Merge branch 'main' into feat/signing-reminders

packages/lib/client-only/download-pdf.ts

@@ -3,22 +3,38 @@ import type { DocumentData } from '@prisma/client';
 import { getFile } from '../universal/upload/get-file';
 import { downloadFile } from './download-file';
 
+type DocumentVersion = 'original' | 'signed';
+
 type DownloadPDFProps = {
   documentData: DocumentData;
   fileName?: string;
+  /**
+   * Specifies which version of the document to download.
+   * 'signed': Downloads the signed version (default).
+   * 'original': Downloads the original version.
+   */
+  version?: DocumentVersion;
 };
 
-export const downloadPDF = async ({ documentData, fileName }: DownloadPDFProps) => {
-  const bytes = await getFile(documentData);
+export const downloadPDF = async ({
+  documentData,
+  fileName,
+  version = 'signed',
+}: DownloadPDFProps) => {
+  const bytes = await getFile({
+    type: documentData.type,
+    data: version === 'signed' ? documentData.data : documentData.initialData,
+  });
 
   const blob = new Blob([bytes], {
     type: 'application/pdf',
   });
 
   const baseTitle = (fileName ?? 'document').replace(/\.pdf$/, '');
+  const suffix = version === 'signed' ? '_signed.pdf' : '.pdf';
 
   downloadFile({
-    filename: `${baseTitle}_signed.pdf`,
+    filename: `${baseTitle}${suffix}`,
     data: blob,
   });
 };

packages/lib/client-only/hooks/use-element-bounds.ts

@@ -0,0 +1,75 @@
+import { useCallback, useEffect, useState } from 'react';
+
+import { getBoundingClientRect } from '@documenso/lib/client-only/get-bounding-client-rect';
+
+export const useElementBounds = (elementOrSelector: HTMLElement | string, withScroll = false) => {
+  const [bounds, setBounds] = useState({
+    top: 0,
+    left: 0,
+    height: 0,
+    width: 0,
+  });
+
+  const calculateBounds = useCallback(() => {
+    const $el =
+      typeof elementOrSelector === 'string'
+        ? document.querySelector<HTMLElement>(elementOrSelector)
+        : elementOrSelector;
+
+    if (!$el) {
+      throw new Error('Element not found');
+    }
+
+    if (withScroll) {
+      return getBoundingClientRect($el);
+    }
+
+    const { top, left, width, height } = $el.getBoundingClientRect();
+
+    return {
+      top,
+      left,
+      width,
+      height,
+    };
+  }, [elementOrSelector, withScroll]);
+
+  useEffect(() => {
+    setBounds(calculateBounds());
+  }, []);
+
+  useEffect(() => {
+    const onResize = () => {
+      setBounds(calculateBounds());
+    };
+
+    window.addEventListener('resize', onResize);
+
+    return () => {
+      window.removeEventListener('resize', onResize);
+    };
+  }, []);
+
+  useEffect(() => {
+    const $el =
+      typeof elementOrSelector === 'string'
+        ? document.querySelector<HTMLElement>(elementOrSelector)
+        : elementOrSelector;
+
+    if (!$el) {
+      return;
+    }
+
+    const observer = new ResizeObserver(() => {
+      setBounds(calculateBounds());
+    });
+
+    observer.observe($el);
+
+    return () => {
+      observer.disconnect();
+    };
+  }, []);
+
+  return bounds;
+};

packages/lib/client-only/providers/organisation.tsx

@@ -0,0 +1,33 @@
+import { createContext, useContext } from 'react';
+import React from 'react';
+
+import type { OrganisationSession } from '@documenso/trpc/server/organisation-router/get-organisation-session.types';
+
+type OrganisationProviderValue = OrganisationSession;
+
+interface OrganisationProviderProps {
+  children: React.ReactNode;
+  organisation: OrganisationProviderValue | null;
+}
+
+const OrganisationContext = createContext<OrganisationProviderValue | null>(null);
+
+export const useCurrentOrganisation = () => {
+  const context = useContext(OrganisationContext);
+
+  if (!context) {
+    throw new Error('useCurrentOrganisation must be used within a OrganisationProvider');
+  }
+
+  return context;
+};
+
+export const useOptionalCurrentOrganisation = () => {
+  return useContext(OrganisationContext);
+};
+
+export const OrganisationProvider = ({ children, organisation }: OrganisationProviderProps) => {
+  return (
+    <OrganisationContext.Provider value={organisation}>{children}</OrganisationContext.Provider>
+  );
+};

packages/lib/client-only/providers/session.tsx

@@ -6,13 +6,15 @@ import { useLocation } from 'react-router';
 
 import { authClient } from '@documenso/auth/client';
 import type { SessionUser } from '@documenso/auth/server/lib/session/session';
-import { type TGetTeamsResponse } from '@documenso/lib/server-only/team/get-teams';
 import { trpc } from '@documenso/trpc/client';
+import type { TGetOrganisationSessionResponse } from '@documenso/trpc/server/organisation-router/get-organisation-session.types';
+
+import { SKIP_QUERY_BATCH_META } from '../../constants/trpc';
 
 export type AppSession = {
   session: Session;
   user: SessionUser;
-  teams: TGetTeamsResponse;
+  organisations: TGetOrganisationSessionResponse;
 };
 
 interface SessionProviderProps {
@@ -67,15 +69,17 @@ export const SessionProvider = ({ children, initialSession }: SessionProviderPro
       return;
     }
 
-    const teams = await trpc.team.getTeams.query().catch(() => {
-      // Todo: (RR7) Log
-      return [];
-    });
+    const organisations = await trpc.organisation.internal.getOrganisationSession
+      .query(undefined, SKIP_QUERY_BATCH_META.trpc)
+      .catch(() => {
+        // Todo: (RR7) Log
+        return [];
+      });
 
     setSession({
       session: newSession.session,
       user: newSession.user,
-      teams,
+      organisations,
     });
   }, []);
 

packages/lib/constants/app.ts

@@ -12,3 +12,5 @@ export const NEXT_PRIVATE_INTERNAL_WEBAPP_URL =
 export const IS_BILLING_ENABLED = () => env('NEXT_PUBLIC_FEATURE_BILLING_ENABLED') === 'true';
 
 export const API_V2_BETA_URL = '/api/v2-beta';
+
+export const SUPPORT_EMAIL = env('NEXT_PUBLIC_SUPPORT_EMAIL') ?? 'support@documenso.com';

packages/lib/constants/auth.ts

@@ -31,6 +31,7 @@ export const USER_SECURITY_AUDIT_LOG_MAP: Record<string, string> = {
   PASSKEY_UPDATED: 'Passkey updated',
   PASSWORD_RESET: 'Password reset',
   PASSWORD_UPDATE: 'Password updated',
+  SESSION_REVOKED: 'Session revoked',
   SIGN_OUT: 'Signed Out',
   SIGN_IN: 'Signed In',
   SIGN_IN_FAIL: 'Sign in attempt failed',

packages/lib/constants/autosign.ts

@@ -0,0 +1,8 @@
+import { FieldType } from '@prisma/client';
+
+export const AUTO_SIGNABLE_FIELD_TYPES: FieldType[] = [
+  FieldType.NAME,
+  FieldType.INITIALS,
+  FieldType.EMAIL,
+  FieldType.DATE,
+];

packages/lib/constants/billing.ts

@@ -1,12 +1,18 @@
-export enum STRIPE_CUSTOMER_TYPE {
-  INDIVIDUAL = 'individual',
-  TEAM = 'team',
-}
+import { SubscriptionStatus } from '@prisma/client';
 
 export enum STRIPE_PLAN_TYPE {
-  REGULAR = 'regular',
-  TEAM = 'team',
-  COMMUNITY = 'community',
+  FREE = 'free',
+  INDIVIDUAL = 'individual',
+  PRO = 'pro',
+  EARLY_ADOPTER = 'earlyAdopter',
   PLATFORM = 'platform',
   ENTERPRISE = 'enterprise',
 }
+
+export const FREE_TIER_DOCUMENT_QUOTA = 5;
+
+export const SUBSCRIPTION_STATUS_MAP = {
+  [SubscriptionStatus.ACTIVE]: 'Active',
+  [SubscriptionStatus.INACTIVE]: 'Inactive',
+  [SubscriptionStatus.PAST_DUE]: 'Past Due',
+};

packages/lib/constants/date-formats.ts

@@ -9,6 +9,7 @@ export const VALID_DATE_FORMAT_VALUES = [
   'yyyy-MM-dd',
   'dd/MM/yyyy hh:mm a',
   'MM/dd/yyyy hh:mm a',
+  'dd.MM.yyyy HH:mm',
   'yyyy-MM-dd HH:mm',
   'yy-MM-dd hh:mm a',
   'yyyy-MM-dd HH:mm:ss',
@@ -17,6 +18,8 @@ export const VALID_DATE_FORMAT_VALUES = [
   "yyyy-MM-dd'T'HH:mm:ss.SSSXXX",
 ] as const;
 
+export type ValidDateFormat = (typeof VALID_DATE_FORMAT_VALUES)[number];
+
 export const DATE_FORMATS = [
   {
     key: 'yyyy-MM-dd_hh:mm_a',
@@ -38,6 +41,11 @@ export const DATE_FORMATS = [
     label: 'MM/DD/YYYY',
     value: 'MM/dd/yyyy hh:mm a',
   },
+  {
+    key: 'DDMMYYYYHHMM',
+    label: 'DD.MM.YYYY HH:mm',
+    value: 'dd.MM.yyyy HH:mm',
+  },
   {
     key: 'YYYYMMDDHHmm',
     label: 'YYYY-MM-DD HH:mm',
@@ -94,3 +102,7 @@ export const convertToLocalSystemFormat = (
 
   return formattedDate;
 };
+
+export const isValidDateFormat = (dateFormat: unknown): dateFormat is ValidDateFormat => {
+  return VALID_DATE_FORMAT_VALUES.includes(dateFormat as ValidDateFormat);
+};

packages/lib/constants/document-auth.ts

@@ -19,6 +19,10 @@ export const DOCUMENT_AUTH_TYPES: Record<string, DocumentAuthTypeData> = {
     key: DocumentAuth.TWO_FACTOR_AUTH,
     value: 'Require 2FA',
   },
+  [DocumentAuth.PASSWORD]: {
+    key: DocumentAuth.PASSWORD,
+    value: 'Require password',
+  },
   [DocumentAuth.EXPLICIT_NONE]: {
     key: DocumentAuth.EXPLICIT_NONE,
     value: 'None (Overrides global settings)',

packages/lib/constants/document.ts

@@ -2,6 +2,13 @@ import type { MessageDescriptor } from '@lingui/core';
 import { msg } from '@lingui/core/macro';
 import { DocumentDistributionMethod, DocumentStatus } from '@prisma/client';
 
+/**
+ * Workaround for E2E tests to not import `msg`.
+ */
+import { DocumentSignatureType } from '@documenso/lib/utils/teams';
+
+export { DocumentSignatureType };
+
 export const DOCUMENT_STATUS: {
   [status in DocumentStatus]: { description: MessageDescriptor };
 } = {
@@ -35,12 +42,6 @@ export const DOCUMENT_DISTRIBUTION_METHODS: Record<string, DocumentDistributionM
   },
 } satisfies Record<DocumentDistributionMethod, DocumentDistributionMethodTypeData>;
 
-export enum DocumentSignatureType {
-  DRAW = 'draw',
-  TYPE = 'type',
-  UPLOAD = 'upload',
-}
-
 type DocumentSignatureTypeData = {
   label: MessageDescriptor;
   value: DocumentSignatureType;
@@ -48,15 +49,24 @@ type DocumentSignatureTypeData = {
 
 export const DOCUMENT_SIGNATURE_TYPES = {
   [DocumentSignatureType.DRAW]: {
-    label: msg`Draw`,
+    label: msg({
+      message: `Draw`,
+      context: `Draw signatute type`,
+    }),
     value: DocumentSignatureType.DRAW,
   },
   [DocumentSignatureType.TYPE]: {
-    label: msg`Type`,
+    label: msg({
+      message: `Type`,
+      context: `Type signatute type`,
+    }),
     value: DocumentSignatureType.TYPE,
   },
   [DocumentSignatureType.UPLOAD]: {
-    label: msg`Upload`,
+    label: msg({
+      message: `Upload`,
+      context: `Upload signatute type`,
+    }),
     value: DocumentSignatureType.UPLOAD,
   },
 } satisfies Record<DocumentSignatureType, DocumentSignatureTypeData>;

packages/lib/constants/email.ts

@@ -3,6 +3,11 @@ import { env } from '../utils/env';
 export const FROM_ADDRESS = env('NEXT_PRIVATE_SMTP_FROM_ADDRESS') || 'noreply@documenso.com';
 export const FROM_NAME = env('NEXT_PRIVATE_SMTP_FROM_NAME') || 'Documenso';
 
+export const DOCUMENSO_INTERNAL_EMAIL = {
+  name: FROM_NAME,
+  address: FROM_ADDRESS,
+};
+
 export const SERVICE_USER_EMAIL = 'serviceaccount@documenso.com';
 
 export const EMAIL_VERIFICATION_STATE = {

packages/lib/constants/feature-flags.ts

@@ -2,7 +2,6 @@ import { env } from '@documenso/lib/utils/env';
 
 import { NEXT_PUBLIC_WEBAPP_URL } from './app';
 
-const NEXT_PUBLIC_FEATURE_BILLING_ENABLED = () => env('NEXT_PUBLIC_FEATURE_BILLING_ENABLED');
 const NEXT_PUBLIC_POSTHOG_KEY = () => env('NEXT_PUBLIC_POSTHOG_KEY');
 
 /**
@@ -10,26 +9,6 @@ const NEXT_PUBLIC_POSTHOG_KEY = () => env('NEXT_PUBLIC_POSTHOG_KEY');
  */
 export const FEATURE_FLAG_GLOBAL_SESSION_RECORDING = 'global_session_recording';
 
-/**
- * How frequent to poll for new feature flags in milliseconds.
- */
-export const FEATURE_FLAG_POLL_INTERVAL = 30000;
-
-/**
- * Feature flags that will be used when PostHog is disabled.
- *
- * Does not take any person or group properties into account.
- */
-export const LOCAL_FEATURE_FLAGS: Record<string, boolean> = {
-  app_allow_encrypted_documents: false,
-  app_billing: NEXT_PUBLIC_FEATURE_BILLING_ENABLED() === 'true',
-  app_document_page_view_history_sheet: false,
-  app_passkey: true,
-  app_public_profile: true,
-  marketing_header_single_player_mode: false,
-  marketing_profiles_announcement_bar: true,
-} as const;
-
 /**
  * Extract the PostHog configuration from the environment.
  */
@@ -46,10 +25,3 @@ export function extractPostHogConfig(): { key: string; host: string } | null {
     host: postHogHost,
   };
 }
-
-/**
- * Whether feature flags are enabled for the current instance.
- */
-export function isFeatureFlagEnabled(): boolean {
-  return extractPostHogConfig() !== null;
-}

packages/lib/constants/organisations-translations.ts

@@ -0,0 +1,25 @@
+/**
+ * These constants are in a different file to avoid E2E tests from importing `msg`
+ * which will break it.
+ */
+import type { MessageDescriptor } from '@lingui/core';
+import { msg } from '@lingui/core/macro';
+import type { OrganisationMemberRole } from '@prisma/client';
+
+export const ORGANISATION_MEMBER_ROLE_MAP: Record<
+  keyof typeof OrganisationMemberRole,
+  MessageDescriptor
+> = {
+  ADMIN: msg`Admin`,
+  MANAGER: msg`Manager`,
+  MEMBER: msg`Member`,
+};
+
+export const EXTENDED_ORGANISATION_MEMBER_ROLE_MAP: Record<
+  keyof typeof OrganisationMemberRole,
+  MessageDescriptor
+> = {
+  ADMIN: msg`Organisation Admin`,
+  MANAGER: msg`Organisation Manager`,
+  MEMBER: msg`Organisation Member`,
+};

packages/lib/constants/organisations.ts

@@ -0,0 +1,128 @@
+import { OrganisationGroupType, OrganisationMemberRole } from '@prisma/client';
+
+export const ORGANISATION_URL_ROOT_REGEX = new RegExp('^/t/[^/]+/?$');
+export const ORGANISATION_URL_REGEX = new RegExp('^/t/[^/]+');
+
+export const ORGANISATION_INTERNAL_GROUPS: {
+  organisationRole: OrganisationMemberRole;
+  type: OrganisationGroupType;
+}[] = [
+  {
+    organisationRole: OrganisationMemberRole.ADMIN,
+    type: OrganisationGroupType.INTERNAL_ORGANISATION,
+  },
+  {
+    organisationRole: OrganisationMemberRole.MANAGER,
+    type: OrganisationGroupType.INTERNAL_ORGANISATION,
+  },
+  {
+    organisationRole: OrganisationMemberRole.MEMBER,
+    type: OrganisationGroupType.INTERNAL_ORGANISATION,
+  },
+] as const;
+
+export const ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP = {
+  /**
+   * Includes permissions to:
+   * - Manage organisation members
+   * - Manage organisation settings, changing name, url, etc.
+   */
+  DELETE_ORGANISATION: [OrganisationMemberRole.ADMIN],
+  MANAGE_BILLING: [OrganisationMemberRole.ADMIN],
+  DELETE_ORGANISATION_TRANSFER_REQUEST: [OrganisationMemberRole.ADMIN],
+  MANAGE_ORGANISATION: [OrganisationMemberRole.ADMIN, OrganisationMemberRole.MANAGER],
+} satisfies Record<string, OrganisationMemberRole[]>;
+
+/**
+ * A hierarchy of organisation member roles to determine which role has higher permission than another.
+ *
+ * Warning: The length of the array is used to determine the priority of the role.
+ * See `getHighestOrganisationRoleInGroup`
+ */
+export const ORGANISATION_MEMBER_ROLE_HIERARCHY = {
+  [OrganisationMemberRole.ADMIN]: [
+    OrganisationMemberRole.ADMIN,
+    OrganisationMemberRole.MANAGER,
+    OrganisationMemberRole.MEMBER,
+  ],
+  [OrganisationMemberRole.MANAGER]: [OrganisationMemberRole.MANAGER, OrganisationMemberRole.MEMBER],
+  [OrganisationMemberRole.MEMBER]: [OrganisationMemberRole.MEMBER],
+} satisfies Record<OrganisationMemberRole, OrganisationMemberRole[]>;
+
+export const LOWEST_ORGANISATION_ROLE = OrganisationMemberRole.MEMBER;
+
+export const PROTECTED_ORGANISATION_URLS = [
+  '403',
+  '404',
+  '500',
+  '502',
+  '503',
+  '504',
+  'about',
+  'account',
+  'admin',
+  'administrator',
+  'api',
+  'app',
+  'archive',
+  'auth',
+  'backup',
+  'config',
+  'configure',
+  'contact',
+  'contact-us',
+  'copyright',
+  'crime',
+  'criminal',
+  'dashboard',
+  'docs',
+  'documentation',
+  'document',
+  'documents',
+  'error',
+  'exploit',
+  'exploitation',
+  'exploiter',
+  'feedback',
+  'finance',
+  'forgot-password',
+  'fraud',
+  'fraudulent',
+  'hack',
+  'hacker',
+  'harassment',
+  'help',
+  'helpdesk',
+  'illegal',
+  'internal',
+  'legal',
+  'login',
+  'logout',
+  'maintenance',
+  'malware',
+  'newsletter',
+  'policy',
+  'privacy',
+  'profile',
+  'public',
+  'reset-password',
+  'scam',
+  'scammer',
+  'settings',
+  'setup',
+  'sign',
+  'signin',
+  'signout',
+  'signup',
+  'spam',
+  'support',
+  'system',
+  'organisation',
+  'terms',
+  'virus',
+  'webhook',
+];
+
+export const isOrganisationUrlProtected = (url: string) => {
+  return PROTECTED_ORGANISATION_URLS.some((protectedUrl) => url.startsWith(`/${protectedUrl}`));
+};

packages/lib/constants/recipient-roles.ts

@@ -4,39 +4,114 @@ import { RecipientRole } from '@prisma/client';
 
 export const RECIPIENT_ROLES_DESCRIPTION = {
   [RecipientRole.APPROVER]: {
-    actionVerb: msg`Approve`,
-    actioned: msg`Approved`,
-    progressiveVerb: msg`Approving`,
-    roleName: msg`Approver`,
-    roleNamePlural: msg`Approvers`,
+    actionVerb: msg({
+      message: `Approve`,
+      context: `Recipient role action verb`,
+    }),
+    actioned: msg({
+      message: `Approved`,
+      context: `Recipient role actioned`,
+    }),
+    progressiveVerb: msg({
+      message: `Approving`,
+      context: `Recipient role progressive verb`,
+    }),
+    roleName: msg({
+      message: `Approver`,
+      context: `Recipient role name`,
+    }),
+    roleNamePlural: msg({
+      message: `Approvers`,
+      context: `Recipient role plural name`,
+    }),
   },
   [RecipientRole.CC]: {
-    actionVerb: msg`CC`,
-    actioned: msg`CC'd`,
-    progressiveVerb: msg`CC`,
-    roleName: msg`Cc`,
-    roleNamePlural: msg`Ccers`,
+    actionVerb: msg({
+      message: `CC`,
+      context: `Recipient role action verb`,
+    }),
+    actioned: msg({
+      message: `CC'd`,
+      context: `Recipient role actioned`,
+    }),
+    progressiveVerb: msg({
+      message: `CC`,
+      context: `Recipient role progressive verb`,
+    }),
+    roleName: msg({
+      message: `Cc`,
+      context: `Recipient role name`,
+    }),
+    roleNamePlural: msg({
+      message: `Ccers`,
+      context: `Recipient role plural name`,
+    }),
   },
   [RecipientRole.SIGNER]: {
-    actionVerb: msg`Sign`,
-    actioned: msg`Signed`,
-    progressiveVerb: msg`Signing`,
-    roleName: msg`Signer`,
-    roleNamePlural: msg`Signers`,
+    actionVerb: msg({
+      message: `Sign`,
+      context: `Recipient role action verb`,
+    }),
+    actioned: msg({
+      message: `Signed`,
+      context: `Recipient role actioned`,
+    }),
+    progressiveVerb: msg({
+      message: `Signing`,
+      context: `Recipient role progressive verb`,
+    }),
+    roleName: msg({
+      message: `Signer`,
+      context: `Recipient role name`,
+    }),
+    roleNamePlural: msg({
+      message: `Signers`,
+      context: `Recipient role plural name`,
+    }),
   },
   [RecipientRole.VIEWER]: {
-    actionVerb: msg`View`,
-    actioned: msg`Viewed`,
-    progressiveVerb: msg`Viewing`,
-    roleName: msg`Viewer`,
-    roleNamePlural: msg`Viewers`,
+    actionVerb: msg({
+      message: `View`,
+      context: `Recipient role action verb`,
+    }),
+    actioned: msg({
+      message: `Viewed`,
+      context: `Recipient role actioned`,
+    }),
+    progressiveVerb: msg({
+      message: `Viewing`,
+      context: `Recipient role progressive verb`,
+    }),
+    roleName: msg({
+      message: `Viewer`,
+      context: `Recipient role name`,
+    }),
+    roleNamePlural: msg({
+      message: `Viewers`,
+      context: `Recipient role plural name`,
+    }),
   },
   [RecipientRole.ASSISTANT]: {
-    actionVerb: msg`Assist`,
-    actioned: msg`Assisted`,
-    progressiveVerb: msg`Assisting`,
-    roleName: msg`Assistant`,
-    roleNamePlural: msg`Assistants`,
+    actionVerb: msg({
+      message: `Assist`,
+      context: `Recipient role action verb`,
+    }),
+    actioned: msg({
+      message: `Assisted`,
+      context: `Recipient role actioned`,
+    }),
+    progressiveVerb: msg({
+      message: `Assisting`,
+      context: `Recipient role progressive verb`,
+    }),
+    roleName: msg({
+      message: `Assistant`,
+      context: `Recipient role name`,
+    }),
+    roleNamePlural: msg({
+      message: `Assistants`,
+      context: `Recipient role plural name`,
+    }),
   },
 } satisfies Record<keyof typeof RecipientRole, unknown>;
 

packages/lib/constants/teams-translations.ts

@@ -0,0 +1,16 @@
+import type { MessageDescriptor } from '@lingui/core';
+import { msg } from '@lingui/core/macro';
+import type { TeamMemberRole } from '@prisma/client';
+
+export const TEAM_MEMBER_ROLE_MAP: Record<keyof typeof TeamMemberRole, MessageDescriptor> = {
+  ADMIN: msg`Admin`,
+  MANAGER: msg`Manager`,
+  MEMBER: msg`Member`,
+};
+
+export const EXTENDED_TEAM_MEMBER_ROLE_MAP: Record<keyof typeof TeamMemberRole, MessageDescriptor> =
+  {
+    ADMIN: msg`Team Admin`,
+    MANAGER: msg`Team Manager`,
+    MEMBER: msg`Team Member`,
+  };

packages/lib/constants/teams.ts

@@ -1,29 +1,43 @@
-import type { MessageDescriptor } from '@lingui/core';
-import { msg } from '@lingui/core/macro';
-import { TeamMemberRole } from '@prisma/client';
+import { OrganisationGroupType, TeamMemberRole } from '@prisma/client';
 
 export const TEAM_URL_ROOT_REGEX = new RegExp('^/t/[^/]+/?$');
 export const TEAM_URL_REGEX = new RegExp('^/t/[^/]+');
 
