chore: merge main, resolve biome formatting conflicts

Merge origin/main into feat/external-2fa-codes. Resolve formatting conflicts caused by biome rollout; preserve both feature streams: PR's external 2FA token + signing-session 2FA proof additions plus main's RateLimit/RecipientExpired/signingReminders/date-auto-insert. In complete-document-with-token.ts, drop the duplicate early field-fetching block introduced when main moved that logic later with date auto-insert support; keep the EXTERNAL_TWO_FACTOR_AUTH check using derivedRecipientActionAuth.
2026-07-24 00:43:40 +10:00 · 2026-05-12 11:46:11 +00:00
parent 9194884fbe
commit 138d663c25
1959 changed files with 93488 additions and 47038 deletions
@@ -1,16 +1,12 @@
-import { Prisma, WebhookCallStatus, WebhookTriggerEvents } from '@prisma/client';
-
 import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { FindResultResponse } from '@documenso/lib/types/search-params';
 import { buildTeamWhereQuery } from '@documenso/lib/utils/teams';
 import { prisma } from '@documenso/prisma';
+import type { Prisma, WebhookCallStatus, WebhookTriggerEvents } from '@prisma/client';

 import { authenticatedProcedure } from '../trpc';
-import {
-  ZFindWebhookCallsRequestSchema,
-  ZFindWebhookCallsResponseSchema,
-} from './find-webhook-calls.types';
+import { ZFindWebhookCallsRequestSchema, ZFindWebhookCallsResponseSchema } from './find-webhook-calls.types';

 export const findWebhookCallsRoute = authenticatedProcedure
  .input(ZFindWebhookCallsRequestSchema)
@@ -1,8 +1,7 @@
-import { WebhookCallStatus, WebhookTriggerEvents } from '@prisma/client';
-import { z } from 'zod';
-
 import { ZFindResultResponse, ZFindSearchParamsSchema } from '@documenso/lib/types/search-params';
 import WebhookCallSchema from '@documenso/prisma/generated/zod/modelSchema/WebhookCallSchema';
+import { WebhookCallStatus, WebhookTriggerEvents } from '@prisma/client';
+import { z } from 'zod';

 export const ZFindWebhookCallsRequestSchema = ZFindSearchParamsSchema.extend({
  webhookId: z.string(),
@@ -1,16 +1,12 @@
-import { Prisma, WebhookCallStatus, WebhookTriggerEvents } from '@prisma/client';
-
 import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import type { FindResultResponse } from '@documenso/lib/types/search-params';
+import { jobs } from '@documenso/lib/jobs/client';
+import { ZWebhookPayloadSchema } from '@documenso/lib/types/webhook-payload';
 import { buildTeamWhereQuery } from '@documenso/lib/utils/teams';
 import { prisma } from '@documenso/prisma';

 import { authenticatedProcedure } from '../trpc';
-import {
-  ZResendWebhookCallRequestSchema,
-  ZResendWebhookCallResponseSchema,
-} from './resend-webhook-call.types';
+import { ZResendWebhookCallRequestSchema, ZResendWebhookCallResponseSchema } from './resend-webhook-call.types';

 export const resendWebhookCallRoute = authenticatedProcedure
  .input(ZResendWebhookCallRequestSchema)
@@ -35,46 +31,22 @@ export const resendWebhookCallRoute = authenticatedProcedure
          }),
        },
      },
-      include: {
-        webhook: true,
-      },
    });

    if (!webhookCall) {
      throw new AppError(AppErrorCode.NOT_FOUND);
    }

-    const { webhook } = webhookCall;
+    // `requestBody` stores the full delivery envelope; unwrap to the inner
+    // document so the handler doesn't wrap it a second time.
+    const { payload: data } = ZWebhookPayloadSchema.parse(webhookCall.requestBody);

-    // Note: This is duplicated in `execute-webhook.handler.ts`.
-    const response = await fetch(webhookCall.url, {
-      method: 'POST',
-      body: JSON.stringify(webhookCall.requestBody),
-      headers: {
-        'Content-Type': 'application/json',
-        'X-Documenso-Secret': webhook.secret ?? '',
-      },
-    });
-
-    const body = await response.text();
-
-    let responseBody: Prisma.InputJsonValue | Prisma.JsonNullValueInput = Prisma.JsonNull;
-
-    try {
-      responseBody = JSON.parse(body);
-    } catch (err) {
-      responseBody = body;
-    }
-
-    return await prisma.webhookCall.update({
-      where: {
-        id: webhookCall.id,
-      },
-      data: {
-        status: response.ok ? WebhookCallStatus.SUCCESS : WebhookCallStatus.FAILED,
-        responseCode: response.status,
-        responseBody,
-        responseHeaders: Object.fromEntries(response.headers.entries()),
+    await jobs.triggerJob({
+      name: 'internal.execute-webhook',
+      payload: {
+        event: webhookCall.event,
+        webhookId,
+        data,
      },
    });
  });
@@ -1,26 +1,11 @@
-import { WebhookCallStatus, WebhookTriggerEvents } from '@prisma/client';
 import { z } from 'zod';

-import WebhookCallSchema from '@documenso/prisma/generated/zod/modelSchema/WebhookCallSchema';
-
 export const ZResendWebhookCallRequestSchema = z.object({
  webhookId: z.string(),
  webhookCallId: z.string(),
 });

