        });
-
-        const envelope = await getEnvelopeById({
-          id: {
-            type: 'documentId',
-            id: documentId,
-          },
-          type: EnvelopeType.DOCUMENT,
-          userId: apiToken.user.id,
-          teamId: apiToken.teamId,
-        }).catch(() => null);
-
-        if (!envelope) {
-          return c.json({ error: 'Document not found' }, 404);
-        }
-
-        // Get the first envelope item (documents have exactly one)
-        const [envelopeItem] = envelope.envelopeItems;
-
-        if (!envelopeItem) {
-          return c.json({ error: 'Document item not found' }, 404);
-        }
-
-        if (!envelopeItem.documentData) {
-          return c.json({ error: 'Document data not found' }, 404);
-        }
-
-        return await handleEnvelopeItemFileRequest({
-          title: envelopeItem.title,
-          status: envelope.status,
-          documentData: envelopeItem.documentData,
-          version: version || 'signed',
-          isDownload: true,
-          context: c,
-        });
-      } catch (error) {
-        logger.error(error);
-
-        if (error instanceof AppError) {
-          if (error.code === AppErrorCode.UNAUTHORIZED) {
-            return c.json({ error: error.message }, 401);
-          }
-
-          return c.json({ error: error.message }, 400);
-        }
-
-        return c.json({ error: 'Internal server error' }, 500);
      }
-    },
-  );
+
+      const apiToken = await getApiTokenByToken({ token });
+
+      if (apiToken.user.disabled) {
+        throw new AppError(AppErrorCode.UNAUTHORIZED, {
+          message: 'User is disabled',
+        });
+      }
+
+      logger.info({
+        auth: 'api',
+        source: 'apiV2',
+        path: c.req.path,
+        userId: apiToken.user.id,
+        apiTokenId: apiToken.id,
+        documentId,
+        version,
+      });
+
+      const envelope = await getEnvelopeById({
+        id: {
+          type: 'documentId',
+          id: documentId,
+        },
+        type: EnvelopeType.DOCUMENT,
+        userId: apiToken.user.id,
+        teamId: apiToken.teamId,
+      }).catch(() => null);
+
+      if (!envelope) {
+        return c.json({ error: 'Document not found' }, 404);
+      }
+
+      // Get the first envelope item (documents have exactly one)
+      const [envelopeItem] = envelope.envelopeItems;
+
+      if (!envelopeItem) {
+        return c.json({ error: 'Document item not found' }, 404);
+      }
+
+      if (!envelopeItem.documentData) {
+        return c.json({ error: 'Document data not found' }, 404);
+      }
+
+      return await handleEnvelopeItemFileRequest({
+        title: envelopeItem.title,
+        status: envelope.status,
+        documentData: envelopeItem.documentData,
+        version: version || 'signed',
+        isDownload: true,
+        context: c,
+      });
+    } catch (error) {
+      logger.error(error);
+
+      if (error instanceof AppError) {
+        if (error.code === AppErrorCode.UNAUTHORIZED) {
+          return c.json({ error: error.message }, 401);
+        }
+
+        return c.json({ error: error.message }, 400);
+      }
+
+      return c.json({ error: 'Internal server error' }, 500);
+    }
+  });
@@ -2,18 +2,21 @@ import { z } from 'zod';

 export const ZDownloadEnvelopeItemRequestParamsSchema = z.object({
  envelopeItemId: z.string().describe('The ID of the envelope item to download.'),
+});
+
+export const ZDownloadEnvelopeItemRequestQuerySchema = z.object({
  version: z
-    .enum(['original', 'signed'])
+    .enum(['original', 'signed', 'pending'])
    .optional()
    .default('signed')
    .describe(
-      'The version of the envelope item to download. "signed" returns the completed document with signatures, "original" returns the original uploaded document.',
+      'The version of the envelope item to download. "signed" returns the completed document with all signatures and the audit trail, "original" returns the original uploaded document, "pending" returns the original document with currently-inserted fields burned in (only valid while the envelope is in PENDING status; not a final executed document).',
    ),
 });

-export type TDownloadEnvelopeItemRequestParams = z.infer<
-  typeof ZDownloadEnvelopeItemRequestParamsSchema
->;
+export type TDownloadEnvelopeItemRequestParams = z.infer<typeof ZDownloadEnvelopeItemRequestParamsSchema>;
+
+export type TDownloadEnvelopeItemRequestQuery = z.infer<typeof ZDownloadEnvelopeItemRequestQuerySchema>;

 export const ZDownloadDocumentRequestParamsSchema = z.object({
  documentId: z.coerce.number().describe('The ID of the document to download.'),