-export const TEAM_MEMBER_ROLE_MAP: Record<keyof typeof TeamMemberRole, MessageDescriptor> = {
-  ADMIN: msg`Admin`,
-  MANAGER: msg`Manager`,
-  MEMBER: msg`Member`,
-};
+export const LOWEST_TEAM_ROLE = TeamMemberRole.MEMBER;
+
+export const ALLOWED_TEAM_GROUP_TYPES: OrganisationGroupType[] = [
+  OrganisationGroupType.CUSTOM,
+  OrganisationGroupType.INTERNAL_ORGANISATION,
+];
+
+export const TEAM_INTERNAL_GROUPS: {
+  teamRole: TeamMemberRole;
+  type: OrganisationGroupType;
+}[] = [
+  {
+    teamRole: TeamMemberRole.ADMIN,
+    type: OrganisationGroupType.INTERNAL_TEAM,
+  },
+  {
+    teamRole: TeamMemberRole.MANAGER,
+    type: OrganisationGroupType.INTERNAL_TEAM,
+  },
+  {
+    teamRole: TeamMemberRole.MEMBER,
+    type: OrganisationGroupType.INTERNAL_TEAM,
+  },
+] as const;
 
 export const TEAM_MEMBER_ROLE_PERMISSIONS_MAP = {
-  /**
-   * Includes permissions to:
-   * - Manage team members
-   * - Manage team settings, changing name, url, etc.
-   */
+  DELETE_TEAM: [TeamMemberRole.ADMIN],
   MANAGE_TEAM: [TeamMemberRole.ADMIN, TeamMemberRole.MANAGER],
-  MANAGE_BILLING: [TeamMemberRole.ADMIN],
-  DELETE_TEAM_TRANSFER_REQUEST: [TeamMemberRole.ADMIN],
 } satisfies Record<string, TeamMemberRole[]>;
 
 /**
  * A hierarchy of team member roles to determine which role has higher permission than another.
+ *
+ * Warning: The length of the array is used to determine the priority of the role.
+ * See `getHighestTeamRoleInGroup`
  */
 export const TEAM_MEMBER_ROLE_HIERARCHY = {
   [TeamMemberRole.ADMIN]: [TeamMemberRole.ADMIN, TeamMemberRole.MANAGER, TeamMemberRole.MEMBER],

packages/lib/constants/template.ts

@@ -3,6 +3,10 @@ import { msg } from '@lingui/core/macro';
 export const TEMPLATE_RECIPIENT_EMAIL_PLACEHOLDER_REGEX = /recipient\.\d+@documenso\.com/i;
 export const TEMPLATE_RECIPIENT_NAME_PLACEHOLDER_REGEX = /Recipient \d+/i;
 
+export const isTemplateRecipientEmailPlaceholder = (email: string) => {
+  return TEMPLATE_RECIPIENT_EMAIL_PLACEHOLDER_REGEX.test(email);
+};
+
 export const DIRECT_TEMPLATE_DOCUMENTATION = [
   {
     title: msg`Enable Direct Link Signing`,

packages/lib/jobs/client.ts

@@ -3,14 +3,16 @@ import { SEND_CONFIRMATION_EMAIL_JOB_DEFINITION } from './definitions/emails/sen
 import { SEND_DAILY_REMINDER_EMAIL_JOB } from './definitions/emails/send-daily-reminder-email';
 import { SEND_DOCUMENT_CANCELLED_EMAILS_JOB_DEFINITION } from './definitions/emails/send-document-cancelled-emails';
 import { SEND_HOURLY_REMINDER_EMAIL_JOB } from './definitions/emails/send-hourly-reminder-email';
+import { SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION } from './definitions/emails/send-organisation-member-joined-email';
+import { SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION } from './definitions/emails/send-organisation-member-left-email';
 import { SEND_PASSWORD_RESET_SUCCESS_EMAIL_JOB_DEFINITION } from './definitions/emails/send-password-reset-success-email';
 import { SEND_RECIPIENT_SIGNED_EMAIL_JOB_DEFINITION } from './definitions/emails/send-recipient-signed-email';
 import { SEND_SIGNING_REJECTION_EMAILS_JOB_DEFINITION } from './definitions/emails/send-rejection-emails';
 import { SEND_SIGNING_EMAIL_JOB_DEFINITION } from './definitions/emails/send-signing-email';
 import { SEND_TEAM_DELETED_EMAIL_JOB_DEFINITION } from './definitions/emails/send-team-deleted-email';
-import { SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION } from './definitions/emails/send-team-member-joined-email';
-import { SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION } from './definitions/emails/send-team-member-left-email';
+import { BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION } from './definitions/internal/backport-subscription-claims';
 import { BULK_SEND_TEMPLATE_JOB_DEFINITION } from './definitions/internal/bulk-send-template';
+import { EXECUTE_WEBHOOK_JOB_DEFINITION } from './definitions/internal/execute-webhook';
 import { SEAL_DOCUMENT_JOB_DEFINITION } from './definitions/internal/seal-document';
 
 /**
@@ -20,17 +22,19 @@ import { SEAL_DOCUMENT_JOB_DEFINITION } from './definitions/internal/seal-docume
 export const jobsClient = new JobClient([
   SEND_SIGNING_EMAIL_JOB_DEFINITION,
   SEND_CONFIRMATION_EMAIL_JOB_DEFINITION,
-  SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION,
-  SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION,
+  SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION,
+  SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION,
   SEND_TEAM_DELETED_EMAIL_JOB_DEFINITION,
   SEAL_DOCUMENT_JOB_DEFINITION,
   SEND_PASSWORD_RESET_SUCCESS_EMAIL_JOB_DEFINITION,
   SEND_SIGNING_REJECTION_EMAILS_JOB_DEFINITION,
   SEND_RECIPIENT_SIGNED_EMAIL_JOB_DEFINITION,
   SEND_DOCUMENT_CANCELLED_EMAILS_JOB_DEFINITION,
+  BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION,
   BULK_SEND_TEMPLATE_JOB_DEFINITION,
   SEND_HOURLY_REMINDER_EMAIL_JOB,
   SEND_DAILY_REMINDER_EMAIL_JOB,
+  EXECUTE_WEBHOOK_JOB_DEFINITION,
 ] as const);
 
 export const jobs = jobsClient;

packages/lib/jobs/definitions/emails/send-bulk-complete-email.ts

@@ -1,39 +0,0 @@
-import { z } from 'zod';
-
-import { ZRequestMetadataSchema } from '../../../universal/extract-request-metadata';
-import { type JobDefinition } from '../../client/_internal/job';
-
-const SEND_BULK_COMPLETE_EMAIL_JOB_DEFINITION_ID = 'send.bulk.complete.email';
-
-const SEND_BULK_COMPLETE_EMAIL_JOB_DEFINITION_SCHEMA = z.object({
-  userId: z.number(),
-  templateId: z.number(),
-  templateName: z.string(),
-  totalProcessed: z.number(),
-  successCount: z.number(),
-  failedCount: z.number(),
-  errors: z.array(z.string()),
-  requestMetadata: ZRequestMetadataSchema.optional(),
-});
-
-export type TSendBulkCompleteEmailJobDefinition = z.infer<
-  typeof SEND_BULK_COMPLETE_EMAIL_JOB_DEFINITION_SCHEMA
->;
-
-export const SEND_BULK_COMPLETE_EMAIL_JOB_DEFINITION = {
-  id: SEND_BULK_COMPLETE_EMAIL_JOB_DEFINITION_ID,
-  name: 'Send Bulk Complete Email',
-  version: '1.0.0',
-  trigger: {
-    name: SEND_BULK_COMPLETE_EMAIL_JOB_DEFINITION_ID,
-    schema: SEND_BULK_COMPLETE_EMAIL_JOB_DEFINITION_SCHEMA,
-  },
-  handler: async ({ payload, io }) => {
-    const handler = await import('./send-bulk-complete-email.handler');
-
-    await handler.run({ payload, io });
-  },
-} as const satisfies JobDefinition<
-  typeof SEND_BULK_COMPLETE_EMAIL_JOB_DEFINITION_ID,
-  TSendBulkCompleteEmailJobDefinition
->;

packages/lib/jobs/definitions/emails/send-document-cancelled-emails.handler.ts

@@ -9,10 +9,9 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../../constants/email';
+import { getEmailContext } from '../../../server-only/email/get-email-context';
 import { extractDerivedDocumentEmailSettings } from '../../../types/document-email';
 import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../../utils/team-global-settings-to-branding';
 import type { JobRunIO } from '../../client/_internal/job';
 import type { TSendDocumentCancelledEmailsJobDefinition } from './send-document-cancelled-emails';
 
@@ -38,12 +37,20 @@ export const run = async ({
           teamEmail: true,
           name: true,
           url: true,
-          teamGlobalSettings: true,
         },
       },
     },
   });
 
+  const { branding, emailLanguage, senderEmail, replyToEmail } = await getEmailContext({
+    emailType: 'RECIPIENT',
+    source: {
+      type: 'team',
+      teamId: document.teamId,
+    },
+    meta: document.documentMeta,
+  });
+
   const { documentMeta, user: documentOwner } = document;
 
   // Check if document cancellation emails are enabled
@@ -53,7 +60,7 @@ export const run = async ({
     return;
   }
 
-  const i18n = await getI18nInstance(documentMeta?.language);
+  const i18n = await getI18nInstance(emailLanguage);
 
   // Send cancellation emails to all recipients who have been sent the document or viewed it
   const recipientsToNotify = document.recipients.filter(
@@ -73,14 +80,10 @@ export const run = async ({
           cancellationReason: cancellationReason || 'The document has been cancelled.',
         });
 
-        const branding = document.team?.teamGlobalSettings
-          ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-          : undefined;
-
         const [html, text] = await Promise.all([
-          renderEmailWithI18N(template, { lang: documentMeta?.language, branding }),
+          renderEmailWithI18N(template, { lang: emailLanguage, branding }),
           renderEmailWithI18N(template, {
-            lang: documentMeta?.language,
+            lang: emailLanguage,
             branding,
             plainText: true,
           }),
@@ -91,10 +94,8 @@ export const run = async ({
             name: recipient.name,
             address: recipient.email,
           },
-          from: {
-            name: FROM_NAME,
-            address: FROM_ADDRESS,
-          },
+          from: senderEmail,
+          replyTo: replyToEmail,
           subject: i18n._(msg`Document "${document.title}" Cancelled`),
           html,
           text,

packages/lib/jobs/definitions/emails/send-organisation-member-joined-email.handler.ts

@@ -0,0 +1,108 @@
+import { createElement } from 'react';
+
+import { msg } from '@lingui/core/macro';
+
+import { mailer } from '@documenso/email/mailer';
+import OrganisationJoinEmailTemplate from '@documenso/email/templates/organisation-join';
+import { prisma } from '@documenso/prisma';
+
+import { getI18nInstance } from '../../../client-only/providers/i18n-server';
+import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
+import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '../../../constants/organisations';
+import { getEmailContext } from '../../../server-only/email/get-email-context';
+import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
+import type { JobRunIO } from '../../client/_internal/job';
+import type { TSendOrganisationMemberJoinedEmailJobDefinition } from './send-organisation-member-joined-email';
+
+export const run = async ({
+  payload,
+  io,
+}: {
+  payload: TSendOrganisationMemberJoinedEmailJobDefinition;
+  io: JobRunIO;
+}) => {
+  const organisation = await prisma.organisation.findFirstOrThrow({
+    where: {
+      id: payload.organisationId,
+    },
+    include: {
+      members: {
+        where: {
+          organisationGroupMembers: {
+            some: {
+              group: {
+                organisationRole: {
+                  in: ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_ORGANISATION'],
+                },
+              },
+            },
+          },
+        },
+        include: {
+          user: true,
+        },
+      },
+    },
+  });
+
+  const invitedMember = await prisma.organisationMember.findFirstOrThrow({
+    where: {
+      userId: payload.memberUserId,
+      organisationId: payload.organisationId,
+    },
+    include: {
+      user: true,
+    },
+  });
+
+  const { branding, emailLanguage, senderEmail } = await getEmailContext({
+    emailType: 'INTERNAL',
+    source: {
+      type: 'organisation',
+      organisationId: organisation.id,
+    },
+  });
+
+  for (const member of organisation.members) {
+    if (member.id === invitedMember.id) {
+      continue;
+    }
+
+    await io.runTask(
+      `send-organisation-member-joined-email--${invitedMember.id}_${member.id}`,
+      async () => {
+        const emailContent = createElement(OrganisationJoinEmailTemplate, {
+          assetBaseUrl: NEXT_PUBLIC_WEBAPP_URL(),
+          baseUrl: NEXT_PUBLIC_WEBAPP_URL(),
+          memberName: invitedMember.user.name || '',
+          memberEmail: invitedMember.user.email,
+          organisationName: organisation.name,
+          organisationUrl: organisation.url,
+        });
+
+        // !: Replace with the actual language of the recipient later
+        const [html, text] = await Promise.all([
+          renderEmailWithI18N(emailContent, {
+            lang: emailLanguage,
+            branding,
+          }),
+          renderEmailWithI18N(emailContent, {
+            lang: emailLanguage,
+            branding,
+            plainText: true,
+          }),
+        ]);
+
+        const i18n = await getI18nInstance(emailLanguage);
+
+        await mailer.sendMail({
+          to: member.user.email,
+          from: senderEmail,
+          subject: i18n._(msg`A new member has joined your organisation`),
+          html,
+          text,
+        });
+      },
+    );
+  }
+};

packages/lib/jobs/definitions/emails/send-organisation-member-joined-email.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+
+import type { JobDefinition } from '../../client/_internal/job';
+
+const SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION_ID =
+  'send.organisation-member-joined.email';
+
+const SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION_SCHEMA = z.object({
+  organisationId: z.string(),
+  memberUserId: z.number(),
+});
+
+export type TSendOrganisationMemberJoinedEmailJobDefinition = z.infer<
+  typeof SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION_SCHEMA
+>;
+
+export const SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION = {
+  id: SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION_ID,
+  name: 'Send Organisation Member Joined Email',
+  version: '1.0.0',
+  trigger: {
+    name: SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION_ID,
+    schema: SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION_SCHEMA,
+  },
+  handler: async ({ payload, io }) => {
+    const handler = await import('./send-organisation-member-joined-email.handler');
+
+    await handler.run({ payload, io });
+  },
+} as const satisfies JobDefinition<
+  typeof SEND_ORGANISATION_MEMBER_JOINED_EMAIL_JOB_DEFINITION_ID,
+  TSendOrganisationMemberJoinedEmailJobDefinition
+>;

packages/lib/jobs/definitions/emails/send-organisation-member-left-email.handler.ts

@@ -0,0 +1,103 @@
+import { createElement } from 'react';
+
+import { msg } from '@lingui/core/macro';
+
+import { mailer } from '@documenso/email/mailer';
+import OrganisationLeaveEmailTemplate from '@documenso/email/templates/organisation-leave';
+import { prisma } from '@documenso/prisma';
+
+import { getI18nInstance } from '../../../client-only/providers/i18n-server';
+import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
+import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '../../../constants/organisations';
+import { getEmailContext } from '../../../server-only/email/get-email-context';
+import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
+import type { JobRunIO } from '../../client/_internal/job';
+import type { TSendOrganisationMemberLeftEmailJobDefinition } from './send-organisation-member-left-email';
+
+export const run = async ({
+  payload,
+  io,
+}: {
+  payload: TSendOrganisationMemberLeftEmailJobDefinition;
+  io: JobRunIO;
+}) => {
+  const organisation = await prisma.organisation.findFirstOrThrow({
+    where: {
+      id: payload.organisationId,
+    },
+    include: {
+      members: {
+        where: {
+          organisationGroupMembers: {
+            some: {
+              group: {
+                organisationRole: {
+                  in: ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_ORGANISATION'],
+                },
+              },
+            },
+          },
+        },
+        include: {
+          user: true,
+        },
+      },
+    },
+  });
+
+  const oldMember = await prisma.user.findFirstOrThrow({
+    where: {
+      id: payload.memberUserId,
+    },
+  });
+
+  const { branding, emailLanguage, senderEmail } = await getEmailContext({
+    emailType: 'INTERNAL',
+    source: {
+      type: 'organisation',
+      organisationId: organisation.id,
+    },
+  });
+
+  for (const member of organisation.members) {
+    if (member.userId === oldMember.id) {
+      continue;
+    }
+
+    await io.runTask(
+      `send-organisation-member-left-email--${oldMember.id}_${member.id}`,
+      async () => {
+        const emailContent = createElement(OrganisationLeaveEmailTemplate, {
+          assetBaseUrl: NEXT_PUBLIC_WEBAPP_URL(),
+          baseUrl: NEXT_PUBLIC_WEBAPP_URL(),
+          memberName: oldMember.name || '',
+          memberEmail: oldMember.email,
+          organisationName: organisation.name,
+          organisationUrl: organisation.url,
+        });
+
+        const [html, text] = await Promise.all([
+          renderEmailWithI18N(emailContent, {
+            lang: emailLanguage,
+            branding,
+          }),
+          renderEmailWithI18N(emailContent, {
+            lang: emailLanguage,
+            branding,
+            plainText: true,
+          }),
+        ]);
+
+        const i18n = await getI18nInstance(emailLanguage);
+
+        await mailer.sendMail({
+          to: member.user.email,
+          from: senderEmail,
+          subject: i18n._(msg`A member has left your organisation`),
+          html,
+          text,
+        });
+      },
+    );
+  }
+};

packages/lib/jobs/definitions/emails/send-organisation-member-left-email.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+
+import type { JobDefinition } from '../../client/_internal/job';
+
+const SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION_ID = 'send.organisation-member-left.email';
+
+const SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION_SCHEMA = z.object({
+  organisationId: z.string(),
+  memberUserId: z.number(),
+});
+
+export type TSendOrganisationMemberLeftEmailJobDefinition = z.infer<
+  typeof SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION_SCHEMA
+>;
+
+export const SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION = {
+  id: SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION_ID,
+  name: 'Send Organisation Member Left Email',
+  version: '1.0.0',
+  trigger: {
+    name: SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION_ID,
+    schema: SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION_SCHEMA,
+  },
+  handler: async ({ payload, io }) => {
+    const handler = await import('./send-organisation-member-left-email.handler');
+
+    await handler.run({ payload, io });
+  },
+} as const satisfies JobDefinition<
+  typeof SEND_ORGANISATION_MEMBER_LEFT_EMAIL_JOB_DEFINITION_ID,
+  TSendOrganisationMemberLeftEmailJobDefinition
+>;

packages/lib/jobs/definitions/emails/send-recipient-signed-email.handler.ts

@@ -8,10 +8,9 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../../constants/email';
+import { getEmailContext } from '../../../server-only/email/get-email-context';
 import { extractDerivedDocumentEmailSettings } from '../../../types/document-email';
 import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../../utils/team-global-settings-to-branding';
 import type { JobRunIO } from '../../client/_internal/job';
 import type { TSendRecipientSignedEmailJobDefinition } from './send-recipient-signed-email';
 
@@ -41,11 +40,6 @@ export const run = async ({
       },
       user: true,
       documentMeta: true,
-      team: {
-        include: {
-          teamGlobalSettings: true,
-        },
-      },
     },
   });
 
@@ -76,8 +70,18 @@ export const run = async ({
     return;
   }
 
+  const { branding, emailLanguage, senderEmail } = await getEmailContext({
+    emailType: 'INTERNAL',
+    source: {
+      type: 'team',
+      teamId: document.teamId,
+    },
+    meta: document.documentMeta,
+  });
+
   const assetBaseUrl = NEXT_PUBLIC_WEBAPP_URL() || 'http://localhost:3000';
-  const i18n = await getI18nInstance(document.documentMeta?.language);
+
+  const i18n = await getI18nInstance(emailLanguage);
 
   const template = createElement(DocumentRecipientSignedEmailTemplate, {
     documentName: document.title,
@@ -87,14 +91,10 @@ export const run = async ({
   });
 
   await io.runTask('send-recipient-signed-email', async () => {
-    const branding = document.team?.teamGlobalSettings
-      ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-      : undefined;
-
     const [html, text] = await Promise.all([
-      renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+      renderEmailWithI18N(template, { lang: emailLanguage, branding }),
       renderEmailWithI18N(template, {
-        lang: document.documentMeta?.language,
+        lang: emailLanguage,
         branding,
         plainText: true,
       }),
@@ -105,10 +105,7 @@ export const run = async ({
         name: owner.name ?? '',
         address: owner.email,
       },
-      from: {
-        name: FROM_NAME,
-        address: FROM_ADDRESS,
-      },
+      from: senderEmail,
       subject: i18n._(msg`${recipientReference} has signed "${document.title}"`),
       html,
       text,

packages/lib/jobs/definitions/emails/send-rejection-emails.handler.ts

@@ -10,10 +10,10 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../../constants/email';
+import { DOCUMENSO_INTERNAL_EMAIL } from '../../../constants/email';
+import { getEmailContext } from '../../../server-only/email/get-email-context';
 import { extractDerivedDocumentEmailSettings } from '../../../types/document-email';
 import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../../utils/team-global-settings-to-branding';
 import { formatDocumentsPath } from '../../../utils/teams';
 import type { JobRunIO } from '../../client/_internal/job';
 import type { TSendSigningRejectionEmailsJobDefinition } from './send-rejection-emails';
@@ -40,7 +40,6 @@ export const run = async ({
             teamEmail: true,
             name: true,
             url: true,
-            teamGlobalSettings: true,
           },
         },
       },
@@ -53,7 +52,7 @@ export const run = async ({
     }),
   ]);
 
-  const { documentMeta, user: documentOwner } = document;
+  const { user: documentOwner } = document;
 
   const isEmailEnabled = extractDerivedDocumentEmailSettings(
     document.documentMeta,
@@ -63,7 +62,16 @@ export const run = async ({
     return;
   }
 
-  const i18n = await getI18nInstance(documentMeta?.language);
+  const { branding, emailLanguage, senderEmail, replyToEmail } = await getEmailContext({
+    emailType: 'RECIPIENT',
+    source: {
+      type: 'team',
+      teamId: document.teamId,
+    },
+    meta: document.documentMeta,
+  });
+
+  const i18n = await getI18nInstance(emailLanguage);
 
   // Send confirmation email to the recipient who rejected
   await io.runTask('send-rejection-confirmation-email', async () => {
@@ -75,14 +83,10 @@ export const run = async ({
       assetBaseUrl: NEXT_PUBLIC_WEBAPP_URL(),
     });
 