-export const ZResendWebhookCallResponseSchema = WebhookCallSchema.pick({
-  webhookId: true,
-  status: true,
-  event: true,
-  id: true,
-  url: true,
-  responseCode: true,
-  createdAt: true,
-}).extend({
-  requestBody: z.unknown(),
-  responseHeaders: z.unknown().nullable(),
-  responseBody: z.unknown().nullable(),
-});
+export const ZResendWebhookCallResponseSchema = z.void();

 export type TResendWebhookRequest = z.infer<typeof ZResendWebhookCallRequestSchema>;
 export type TResendWebhookResponse = z.infer<typeof ZResendWebhookCallResponseSchema>;
@@ -32,93 +32,83 @@ export const webhookRouter = router({
    return await getWebhooksByTeamId(ctx.teamId, ctx.user.id);
  }),

-  getWebhookById: authenticatedProcedure
-    .input(ZGetWebhookByIdRequestSchema)
-    .query(async ({ input, ctx }) => {
-      const { id } = input;
+  getWebhookById: authenticatedProcedure.input(ZGetWebhookByIdRequestSchema).query(async ({ input, ctx }) => {
+    const { id } = input;

-      ctx.logger.info({
-        input: {
-          id,
-        },
-      });
-
-      return await getWebhookById({
+    ctx.logger.info({
+      input: {
        id,
-        userId: ctx.user.id,
-        teamId: ctx.teamId,
-      });
-    }),
+      },
+    });

-  createWebhook: authenticatedProcedure
-    .input(ZCreateWebhookRequestSchema)
-    .mutation(async ({ input, ctx }) => {
-      const { enabled, eventTriggers, secret, webhookUrl } = input;
+    return await getWebhookById({
+      id,
+      userId: ctx.user.id,
+      teamId: ctx.teamId,
+    });
+  }),

-      return await createWebhook({
-        enabled,
-        secret,
-        webhookUrl,
-        eventTriggers,
-        teamId: ctx.teamId,
-        userId: ctx.user.id,
-      });
-    }),
+  createWebhook: authenticatedProcedure.input(ZCreateWebhookRequestSchema).mutation(async ({ input, ctx }) => {
+    const { enabled, eventTriggers, secret, webhookUrl } = input;

-  deleteWebhook: authenticatedProcedure
-    .input(ZDeleteWebhookRequestSchema)
-    .mutation(async ({ input, ctx }) => {
-      const { id } = input;
+    return await createWebhook({
+      enabled,
+      secret,
+      webhookUrl,
+      eventTriggers,
+      teamId: ctx.teamId,
+      userId: ctx.user.id,
+    });
+  }),

-      ctx.logger.info({
-        input: {
-          id,
-        },
-      });
+  deleteWebhook: authenticatedProcedure.input(ZDeleteWebhookRequestSchema).mutation(async ({ input, ctx }) => {
+    const { id } = input;

-      return await deleteWebhookById({
+    ctx.logger.info({
+      input: {
        id,
-        teamId: ctx.teamId,
-        userId: ctx.user.id,
-      });
-    }),
+      },
+    });

-  editWebhook: authenticatedProcedure
-    .input(ZEditWebhookRequestSchema)
-    .mutation(async ({ input, ctx }) => {
-      const { id, ...data } = input;
+    return await deleteWebhookById({
+      id,
+      teamId: ctx.teamId,
+      userId: ctx.user.id,
+    });
+  }),

-      ctx.logger.info({
-        input: {
-          id,
-        },
-      });
+  editWebhook: authenticatedProcedure.input(ZEditWebhookRequestSchema).mutation(async ({ input, ctx }) => {
+    const { id, ...data } = input;

-      return await editWebhook({
+    ctx.logger.info({
+      input: {
        id,
-        data,
-        userId: ctx.user.id,
-        teamId: ctx.teamId,
-      });
-    }),
+      },
+    });

-  testWebhook: authenticatedProcedure
-    .input(ZTriggerTestWebhookRequestSchema)
-    .mutation(async ({ input, ctx }) => {
-      const { id, event } = input;
+    return await editWebhook({
+      id,
+      data,
+      userId: ctx.user.id,
+      teamId: ctx.teamId,
+    });
+  }),

-      ctx.logger.info({
-        input: {
-          id,
-          event,
-        },
-      });
+  testWebhook: authenticatedProcedure.input(ZTriggerTestWebhookRequestSchema).mutation(async ({ input, ctx }) => {
+    const { id, event } = input;

-      return await triggerTestWebhook({
+    ctx.logger.info({
+      input: {
        id,
        event,
-        userId: ctx.user.id,
-        teamId: ctx.teamId,
-      });
-    }),
+      },
+    });
+
+    return await triggerTestWebhook({
+      id,
+      event,
+      userId: ctx.user.id,
+      teamId: ctx.teamId,
+    });
+  }),
 });
@@ -1,8 +1,16 @@
+import { isPrivateUrl } from '@documenso/lib/server-only/webhooks/is-private-url';
 import { WebhookTriggerEvents } from '@prisma/client';
 import { z } from 'zod';

+export const ZWebhookUrlSchema = z
+  .string()
+  .url()
+  .refine((url) => !isPrivateUrl(url), {
+    message: 'Webhook URL cannot point to a private or loopback address',
+  });
+
 export const ZCreateWebhookRequestSchema = z.object({
-  webhookUrl: z.string().url(),
+  webhookUrl: ZWebhookUrlSchema,
  eventTriggers: z
    .array(z.nativeEnum(WebhookTriggerEvents))
    .min(1, { message: 'At least one event trigger is required' }),