-    const branding = document.team?.teamGlobalSettings
-      ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-      : undefined;
-
     const [html, text] = await Promise.all([
-      renderEmailWithI18N(recipientTemplate, { lang: documentMeta?.language, branding }),
+      renderEmailWithI18N(recipientTemplate, { lang: emailLanguage, branding }),
       renderEmailWithI18N(recipientTemplate, {
-        lang: documentMeta?.language,
+        lang: emailLanguage,
         branding,
         plainText: true,
       }),
@@ -93,10 +97,8 @@ export const run = async ({
         name: recipient.name,
         address: recipient.email,
       },
-      from: {
-        name: FROM_NAME,
-        address: FROM_ADDRESS,
-      },
+      from: senderEmail,
+      replyTo: replyToEmail,
       subject: i18n._(msg`Document "${document.title}" - Rejection Confirmed`),
       html,
       text,
@@ -115,14 +117,10 @@ export const run = async ({
       assetBaseUrl: NEXT_PUBLIC_WEBAPP_URL(),
     });
 
-    const branding = document.team?.teamGlobalSettings
-      ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-      : undefined;
-
     const [html, text] = await Promise.all([
-      renderEmailWithI18N(ownerTemplate, { lang: documentMeta?.language, branding }),
+      renderEmailWithI18N(ownerTemplate, { lang: emailLanguage, branding }),
       renderEmailWithI18N(ownerTemplate, {
-        lang: documentMeta?.language,
+        lang: emailLanguage,
         branding,
         plainText: true,
       }),
@@ -133,10 +131,7 @@ export const run = async ({
         name: documentOwner.name || '',
         address: documentOwner.email,
       },
-      from: {
-        name: FROM_NAME,
-        address: FROM_ADDRESS,
-      },
+      from: DOCUMENSO_INTERNAL_EMAIL, // Purposefully using internal email here.
       subject: i18n._(msg`Document "${document.title}" - Rejected by ${recipient.name}`),
       html,
       text,

packages/lib/jobs/definitions/emails/send-signing-email.handler.ts

@@ -1,7 +1,13 @@
 import { createElement } from 'react';
 
 import { msg } from '@lingui/core/macro';
-import { DocumentSource, DocumentStatus, RecipientRole, SendStatus } from '@prisma/client';
+import {
+  DocumentSource,
+  DocumentStatus,
+  OrganisationType,
+  RecipientRole,
+  SendStatus,
+} from '@prisma/client';
 
 import { mailer } from '@documenso/email/mailer';
 import DocumentInviteEmailTemplate from '@documenso/email/templates/document-invite';
@@ -9,17 +15,16 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../../constants/email';
 import {
   RECIPIENT_ROLES_DESCRIPTION,
   RECIPIENT_ROLE_TO_EMAIL_TYPE,
 } from '../../../constants/recipient-roles';
+import { getEmailContext } from '../../../server-only/email/get-email-context';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../../types/document-audit-logs';
 import { extractDerivedDocumentEmailSettings } from '../../../types/document-email';
 import { createDocumentAuditLogData } from '../../../utils/document-audit-logs';
 import { renderCustomEmailTemplate } from '../../../utils/render-custom-email-template';
 import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../../utils/team-global-settings-to-branding';
 import type { JobRunIO } from '../../client/_internal/job';
 import type { TSendSigningEmailJobDefinition } from './send-signing-email';
 
@@ -49,7 +54,6 @@ export const run = async ({
           select: {
             teamEmail: true,
             name: true,
-            teamGlobalSettings: true,
           },
         },
       },
@@ -75,16 +79,25 @@ export const run = async ({
     return;
   }
 
+  const { branding, emailLanguage, settings, organisationType, senderEmail, replyToEmail } =
+    await getEmailContext({
+      emailType: 'RECIPIENT',
+      source: {
+        type: 'team',
+        teamId: document.teamId,
+      },
+      meta: document.documentMeta,
+    });
+
   const customEmail = document?.documentMeta;
   const isDirectTemplate = document.source === DocumentSource.TEMPLATE_DIRECT_LINK;
-  const isTeamDocument = document.teamId !== null;
 
   const recipientEmailType = RECIPIENT_ROLE_TO_EMAIL_TYPE[recipient.role];
 
   const { email, name } = recipient;
   const selfSigner = email === user.email;
 
-  const i18n = await getI18nInstance(documentMeta?.language);
+  const i18n = await getI18nInstance(emailLanguage);
 
   const recipientActionVerb = i18n
     ._(RECIPIENT_ROLES_DESCRIPTION[recipient.role].actionVerb)
@@ -109,7 +122,7 @@ export const run = async ({
     );
   }
 
-  if (isTeamDocument && team) {
+  if (organisationType === OrganisationType.ORGANISATION) {
     emailSubject = i18n._(msg`${team.name} invited you to ${recipientActionVerb} a document`);
     emailMessage = customEmail?.message ?? '';
 
@@ -117,7 +130,7 @@ export const run = async ({
       const inviterName = user.name || '';
 
       emailMessage = i18n._(
-        team.teamGlobalSettings?.includeSenderDetails
+        settings.includeSenderDetails
           ? msg`${inviterName} on behalf of "${team.name}" has invited you to ${recipientActionVerb} the document "${document.title}".`
           : msg`${team.name} has invited you to ${recipientActionVerb} the document "${document.title}".`,
       );
@@ -136,27 +149,26 @@ export const run = async ({
   const template = createElement(DocumentInviteEmailTemplate, {
     documentName: document.title,
     inviterName: user.name || undefined,
-    inviterEmail: isTeamDocument ? team?.teamEmail?.email || user.email : user.email,
+    inviterEmail:
+      organisationType === OrganisationType.ORGANISATION
+        ? team?.teamEmail?.email || user.email
+        : user.email,
     assetBaseUrl,
     signDocumentLink,
     customBody: renderCustomEmailTemplate(emailMessage, customEmailTemplate),
     role: recipient.role,
     selfSigner,
-    isTeamInvite: isTeamDocument,
+    organisationType,
     teamName: team?.name,
     teamEmail: team?.teamEmail?.email,
-    includeSenderDetails: team?.teamGlobalSettings?.includeSenderDetails,
+    includeSenderDetails: settings.includeSenderDetails,
   });
 
   await io.runTask('send-signing-email', async () => {
-    const branding = document.team?.teamGlobalSettings
-      ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-      : undefined;
-
     const [html, text] = await Promise.all([
-      renderEmailWithI18N(template, { lang: documentMeta?.language, branding }),
+      renderEmailWithI18N(template, { lang: emailLanguage, branding }),
       renderEmailWithI18N(template, {
-        lang: documentMeta?.language,
+        lang: emailLanguage,
         branding,
         plainText: true,
       }),
@@ -167,10 +179,8 @@ export const run = async ({
         name: recipient.name,
         address: recipient.email,
       },
-      from: {
-        name: FROM_NAME,
-        address: FROM_ADDRESS,
-      },
+      from: senderEmail,
+      replyTo: replyToEmail,
       subject: renderCustomEmailTemplate(
         documentMeta?.subject || emailSubject,
         customEmailTemplate,

packages/lib/jobs/definitions/emails/send-team-deleted-email.handler.ts

@@ -9,14 +9,14 @@ export const run = async ({
   payload: TSendTeamDeletedEmailJobDefinition;
   io: JobRunIO;
 }) => {
-  const { team, members } = payload;
+  const { team, members, organisationId } = payload;
 
   for (const member of members) {
     await io.runTask(`send-team-deleted-email--${team.url}_${member.id}`, async () => {
       await sendTeamDeleteEmail({
         email: member.email,
         team,
-        isOwner: member.id === team.ownerUserId,
+        organisationId,
       });
     });
   }

packages/lib/jobs/definitions/emails/send-team-deleted-email.ts

@@ -1,4 +1,3 @@
-import { DocumentVisibility } from '@prisma/client';
 import { z } from 'zod';
 
 import type { JobDefinition } from '../../client/_internal/job';
@@ -6,27 +5,10 @@ import type { JobDefinition } from '../../client/_internal/job';
 const SEND_TEAM_DELETED_EMAIL_JOB_DEFINITION_ID = 'send.team-deleted.email';
 
 const SEND_TEAM_DELETED_EMAIL_JOB_DEFINITION_SCHEMA = z.object({
+  organisationId: z.string(),
   team: z.object({
     name: z.string(),
     url: z.string(),
-    ownerUserId: z.number(),
-    teamGlobalSettings: z
-      .object({
-        documentVisibility: z.nativeEnum(DocumentVisibility),
-        documentLanguage: z.string(),
-        includeSenderDetails: z.boolean(),
-        includeSigningCertificate: z.boolean(),
-        brandingEnabled: z.boolean(),
-        brandingLogo: z.string(),
-        brandingUrl: z.string(),
-        brandingCompanyDetails: z.string(),
-        brandingHidePoweredBy: z.boolean(),
-        teamId: z.number(),
-        typedSignatureEnabled: z.boolean(),
-        uploadSignatureEnabled: z.boolean(),
-        drawSignatureEnabled: z.boolean(),
-      })
-      .nullish(),
   }),
   members: z.array(
     z.object({

packages/lib/jobs/definitions/emails/send-team-member-joined-email.handler.ts

@@ -1,105 +0,0 @@
-import { createElement } from 'react';
-
-import { msg } from '@lingui/core/macro';
-import { TeamMemberRole } from '@prisma/client';
-
-import { mailer } from '@documenso/email/mailer';
-import TeamJoinEmailTemplate from '@documenso/email/templates/team-join';
-import { prisma } from '@documenso/prisma';
-
-import { getI18nInstance } from '../../../client-only/providers/i18n-server';
-import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../../constants/email';
-import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../../utils/team-global-settings-to-branding';
-import type { JobRunIO } from '../../client/_internal/job';
-import type { TSendTeamMemberJoinedEmailJobDefinition } from './send-team-member-joined-email';
-
-export const run = async ({
-  payload,
-  io,
-}: {
-  payload: TSendTeamMemberJoinedEmailJobDefinition;
-  io: JobRunIO;
-}) => {
-  const team = await prisma.team.findFirstOrThrow({
-    where: {
-      id: payload.teamId,
-    },
-    include: {
-      members: {
-        where: {
-          role: {
-            in: [TeamMemberRole.ADMIN, TeamMemberRole.MANAGER],
-          },
-        },
-        include: {
-          user: true,
-        },
-      },
-      teamGlobalSettings: true,
-    },
-  });
-
-  const invitedMember = await prisma.teamMember.findFirstOrThrow({
-    where: {
-      id: payload.memberId,
-      teamId: payload.teamId,
-    },
-    include: {
-      user: true,
-    },
-  });
-
-  for (const member of team.members) {
-    if (member.id === invitedMember.id) {
-      continue;
-    }
-
-    await io.runTask(
-      `send-team-member-joined-email--${invitedMember.id}_${member.id}`,
-      async () => {
-        const emailContent = createElement(TeamJoinEmailTemplate, {
-          assetBaseUrl: NEXT_PUBLIC_WEBAPP_URL(),
-          baseUrl: NEXT_PUBLIC_WEBAPP_URL(),
-          memberName: invitedMember.user.name || '',
-          memberEmail: invitedMember.user.email,
-          teamName: team.name,
-          teamUrl: team.url,
-        });
-
-        const branding = team.teamGlobalSettings
-          ? teamGlobalSettingsToBranding(team.teamGlobalSettings)
-          : undefined;
-
-        const lang = team.teamGlobalSettings?.documentLanguage;
-
-        // !: Replace with the actual language of the recipient later
-        const [html, text] = await Promise.all([
-          renderEmailWithI18N(emailContent, {
-            lang,
-            branding,
-          }),
-          renderEmailWithI18N(emailContent, {
-            lang,
-            branding,
-            plainText: true,
-          }),
-        ]);
-
-        const i18n = await getI18nInstance(lang);
-
-        await mailer.sendMail({
-          to: member.user.email,
-          from: {
-            name: FROM_NAME,
-            address: FROM_ADDRESS,
-          },
-          subject: i18n._(msg`A new member has joined your team`),
-          html,
-          text,
-        });
-      },
-    );
-  }
-};

packages/lib/jobs/definitions/emails/send-team-member-joined-email.ts

@@ -1,33 +0,0 @@
-import { z } from 'zod';
-
-import type { JobDefinition } from '../../client/_internal/job';
-
-const SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION_ID = 'send.team-member-joined.email';
-
-const SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION_SCHEMA = z.object({
-  teamId: z.number(),
-  memberId: z.number(),
-});
-
-export type TSendTeamMemberJoinedEmailJobDefinition = z.infer<
-  typeof SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION_SCHEMA
->;
-
-export const SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION = {
-  id: SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION_ID,
-  name: 'Send Team Member Joined Email',
-  version: '1.0.0',
-  trigger: {
-    type: 'event',
-    name: SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION_ID,
-    schema: SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION_SCHEMA,
-  },
-  handler: async ({ payload, io }) => {
-    const handler = await import('./send-team-member-joined-email.handler');
-
-    await handler.run({ payload, io });
-  },
-} as const satisfies JobDefinition<
-  typeof SEND_TEAM_MEMBER_JOINED_EMAIL_JOB_DEFINITION_ID,
-  TSendTeamMemberJoinedEmailJobDefinition
->;

packages/lib/jobs/definitions/emails/send-team-member-left-email.handler.ts

@@ -1,93 +0,0 @@
-import { createElement } from 'react';
-
-import { msg } from '@lingui/core/macro';
-import { TeamMemberRole } from '@prisma/client';
-
-import { mailer } from '@documenso/email/mailer';
-import TeamJoinEmailTemplate from '@documenso/email/templates/team-join';
-import { prisma } from '@documenso/prisma';
-
-import { getI18nInstance } from '../../../client-only/providers/i18n-server';
-import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../../constants/email';
-import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../../utils/team-global-settings-to-branding';
-import type { JobRunIO } from '../../client/_internal/job';
-import type { TSendTeamMemberLeftEmailJobDefinition } from './send-team-member-left-email';
-
-export const run = async ({
-  payload,
-  io,
-}: {
-  payload: TSendTeamMemberLeftEmailJobDefinition;
-  io: JobRunIO;
-}) => {
-  const team = await prisma.team.findFirstOrThrow({
-    where: {
-      id: payload.teamId,
-    },
-    include: {
-      members: {
-        where: {
-          role: {
-            in: [TeamMemberRole.ADMIN, TeamMemberRole.MANAGER],
-          },
-        },
-        include: {
-          user: true,
-        },
-      },
-      teamGlobalSettings: true,
-    },
-  });
-
-  const oldMember = await prisma.user.findFirstOrThrow({
-    where: {
-      id: payload.memberUserId,
-    },
-  });
-
-  for (const member of team.members) {
-    await io.runTask(`send-team-member-left-email--${oldMember.id}_${member.id}`, async () => {
-      const emailContent = createElement(TeamJoinEmailTemplate, {
-        assetBaseUrl: NEXT_PUBLIC_WEBAPP_URL(),
-        baseUrl: NEXT_PUBLIC_WEBAPP_URL(),
-        memberName: oldMember.name || '',
-        memberEmail: oldMember.email,
-        teamName: team.name,
-        teamUrl: team.url,
-      });
-
-      const branding = team.teamGlobalSettings
-        ? teamGlobalSettingsToBranding(team.teamGlobalSettings)
-        : undefined;
-
-      const lang = team.teamGlobalSettings?.documentLanguage;
-
-      const [html, text] = await Promise.all([
-        renderEmailWithI18N(emailContent, {
-          lang,
-          branding,
-        }),
-        renderEmailWithI18N(emailContent, {
-          lang,
-          branding,
-          plainText: true,
-        }),
-      ]);
-
-      const i18n = await getI18nInstance(lang);
-
-      await mailer.sendMail({
-        to: member.user.email,
-        from: {
-          name: FROM_NAME,
-          address: FROM_ADDRESS,
-        },
-        subject: i18n._(msg`A team member has left ${team.name}`),
-        html,
-        text,
-      });
-    });
-  }
-};

packages/lib/jobs/definitions/emails/send-team-member-left-email.ts

@@ -1,33 +0,0 @@
-import { z } from 'zod';
-
-import type { JobDefinition } from '../../client/_internal/job';
-
-const SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION_ID = 'send.team-member-left.email';
-
-const SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION_SCHEMA = z.object({
-  teamId: z.number(),
-  memberUserId: z.number(),
-});
-
-export type TSendTeamMemberLeftEmailJobDefinition = z.infer<
-  typeof SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION_SCHEMA
->;
-
-export const SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION = {
-  id: SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION_ID,
-  name: 'Send Team Member Left Email',
-  version: '1.0.0',
-  trigger: {
-    type: 'event',
-    name: SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION_ID,
-    schema: SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION_SCHEMA,
-  },
-  handler: async ({ payload, io }) => {
-    const handler = await import('./send-team-member-left-email.handler');
-
-    await handler.run({ payload, io });
-  },
-} as const satisfies JobDefinition<
-  typeof SEND_TEAM_MEMBER_LEFT_EMAIL_JOB_DEFINITION_ID,
-  TSendTeamMemberLeftEmailJobDefinition
->;

packages/lib/jobs/definitions/internal/backport-subscription-claims.handler.ts

@@ -0,0 +1,35 @@
+import { prisma } from '@documenso/prisma';
+
+import { AppError, AppErrorCode } from '../../../errors/app-error';
+import type { JobRunIO } from '../../client/_internal/job';
+import type { TBackportSubscriptionClaimJobDefinition } from './backport-subscription-claims';
+
+export const run = async ({
+  payload,
+  io,
+}: {
+  payload: TBackportSubscriptionClaimJobDefinition;
+  io: JobRunIO;
+}) => {
+  const { subscriptionClaimId, flags } = payload;
+
+  const subscriptionClaim = await prisma.subscriptionClaim.findFirst({
+    where: {
+      id: subscriptionClaimId,
+    },
+  });
+
+  if (!subscriptionClaim) {
+    throw new AppError(AppErrorCode.NOT_FOUND, { message: 'Subscription claim not found' });
+  }
+
+  await io.runTask('backport-claims', async () => {
+    const newFlagsJson = JSON.stringify(flags);
+
+    await prisma.$executeRaw`
+      UPDATE "OrganisationClaim"
+      SET "flags" = "flags" || ${newFlagsJson}::jsonb
+      WHERE "originalSubscriptionClaimId" = ${subscriptionClaimId}
+    `;
+  });
+};

packages/lib/jobs/definitions/internal/backport-subscription-claims.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+
+import { type JobDefinition } from '../../client/_internal/job';
+
+const BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION_ID = 'internal.backport-subscription-claims';
+
+const BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION_SCHEMA = z.object({
+  subscriptionClaimId: z.string(),
+  // I would prefer to fetch the subscription within the runner, but
+  // it seems the local job runs it asynchronously, so we can't get
+  // the updated values in the job.
+  flags: z.object({
+    unlimitedDocuments: z.literal(true).optional(),
+    allowCustomBranding: z.literal(true).optional(),
+    hidePoweredBy: z.literal(true).optional(),
+    embedAuthoring: z.literal(true).optional(),
+    embedAuthoringWhiteLabel: z.literal(true).optional(),
+    embedSigning: z.literal(true).optional(),
+    embedSigningWhiteLabel: z.literal(true).optional(),
+    cfr21: z.literal(true).optional(),
+  }),
+});
+
+export type TBackportSubscriptionClaimJobDefinition = z.infer<
+  typeof BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION_SCHEMA
+>;
+
+export const BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION = {
+  id: BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION_ID,
+  name: 'Backport Subscription Claims',
+  version: '1.0.0',
+  trigger: {
+    name: BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION_ID,
+    schema: BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION_SCHEMA,
+  },
+  handler: async ({ payload, io }) => {
+    const handler = await import('./backport-subscription-claims.handler');
+
+    await handler.run({ payload, io });
+  },
+} as const satisfies JobDefinition<
+  typeof BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION_ID,
+  TBackportSubscriptionClaimJobDefinition
+>;

packages/lib/jobs/definitions/internal/bulk-send-template.handler.ts

@@ -1,7 +1,6 @@
 import { createElement } from 'react';
 
 import { msg } from '@lingui/macro';
-import type { TeamGlobalSettings } from '@prisma/client';
 import { parse } from 'csv-parse/sync';
 import { z } from 'zod';
 
@@ -14,10 +13,9 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../../constants/email';
 import { AppError } from '../../../errors/app-error';
+import { getEmailContext } from '../../../server-only/email/get-email-context';
 import { renderEmailWithI18N } from '../../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../../utils/team-global-settings-to-branding';
 import type { JobRunIO } from '../../client/_internal/job';
 import type { TBulkSendTemplateJobDefinition } from './bulk-send-template';
 
@@ -163,29 +161,23 @@ export const run = async ({
       assetBaseUrl: NEXT_PUBLIC_WEBAPP_URL(),
     });
 
-    let teamGlobalSettings: TeamGlobalSettings | undefined | null;
+    const { branding, emailLanguage, senderEmail } = await getEmailContext({
+      emailType: 'INTERNAL',
+      source: {
+        type: 'team',
+        teamId,
+      },
+    });
 
-    if (template.teamId) {
-      teamGlobalSettings = await prisma.teamGlobalSettings.findUnique({
-        where: {
-          teamId: template.teamId,
-        },
-      });
-    }
-
-    const branding = teamGlobalSettings
-      ? teamGlobalSettingsToBranding(teamGlobalSettings)
-      : undefined;
-
-    const i18n = await getI18nInstance(teamGlobalSettings?.documentLanguage);
+    const i18n = await getI18nInstance(emailLanguage);
 
     const [html, text] = await Promise.all([
       renderEmailWithI18N(completionTemplate, {
-        lang: teamGlobalSettings?.documentLanguage,
+        lang: emailLanguage,
         branding,
       }),
       renderEmailWithI18N(completionTemplate, {
-        lang: teamGlobalSettings?.documentLanguage,
+        lang: emailLanguage,
         branding,
         plainText: true,
       }),
@@ -196,10 +188,7 @@ export const run = async ({
         name: user.name || '',
         address: user.email,
       },
-      from: {
-        name: FROM_NAME,
-        address: FROM_ADDRESS,
-      },
+      from: senderEmail,
       subject: i18n._(msg`Bulk Send Complete: ${template.title}`),
       html,
       text,

packages/lib/jobs/definitions/internal/bulk-send-template.ts

@@ -7,7 +7,7 @@ const BULK_SEND_TEMPLATE_JOB_DEFINITION_ID = 'internal.bulk-send-template';
 
 const BULK_SEND_TEMPLATE_JOB_DEFINITION_SCHEMA = z.object({
   userId: z.number(),
-  teamId: z.number().optional(),
+  teamId: z.number(),
   templateId: z.number(),
   csvContent: z.string(),
   sendImmediately: z.boolean(),

packages/lib/jobs/definitions/internal/execute-webhook.handler.ts

@@ -0,0 +1,74 @@
+import { Prisma, WebhookCallStatus } from '@prisma/client';
+
+import { prisma } from '@documenso/prisma';
+
+import type { JobRunIO } from '../../client/_internal/job';
+import type { TExecuteWebhookJobDefinition } from './execute-webhook';
+
+export const run = async ({
+  payload,
+  io,
+}: {
+  payload: TExecuteWebhookJobDefinition;
+  io: JobRunIO;
+}) => {
+  const { event, webhookId, data } = payload;
+
+  const webhook = await prisma.webhook.findUniqueOrThrow({
+    where: {
+      id: webhookId,
+    },
+  });
+
+  const { webhookUrl: url, secret } = webhook;
+
+  await io.runTask('execute-webhook', async () => {
+    const payloadData = {
+      event,
+      payload: data,
+      createdAt: new Date().toISOString(),
+      webhookEndpoint: url,
+    };
+
+    const response = await fetch(url, {
+      method: 'POST',
+      body: JSON.stringify(payloadData),
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Documenso-Secret': secret ?? '',
+      },
+    });
+
+    const body = await response.text();
+
+    let responseBody: Prisma.InputJsonValue | Prisma.JsonNullValueInput = Prisma.JsonNull;
+
+    try {
+      responseBody = JSON.parse(body);
+    } catch (err) {
+      responseBody = body;
+    }
+
+    await prisma.webhookCall.create({
+      data: {
+        url,
+        event,
+        status: response.ok ? WebhookCallStatus.SUCCESS : WebhookCallStatus.FAILED,
+        requestBody: payloadData as Prisma.InputJsonValue,
+        responseCode: response.status,
+        responseBody,
+        responseHeaders: Object.fromEntries(response.headers.entries()),
+        webhookId: webhook.id,
+      },
+    });
+
+    if (!response.ok) {
+      throw new Error(`Webhook execution failed with status ${response.status}`);
+    }
+
+    return {
+      success: response.ok,
+      status: response.status,
+    };
+  });
+};

packages/lib/jobs/definitions/internal/execute-webhook.ts

@@ -0,0 +1,34 @@
+import { WebhookTriggerEvents } from '@prisma/client';
+import { z } from 'zod';
+
+import { ZRequestMetadataSchema } from '../../../universal/extract-request-metadata';
+import { type JobDefinition } from '../../client/_internal/job';
+
+const EXECUTE_WEBHOOK_JOB_DEFINITION_ID = 'internal.execute-webhook';
+
+const EXECUTE_WEBHOOK_JOB_DEFINITION_SCHEMA = z.object({
+  event: z.nativeEnum(WebhookTriggerEvents),
+  webhookId: z.string(),
+  data: z.unknown(),
+  requestMetadata: ZRequestMetadataSchema.optional(),
+});
+
+export type TExecuteWebhookJobDefinition = z.infer<typeof EXECUTE_WEBHOOK_JOB_DEFINITION_SCHEMA>;
+
+export const EXECUTE_WEBHOOK_JOB_DEFINITION = {
+  id: EXECUTE_WEBHOOK_JOB_DEFINITION_ID,
+  name: 'Execute Webhook',
+  version: '1.0.0',
+  trigger: {
+    name: EXECUTE_WEBHOOK_JOB_DEFINITION_ID,
+    schema: EXECUTE_WEBHOOK_JOB_DEFINITION_SCHEMA,
+  },
+  handler: async ({ payload, io }) => {
+    const handler = await import('./execute-webhook.handler');
+
+    await handler.run({ payload, io });
+  },
+} as const satisfies JobDefinition<
+  typeof EXECUTE_WEBHOOK_JOB_DEFINITION_ID,
+  TExecuteWebhookJobDefinition
+>;

packages/lib/jobs/definitions/internal/seal-document.handler.ts

@@ -9,18 +9,22 @@ import { signPdf } from '@documenso/signing';
 import { AppError, AppErrorCode } from '../../../errors/app-error';
 import { sendCompletedEmail } from '../../../server-only/document/send-completed-email';
 import PostHogServerClient from '../../../server-only/feature-flags/get-post-hog-server-client';
+import { getAuditLogsPdf } from '../../../server-only/htmltopdf/get-audit-logs-pdf';
 import { getCertificatePdf } from '../../../server-only/htmltopdf/get-certificate-pdf';
 import { addRejectionStampToPdf } from '../../../server-only/pdf/add-rejection-stamp-to-pdf';
 import { flattenAnnotations } from '../../../server-only/pdf/flatten-annotations';
 import { flattenForm } from '../../../server-only/pdf/flatten-form';
 import { insertFieldInPDF } from '../../../server-only/pdf/insert-field-in-pdf';
+import { legacy_insertFieldInPDF } from '../../../server-only/pdf/legacy-insert-field-in-pdf';
 import { normalizeSignatureAppearances } from '../../../server-only/pdf/normalize-signature-appearances';
+import { getTeamSettings } from '../../../server-only/team/get-team-settings';
 import { triggerWebhook } from '../../../server-only/webhooks/trigger/trigger-webhook';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../../types/document-audit-logs';
 import {
   ZWebhookDocumentSchema,
   mapDocumentToWebhookDocumentPayload,
 } from '../../../types/webhook-payload';
+import { prefixedId } from '../../../universal/id';
 import { getFileServerSide } from '../../../universal/upload/get-file.server';
 import { putPdfFileServerSide } from '../../../universal/upload/put-file.server';
 import { fieldsContainUnsignedRequiredField } from '../../../utils/advanced-fields-helpers';
@@ -45,18 +49,14 @@ export const run = async ({
     include: {
       documentMeta: true,
       recipients: true,
-      team: {
-        select: {
-          teamGlobalSettings: {
-            select: {
-              includeSigningCertificate: true,
-            },
-          },
-        },
-      },
     },
   });
 
+  const settings = await getTeamSettings({
+    userId: document.userId,
+    teamId: document.teamId,
+  });
+
   const isComplete =
     document.recipients.some((recipient) => recipient.signingStatus === SigningStatus.REJECTED) ||
     document.recipients.every((recipient) => recipient.signingStatus === SigningStatus.SIGNED);
@@ -129,22 +129,49 @@ export const run = async ({
     documentData.data = documentData.initialData;
   }
 
+  if (!document.qrToken) {
+    await prisma.document.update({
+      where: {
+        id: document.id,
+      },
+      data: {
+        qrToken: prefixedId('qr'),
+      },
+    });
+  }
+
   const pdfData = await getFileServerSide(documentData);
 
-  const certificateData =
-    (document.team?.teamGlobalSettings?.includeSigningCertificate ?? true)
-      ? await getCertificatePdf({
-          documentId,
-          language: document.documentMeta?.language,
-        }).catch(() => null)
-      : null;
+  const certificateData = settings.includeSigningCertificate
+    ? await getCertificatePdf({
+        documentId,
+        language: document.documentMeta?.language,
+      }).catch((e) => {
+        console.log('Failed to get certificate PDF');
+        console.error(e);
+
+        return null;
+      })
+    : null;
+
+  const auditLogData = settings.includeAuditLog
+    ? await getAuditLogsPdf({
+        documentId,
+        language: document.documentMeta?.language,
+      }).catch((e) => {
+        console.log('Failed to get audit logs PDF');
+        console.error(e);
+
+        return null;
+      })
+    : null;
 
   const newDataId = await io.runTask('decorate-and-sign-pdf', async () => {
     const pdfDoc = await PDFDocument.load(pdfData);
 
     // Normalize and flatten layers that could cause issues with the signature
     normalizeSignatureAppearances(pdfDoc);
-    flattenForm(pdfDoc);
+    await flattenForm(pdfDoc);
     flattenAnnotations(pdfDoc);
 
     // Add rejection stamp if the document is rejected
@@ -165,15 +192,27 @@ export const run = async ({
       });
     }
 
+    if (auditLogData) {
+      const auditLogDoc = await PDFDocument.load(auditLogData);
+
+      const auditLogPages = await pdfDoc.copyPages(auditLogDoc, auditLogDoc.getPageIndices());
+
+      auditLogPages.forEach((page) => {
+        pdfDoc.addPage(page);
+      });
+    }
+
     for (const field of fields) {
       if (field.inserted) {
-        await insertFieldInPDF(pdfDoc, field);
+        document.useLegacyFieldInsertion
+          ? await legacy_insertFieldInPDF(pdfDoc, field)
+          : await insertFieldInPDF(pdfDoc, field);
       }
     }
 
     // Re-flatten the form to handle our checkbox and radio fields that
     // create native arcoFields
-    flattenForm(pdfDoc);
+    await flattenForm(pdfDoc);
 
     const pdfBytes = await pdfDoc.save();
     const pdfBuffer = await signPdf({ pdf: Buffer.from(pdfBytes) });

packages/lib/package.json

@@ -15,8 +15,8 @@
     "clean": "rimraf node_modules"
   },
   "dependencies": {
-    "@auth/kysely-adapter": "^0.6.0",
     "@aws-sdk/client-s3": "^3.410.0",
+    "@aws-sdk/client-sesv2": "^3.410.0",
     "@aws-sdk/cloudfront-signer": "^3.410.0",
     "@aws-sdk/s3-request-presigner": "^3.410.0",
     "@aws-sdk/signature-v4-crt": "^3.410.0",
@@ -24,29 +24,32 @@
     "@documenso/email": "*",
     "@documenso/prisma": "*",
     "@documenso/signing": "*",
-    "@honeybadger-io/js": "^6.10.1",
     "@lingui/core": "^5.2.0",
     "@lingui/macro": "^5.2.0",
     "@lingui/react": "^5.2.0",
-    "jose": "^6.0.0",
     "@noble/ciphers": "0.4.0",
     "@noble/hashes": "1.3.2",
     "@node-rs/bcrypt": "^1.10.0",
     "@pdf-lib/fontkit": "^1.1.1",
     "@scure/base": "^1.1.3",
     "@sindresorhus/slugify": "^2.2.1",
+    "@team-plain/typescript-sdk": "^5.9.0",
     "@vvo/tzdb": "^6.117.0",
     "csv-parse": "^5.6.0",
     "inngest": "^3.19.13",
+    "jose": "^6.0.0",
     "kysely": "0.26.3",
     "luxon": "^3.4.0",
     "micro": "^10.0.1",
-    "nanoid": "^4.0.2",
+    "nanoid": "^5.1.5",
     "oslo": "^0.17.0",
     "pdf-lib": "^1.17.1",
     "pg": "^8.11.3",
-    "playwright": "1.43.0",
-    "posthog-js": "^1.224.0",
+    "pino": "^9.7.0",
+    "pino-pretty": "^13.0.0",
+    "playwright": "1.52.0",
+    "posthog-js": "^1.245.0",
+    "posthog-node": "^4.17.0",
     "react": "^18",
     "remeda": "^2.17.3",
     "sharp": "0.32.6",
@@ -55,8 +58,8 @@
     "zod": "3.24.1"
   },
   "devDependencies": {
-    "@playwright/browser-chromium": "1.43.0",
+    "@playwright/browser-chromium": "1.52.0",
     "@types/luxon": "^3.3.1",
     "@types/pg": "^8.11.4"
   }
-}
+}

packages/lib/plain/client.ts

@@ -0,0 +1,7 @@
+import { PlainClient } from '@team-plain/typescript-sdk';
+
+import { env } from '@documenso/lib/utils/env';
+
+export const plainClient = new PlainClient({
+  apiKey: env('NEXT_PRIVATE_PLAIN_API_KEY') ?? '',
+});

packages/lib/server-only/2fa/verify-password.ts

@@ -0,0 +1,20 @@
+import { compare } from '@node-rs/bcrypt';
+
+import { prisma } from '@documenso/prisma';
+
+type VerifyPasswordOptions = {
+  userId: number;
+  password: string;
+};
+
+export const verifyPassword = async ({ userId, password }: VerifyPasswordOptions) => {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+  });
+
+  if (!user || !user.password) {
+    return false;
+  }
+
+  return await compare(password, user.password);
+};

packages/lib/server-only/admin/get-all-subscriptions.ts

@@ -1,13 +0,0 @@
-import { prisma } from '@documenso/prisma';
-
-export const findSubscriptions = async () => {
-  return prisma.subscription.findMany({
-    select: {
-      id: true,
-      status: true,
-      createdAt: true,
-      periodEnd: true,
-      userId: true,
-    },
-  });
-};

packages/lib/server-only/admin/get-signing-volume.ts

@@ -29,37 +29,26 @@ export async function getSigningVolume({
 
   let findQuery = kyselyPrisma.$kysely
     .selectFrom('Subscription as s')
-    .leftJoin('User as u', 's.userId', 'u.id')
-    .leftJoin('Team as t', 's.teamId', 't.id')
-    .leftJoin('Document as ud', (join) =>
+    .innerJoin('Organisation as o', 's.organisationId', 'o.id')
+    .leftJoin('Team as t', 'o.id', 't.organisationId')
+    .leftJoin('Document as d', (join) =>
       join
-        .onRef('u.id', '=', 'ud.userId')
-        .on('ud.status', '=', sql.lit(DocumentStatus.COMPLETED))
-        .on('ud.deletedAt', 'is', null)
-        .on('ud.teamId', 'is', null),
-    )
-    .leftJoin('Document as td', (join) =>
-      join
-        .onRef('t.id', '=', 'td.teamId')
-        .on('td.status', '=', sql.lit(DocumentStatus.COMPLETED))
-        .on('td.deletedAt', 'is', null),
+        .onRef('t.id', '=', 'd.teamId')
+        .on('d.status', '=', sql.lit(DocumentStatus.COMPLETED))
+        .on('d.deletedAt', 'is', null),
     )
     .where(sql`s.status = ${SubscriptionStatus.ACTIVE}::"SubscriptionStatus"`)
     .where((eb) =>
-      eb.or([
-        eb('u.name', 'ilike', `%${search}%`),
-        eb('u.email', 'ilike', `%${search}%`),
-        eb('t.name', 'ilike', `%${search}%`),
-      ]),
+      eb.or([eb('o.name', 'ilike', `%${search}%`), eb('t.name', 'ilike', `%${search}%`)]),
     )
     .select([
       's.id as id',
       's.createdAt as createdAt',
       's.planId as planId',
-      sql<string>`COALESCE(u.name, t.name, u.email, 'Unknown')`.as('name'),
-      sql<number>`COUNT(DISTINCT ud.id) + COUNT(DISTINCT td.id)`.as('signingVolume'),
+      sql<string>`COALESCE(o.name, 'Unknown')`.as('name'),
+      sql<number>`COUNT(DISTINCT d.id)`.as('signingVolume'),
     ])
-    .groupBy(['s.id', 'u.name', 't.name', 'u.email']);
+    .groupBy(['s.id', 'o.name']);
 
   switch (sortBy) {
     case 'name':
@@ -79,15 +68,11 @@ export async function getSigningVolume({
 
   const countQuery = kyselyPrisma.$kysely
     .selectFrom('Subscription as s')
-    .leftJoin('User as u', 's.userId', 'u.id')
-    .leftJoin('Team as t', 's.teamId', 't.id')
+    .innerJoin('Organisation as o', 's.organisationId', 'o.id')
+    .leftJoin('Team as t', 'o.id', 't.organisationId')
     .where(sql`s.status = ${SubscriptionStatus.ACTIVE}::"SubscriptionStatus"`)
     .where((eb) =>
-      eb.or([
-        eb('u.name', 'ilike', `%${search}%`),
-        eb('u.email', 'ilike', `%${search}%`),
-        eb('t.name', 'ilike', `%${search}%`),
-      ]),
+      eb.or([eb('o.name', 'ilike', `%${search}%`), eb('t.name', 'ilike', `%${search}%`)]),
     )
     .select(({ fn }) => [fn.countAll().as('count')]);
 

packages/lib/server-only/admin/get-users-stats.ts

@@ -1,50 +1,17 @@
-import { DocumentStatus, SubscriptionStatus } from '@prisma/client';
 import { DateTime } from 'luxon';
 
-import { prisma } from '@documenso/prisma';
+import { kyselyPrisma, prisma, sql } from '@documenso/prisma';
+import { SubscriptionStatus, UserSecurityAuditLogType } from '@documenso/prisma/client';
 
 export const getUsersCount = async () => {
   return await prisma.user.count();
 };
 
-export const getUsersWithSubscriptionsCount = async () => {
-  return await prisma.user.count({
+export const getOrganisationsWithSubscriptionsCount = async () => {
+  return await prisma.organisation.count({
     where: {
-      subscriptions: {
-        some: {
-          status: SubscriptionStatus.ACTIVE,
-        },
-      },
-    },
-  });
-};
-
-export const getUserWithAtLeastOneDocumentPerMonth = async () => {
-  return await prisma.user.count({
-    where: {
-      documents: {
-        some: {
-          createdAt: {
-            gte: DateTime.now().minus({ months: 1 }).toJSDate(),
-          },
-        },
-      },
-    },
-  });
-};
-
-export const getUserWithAtLeastOneDocumentSignedPerMonth = async () => {
-  return await prisma.user.count({
-    where: {
-      documents: {
-        some: {
-          status: {
-            equals: DocumentStatus.COMPLETED,
-          },
-          completedAt: {
-            gte: DateTime.now().minus({ months: 1 }).toJSDate(),
-          },
-        },
+      subscription: {
+        status: SubscriptionStatus.ACTIVE,
       },
     },
   });
@@ -69,6 +36,8 @@ export const getUserWithSignedDocumentMonthlyGrowth = async () => {
         COUNT(DISTINCT "Document"."userId") as "count",
         COUNT(DISTINCT CASE WHEN "Document"."status" = 'COMPLETED' THEN "Document"."userId" END) as "signed_count"
       FROM "Document"
+      INNER JOIN "Team" ON "Document"."teamId" = "Team"."id"
+      INNER JOIN "Organisation" ON "Team"."organisationId" = "Organisation"."id"
       GROUP BY "month"
       ORDER BY "month" DESC
       LIMIT 12
@@ -80,3 +49,37 @@ export const getUserWithSignedDocumentMonthlyGrowth = async () => {
     signed_count: Number(row.signed_count),
   }));
 };
+
+export type GetMonthlyActiveUsersResult = Array<{
+  month: string;
+  count: number;
+  cume_count: number;
+}>;
+
+export const getMonthlyActiveUsers = async () => {
+  const qb = kyselyPrisma.$kysely
+    .selectFrom('UserSecurityAuditLog')
+    .select(({ fn }) => [
+      fn<Date>('DATE_TRUNC', [sql.lit('MONTH'), 'UserSecurityAuditLog.createdAt']).as('month'),
+      fn.count('userId').distinct().as('count'),
+      fn
+        .sum(fn.count('userId').distinct())
+        .over((ob) =>
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/consistent-type-assertions
+          ob.orderBy(fn('DATE_TRUNC', [sql.lit('MONTH'), 'UserSecurityAuditLog.createdAt']) as any),
+        )
+        .as('cume_count'),
+    ])
+    .where(sql`type = ${UserSecurityAuditLogType.SIGN_IN}::"UserSecurityAuditLogType"`)
+    .groupBy(({ fn }) => fn('DATE_TRUNC', [sql.lit('MONTH'), 'UserSecurityAuditLog.createdAt']))
+    .orderBy('month', 'desc')
+    .limit(12);
+
+  const result = await qb.execute();
+
+  return result.map((row) => ({
+    month: DateTime.fromJSDate(row.month).toFormat('yyyy-MM'),
+    count: Number(row.count),
+    cume_count: Number(row.cume_count),
+  }));
+};

packages/lib/server-only/document-meta/upsert-document-meta.ts

@@ -15,10 +15,11 @@ import { prisma } from '@documenso/prisma';
 import type { SupportedLanguageCodes } from '../../constants/i18n';
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import type { TDocumentEmailSettings } from '../../types/document-email';
+import { getDocumentWhereInput } from '../document/get-document-by-id';
 
 export type CreateDocumentMetaOptions = {
   userId: number;
-  teamId?: number;
+  teamId: number;
   documentId: number;
   subject?: string;
   message?: string;
@@ -26,6 +27,8 @@ export type CreateDocumentMetaOptions = {
   password?: string;
   dateFormat?: string;
   redirectUrl?: string;
+  emailId?: string | null;
+  emailReplyTo?: string | null;
   emailSettings?: TDocumentEmailSettings;
   signingOrder?: DocumentSigningOrder;
   allowDictateNextSigner?: boolean;
@@ -50,6 +53,8 @@ export const upsertDocumentMeta = async ({
   redirectUrl,
   signingOrder,
   allowDictateNextSigner,
+  emailId,
+  emailReplyTo,
   emailSettings,
   distributionMethod,
   typedSignatureEnabled,
@@ -59,25 +64,14 @@ export const upsertDocumentMeta = async ({
   reminderInterval,
   requestMetadata,
 }: CreateDocumentMetaOptions) => {
+  const { documentWhereInput, team } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
   const document = await prisma.document.findFirst({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
+    where: documentWhereInput,
     include: {
       documentMeta: true,
     },
@@ -91,6 +85,22 @@ export const upsertDocumentMeta = async ({
 
   const { documentMeta: originalDocumentMeta } = document;
 
+  // Validate the emailId belongs to the organisation.
+  if (emailId) {
+    const email = await prisma.organisationEmail.findFirst({
+      where: {
+        id: emailId,
+        organisationId: team.organisationId,
+      },
+    });
+
+    if (!email) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Email not found',
+      });
+    }
+  }
+
   return await prisma.$transaction(async (tx) => {
     const upsertedDocumentMeta = await tx.documentMeta.upsert({
       where: {
@@ -106,6 +116,8 @@ export const upsertDocumentMeta = async ({
         redirectUrl,
         signingOrder,
         allowDictateNextSigner,
+        emailId,
+        emailReplyTo,
         emailSettings,
         distributionMethod,
         typedSignatureEnabled,
@@ -123,6 +135,8 @@ export const upsertDocumentMeta = async ({
         redirectUrl,
         signingOrder,
         allowDictateNextSigner,
+        emailId,
+        emailReplyTo,
         emailSettings,
         distributionMethod,
         typedSignatureEnabled,

packages/lib/server-only/document/complete-document-with-token.ts

@@ -23,6 +23,7 @@ import {
   ZWebhookDocumentSchema,
   mapDocumentToWebhookDocumentPayload,
 } from '../../types/webhook-payload';
+import { extractDocumentAuthMethods } from '../../utils/document-auth';
 import { getIsRecipientsTurnToSign } from '../recipient/get-is-recipient-turn';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 import { sendPendingEmail } from './send-pending-email';
@@ -140,6 +141,11 @@ export const completeDocumentWithToken = async ({
       },
     });
 
+    const authOptions = extractDocumentAuthMethods({
+      documentAuth: document.authOptions,
+      recipientAuth: recipient.authOptions,
+    });
+
     await tx.documentAuditLog.create({
       data: createDocumentAuditLogData({
         type: DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_RECIPIENT_COMPLETED,
@@ -154,6 +160,7 @@ export const completeDocumentWithToken = async ({
           recipientName: recipient.name,
           recipientId: recipient.id,
           recipientRole: recipient.role,
+          actionAuth: authOptions.derivedRecipientActionAuth,
         },
       }),
     });

packages/lib/server-only/document/create-document-v2.ts

@@ -6,14 +6,12 @@ import {
   SigningStatus,
   WebhookTriggerEvents,
 } from '@prisma/client';
-import { TeamMemberRole } from '@prisma/client';
 
-import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { normalizePdf as makeNormalizedPdf } from '@documenso/lib/server-only/pdf/normalize-pdf';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
-import { nanoid } from '@documenso/lib/universal/id';
+import { nanoid, prefixedId } from '@documenso/lib/universal/id';
 import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
 import { prisma } from '@documenso/prisma';
 import type { TCreateDocumentV2Request } from '@documenso/trpc/server/document-router/schema';
@@ -26,21 +24,25 @@ import {
 } from '../../types/webhook-payload';
 import { getFileServerSide } from '../../universal/upload/get-file.server';
 import { putPdfFileServerSide } from '../../universal/upload/put-file.server';
+import { extractDerivedDocumentMeta } from '../../utils/document';
 import { createDocumentAuthOptions, createRecipientAuthOptions } from '../../utils/document-auth';
 import { determineDocumentVisibility } from '../../utils/document-visibility';
+import { buildTeamWhereQuery } from '../../utils/teams';
+import { getMemberRoles } from '../team/get-member-roles';
+import { getTeamSettings } from '../team/get-team-settings';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 
 export type CreateDocumentOptions = {
   userId: number;
-  teamId?: number;
+  teamId: number;
   documentDataId: string;
   normalizePdf?: boolean;
   data: {
     title: string;
     externalId?: string;
     visibility?: DocumentVisibility;
-    globalAccessAuth?: TDocumentAccessAuthTypes;
-    globalActionAuth?: TDocumentActionAuthTypes;
+    globalAccessAuth?: TDocumentAccessAuthTypes[];
+    globalActionAuth?: TDocumentActionAuthTypes[];
     formValues?: TDocumentFormValues;
     recipients: TCreateDocumentV2Request['recipients'];
   };
@@ -59,36 +61,28 @@ export const createDocumentV2 = async ({
 }: CreateDocumentOptions) => {
   const { title, formValues } = data;
 
-  const team = teamId
-    ? await prisma.team.findFirst({
-        where: {
-          id: teamId,
-          members: {
-            some: {
-              userId,
-            },
-          },
+  const team = await prisma.team.findFirst({
+    where: buildTeamWhereQuery({ teamId, userId }),
+    include: {
+      organisation: {
+        select: {
+          organisationClaim: true,
         },
-        include: {
-          teamGlobalSettings: true,
-          members: {
-            where: {
-              userId: userId,
-            },
-            select: {
-              role: true,
-            },
-          },
-        },
-      })
-    : null;
+      },
+    },
+  });
 
-  if (teamId !== undefined && !team) {
+  if (!team) {
     throw new AppError(AppErrorCode.NOT_FOUND, {
       message: 'Team not found',
     });
   }
 
+  const settings = await getTeamSettings({
+    userId,
+    teamId,
+  });
+
   if (normalizePdf) {
     const documentData = await prisma.documentData.findFirst({
       where: {
@@ -113,35 +107,57 @@ export const createDocumentV2 = async ({
   }
 
   const authOptions = createDocumentAuthOptions({
-    globalAccessAuth: data?.globalAccessAuth || null,
-    globalActionAuth: data?.globalActionAuth || null,
+    globalAccessAuth: data?.globalAccessAuth || [],
+    globalActionAuth: data?.globalActionAuth || [],
   });
 
-  const recipientsHaveActionAuth = data.recipients?.some((recipient) => recipient.actionAuth);
+  const recipientsHaveActionAuth = data.recipients?.some(
+    (recipient) => recipient.actionAuth && recipient.actionAuth.length > 0,
+  );
 
   // Check if user has permission to set the global action auth.
-  if (authOptions.globalActionAuth || recipientsHaveActionAuth) {
-    const isDocumentEnterprise = await isUserEnterprise({
-      userId,
-      teamId,
+  if (
+    (authOptions.globalActionAuth.length > 0 || recipientsHaveActionAuth) &&
+    !team.organisation.organisationClaim.flags.cfr21
+  ) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'You do not have permission to set the action auth',
+    });
+  }
+
+  const { teamRole } = await getMemberRoles({
+    teamId,
+    reference: {
+      type: 'User',
+      id: userId,
+    },
+  });
+
+  const visibility = determineDocumentVisibility(settings.documentVisibility, teamRole);
+
+  const emailId = meta?.emailId;
+
+  // Validate that the email ID belongs to the organisation.
+  if (emailId) {
+    const email = await prisma.organisationEmail.findFirst({
+      where: {
+        id: emailId,
+        organisationId: team.organisationId,
+      },
     });
 
-    if (!isDocumentEnterprise) {
-      throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'You do not have permission to set the action auth',
+    if (!email) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Email not found',
       });
     }
   }
 
-  const visibility = determineDocumentVisibility(
-    team?.teamGlobalSettings?.documentVisibility,
-    team?.members[0].role ?? TeamMemberRole.MEMBER,
-  );
-
   return await prisma.$transaction(async (tx) => {
     const document = await tx.document.create({
       data: {
         title,
+        qrToken: prefixedId('qr'),
         externalId: data.externalId,
         documentDataId,
         userId,
@@ -151,18 +167,7 @@ export const createDocumentV2 = async ({
         formValues,
         source: DocumentSource.DOCUMENT,
         documentMeta: {
-          create: {
-            ...meta,
-            signingOrder: meta?.signingOrder || undefined,
-            emailSettings: meta?.emailSettings || undefined,
-            language: meta?.language || team?.teamGlobalSettings?.documentLanguage,
-            typedSignatureEnabled:
-              meta?.typedSignatureEnabled ?? team?.teamGlobalSettings?.typedSignatureEnabled,
-            uploadSignatureEnabled:
-              meta?.uploadSignatureEnabled ?? team?.teamGlobalSettings?.uploadSignatureEnabled,
-            drawSignatureEnabled:
-              meta?.drawSignatureEnabled ?? team?.teamGlobalSettings?.drawSignatureEnabled,
-          },
+          create: extractDerivedDocumentMeta(settings, meta),
         },
       },
     });
@@ -170,8 +175,8 @@ export const createDocumentV2 = async ({
     await Promise.all(
       (data.recipients || []).map(async (recipient) => {
         const recipientAuthOptions = createRecipientAuthOptions({
-          accessAuth: recipient.accessAuth || null,
-          actionAuth: recipient.actionAuth || null,
+          accessAuth: recipient.accessAuth ?? [],
+          actionAuth: recipient.actionAuth ?? [],
         });
 
         await tx.recipient.create({
@@ -207,7 +212,7 @@ export const createDocumentV2 = async ({
       }),
     );
 
-    // Todo: Is it necessary to create a full audit log with all fields and recipients audit logs?
+    // Todo: Is it necessary to create a full audit logs with all fields and recipients audit logs?
 
     await tx.documentAuditLog.create({
       data: createDocumentAuditLogData({
@@ -232,6 +237,7 @@ export const createDocumentV2 = async ({
         documentMeta: true,
         recipients: true,
         fields: true,
+        folder: true,
       },
     });
 

packages/lib/server-only/document/create-document.ts

@@ -1,33 +1,39 @@
 import { DocumentSource, WebhookTriggerEvents } from '@prisma/client';
-import type { Team, TeamGlobalSettings } from '@prisma/client';
-import { TeamMemberRole } from '@prisma/client';
+import type { DocumentVisibility } from '@prisma/client';
 
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { normalizePdf as makeNormalizedPdf } from '@documenso/lib/server-only/pdf/normalize-pdf';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
 import { prisma } from '@documenso/prisma';
 
+import { AppError, AppErrorCode } from '../../errors/app-error';
 import {
   ZWebhookDocumentSchema,
   mapDocumentToWebhookDocumentPayload,
 } from '../../types/webhook-payload';
+import { prefixedId } from '../../universal/id';
 import { getFileServerSide } from '../../universal/upload/get-file.server';
 import { putPdfFileServerSide } from '../../universal/upload/put-file.server';
+import { extractDerivedDocumentMeta } from '../../utils/document';
 import { determineDocumentVisibility } from '../../utils/document-visibility';
+import { buildTeamWhereQuery } from '../../utils/teams';
+import { getTeamById } from '../team/get-team';
+import { getTeamSettings } from '../team/get-team-settings';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 
 export type CreateDocumentOptions = {
   title: string;
   externalId?: string | null;
   userId: number;
-  teamId?: number;
+  teamId: number;
   documentDataId: string;
   formValues?: Record<string, string | number | boolean>;
   normalizePdf?: boolean;
   timezone?: string;
+  userTimezone?: string;
   requestMetadata: ApiRequestMetadata;
+  folderId?: string;
 };
 
 export const createDocument = async ({
@@ -40,52 +46,39 @@ export const createDocument = async ({
   formValues,
   requestMetadata,
   timezone,
+  userTimezone,
+  folderId,
 }: CreateDocumentOptions) => {
-  const user = await prisma.user.findFirstOrThrow({
-    where: {
-      id: userId,
-    },
-    include: {
-      teamMembers: {
-        select: {
-          teamId: true,
-        },
-      },
-    },
+  const team = await getTeamById({ userId, teamId });
+
+  const settings = await getTeamSettings({
+    userId,
+    teamId,
   });
 
-  if (
-    teamId !== undefined &&
-    !user.teamMembers.some((teamMember) => teamMember.teamId === teamId)
-  ) {
-    throw new AppError(AppErrorCode.NOT_FOUND, {
-      message: 'Team not found',
-    });
-  }
+  let folderVisibility: DocumentVisibility | undefined;
 
-  let team: (Team & { teamGlobalSettings: TeamGlobalSettings | null }) | null = null;
-  let userTeamRole: TeamMemberRole | undefined;
-
-  if (teamId) {
-    const teamWithUserRole = await prisma.team.findFirstOrThrow({
+  if (folderId) {
+    const folder = await prisma.folder.findFirst({
       where: {
-        id: teamId,
+        id: folderId,
+        team: buildTeamWhereQuery({
+          teamId,
+          userId,
+        }),
       },
-      include: {
-        teamGlobalSettings: true,
-        members: {
-          where: {
-            userId: userId,
-          },
-          select: {
-            role: true,
-          },
-        },
+      select: {
+        visibility: true,
       },
     });
 
-    team = teamWithUserRole;
-    userTeamRole = teamWithUserRole.members[0]?.role;
+    if (!folder) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Folder not found',
+      });
+    }
+
+    folderVisibility = folder.visibility;
   }
 
   if (normalizePdf) {
@@ -111,28 +104,29 @@ export const createDocument = async ({
     }
   }
 
+  // userTimezone is last because it's always passed in regardless of the organisation/team settings
+  // for uploads from the frontend
+  const timezoneToUse = timezone || settings.documentTimezone || userTimezone;
+
   return await prisma.$transaction(async (tx) => {
     const document = await tx.document.create({
       data: {
         title,
+        qrToken: prefixedId('qr'),
         externalId,
         documentDataId,
         userId,
         teamId,
-        visibility: determineDocumentVisibility(
-          team?.teamGlobalSettings?.documentVisibility,
-          userTeamRole ?? TeamMemberRole.MEMBER,
-        ),
+        folderId,
+        visibility:
+          folderVisibility ??
+          determineDocumentVisibility(settings.documentVisibility, team.currentTeamRole),
         formValues,
         source: DocumentSource.DOCUMENT,
         documentMeta: {
-          create: {
-            language: team?.teamGlobalSettings?.documentLanguage,
-            timezone: timezone,
-            typedSignatureEnabled: team?.teamGlobalSettings?.typedSignatureEnabled ?? true,
-            uploadSignatureEnabled: team?.teamGlobalSettings?.uploadSignatureEnabled ?? true,
-            drawSignatureEnabled: team?.teamGlobalSettings?.drawSignatureEnabled ?? true,
-          },
+          create: extractDerivedDocumentMeta(settings, {
+            timezone: timezoneToUse,
+          }),
         },
       },
     });

packages/lib/server-only/document/delete-document.ts

@@ -1,14 +1,7 @@
 import { createElement } from 'react';
 
 import { msg } from '@lingui/core/macro';
-import type {
-  Document,
-  DocumentMeta,
-  Recipient,
-  Team,
-  TeamGlobalSettings,
-  User,
-} from '@prisma/client';
+import type { Document, DocumentMeta, Recipient, User } from '@prisma/client';
 import { DocumentStatus, SendStatus, WebhookTriggerEvents } from '@prisma/client';
 
 import { mailer } from '@documenso/email/mailer';
@@ -17,7 +10,6 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../constants/email';
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
 import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
@@ -29,13 +21,14 @@ import type { ApiRequestMetadata } from '../../universal/extract-request-metadat
 import { isDocumentCompleted } from '../../utils/document';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
+import { getEmailContext } from '../email/get-email-context';
+import { getMemberRoles } from '../team/get-member-roles';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 
 export type DeleteDocumentOptions = {
   id: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
   requestMetadata: ApiRequestMetadata;
 };
 
@@ -64,23 +57,26 @@ export const deleteDocument = async ({
     include: {
       recipients: true,
       documentMeta: true,
-      team: {
-        include: {
-          members: true,
-          teamGlobalSettings: true,
-        },
-      },
     },
   });
 
-  if (!document || (teamId !== undefined && teamId !== document.teamId)) {
+  if (!document) {
     throw new AppError(AppErrorCode.NOT_FOUND, {
       message: 'Document not found',
     });
   }
 
+  const isUserTeamMember = await getMemberRoles({
+    teamId: document.teamId,
+    reference: {
+      type: 'User',
+      id: userId,
+    },
+  })
+    .then(() => true)
+    .catch(() => false);
+
   const isUserOwner = document.userId === userId;
-  const isUserTeamMember = document.team?.members.some((member) => member.userId === userId);
   const userRecipient = document.recipients.find((recipient) => recipient.email === user.email);
 
   if (!isUserOwner && !isUserTeamMember && !userRecipient) {
@@ -94,7 +90,6 @@ export const deleteDocument = async ({
     await handleDocumentOwnerDelete({
       document,
       user,
-      team: document.team,
       requestMetadata,
     });
   }
@@ -142,11 +137,6 @@ type HandleDocumentOwnerDeleteOptions = {
     recipients: Recipient[];
     documentMeta: DocumentMeta | null;
   };
-  team?:
-    | (Team & {
-        teamGlobalSettings?: TeamGlobalSettings | null;
-      })
-    | null;
   user: User;
   requestMetadata: ApiRequestMetadata;
 };
@@ -154,13 +144,21 @@ type HandleDocumentOwnerDeleteOptions = {
 const handleDocumentOwnerDelete = async ({
   document,
   user,
-  team,
   requestMetadata,
 }: HandleDocumentOwnerDeleteOptions) => {
   if (document.deletedAt) {
     return;
   }
 
+  const { branding, emailLanguage, senderEmail, replyToEmail } = await getEmailContext({
+    emailType: 'RECIPIENT',
+    source: {
+      type: 'team',
+      teamId: document.teamId,
+    },
+    meta: document.documentMeta,
+  });
+
   // Soft delete completed documents.
   if (isDocumentCompleted(document.status)) {
     return await prisma.$transaction(async (tx) => {
@@ -235,30 +233,24 @@ const handleDocumentOwnerDelete = async ({
         assetBaseUrl,
       });
 
-      const branding = team?.teamGlobalSettings
-        ? teamGlobalSettingsToBranding(team.teamGlobalSettings)
-        : undefined;
-
       const [html, text] = await Promise.all([
-        renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+        renderEmailWithI18N(template, { lang: emailLanguage, branding }),
         renderEmailWithI18N(template, {
-          lang: document.documentMeta?.language,
+          lang: emailLanguage,
           branding,
           plainText: true,
         }),
       ]);
 
-      const i18n = await getI18nInstance(document.documentMeta?.language);
+      const i18n = await getI18nInstance(emailLanguage);
 
       await mailer.sendMail({
         to: {
           address: recipient.email,
           name: recipient.name,
         },
-        from: {
-          name: FROM_NAME,
-          address: FROM_ADDRESS,
-        },
+        from: senderEmail,
+        replyTo: replyToEmail,
         subject: i18n._(msg`Document Cancelled`),
         html,
         text,

packages/lib/server-only/document/duplicate-document-by-id.ts

@@ -1,14 +1,22 @@
-import { DocumentSource, type Prisma } from '@prisma/client';
+import type { Prisma, Recipient } from '@prisma/client';
+import { DocumentSource, WebhookTriggerEvents } from '@prisma/client';
+import { omit } from 'remeda';
 
 import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
+import {
+  ZWebhookDocumentSchema,
+  mapDocumentToWebhookDocumentPayload,
+} from '../../types/webhook-payload';
+import { nanoid, prefixedId } from '../../universal/id';
+import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 import { getDocumentWhereInput } from './get-document-by-id';
 
 export interface DuplicateDocumentOptions {
   documentId: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
 }
 
 export const duplicateDocument = async ({
@@ -16,7 +24,7 @@ export const duplicateDocument = async ({
   userId,
   teamId,
 }: DuplicateDocumentOptions) => {
-  const documentWhereInput = await getDocumentWhereInput({
+  const { documentWhereInput } = await getDocumentWhereInput({
     documentId,
     userId,
     teamId,
@@ -34,14 +42,16 @@ export const duplicateDocument = async ({
           type: true,
         },
       },
-      documentMeta: {
+      authOptions: true,
+      visibility: true,
+      documentMeta: true,
+      recipients: {
         select: {
-          message: true,
-          subject: true,
-          dateFormat: true,
-          password: true,
-          timezone: true,
-          redirectUrl: true,
+          email: true,
+          name: true,
+          role: true,
+          signingOrder: true,
+          fields: true,
         },
       },
     },
@@ -53,38 +63,88 @@ export const duplicateDocument = async ({
     });
   }
 
-  const createDocumentArguments: Prisma.DocumentCreateArgs = {
+  const documentData = await prisma.documentData.create({
     data: {
-      title: document.title,
-      user: {
-        connect: {
-          id: document.userId,
-        },
-      },
-      documentData: {
-        create: {
-          ...document.documentData,
-          data: document.documentData.initialData,
-        },
-      },
-      documentMeta: {
-        create: {
-          ...document.documentMeta,
-        },
-      },
-      source: DocumentSource.DOCUMENT,
+      type: document.documentData.type,
+      data: document.documentData.initialData,
+      initialData: document.documentData.initialData,
     },
-  };
+  });
 
-  if (teamId !== undefined) {
-    createDocumentArguments.data.team = {
-      connect: {
-        id: teamId,
+  let documentMeta: Prisma.DocumentCreateArgs['data']['documentMeta'] | undefined = undefined;
+
+  if (document.documentMeta) {
+    documentMeta = {
+      create: {
+        ...omit(document.documentMeta, ['id', 'documentId']),
+        emailSettings: document.documentMeta.emailSettings || undefined,
       },
     };
   }
 
-  const createdDocument = await prisma.document.create(createDocumentArguments);
+  const createdDocument = await prisma.document.create({
+    data: {
+      userId: document.userId,
+      teamId: teamId,
+      title: document.title,
+      documentDataId: documentData.id,
+      authOptions: document.authOptions || undefined,
+      visibility: document.visibility,
+      qrToken: prefixedId('qr'),
+      documentMeta,
+      source: DocumentSource.DOCUMENT,
+    },
+    include: {
+      recipients: true,
+      documentMeta: true,
+    },
+  });
+
+  const recipientsToCreate = document.recipients.map((recipient) => ({
+    documentId: createdDocument.id,
+    email: recipient.email,
+    name: recipient.name,
+    role: recipient.role,
+    signingOrder: recipient.signingOrder,
+    token: nanoid(),
+    fields: {
+      createMany: {
+        data: recipient.fields.map((field) => ({
+          documentId: createdDocument.id,
+          type: field.type,
+          page: field.page,
+          positionX: field.positionX,
+          positionY: field.positionY,
+          width: field.width,
+          height: field.height,
+          customText: '',
+          inserted: false,
+          fieldMeta: field.fieldMeta as PrismaJson.FieldMeta,
+        })),
+      },
+    },
+  }));
+
+  const recipients: Recipient[] = [];
+
+  for (const recipientData of recipientsToCreate) {
+    const newRecipient = await prisma.recipient.create({
+      data: recipientData,
+    });
+
+    recipients.push(newRecipient);
+  }
+
+  await triggerWebhook({
+    event: WebhookTriggerEvents.DOCUMENT_CREATED,
+    data: ZWebhookDocumentSchema.parse({
+      ...mapDocumentToWebhookDocumentPayload(createdDocument),
+      recipients,
+      documentMeta: createdDocument.documentMeta,
+    }),
+    userId: userId,
+    teamId: teamId,
+  });
 
   return {
     documentId: createdDocument.id,

packages/lib/server-only/document/find-document-audit-logs.ts

@@ -6,10 +6,11 @@ import { AppError, AppErrorCode } from '../../errors/app-error';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
 import type { FindResultResponse } from '../../types/search-params';
 import { parseDocumentAuditLogData } from '../../utils/document-audit-logs';
+import { getDocumentWhereInput } from './get-document-by-id';
 
 export interface FindDocumentAuditLogsOptions {
   userId: number;
-  teamId?: number;
+  teamId: number;
   documentId: number;
   page?: number;
   perPage?: number;
@@ -34,25 +35,14 @@ export const findDocumentAuditLogs = async ({
   const orderByColumn = orderBy?.column ?? 'createdAt';
   const orderByDirection = orderBy?.direction ?? 'desc';
 
+  const { documentWhereInput } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
   const document = await prisma.document.findFirst({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
+    where: documentWhereInput,
   });
 
   if (!document) {

packages/lib/server-only/document/find-documents.ts

@@ -9,6 +9,7 @@ import { ExtendedDocumentStatus } from '@documenso/prisma/types/extended-documen
 import { DocumentVisibility } from '../../types/document-visibility';
 import { type FindResultResponse } from '../../types/search-params';
 import { maskRecipientTokensForDocument } from '../../utils/mask-recipient-tokens-for-document';
+import { getTeamById } from '../team/get-team';
 
 export type PeriodSelectorValue = '' | '7d' | '14d' | '30d';
 
@@ -27,6 +28,7 @@ export type FindDocumentsOptions = {
   period?: PeriodSelectorValue;
   senderIds?: number[];
   query?: string;
+  folderId?: string;
 };
 
 export const findDocuments = async ({
@@ -41,6 +43,7 @@ export const findDocuments = async ({
   period,
   senderIds,
   query = '',
+  folderId,
 }: FindDocumentsOptions) => {
   const user = await prisma.user.findFirstOrThrow({
     where: {
@@ -51,32 +54,15 @@ export const findDocuments = async ({
   let team = null;
 
   if (teamId !== undefined) {
-    team = await prisma.team.findFirstOrThrow({
-      where: {
-        id: teamId,
-        members: {
-          some: {
-            userId,
-          },
-        },
-      },
-      include: {
-        teamEmail: true,
-        members: {
-          where: {
-            userId,
-          },
-          select: {
-            role: true,
-          },
-        },
-      },
+    team = await getTeamById({
+      userId,
+      teamId,
     });
   }
 
   const orderByColumn = orderBy?.column ?? 'createdAt';
   const orderByDirection = orderBy?.direction ?? 'desc';
-  const teamMemberRole = team?.members[0].role ?? null;
+  const teamMemberRole = team?.currentTeamRole ?? null;
 
   const searchFilter: Prisma.DocumentWhereInput = {
     OR: [
@@ -120,10 +106,10 @@ export const findDocuments = async ({
     },
   ];
 
-  let filters: Prisma.DocumentWhereInput | null = findDocumentsFilter(status, user);
+  let filters: Prisma.DocumentWhereInput | null = findDocumentsFilter(status, user, folderId);
 
   if (team) {
-    filters = findTeamDocumentsFilter(status, team, visibilityFilters);
+    filters = findTeamDocumentsFilter(status, team, visibilityFilters, folderId);
   }
 
   if (filters === null) {
@@ -227,6 +213,12 @@ export const findDocuments = async ({
     };
   }
 
+  if (folderId !== undefined) {
+    whereClause.folderId = folderId;
+  } else {
+    whereClause.folderId = null;
+  }
+
   const [data, count] = await Promise.all([
     prisma.document.findMany({
       where: whereClause,
@@ -273,13 +265,17 @@ export const findDocuments = async ({
   } satisfies FindResultResponse<typeof data>;
 };
 
-const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
+const findDocumentsFilter = (
+  status: ExtendedDocumentStatus,
+  user: User,
+  folderId?: string | null,
+) => {
   return match<ExtendedDocumentStatus, Prisma.DocumentWhereInput>(status)
     .with(ExtendedDocumentStatus.ALL, () => ({
       OR: [
         {
           userId: user.id,
-          teamId: null,
+          folderId: folderId,
         },
         {
           status: ExtendedDocumentStatus.COMPLETED,
@@ -288,6 +284,7 @@ const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
               email: user.email,
             },
           },
+          folderId: folderId,
         },
         {
           status: ExtendedDocumentStatus.PENDING,
@@ -296,6 +293,7 @@ const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
               email: user.email,
             },
           },
+          folderId: folderId,
         },
       ],
     }))
@@ -315,15 +313,14 @@ const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
     }))
     .with(ExtendedDocumentStatus.DRAFT, () => ({
       userId: user.id,
-      teamId: null,
       status: ExtendedDocumentStatus.DRAFT,
     }))
     .with(ExtendedDocumentStatus.PENDING, () => ({
       OR: [
         {
           userId: user.id,
-          teamId: null,
           status: ExtendedDocumentStatus.PENDING,
+          folderId: folderId,
         },
         {
           status: ExtendedDocumentStatus.PENDING,
@@ -336,6 +333,7 @@ const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
               },
             },
           },
+          folderId: folderId,
         },
       ],
     }))
@@ -343,8 +341,8 @@ const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
       OR: [
         {
           userId: user.id,
-          teamId: null,
           status: ExtendedDocumentStatus.COMPLETED,
+          folderId: folderId,
         },
         {
           status: ExtendedDocumentStatus.COMPLETED,
@@ -353,6 +351,7 @@ const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
               email: user.email,
             },
           },
+          folderId: folderId,
         },
       ],
     }))
@@ -360,8 +359,8 @@ const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
       OR: [
         {
           userId: user.id,
-          teamId: null,
           status: ExtendedDocumentStatus.REJECTED,
+          folderId: folderId,
         },
         {
           status: ExtendedDocumentStatus.REJECTED,
@@ -371,6 +370,7 @@ const findDocumentsFilter = (status: ExtendedDocumentStatus, user: User) => {
               signingStatus: SigningStatus.REJECTED,
             },
           },
+          folderId: folderId,
         },
       ],
     }))
@@ -410,6 +410,7 @@ const findTeamDocumentsFilter = (
   status: ExtendedDocumentStatus,
   team: Team & { teamEmail: TeamEmail | null },
   visibilityFilters: Prisma.DocumentWhereInput[],
+  folderId?: string,
 ) => {
   const teamEmail = team.teamEmail?.email ?? null;
 
@@ -420,6 +421,7 @@ const findTeamDocumentsFilter = (
         OR: [
           {
             teamId: team.id,
+            folderId: folderId,
             OR: visibilityFilters,
           },
         ],
@@ -437,6 +439,7 @@ const findTeamDocumentsFilter = (
             },
           },
           OR: visibilityFilters,
+          folderId: folderId,
         });
 
         // Filter to display all documents that have been sent by the team email.
@@ -445,6 +448,7 @@ const findTeamDocumentsFilter = (
             email: teamEmail,
           },
           OR: visibilityFilters,
+          folderId: folderId,
         });
       }
 
@@ -470,6 +474,7 @@ const findTeamDocumentsFilter = (
           },
         },
         OR: visibilityFilters,
+        folderId: folderId,
       };
     })
     .with(ExtendedDocumentStatus.DRAFT, () => {
@@ -479,6 +484,7 @@ const findTeamDocumentsFilter = (
             teamId: team.id,
             status: ExtendedDocumentStatus.DRAFT,
             OR: visibilityFilters,
+            folderId: folderId,
           },
         ],
       };
@@ -490,6 +496,7 @@ const findTeamDocumentsFilter = (
             email: teamEmail,
           },
           OR: visibilityFilters,
+          folderId: folderId,
         });
       }
 
@@ -502,6 +509,7 @@ const findTeamDocumentsFilter = (
             teamId: team.id,
             status: ExtendedDocumentStatus.PENDING,
             OR: visibilityFilters,
+            folderId: folderId,
           },
         ],
       };
@@ -521,12 +529,14 @@ const findTeamDocumentsFilter = (
                 },
               },
               OR: visibilityFilters,
+              folderId: folderId,
             },
             {
               user: {
                 email: teamEmail,
               },
               OR: visibilityFilters,
+              folderId: folderId,
             },
           ],
         });

packages/lib/server-only/document/get-document-by-access-token.ts

@@ -0,0 +1,38 @@
+import { prisma } from '@documenso/prisma';
+
+export type GetDocumentByAccessTokenOptions = {
+  token: string;
+};
+
+export const getDocumentByAccessToken = async ({ token }: GetDocumentByAccessTokenOptions) => {
+  if (!token) {
+    throw new Error('Missing token');
+  }
+
+  const result = await prisma.document.findFirstOrThrow({
+    where: {
+      qrToken: token,
+    },
+    select: {
+      id: true,
+      title: true,
+      completedAt: true,
+      documentData: {
+        select: {
+          id: true,
+          type: true,
+          data: true,
+          initialData: true,
+        },
+      },
+      documentMeta: {
+        select: {
+          password: true,
+        },
+      },
+      recipients: true,
+    },
+  });
+
+  return result;
+};

packages/lib/server-only/document/get-document-by-id.ts

@@ -1,5 +1,5 @@
 import type { Prisma } from '@prisma/client';
-import { TeamMemberRole } from '@prisma/client';
+import { DocumentStatus, TeamMemberRole } from '@prisma/client';
 import { match } from 'ts-pattern';
 
 import { prisma } from '@documenso/prisma';
@@ -11,18 +11,27 @@ import { getTeamById } from '../team/get-team';
 export type GetDocumentByIdOptions = {
   documentId: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
+  folderId?: string;
 };
 
-export const getDocumentById = async ({ documentId, userId, teamId }: GetDocumentByIdOptions) => {
-  const documentWhereInput = await getDocumentWhereInput({
+export const getDocumentById = async ({
+  documentId,
+  userId,
+  teamId,
+  folderId,
+}: GetDocumentByIdOptions) => {
+  const { documentWhereInput } = await getDocumentWhereInput({
     documentId,
     userId,
     teamId,
   });
 
   const document = await prisma.document.findFirst({
-    where: documentWhereInput,
+    where: {
+      ...documentWhereInput,
+      folderId,
+    },
     include: {
       documentData: true,
       documentMeta: true,
@@ -59,18 +68,7 @@ export const getDocumentById = async ({ documentId, userId, teamId }: GetDocumen
 export type GetDocumentWhereInputOptions = {
   documentId: number;
   userId: number;
-  teamId?: number;
-
-  /**
-   * Whether to return a filter that allows access to both the user and team documents.
-   * This only applies if `teamId` is passed in.
-   *
-   * If true, and `teamId` is passed in, the filter will allow both team and user documents.
-   * If false, and `teamId` is passed in, the filter will only allow team documents.
-   *
-   * Defaults to false.
-   */
-  overlapUserTeamScope?: boolean;
+  teamId: number;
 };
 
 /**
@@ -82,42 +80,55 @@ export const getDocumentWhereInput = async ({
   documentId,
   userId,
   teamId,
-  overlapUserTeamScope = false,
 }: GetDocumentWhereInputOptions) => {
-  const documentWhereInput: Prisma.DocumentWhereUniqueInput = {
-    id: documentId,
-    OR: [
-      {
-        userId,
-      },
-    ],
-  };
-
-  if (teamId === undefined || !documentWhereInput.OR) {
-    return documentWhereInput;
-  }
-
   const team = await getTeamById({ teamId, userId });
 
-  // Allow access to team and user documents.
-  if (overlapUserTeamScope) {
-    documentWhereInput.OR.push({
-      teamId: team.id,
-    });
-  }
+  const user = await prisma.user.findFirstOrThrow({
+    where: {
+      id: userId,
+    },
+  });
 
-  // Allow access to only team documents.
-  if (!overlapUserTeamScope) {
-    documentWhereInput.OR = [
-      {
-        teamId: team.id,
+  const teamVisibilityFilters = match(team.currentTeamRole)
+    .with(TeamMemberRole.ADMIN, () => [
+      DocumentVisibility.EVERYONE,
+      DocumentVisibility.MANAGER_AND_ABOVE,
+      DocumentVisibility.ADMIN,
+    ])
+    .with(TeamMemberRole.MANAGER, () => [
+      DocumentVisibility.EVERYONE,
+      DocumentVisibility.MANAGER_AND_ABOVE,
+    ])
+    .otherwise(() => [DocumentVisibility.EVERYONE]);
+
+  const documentOrInput: Prisma.DocumentWhereInput[] = [
+    // Allow access if they own the document.
+    {
+      userId,
+    },
+    // Or, if they belong to the team that the document is associated with.
+    {
+      visibility: {
+        in: teamVisibilityFilters,
       },
-    ];
-  }
+      teamId: team.id,
+    },
+    // Or, if they are a recipient of the document.
+    {
+      status: {
+        not: DocumentStatus.DRAFT,
+      },
+      recipients: {
+        some: {
+          email: user.email,
+        },
+      },
+    },
+  ];
 
   // Allow access to documents sent to or from the team email.
   if (team.teamEmail) {
-    documentWhereInput.OR.push(
+    documentOrInput.push(
       {
         recipients: {
           some: {
@@ -133,42 +144,13 @@ export const getDocumentWhereInput = async ({
     );
   }
 
-  const user = await prisma.user.findFirstOrThrow({
-    where: {
-      id: userId,
-    },
-  });
-
-  const visibilityFilters = [
-    ...match(team.currentTeamMember?.role)
-      .with(TeamMemberRole.ADMIN, () => [
-        { visibility: DocumentVisibility.EVERYONE },
-        { visibility: DocumentVisibility.MANAGER_AND_ABOVE },
-        { visibility: DocumentVisibility.ADMIN },
-      ])
-      .with(TeamMemberRole.MANAGER, () => [
-        { visibility: DocumentVisibility.EVERYONE },
-        { visibility: DocumentVisibility.MANAGER_AND_ABOVE },
-      ])
-      .otherwise(() => [{ visibility: DocumentVisibility.EVERYONE }]),
-    {
-      OR: [
-        {
-          recipients: {
-            some: {
-              email: user.email,
-            },
-          },
-        },
-        {
-          userId: user.id,
-        },
-      ],
-    },
-  ];
+  const documentWhereInput: Prisma.DocumentWhereUniqueInput = {
+    id: documentId,
+    OR: documentOrInput,
+  };
 
   return {
-    ...documentWhereInput,
-    OR: [...visibilityFilters],
+    documentWhereInput,
+    team,
   };
 };

packages/lib/server-only/document/get-document-by-token.ts

@@ -85,11 +85,6 @@ export const getDocumentAndSenderByToken = async ({
         select: {
           name: true,
           teamEmail: true,
-          teamGlobalSettings: {
-            select: {
-              includeSenderDetails: true,
-            },
-          },
         },
       },
     },

packages/lib/server-only/document/get-document-certificate-audit-logs.ts

@@ -17,6 +17,7 @@ export const getDocumentCertificateAuditLogs = async ({
         in: [
           DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_RECIPIENT_COMPLETED,
           DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_RECIPIENT_REJECTED,
+          DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_FIELD_INSERTED,
           DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_OPENED,
           DOCUMENT_AUDIT_LOG_TYPE.EMAIL_SENT,
         ],
@@ -36,6 +37,9 @@ export const getDocumentCertificateAuditLogs = async ({
     [DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_OPENED]: auditLogs.filter(
       (log) => log.type === DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_OPENED,
     ),
+    [DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_FIELD_INSERTED]: auditLogs.filter(
+      (log) => log.type === DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_FIELD_INSERTED,
+    ),
     [DOCUMENT_AUDIT_LOG_TYPE.EMAIL_SENT]: auditLogs.filter(
       (log) =>
         log.type === DOCUMENT_AUDIT_LOG_TYPE.EMAIL_SENT &&

packages/lib/server-only/document/get-document-with-details-by-id.ts

@@ -6,27 +6,57 @@ import { getDocumentWhereInput } from './get-document-by-id';
 export type GetDocumentWithDetailsByIdOptions = {
   documentId: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
+  folderId?: string;
 };
 
 export const getDocumentWithDetailsById = async ({
   documentId,
   userId,
   teamId,
+  folderId,
 }: GetDocumentWithDetailsByIdOptions) => {
-  const documentWhereInput = await getDocumentWhereInput({
+  const { documentWhereInput } = await getDocumentWhereInput({
     documentId,
     userId,
     teamId,
   });
 
   const document = await prisma.document.findFirst({
-    where: documentWhereInput,
+    where: {
+      ...documentWhereInput,
+      folderId,
+    },
     include: {
       documentData: true,
       documentMeta: true,
       recipients: true,
-      fields: true,
+      folder: true,
+      fields: {
+        include: {
+          signature: true,
+          recipient: {
+            select: {
+              name: true,
+              email: true,
+              signingStatus: true,
+            },
+          },
+        },
+      },
+      team: {
+        select: {
+          id: true,
+          url: true,
+        },
+      },
+      user: {
+        select: {
+          id: true,
+          name: true,
+          email: true,
+        },
+      },
     },
   });
 

packages/lib/server-only/document/get-stats.ts

@@ -11,13 +11,20 @@ import { isExtendedDocumentStatus } from '@documenso/prisma/guards/is-extended-d
 import { ExtendedDocumentStatus } from '@documenso/prisma/types/extended-document-status';
 
 export type GetStatsInput = {
-  user: User;
+  user: Pick<User, 'id' | 'email'>;
   team?: Omit<GetTeamCountsOption, 'createdAt'>;
   period?: PeriodSelectorValue;
   search?: string;
+  folderId?: string;
 };
 
-export const getStats = async ({ user, period, search = '', ...options }: GetStatsInput) => {
+export const getStats = async ({
+  user,
+  period,
+  search = '',
+  folderId,
+  ...options
+}: GetStatsInput) => {
   let createdAt: Prisma.DocumentWhereInput['createdAt'];
 
   if (period) {
@@ -37,8 +44,9 @@ export const getStats = async ({ user, period, search = '', ...options }: GetSta
         currentUserEmail: user.email,
         userId: user.id,
         search,
+        folderId,
       })
-    : getCounts({ user, createdAt, search }));
+    : getCounts({ user, createdAt, search, folderId }));
 
   const stats: Record<ExtendedDocumentStatus, number> = {
     [ExtendedDocumentStatus.DRAFT]: 0,
@@ -81,12 +89,13 @@ export const getStats = async ({ user, period, search = '', ...options }: GetSta
 };
 
 type GetCountsOption = {
-  user: User;
+  user: Pick<User, 'id' | 'email'>;
   createdAt: Prisma.DocumentWhereInput['createdAt'];
   search?: string;
+  folderId?: string | null;
 };
 
-const getCounts = async ({ user, createdAt, search }: GetCountsOption) => {
+const getCounts = async ({ user, createdAt, search, folderId }: GetCountsOption) => {
   const searchFilter: Prisma.DocumentWhereInput = {
     OR: [
       { title: { contains: search, mode: 'insensitive' } },
@@ -95,6 +104,8 @@ const getCounts = async ({ user, createdAt, search }: GetCountsOption) => {
     ],
   };
 
+  const rootPageFilter = folderId === undefined ? { folderId: null } : {};
+
   return Promise.all([
     // Owner counts.
     prisma.document.groupBy({
@@ -105,9 +116,8 @@ const getCounts = async ({ user, createdAt, search }: GetCountsOption) => {
       where: {
         userId: user.id,
         createdAt,
-        teamId: null,
         deletedAt: null,
-        AND: [searchFilter],
+        AND: [searchFilter, rootPageFilter, folderId ? { folderId } : {}],
       },
     }),
     // Not signed counts.
@@ -126,7 +136,7 @@ const getCounts = async ({ user, createdAt, search }: GetCountsOption) => {
           },
         },
         createdAt,
-        AND: [searchFilter],
+        AND: [searchFilter, rootPageFilter, folderId ? { folderId } : {}],
       },
     }),
     // Has signed counts.
@@ -164,7 +174,7 @@ const getCounts = async ({ user, createdAt, search }: GetCountsOption) => {
             },
           },
         ],
-        AND: [searchFilter],
+        AND: [searchFilter, rootPageFilter, folderId ? { folderId } : {}],
       },
     }),
   ]);
@@ -179,10 +189,11 @@ type GetTeamCountsOption = {
   createdAt: Prisma.DocumentWhereInput['createdAt'];
   currentTeamMemberRole?: TeamMemberRole;
   search?: string;
+  folderId?: string | null;
 };
 
 const getTeamCounts = async (options: GetTeamCountsOption) => {
-  const { createdAt, teamId, teamEmail } = options;
+  const { createdAt, teamId, teamEmail, folderId } = options;
 
   const senderIds = options.senderIds ?? [];
 
@@ -206,6 +217,7 @@ const getTeamCounts = async (options: GetTeamCountsOption) => {
     createdAt,
     teamId,
     deletedAt: null,
+    folderId,
   };
 
   let notSignedCountsGroupByArgs = null;
@@ -278,6 +290,7 @@ const getTeamCounts = async (options: GetTeamCountsOption) => {
       where: {
         userId: userIdWhereClause,
         createdAt,
+        folderId,
         status: ExtendedDocumentStatus.PENDING,
         recipients: {
           some: {
@@ -298,6 +311,7 @@ const getTeamCounts = async (options: GetTeamCountsOption) => {
       where: {
         userId: userIdWhereClause,
         createdAt,
+        folderId,
         OR: [
           {
             status: ExtendedDocumentStatus.PENDING,
@@ -319,7 +333,6 @@ const getTeamCounts = async (options: GetTeamCountsOption) => {
                 documentDeletedAt: null,
               },
             },
-            deletedAt: null,
           },
         ],
       },

packages/lib/server-only/document/is-recipient-authorized.ts

@@ -5,6 +5,7 @@ import { match } from 'ts-pattern';
 import { prisma } from '@documenso/prisma';
 
 import { verifyTwoFactorAuthenticationToken } from '../2fa/verify-2fa-token';
+import { verifyPassword } from '../2fa/verify-password';
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import type { TDocumentAuth, TDocumentAuthMethods } from '../../types/document-auth';
 import { DocumentAuth } from '../../types/document-auth';
@@ -60,23 +61,26 @@ export const isRecipientAuthorized = async ({
     recipientAuth: recipient.authOptions,
   });
 
-  const authMethod: TDocumentAuth | null =
+  const authMethods: TDocumentAuth[] =
     type === 'ACCESS' ? derivedRecipientAccessAuth : derivedRecipientActionAuth;
 
   // Early true return when auth is not required.
-  if (!authMethod || authMethod === DocumentAuth.EXPLICIT_NONE) {
+  if (
+    authMethods.length === 0 ||
+    authMethods.some((method) => method === DocumentAuth.EXPLICIT_NONE)
+  ) {
     return true;
   }
 
   // Create auth options when none are passed for account.
-  if (!authOptions && authMethod === DocumentAuth.ACCOUNT) {
+  if (!authOptions && authMethods.some((method) => method === DocumentAuth.ACCOUNT)) {
     authOptions = {
       type: DocumentAuth.ACCOUNT,
     };
   }
 
   // Authentication required does not match provided method.
-  if (!authOptions || authOptions.type !== authMethod || !userId) {
+  if (!authOptions || !authMethods.includes(authOptions.type) || !userId) {
     return false;
   }
 
@@ -117,6 +121,15 @@ export const isRecipientAuthorized = async ({
         window: 10, // 5 minutes worth of tokens
       });
     })
+    .with({ type: DocumentAuth.PASSWORD }, async ({ password }) => {
+      return await verifyPassword({
+        userId,
+        password,
+      });
+    })
+    .with({ type: DocumentAuth.EXPLICIT_NONE }, () => {
+      return true;
+    })
     .exhaustive();
 };
 
@@ -160,7 +173,7 @@ const verifyPasskey = async ({
 }: VerifyPasskeyOptions): Promise<void> => {
   const passkey = await prisma.passkey.findFirst({
     where: {
-      credentialId: Buffer.from(authenticationResponse.id, 'base64'),
+      credentialId: new Uint8Array(Buffer.from(authenticationResponse.id, 'base64')),
       userId,
     },
   });

packages/lib/server-only/document/move-document-to-team.ts

@@ -1,73 +0,0 @@
-import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
-import { prisma } from '@documenso/prisma';
-
-import { AppError, AppErrorCode } from '../../errors/app-error';
-import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
-import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
-
-export type MoveDocumentToTeamOptions = {
-  documentId: number;
-  teamId: number;
-  userId: number;
-  requestMetadata: ApiRequestMetadata;
-};
-
-export const moveDocumentToTeam = async ({
-  documentId,
-  teamId,
-  userId,
-  requestMetadata,
-}: MoveDocumentToTeamOptions) => {
-  return await prisma.$transaction(async (tx) => {
-    const document = await tx.document.findFirst({
-      where: {
-        id: documentId,
-        userId,
-        teamId: null,
-      },
-    });
-
-    if (!document) {
-      throw new AppError(AppErrorCode.NOT_FOUND, {
-        message: 'Document not found or already associated with a team.',
-      });
-    }
-
-    const team = await tx.team.findFirst({
-      where: {
-        id: teamId,
-        members: {
-          some: {
-            userId,
-          },
-        },
-      },
-    });
-
-    if (!team) {
-      throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'This team does not exist, or you are not a member of this team.',
-      });
-    }
-
-    const updatedDocument = await tx.document.update({
-      where: { id: documentId },
-      data: { teamId },
-    });
-
-    await tx.documentAuditLog.create({
-      data: createDocumentAuditLogData({
-        type: DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_MOVED_TO_TEAM,
-        documentId: updatedDocument.id,
-        metadata: requestMetadata,
-        data: {
-          movedByUserId: userId,
-          fromPersonalAccount: true,
-          toTeamId: teamId,
-        },
-      }),
-    });
-
-    return updatedDocument;
-  });
-};

packages/lib/server-only/document/resend-document.ts

@@ -1,12 +1,10 @@
 import { createElement } from 'react';
 
 import { msg } from '@lingui/core/macro';
-import { DocumentStatus, RecipientRole, SigningStatus } from '@prisma/client';
-import type { Prisma } from '@prisma/client';
+import { DocumentStatus, OrganisationType, RecipientRole, SigningStatus } from '@prisma/client';
 
 import { mailer } from '@documenso/email/mailer';
 import { DocumentInviteEmailTemplate } from '@documenso/email/templates/document-invite';
-import { FROM_ADDRESS, FROM_NAME } from '@documenso/lib/constants/email';
 import {
   RECIPIENT_ROLES_DESCRIPTION,
   RECIPIENT_ROLE_TO_EMAIL_TYPE,
@@ -22,14 +20,14 @@ import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
 import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import { isDocumentCompleted } from '../../utils/document';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
+import { getEmailContext } from '../email/get-email-context';
 import { getDocumentWhereInput } from './get-document-by-id';
 
 export type ResendDocumentOptions = {
   documentId: number;
   userId: number;
   recipients: number[];
-  teamId?: number;
+  teamId: number;
   requestMetadata: ApiRequestMetadata;
 };
 
@@ -46,7 +44,7 @@ export const resendDocument = async ({
     },
   });
 
-  const documentWhereInput: Prisma.DocumentWhereUniqueInput = await getDocumentWhereInput({
+  const { documentWhereInput } = await getDocumentWhereInput({
     documentId,
     userId,
     teamId,
@@ -55,27 +53,18 @@ export const resendDocument = async ({
   const document = await prisma.document.findUnique({
     where: documentWhereInput,
     include: {
-      recipients: {
-        where: {
-          id: {
-            in: recipients,
-          },
-          signingStatus: SigningStatus.NOT_SIGNED,
-        },
-      },
+      recipients: true,
       documentMeta: true,
       team: {
         select: {
           teamEmail: true,
           name: true,
-          teamGlobalSettings: true,
         },
       },
     },
   });
 
   const customEmail = document?.documentMeta;
-  const isTeamDocument = document?.team !== null;
 
   if (!document) {
     throw new Error('Document not found');
@@ -93,6 +82,11 @@ export const resendDocument = async ({
     throw new Error('Can not send completed document');
   }
 
+  const recipientsToRemind = document.recipients.filter(
+    (recipient) =>
+      recipients.includes(recipient.id) && recipient.signingStatus === SigningStatus.NOT_SIGNED,
+  );
+
   const isRecipientSigningRequestEmailEnabled = extractDerivedDocumentEmailSettings(
     document.documentMeta,
   ).recipientSigningRequest;
@@ -101,13 +95,23 @@ export const resendDocument = async ({
     return;
   }
 
+  const { branding, emailLanguage, organisationType, senderEmail, replyToEmail } =
+    await getEmailContext({
+      emailType: 'RECIPIENT',
+      source: {
+        type: 'team',
+        teamId: document.teamId,
+      },
+      meta: document.documentMeta,
+    });
+
   await Promise.all(
-    document.recipients.map(async (recipient) => {
+    recipientsToRemind.map(async (recipient) => {
       if (recipient.role === RecipientRole.CC) {
         return;
       }
 
-      const i18n = await getI18nInstance(document.documentMeta?.language);
+      const i18n = await getI18nInstance(emailLanguage);
 
       const recipientEmailType = RECIPIENT_ROLE_TO_EMAIL_TYPE[recipient.role];
 
@@ -128,7 +132,7 @@ export const resendDocument = async ({
         emailSubject = i18n._(msg`Reminder: Please ${recipientActionVerb} your document`);
       }
 
-      if (isTeamDocument && document.team) {
+      if (organisationType === OrganisationType.ORGANISATION) {
         emailSubject = i18n._(
           msg`Reminder: ${document.team.name} invited you to ${recipientActionVerb} a document`,
         );
@@ -151,27 +155,26 @@ export const resendDocument = async ({
       const template = createElement(DocumentInviteEmailTemplate, {
         documentName: document.title,
         inviterName: user.name || undefined,
-        inviterEmail: isTeamDocument ? document.team?.teamEmail?.email || user.email : user.email,
+        inviterEmail:
+          organisationType === OrganisationType.ORGANISATION
+            ? document.team?.teamEmail?.email || user.email
+            : user.email,
         assetBaseUrl,
         signDocumentLink,
         customBody: renderCustomEmailTemplate(emailMessage, customEmailTemplate),
         role: recipient.role,
         selfSigner,
-        isTeamInvite: isTeamDocument,
+        organisationType,
         teamName: document.team?.name,
       });
 
-      const branding = document.team?.teamGlobalSettings
-        ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-        : undefined;
-
       const [html, text] = await Promise.all([
         renderEmailWithI18N(template, {
-          lang: document.documentMeta?.language,
+          lang: emailLanguage,
           branding,
         }),
         renderEmailWithI18N(template, {
-          lang: document.documentMeta?.language,
+          lang: emailLanguage,
           branding,
           plainText: true,
         }),
@@ -184,10 +187,8 @@ export const resendDocument = async ({
               address: email,
               name,
             },
-            from: {
-              name: FROM_NAME,
-              address: FROM_ADDRESS,
-            },
+            from: senderEmail,
+            replyTo: replyToEmail,
             subject: customEmail?.subject
               ? renderCustomEmailTemplate(
                   i18n._(msg`Reminder: ${customEmail.subject}`),

packages/lib/server-only/document/seal-document.ts

@@ -17,12 +17,15 @@ import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { getFileServerSide } from '../../universal/upload/get-file.server';
 import { putPdfFileServerSide } from '../../universal/upload/put-file.server';
 import { fieldsContainUnsignedRequiredField } from '../../utils/advanced-fields-helpers';
+import { getAuditLogsPdf } from '../htmltopdf/get-audit-logs-pdf';
 import { getCertificatePdf } from '../htmltopdf/get-certificate-pdf';
 import { addRejectionStampToPdf } from '../pdf/add-rejection-stamp-to-pdf';
 import { flattenAnnotations } from '../pdf/flatten-annotations';
 import { flattenForm } from '../pdf/flatten-form';
 import { insertFieldInPDF } from '../pdf/insert-field-in-pdf';
+import { legacy_insertFieldInPDF } from '../pdf/legacy-insert-field-in-pdf';
 import { normalizeSignatureAppearances } from '../pdf/normalize-signature-appearances';
+import { getTeamSettings } from '../team/get-team-settings';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 import { sendCompletedEmail } from './send-completed-email';
 
@@ -47,15 +50,6 @@ export const sealDocument = async ({
       documentData: true,
       documentMeta: true,
       recipients: true,
-      team: {
-        select: {
-          teamGlobalSettings: {
-            select: {
-              includeSigningCertificate: true,
-            },
-          },
-        },
-      },
     },
   });
 
@@ -65,6 +59,11 @@ export const sealDocument = async ({
     throw new Error(`Document ${document.id} has no document data`);
   }
 
+  const settings = await getTeamSettings({
+    userId: document.userId,
+    teamId: document.teamId,
+  });
+
   const recipients = await prisma.recipient.findMany({
     where: {
       documentId: document.id,
@@ -115,19 +114,35 @@ export const sealDocument = async ({
   // !: Need to write the fields onto the document as a hard copy
   const pdfData = await getFileServerSide(documentData);
 
-  const certificateData =
-    (document.team?.teamGlobalSettings?.includeSigningCertificate ?? true)
-      ? await getCertificatePdf({
-          documentId,
-          language: document.documentMeta?.language,
-        }).catch(() => null)
-      : null;
+  const certificateData = settings.includeSigningCertificate
+    ? await getCertificatePdf({
+        documentId,
+        language: document.documentMeta?.language,
+      }).catch((e) => {
+        console.log('Failed to get certificate PDF');
+        console.error(e);
+
+        return null;
+      })
+    : null;
+
+  const auditLogData = settings.includeAuditLog
+    ? await getAuditLogsPdf({
+        documentId,
+        language: document.documentMeta?.language,
+      }).catch((e) => {
+        console.log('Failed to get audit logs PDF');
+        console.error(e);
+
+        return null;
+      })
+    : null;
 
   const doc = await PDFDocument.load(pdfData);
 
   // Normalize and flatten layers that could cause issues with the signature
   normalizeSignatureAppearances(doc);
-  flattenForm(doc);
+  await flattenForm(doc);
   flattenAnnotations(doc);
 
   // Add rejection stamp if the document is rejected
@@ -145,12 +160,24 @@ export const sealDocument = async ({
     });
   }
 
+  if (auditLogData) {
+    const auditLog = await PDFDocument.load(auditLogData);
+
+    const auditLogPages = await doc.copyPages(auditLog, auditLog.getPageIndices());
+
+    auditLogPages.forEach((page) => {
+      doc.addPage(page);
+    });
+  }
+
   for (const field of fields) {
-    await insertFieldInPDF(doc, field);
+    document.useLegacyFieldInsertion
+      ? await legacy_insertFieldInPDF(doc, field)
+      : await insertFieldInPDF(doc, field);
   }
 
   // Re-flatten post-insertion to handle fields that create arcoFields
-  flattenForm(doc);
+  await flattenForm(doc);
 
   const pdfBytes = await doc.save();
 

packages/lib/server-only/document/search-documents-with-keyword.ts

@@ -3,7 +3,11 @@ import type { Document, Recipient, User } from '@prisma/client';
 import { DocumentVisibility, TeamMemberRole } from '@prisma/client';
 import { match } from 'ts-pattern';
 
-import { formatDocumentsPath } from '@documenso/lib/utils/teams';
+import {
+  buildTeamWhereQuery,
+  formatDocumentsPath,
+  getHighestTeamRoleInGroup,
+} from '@documenso/lib/utils/teams';
 import { prisma } from '@documenso/prisma';
 
 export type SearchDocumentsWithKeywordOptions = {
@@ -84,16 +88,7 @@ export const searchDocumentsWithKeyword = async ({
             contains: query,
             mode: 'insensitive',
           },
-          teamId: {
-            not: null,
-          },
-          team: {
-            members: {
-              some: {
-                userId: userId,
-              },
-            },
-          },
+          team: buildTeamWhereQuery({ teamId: undefined, userId }),
           deletedAt: null,
         },
         {
@@ -101,16 +96,7 @@ export const searchDocumentsWithKeyword = async ({
             contains: query,
             mode: 'insensitive',
           },
-          teamId: {
-            not: null,
-          },
-          team: {
-            members: {
-              some: {
-                userId: userId,
-              },
-            },
-          },
+          team: buildTeamWhereQuery({ teamId: undefined, userId }),
           deletedAt: null,
         },
       ],
@@ -120,12 +106,17 @@ export const searchDocumentsWithKeyword = async ({
       team: {
         select: {
           url: true,
-          members: {
+          teamGroups: {
             where: {
-              userId: userId,
-            },
-            select: {
-              role: true,
+              organisationGroup: {
+                organisationGroupMembers: {
+                  some: {
+                    organisationMember: {
+                      userId,
+                    },
+                  },
+                },
+              },
             },
           },
         },
@@ -147,7 +138,9 @@ export const searchDocumentsWithKeyword = async ({
         return true;
       }
 
-      const teamMemberRole = document.team?.members[0]?.role;
+      const teamMemberRole = getHighestTeamRoleInGroup(
+        document.team.teamGroups.filter((tg) => tg.teamId === document.teamId),
+      );
 
       if (!teamMemberRole) {
         return false;

packages/lib/server-only/document/send-completed-email.ts

@@ -14,11 +14,10 @@ import { extractDerivedDocumentEmailSettings } from '../../types/document-email'
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { getFileServerSide } from '../../universal/upload/get-file.server';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
-import { env } from '../../utils/env';
 import { renderCustomEmailTemplate } from '../../utils/render-custom-email-template';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
 import { formatDocumentsPath } from '../../utils/teams';
+import { getEmailContext } from '../email/get-email-context';
 
 export interface SendDocumentOptions {
   documentId: number;
@@ -39,7 +38,6 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
         select: {
           id: true,
           url: true,
-          teamGlobalSettings: true,
         },
       },
     },
@@ -55,6 +53,15 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
     throw new Error('Document has no recipients');
   }
 
+  const { branding, emailLanguage, senderEmail, replyToEmail } = await getEmailContext({
+    emailType: 'RECIPIENT',
+    source: {
+      type: 'team',
+      teamId: document.teamId,
+    },
+    meta: document.documentMeta,
+  });
+
   const { user: owner } = document;
 
   const completedDocument = await getFileServerSide(document.documentData);
@@ -71,8 +78,6 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
     }`;
   }
 
-  const i18n = await getI18nInstance(document.documentMeta?.language);
-
   const emailSettings = extractDerivedDocumentEmailSettings(document.documentMeta);
   const isDocumentCompletedEmailEnabled = emailSettings.documentCompleted;
   const isOwnerDocumentCompletedEmailEnabled = emailSettings.ownerDocumentCompleted;
@@ -93,19 +98,17 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
       downloadLink: documentOwnerDownloadLink,
     });
 
-    const branding = document.team?.teamGlobalSettings
-      ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-      : undefined;
-
     const [html, text] = await Promise.all([
-      renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+      renderEmailWithI18N(template, { lang: emailLanguage, branding }),
       renderEmailWithI18N(template, {
-        lang: document.documentMeta?.language,
+        lang: emailLanguage,
         branding,
         plainText: true,
       }),
     ]);
 
+    const i18n = await getI18nInstance(emailLanguage);
+
     await mailer.sendMail({
       to: [
         {
@@ -113,10 +116,8 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
           address: owner.email,
         },
       ],
-      from: {
-        name: env('NEXT_PRIVATE_SMTP_FROM_NAME') || 'Documenso',
-        address: env('NEXT_PRIVATE_SMTP_FROM_ADDRESS') || 'noreply@documenso.com',
-      },
+      from: senderEmail,
+      replyTo: replyToEmail,
       subject: i18n._(msg`Signing Complete!`),
       html,
       text,
@@ -170,19 +171,17 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
             : undefined,
       });
 
-      const branding = document.team?.teamGlobalSettings
-        ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-        : undefined;
-
       const [html, text] = await Promise.all([
-        renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+        renderEmailWithI18N(template, { lang: emailLanguage, branding }),
         renderEmailWithI18N(template, {
-          lang: document.documentMeta?.language,
+          lang: emailLanguage,
           branding,
           plainText: true,
         }),
       ]);
 
+      const i18n = await getI18nInstance(emailLanguage);
+
       await mailer.sendMail({
         to: [
           {
@@ -190,10 +189,8 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
             address: recipient.email,
           },
         ],
-        from: {
-          name: env('NEXT_PRIVATE_SMTP_FROM_NAME') || 'Documenso',
-          address: env('NEXT_PRIVATE_SMTP_FROM_ADDRESS') || 'noreply@documenso.com',
-        },
+        from: senderEmail,
+        replyTo: replyToEmail,
         subject:
           isDirectTemplate && document.documentMeta?.subject
             ? renderCustomEmailTemplate(document.documentMeta.subject, customEmailTemplate)

packages/lib/server-only/document/send-delete-email.ts

@@ -10,9 +10,8 @@ import { getI18nInstance } from '../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
-import { env } from '../../utils/env';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
+import { getEmailContext } from '../email/get-email-context';
 
 export interface SendDeleteEmailOptions {
   documentId: number;
@@ -27,11 +26,6 @@ export const sendDeleteEmail = async ({ documentId, reason }: SendDeleteEmailOpt
     include: {
       user: true,
       documentMeta: true,
-      team: {
-        include: {
-          teamGlobalSettings: true,
-        },
-      },
     },
   });
 
@@ -49,6 +43,15 @@ export const sendDeleteEmail = async ({ documentId, reason }: SendDeleteEmailOpt
     return;
   }
 
+  const { branding, emailLanguage, senderEmail } = await getEmailContext({
+    emailType: 'INTERNAL',
+    source: {
+      type: 'team',
+      teamId: document.teamId,
+    },
+    meta: document.documentMeta,
+  });
+
   const { email, name } = document.user;
 
   const assetBaseUrl = NEXT_PUBLIC_WEBAPP_URL() || 'http://localhost:3000';
@@ -59,30 +62,23 @@ export const sendDeleteEmail = async ({ documentId, reason }: SendDeleteEmailOpt
     assetBaseUrl,
   });
 
-  const branding = document.team?.teamGlobalSettings
-    ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-    : undefined;
-
   const [html, text] = await Promise.all([
-    renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+    renderEmailWithI18N(template, { lang: emailLanguage, branding }),
     renderEmailWithI18N(template, {
-      lang: document.documentMeta?.language,
+      lang: emailLanguage,
       branding,
       plainText: true,
     }),
   ]);
 
-  const i18n = await getI18nInstance();
+  const i18n = await getI18nInstance(emailLanguage);
 
   await mailer.sendMail({
     to: {
       address: email,
       name: name || '',
     },
-    from: {
-      name: env('NEXT_PRIVATE_SMTP_FROM_NAME') || 'Documenso',
-      address: env('NEXT_PRIVATE_SMTP_FROM_ADDRESS') || 'noreply@documenso.com',
-    },
+    from: senderEmail,
     subject: i18n._(msg`Document Deleted!`),
     html,
     text,

packages/lib/server-only/document/send-document.tsx

@@ -23,11 +23,12 @@ import { putPdfFileServerSide } from '../../universal/upload/put-file.server';
 import { isDocumentCompleted } from '../../utils/document';
 import { insertFormValuesInPdf } from '../pdf/insert-form-values-in-pdf';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
+import { getDocumentWhereInput } from './get-document-by-id';
 
 export type SendDocumentOptions = {
   documentId: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
   sendEmail?: boolean;
   requestMetadata: ApiRequestMetadata;
 };
@@ -39,25 +40,14 @@ export const sendDocument = async ({
   sendEmail,
   requestMetadata,
 }: SendDocumentOptions) => {
-  const document = await prisma.document.findUnique({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
+  const { documentWhereInput } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
+  const document = await prisma.document.findFirst({
+    where: documentWhereInput,
     include: {
       recipients: {
         orderBy: [{ signingOrder: { sort: 'asc', nulls: 'last' } }, { id: 'asc' }],

packages/lib/server-only/document/send-pending-email.ts

@@ -9,9 +9,8 @@ import { prisma } from '@documenso/prisma';
 import { getI18nInstance } from '../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
 import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
-import { env } from '../../utils/env';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
+import { getEmailContext } from '../email/get-email-context';
 
 export interface SendPendingEmailOptions {
   documentId: number;
@@ -35,11 +34,6 @@ export const sendPendingEmail = async ({ documentId, recipientId }: SendPendingE
         },
       },
       documentMeta: true,
-      team: {
-        include: {
-          teamGlobalSettings: true,
-        },
-      },
     },
   });
 
@@ -51,6 +45,15 @@ export const sendPendingEmail = async ({ documentId, recipientId }: SendPendingE
     throw new Error('Document has no recipients');
   }
 
+  const { branding, emailLanguage, senderEmail, replyToEmail } = await getEmailContext({
+    emailType: 'RECIPIENT',
+    source: {
+      type: 'team',
+      teamId: document.teamId,
+    },
+    meta: document.documentMeta,
+  });
+
   const isDocumentPendingEmailEnabled = extractDerivedDocumentEmailSettings(
     document.documentMeta,
   ).documentPending;
@@ -70,30 +73,24 @@ export const sendPendingEmail = async ({ documentId, recipientId }: SendPendingE
     assetBaseUrl,
   });
 
-  const branding = document.team?.teamGlobalSettings
-    ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-    : undefined;
-
   const [html, text] = await Promise.all([
-    renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+    renderEmailWithI18N(template, { lang: emailLanguage, branding }),
     renderEmailWithI18N(template, {
-      lang: document.documentMeta?.language,
+      lang: emailLanguage,
       branding,
       plainText: true,
     }),
   ]);
 
-  const i18n = await getI18nInstance(document.documentMeta?.language);
+  const i18n = await getI18nInstance(emailLanguage);
 
   await mailer.sendMail({
     to: {
       address: email,
       name,
     },
-    from: {
-      name: env('NEXT_PRIVATE_SMTP_FROM_NAME') || 'Documenso',
-      address: env('NEXT_PRIVATE_SMTP_FROM_ADDRESS') || 'noreply@documenso.com',
-    },
+    from: senderEmail,
+    replyTo: replyToEmail,
     subject: i18n._(msg`Waiting for others to complete signing.`),
     html,
     text,

packages/lib/server-only/document/super-delete-document.ts

@@ -9,14 +9,13 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../client-only/providers/i18n-server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
-import { FROM_ADDRESS, FROM_NAME } from '../../constants/email';
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
 import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
-import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
+import { getEmailContext } from '../email/get-email-context';
 
 export type SuperDeleteDocumentOptions = {
   id: number;
@@ -32,11 +31,6 @@ export const superDeleteDocument = async ({ id, requestMetadata }: SuperDeleteDo
       recipients: true,
       documentMeta: true,
       user: true,
-      team: {
-        include: {
-          teamGlobalSettings: true,
-        },
-      },
     },
   });
 
@@ -46,6 +40,15 @@ export const superDeleteDocument = async ({ id, requestMetadata }: SuperDeleteDo
     });
   }
 
+  const { branding, settings, senderEmail, replyToEmail } = await getEmailContext({
+    emailType: 'RECIPIENT',
+    source: {
+      type: 'team',
+      teamId: document.teamId,
+    },
+    meta: document.documentMeta,
+  });
+
   const { status, user } = document;
 
   const isDocumentDeletedEmailEnabled = extractDerivedDocumentEmailSettings(
@@ -72,30 +75,26 @@ export const superDeleteDocument = async ({ id, requestMetadata }: SuperDeleteDo
           assetBaseUrl,
         });
 
-        const branding = document.team?.teamGlobalSettings
-          ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
-          : undefined;
+        const lang = document.documentMeta?.language ?? settings.documentLanguage;
 
         const [html, text] = await Promise.all([
-          renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+          renderEmailWithI18N(template, { lang, branding }),
           renderEmailWithI18N(template, {
-            lang: document.documentMeta?.language,
+            lang,
             branding,
             plainText: true,
           }),
         ]);
 
-        const i18n = await getI18nInstance(document.documentMeta?.language);
+        const i18n = await getI18nInstance(lang);
 
         await mailer.sendMail({
           to: {
             address: recipient.email,
             name: recipient.name,
           },
-          from: {
-            name: FROM_NAME,
-            address: FROM_ADDRESS,
-          },
+          from: senderEmail,
+          replyTo: replyToEmail,
           subject: i18n._(msg`Document Cancelled`),
           html,
           text,

packages/lib/server-only/document/update-document.ts

@@ -1,8 +1,8 @@
 import { DocumentVisibility } from '@prisma/client';
 import { DocumentStatus, TeamMemberRole } from '@prisma/client';
+import { isDeepEqual } from 'remeda';
 import { match } from 'ts-pattern';
 
-import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import type { CreateDocumentAuditLogDataResponse } from '@documenso/lib/utils/document-audit-logs';
@@ -12,17 +12,19 @@ import { prisma } from '@documenso/prisma';
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import type { TDocumentAccessAuthTypes, TDocumentActionAuthTypes } from '../../types/document-auth';
 import { createDocumentAuthOptions, extractDocumentAuthMethods } from '../../utils/document-auth';
+import { getDocumentWhereInput } from './get-document-by-id';
 
 export type UpdateDocumentOptions = {
   userId: number;
-  teamId?: number;
+  teamId: number;
   documentId: number;
   data?: {
     title?: string;
     externalId?: string | null;
     visibility?: DocumentVisibility | null;
-    globalAccessAuth?: TDocumentAccessAuthTypes | null;
-    globalActionAuth?: TDocumentActionAuthTypes | null;
+    globalAccessAuth?: TDocumentAccessAuthTypes[];
+    globalActionAuth?: TDocumentActionAuthTypes[];
+    useLegacyFieldInsertion?: boolean;
   };
   requestMetadata: ApiRequestMetadata;
 };
@@ -34,34 +36,20 @@ export const updateDocument = async ({
   data,
   requestMetadata,
 }: UpdateDocumentOptions) => {
+  const { documentWhereInput, team } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
   const document = await prisma.document.findFirst({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
+    where: documentWhereInput,
     include: {
       team: {
         select: {
-          members: {
-            where: {
-              userId,
-            },
+          organisation: {
             select: {
-              role: true,
+              organisationClaim: true,
             },
           },
         },
@@ -75,45 +63,42 @@ export const updateDocument = async ({
     });
   }
 
-  if (teamId) {
-    const currentUserRole = document.team?.members[0]?.role;
-    const isDocumentOwner = document.userId === userId;
-    const requestedVisibility = data?.visibility;
+  const isDocumentOwner = document.userId === userId;
+  const requestedVisibility = data?.visibility;
 
-    if (!isDocumentOwner) {
-      match(currentUserRole)
-        .with(TeamMemberRole.ADMIN, () => true)
-        .with(TeamMemberRole.MANAGER, () => {
-          const allowedVisibilities: DocumentVisibility[] = [
-            DocumentVisibility.EVERYONE,
-            DocumentVisibility.MANAGER_AND_ABOVE,
-          ];
+  if (!isDocumentOwner) {
+    match(team.currentTeamRole)
+      .with(TeamMemberRole.ADMIN, () => true)
+      .with(TeamMemberRole.MANAGER, () => {
+        const allowedVisibilities: DocumentVisibility[] = [
+          DocumentVisibility.EVERYONE,
+          DocumentVisibility.MANAGER_AND_ABOVE,
+        ];
 
-          if (
-            !allowedVisibilities.includes(document.visibility) ||
-            (requestedVisibility && !allowedVisibilities.includes(requestedVisibility))
-          ) {
-            throw new AppError(AppErrorCode.UNAUTHORIZED, {
-              message: 'You do not have permission to update the document visibility',
-            });
-          }
-        })
-        .with(TeamMemberRole.MEMBER, () => {
-          if (
-            document.visibility !== DocumentVisibility.EVERYONE ||
-            (requestedVisibility && requestedVisibility !== DocumentVisibility.EVERYONE)
-          ) {
-            throw new AppError(AppErrorCode.UNAUTHORIZED, {
-              message: 'You do not have permission to update the document visibility',
-            });
-          }
-        })
-        .otherwise(() => {
+        if (
+          !allowedVisibilities.includes(document.visibility) ||
+          (requestedVisibility && !allowedVisibilities.includes(requestedVisibility))
+        ) {
           throw new AppError(AppErrorCode.UNAUTHORIZED, {
-            message: 'You do not have permission to update the document',
+            message: 'You do not have permission to update the document visibility',
           });
+        }
+      })
+      .with(TeamMemberRole.MEMBER, () => {
+        if (
+          document.visibility !== DocumentVisibility.EVERYONE ||
+          (requestedVisibility && requestedVisibility !== DocumentVisibility.EVERYONE)
+        ) {
+          throw new AppError(AppErrorCode.UNAUTHORIZED, {
+            message: 'You do not have permission to update the document visibility',
+          });
+        }
+      })
+      .otherwise(() => {
+        throw new AppError(AppErrorCode.UNAUTHORIZED, {
+          message: 'You do not have permission to update the document',
         });
-    }
+      });
   }
 
   // If no data just return the document since this function is normally chained after a meta update.
@@ -135,25 +120,20 @@ export const updateDocument = async ({
     data?.globalActionAuth === undefined ? documentGlobalActionAuth : data.globalActionAuth;
 
   // Check if user has permission to set the global action auth.
-  if (newGlobalActionAuth) {
-    const isDocumentEnterprise = await isUserEnterprise({
-      userId,
-      teamId,
+  if (newGlobalActionAuth.length > 0 && !document.team.organisation.organisationClaim.flags.cfr21) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'You do not have permission to set the action auth',
     });
-
-    if (!isDocumentEnterprise) {
-      throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'You do not have permission to set the action auth',
-      });
-    }
   }
 
   const isTitleSame = data.title === undefined || data.title === document.title;
   const isExternalIdSame = data.externalId === undefined || data.externalId === document.externalId;
   const isGlobalAccessSame =
-    documentGlobalAccessAuth === undefined || documentGlobalAccessAuth === newGlobalAccessAuth;
+    documentGlobalAccessAuth === undefined ||
+    isDeepEqual(documentGlobalAccessAuth, newGlobalAccessAuth);
   const isGlobalActionSame =
-    documentGlobalActionAuth === undefined || documentGlobalActionAuth === newGlobalActionAuth;
+    documentGlobalActionAuth === undefined ||
+    isDeepEqual(documentGlobalActionAuth, newGlobalActionAuth);
   const isDocumentVisibilitySame =
     data.visibility === undefined || data.visibility === document.visibility;
 
@@ -236,7 +216,7 @@ export const updateDocument = async ({
   }
 
   // Early return if nothing is required.
-  if (auditLogs.length === 0) {
+  if (auditLogs.length === 0 && data.useLegacyFieldInsertion === undefined) {
     return document;
   }
 
@@ -254,6 +234,7 @@ export const updateDocument = async ({
         title: data.title,
         externalId: data.externalId,
         visibility: data.visibility as DocumentVisibility,
+        useLegacyFieldInsertion: data.useLegacyFieldInsertion,
         authOptions,
       },
     });

packages/lib/server-only/document/update-title.ts

@@ -1,81 +0,0 @@
-import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
-import type { RequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
-import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
-import { prisma } from '@documenso/prisma';
-
-export type UpdateTitleOptions = {
-  userId: number;
-  teamId?: number;
-  documentId: number;
-  title: string;
-  requestMetadata?: RequestMetadata;
-};
-
-export const updateTitle = async ({
-  userId,
-  teamId,
-  documentId,
-  title,
-  requestMetadata,
-}: UpdateTitleOptions) => {
-  const user = await prisma.user.findFirstOrThrow({
-    where: {
-      id: userId,
-    },
-  });
-
-  const document = await prisma.document.findFirstOrThrow({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
-  });
-
-  if (document.title === title) {
-    return document;
-  }
-
-  return await prisma.$transaction(async (tx) => {
-    // Instead of doing everything in a transaction we can use our knowledge
-    // of the current document title to ensure we aren't performing a conflicting
-    // update.
-    const updatedDocument = await tx.document.update({
-      where: {
-        id: documentId,
-        title: document.title,
-      },
-      data: {
-        title,
-      },
-    });
-
-    await tx.documentAuditLog.create({
-      data: createDocumentAuditLogData({
-        type: DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_TITLE_UPDATED,
-        documentId,
-        user,
-        requestMetadata,
-        data: {
-          from: document.title,
-          to: updatedDocument.title,
-        },
-      }),
-    });
-
-    return updatedDocument;
-  });
-};

packages/lib/server-only/document/validate-field-auth.ts

@@ -3,7 +3,6 @@ import { FieldType } from '@prisma/client';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import type { TRecipientActionAuth } from '../../types/document-auth';
-import { extractDocumentAuthMethods } from '../../utils/document-auth';
 import { isRecipientAuthorized } from './is-recipient-authorized';
 
 export type ValidateFieldAuthOptions = {
@@ -26,14 +25,9 @@ export const validateFieldAuth = async ({
   userId,
   authOptions,
 }: ValidateFieldAuthOptions) => {
-  const { derivedRecipientActionAuth } = extractDocumentAuthMethods({
-    documentAuth: documentAuthOptions,
-    recipientAuth: recipient.authOptions,
-  });
-
   // Override all non-signature fields to not require any auth.
   if (field.type !== FieldType.SIGNATURE) {
-    return null;
+    return undefined;
   }
 
   const isValid = await isRecipientAuthorized({
@@ -50,5 +44,5 @@ export const validateFieldAuth = async ({
     });
   }
 
-  return derivedRecipientActionAuth;
+  return authOptions?.type;
 };

packages/lib/server-only/document/viewed-document.ts

@@ -15,7 +15,7 @@ import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 
 export type ViewedDocumentOptions = {
   token: string;
-  recipientAccessAuth?: TDocumentAccessAuthTypes | null;
+  recipientAccessAuth?: TDocumentAccessAuthTypes[];
   requestMetadata?: RequestMetadata;
 };
 
@@ -27,7 +27,6 @@ export const viewedDocument = async ({
   const recipient = await prisma.recipient.findFirst({
     where: {
       token,
-      readStatus: ReadStatus.NOT_OPENED,
     },
   });
 
@@ -37,6 +36,30 @@ export const viewedDocument = async ({
 
   const { documentId } = recipient;
 
+  await prisma.documentAuditLog.create({
+    data: createDocumentAuditLogData({
+      type: DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_VIEWED,
+      documentId,
+      user: {
+        name: recipient.name,
+        email: recipient.email,
+      },
+      requestMetadata,
+      data: {
+        recipientEmail: recipient.email,
+        recipientId: recipient.id,
+        recipientName: recipient.name,
+        recipientRole: recipient.role,
+        accessAuth: recipientAccessAuth ?? [],
+      },
+    }),
+  });
+
+  // Early return if already opened.
+  if (recipient.readStatus === ReadStatus.OPENED) {
+    return;
+  }
+
   await prisma.$transaction(async (tx) => {
     await tx.recipient.update({
       where: {
@@ -63,7 +86,7 @@ export const viewedDocument = async ({
           recipientId: recipient.id,
           recipientName: recipient.name,
           recipientRole: recipient.role,
-          accessAuth: recipientAccessAuth || undefined,
+          accessAuth: recipientAccessAuth ?? [],
         },
       }),
     });

packages/lib/server-only/email/get-email-context.ts

@@ -0,0 +1,235 @@
+import type { BrandingSettings } from '@documenso/email/providers/branding';
+import { prisma } from '@documenso/prisma';
+import type {
+  DocumentMeta,
+  EmailDomain,
+  Organisation,
+  OrganisationEmail,
+  OrganisationType,
+} from '@documenso/prisma/client';
+import {
+  EmailDomainStatus,
+  type OrganisationClaim,
+  type OrganisationGlobalSettings,
+} from '@documenso/prisma/client';
+
+import { DOCUMENSO_INTERNAL_EMAIL } from '../../constants/email';
+import { AppError, AppErrorCode } from '../../errors/app-error';
+import {
+  organisationGlobalSettingsToBranding,
+  teamGlobalSettingsToBranding,
+} from '../../utils/team-global-settings-to-branding';
+import { extractDerivedTeamSettings } from '../../utils/teams';
+
+type EmailMetaOption = Partial<Pick<DocumentMeta, 'emailId' | 'emailReplyTo' | 'language'>>;
+
+type BaseGetEmailContextOptions = {
+  /**
+   * The source to extract the email context from.
+   * - "Team" will use the team settings followed by the inherited organisation settings
+   * - "Organisation" will use the organisation settings
+   */
+  source:
+    | {
+        type: 'team';
+        teamId: number;
+      }
+    | {
+        type: 'organisation';
+        organisationId: string;
+      };
+
+  /**
+   * The email type being sent, used to determine what email sender and language to use.
+   * - INTERNAL: Emails to users, such as team invites, etc.
+   * - RECIPIENT: Emails to recipients, such as document sent, document signed, etc.
+   */
+  emailType: 'INTERNAL' | 'RECIPIENT';
+};
+
+type InternalGetEmailContextOptions = BaseGetEmailContextOptions & {
+  emailType: 'INTERNAL';
+  meta?: EmailMetaOption | null;
+};
+
+type RecipientGetEmailContextOptions = BaseGetEmailContextOptions & {
+  emailType: 'RECIPIENT';
+
+  /**
+   * Force meta options as a typesafe way to ensure developers don't forget to
+   * pass it in if it is available.
+   */
+  meta: EmailMetaOption | null | undefined;
+};
+
+type GetEmailContextOptions = InternalGetEmailContextOptions | RecipientGetEmailContextOptions;
+
+type EmailContextResponse = {
+  allowedEmails: OrganisationEmail[];
+  branding: BrandingSettings;
+  settings: Omit<OrganisationGlobalSettings, 'id'>;
+  claims: OrganisationClaim;
+  organisationType: OrganisationType;
+  senderEmail: {
+    name: string;
+    address: string;
+  };
+  replyToEmail: string | undefined;
+  emailLanguage: string;
+};
+
+export const getEmailContext = async (
+  options: GetEmailContextOptions,
+): Promise<EmailContextResponse> => {
+  const { source, meta } = options;
+
+  let emailContext: Omit<EmailContextResponse, 'senderEmail' | 'replyToEmail' | 'emailLanguage'>;
+
+  if (source.type === 'organisation') {
+    emailContext = await handleOrganisationEmailContext(source.organisationId);
+  } else {
+    emailContext = await handleTeamEmailContext(source.teamId);
+  }
+
+  const emailLanguage = meta?.language || emailContext.settings.documentLanguage;
+
+  // Immediate return for internal emails.
+  if (options.emailType === 'INTERNAL') {
+    return {
+      ...emailContext,
+      senderEmail: DOCUMENSO_INTERNAL_EMAIL,
+      replyToEmail: undefined,
+      emailLanguage, // Not sure if we want to use this for internal emails.
+    };
+  }
+
+  const replyToEmail = meta?.emailReplyTo || emailContext.settings.emailReplyTo || undefined;
+  const senderEmailId = meta?.emailId === null ? null : emailContext.settings.emailId;
+
+  const foundSenderEmail = emailContext.allowedEmails.find((email) => email.id === senderEmailId);
+
+  // Reset the emailId to null if not found.
+  if (!foundSenderEmail) {
+    emailContext.settings.emailId = null;
+  }
+
+  const senderEmail = foundSenderEmail
+    ? {
+        name: foundSenderEmail.emailName,
+        address: foundSenderEmail.email,
+      }
+    : DOCUMENSO_INTERNAL_EMAIL;
+
+  return {
+    ...emailContext,
+    senderEmail,
+    replyToEmail,
+    emailLanguage,
+  };
+};
+
+const handleOrganisationEmailContext = async (organisationId: string) => {
+  const organisation = await prisma.organisation.findFirst({
+    where: {
+      id: organisationId,
+    },
+    include: {
+      organisationClaim: true,
+      organisationGlobalSettings: true,
+      emailDomains: {
+        omit: {
+          privateKey: true,
+        },
+        include: {
+          emails: true,
+        },
+      },
+    },
+  });
+
+  if (!organisation) {
+    throw new AppError(AppErrorCode.NOT_FOUND);
+  }
+
+  const claims = organisation.organisationClaim;
+
+  const allowedEmails = getAllowedEmails(organisation);
+
+  return {
+    allowedEmails,
+    branding: organisationGlobalSettingsToBranding(
+      organisation.organisationGlobalSettings,
+      organisation.id,
+      claims.flags.hidePoweredBy ?? false,
+    ),
+    settings: organisation.organisationGlobalSettings,
+    claims,
+    organisationType: organisation.type,
+  };
+};
+
+const handleTeamEmailContext = async (teamId: number) => {
+  const team = await prisma.team.findFirst({
+    where: {
+      id: teamId,
+    },
+    include: {
+      teamGlobalSettings: true,
+      organisation: {
+        include: {
+          organisationClaim: true,
+          organisationGlobalSettings: true,
+          emailDomains: {
+            omit: {
+              privateKey: true,
+            },
+            include: {
+              emails: true,
+            },
+          },
+        },
+      },
+    },
+  });
+
+  if (!team) {
+    throw new AppError(AppErrorCode.NOT_FOUND);
+  }
+
+  const organisation = team.organisation;
+  const claims = organisation.organisationClaim;
+
+  const allowedEmails = getAllowedEmails(organisation);
+
+  const teamSettings = extractDerivedTeamSettings(
+    organisation.organisationGlobalSettings,
+    team.teamGlobalSettings,
+  );
+
+  return {
+    allowedEmails,
+    branding: teamGlobalSettingsToBranding(
+      teamSettings,
+      teamId,
+      claims.flags.hidePoweredBy ?? false,
+    ),
+    settings: teamSettings,
+    claims,
+    organisationType: organisation.type,
+  };
+};
+
+const getAllowedEmails = (
+  organisation: Organisation & {
+    emailDomains: (Pick<EmailDomain, 'status'> & { emails: OrganisationEmail[] })[];
+    organisationClaim: OrganisationClaim;
+  },
+) => {
+  if (!organisation.organisationClaim.flags.emailDomains) {
+    return [];
+  }
+
+  return organisation.emailDomains
+    .filter((emailDomain) => emailDomain.status === EmailDomainStatus.ACTIVE)
+    .flatMap((emailDomain) => emailDomain.emails);
+};

packages/lib/server-only/embedding-presign/create-embedding-presign-token.ts

@@ -27,7 +27,6 @@ export const createEmbeddingPresignToken = async ({
     // In development mode, allow setting expiresIn to 0 for testing
     // In production, enforce a minimum expiration time
     const isDevelopment = env('NODE_ENV') !== 'production';
-    console.log('isDevelopment', isDevelopment);
     const minExpirationMinutes = isDevelopment ? 0 : 5;
 
     // Ensure expiresIn is at least the minimum allowed value

packages/lib/server-only/field/create-document-fields.ts

@@ -6,10 +6,11 @@ import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { canRecipientFieldsBeModified } from '../../utils/recipients';
+import { getDocumentWhereInput } from '../document/get-document-by-id';
 
 export interface CreateDocumentFieldsOptions {
   userId: number;
-  teamId?: number;
+  teamId: number;
   documentId: number;
   fields: (TFieldAndMeta & {
     recipientId: number;
@@ -29,25 +30,14 @@ export const createDocumentFields = async ({
   fields,
   requestMetadata,
 }: CreateDocumentFieldsOptions) => {
+  const { documentWhereInput } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
   const document = await prisma.document.findFirst({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
+    where: documentWhereInput,
     include: {
       recipients: true,
       fields: true,

packages/lib/server-only/field/create-field.ts

@@ -1,4 +1,4 @@
-import type { FieldType, Team } from '@prisma/client';
+import type { FieldType } from '@prisma/client';
 import { match } from 'ts-pattern';
 
 import { prisma } from '@documenso/prisma';
@@ -13,11 +13,12 @@ import {
 import type { TFieldMetaSchema as FieldMeta } from '../../types/field-meta';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
+import { getDocumentWhereInput } from '../document/get-document-by-id';
 
 export type CreateFieldOptions = {
   documentId: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
   recipientId: number;
   type: FieldType;
   pageNumber: number;
@@ -43,60 +44,23 @@ export const createField = async ({
   fieldMeta,
   requestMetadata,
 }: CreateFieldOptions) => {
+  const { documentWhereInput, team } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
   const document = await prisma.document.findFirst({
+    where: documentWhereInput,
     select: {
       id: true,
     },
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
   });
 
   if (!document) {
     throw new Error('Document not found');
   }
 
-  const user = await prisma.user.findFirstOrThrow({
-    where: {
-      id: userId,
-    },
-    select: {
-      id: true,
-      name: true,
-      email: true,
-    },
-  });
-
-  let team: Team | null = null;
-
-  if (teamId) {
-    team = await prisma.team.findFirst({
-      where: {
-        id: teamId,
-        members: {
-          some: {
-            userId,
-          },
-        },
-      },
-    });
-  }
-
   const advancedField = ['NUMBER', 'RADIO', 'CHECKBOX', 'DROPDOWN', 'TEXT'].includes(type);
 
   if (advancedField && !fieldMeta) {
@@ -154,9 +118,9 @@ export const createField = async ({
       type: 'FIELD_CREATED',
       documentId,
       user: {
-        id: team?.id ?? user.id,
-        email: team?.name ?? user.email,
-        name: team ? '' : user.name,
+        id: team.id,
+        email: team.name,
+        name: '',
       },
       data: {
         fieldId: field.secondaryId,

packages/lib/server-only/field/create-template-fields.ts

@@ -5,10 +5,11 @@ import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { canRecipientFieldsBeModified } from '../../utils/recipients';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface CreateTemplateFieldsOptions {
   userId: number;
-  teamId?: number;
+  teamId: number;
   templateId: number;
   fields: {
     recipientId: number;
@@ -31,21 +32,7 @@ export const createTemplateFields = async ({
   const template = await prisma.template.findFirst({
     where: {
       id: templateId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
+      team: buildTeamWhereQuery({ teamId, userId }),
     },
     include: {
       recipients: true,

packages/lib/server-only/field/delete-document-field.ts

@@ -5,10 +5,11 @@ import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { canRecipientFieldsBeModified } from '../../utils/recipients';
+import { getDocumentWhereInput } from '../document/get-document-by-id';
 
 export interface DeleteDocumentFieldOptions {
   userId: number;
-  teamId?: number;
+  teamId: number;
   fieldId: number;
   requestMetadata: ApiRequestMetadata;
 }
@@ -39,25 +40,14 @@ export const deleteDocumentField = async ({
     });
   }
 
+  const { documentWhereInput } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
   const document = await prisma.document.findFirst({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
+    where: documentWhereInput,
     include: {
       recipients: {
         where: {

packages/lib/server-only/field/delete-field.ts

@@ -4,12 +4,13 @@ import { prisma } from '@documenso/prisma';
 
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export type DeleteFieldOptions = {
   fieldId: number;
   documentId: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
   requestMetadata?: RequestMetadata;
 };
 
@@ -25,21 +26,7 @@ export const deleteField = async ({
       id: fieldId,
       document: {
         id: documentId,
-        ...(teamId
-          ? {
-              team: {
-                id: teamId,
-                members: {
-                  some: {
-                    userId,
-                  },
-                },
-              },
-            }
-          : {
-              userId,
-              teamId: null,
-            }),
+        team: buildTeamWhereQuery({ teamId, userId }),
       },
     },
     include: {

packages/lib/server-only/field/delete-template-field.ts

@@ -1,10 +1,11 @@
 import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface DeleteTemplateFieldOptions {
   userId: number;
-  teamId?: number;
+  teamId: number;
   fieldId: number;
 }
 
@@ -16,21 +17,9 @@ export const deleteTemplateField = async ({
   const field = await prisma.field.findFirst({
     where: {
       id: fieldId,
-      template: teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          },
+      template: {
+        team: buildTeamWhereQuery({ teamId, userId }),
+      },
     },
   });
 

packages/lib/server-only/field/get-field-by-id.ts

@@ -1,53 +1,49 @@
 import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export type GetFieldByIdOptions = {
   userId: number;
-  teamId?: number;
+  teamId: number;
   fieldId: number;
-  documentId?: number;
-  templateId?: number;
 };
 
-export const getFieldById = async ({
-  userId,
-  teamId,
-  fieldId,
-  documentId,
-  templateId,
-}: GetFieldByIdOptions) => {
+export const getFieldById = async ({ userId, teamId, fieldId }: GetFieldByIdOptions) => {
   const field = await prisma.field.findFirst({
     where: {
       id: fieldId,
-      documentId,
-      templateId,
+    },
+    include: {
       document: {
-        OR:
-          teamId === undefined
-            ? [
-                {
-                  userId,
-                  teamId: null,
-                },
-              ]
-            : [
-                {
-                  teamId,
-                  team: {
-                    members: {
-                      some: {
-                        userId,
-                      },
-                    },
-                  },
-                },
-              ],
+        select: {
+          teamId: true,
+        },
+      },
+      template: {
+        select: {
+          teamId: true,
+        },
       },
     },
   });
 
-  if (!field) {
+  const foundTeamId = field?.document?.teamId || field?.template?.teamId;
+
+  if (!field || !foundTeamId || foundTeamId !== teamId) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Field not found',
+    });
+  }
+
+  const team = await prisma.team.findUnique({
+    where: buildTeamWhereQuery({
+      teamId: foundTeamId,
+      userId,
+    }),
+  });
+
+  if (!team) {
     throw new AppError(AppErrorCode.NOT_FOUND, {
       message: 'Field not found',
     });

packages/lib/server-only/field/get-fields-for-document.ts

@@ -1,9 +1,11 @@
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
+
 export interface GetFieldsForDocumentOptions {
   documentId: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
 }
 
 export type DocumentField = Awaited<ReturnType<typeof getFieldsForDocument>>[number];
@@ -15,22 +17,10 @@ export const getFieldsForDocument = async ({
 }: GetFieldsForDocumentOptions) => {
   const fields = await prisma.field.findMany({
     where: {
-      documentId,
-      document: teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          },
+      document: {
+        id: documentId,
+        team: buildTeamWhereQuery({ teamId, userId }),
+      },
     },
     include: {
       signature: true,

packages/lib/server-only/field/set-fields-for-document.ts

@@ -26,10 +26,11 @@ import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { canRecipientFieldsBeModified } from '../../utils/recipients';
+import { getDocumentWhereInput } from '../document/get-document-by-id';
 
 export interface SetFieldsForDocumentOptions {
   userId: number;
-  teamId?: number;
+  teamId: number;
   documentId: number;
   fields: FieldData[];
   requestMetadata: ApiRequestMetadata;
@@ -42,25 +43,14 @@ export const setFieldsForDocument = async ({
   fields,
   requestMetadata,
 }: SetFieldsForDocumentOptions) => {
+  const { documentWhereInput } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
   const document = await prisma.document.findFirst({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
+    where: documentWhereInput,
     include: {
       recipients: true,
     },

packages/lib/server-only/field/set-fields-for-template.ts

@@ -16,9 +16,11 @@ import {
 } from '@documenso/lib/types/field-meta';
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
+
 export type SetFieldsForTemplateOptions = {
   userId: number;
-  teamId?: number;
+  teamId: number;
   templateId: number;
   fields: {
     id?: number | null;
@@ -42,21 +44,7 @@ export const setFieldsForTemplate = async ({
   const template = await prisma.template.findFirst({
     where: {
       id: templateId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
+      team: buildTeamWhereQuery({ teamId, userId }),
     },
   });
 

packages/lib/server-only/field/sign-field-with-token.ts

@@ -1,5 +1,6 @@
 import { DocumentStatus, FieldType, RecipientRole, SigningStatus } from '@prisma/client';
 import { DateTime } from 'luxon';
+import { isDeepEqual } from 'remeda';
 import { match } from 'ts-pattern';
 
 import { validateCheckboxField } from '@documenso/lib/advanced-fields-validation/validate-checkbox';
@@ -10,6 +11,7 @@ import { validateTextField } from '@documenso/lib/advanced-fields-validation/val
 import { fromCheckboxValue } from '@documenso/lib/universal/field-checkbox';
 import { prisma } from '@documenso/prisma';
 
+import { AUTO_SIGNABLE_FIELD_TYPES } from '../../constants/autosign';
 import { DEFAULT_DOCUMENT_DATE_FORMAT } from '../../constants/date-formats';
 import { DEFAULT_DOCUMENT_TIME_ZONE } from '../../constants/time-zones';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
@@ -205,6 +207,29 @@ export const signFieldWithToken = async ({
     throw new Error('Typed signatures are not allowed. Please draw your signature');
   }
 
+  if (field.fieldMeta?.readOnly && !AUTO_SIGNABLE_FIELD_TYPES.includes(field.type)) {
+    // !: This is a bit of a hack at the moment, readonly fields with default values
+    // !: should be inserted with their default value on document creation instead of
+    // !: this weird programattic approach. Until that's fixed though this will verify
+    // !: that the programmatic signed value is only that of its default.
+    const isAutomaticSigningValueValid = match(field.fieldMeta)
+      .with({ type: 'text' }, (meta) => customText === meta.text)
+      .with({ type: 'number' }, (meta) => customText === meta.value)
+      .with({ type: 'checkbox' }, (meta) =>
+        isDeepEqual(
+          fromCheckboxValue(customText ?? ''),
+          meta.values?.filter((v) => v.checked).map((v) => v.value) ?? [],
+        ),
+      )
+      .with({ type: 'radio' }, (meta) => customText === meta.values?.find((v) => v.checked)?.value)
+      .with({ type: 'dropdown' }, (meta) => customText === meta.defaultValue)
+      .otherwise(() => false);
+
+    if (!isAutomaticSigningValueValid) {
+      throw new Error('Field is read only and only accepts its default value for signing.');
+    }
+  }
+
   const assistant = recipient.role === RecipientRole.ASSISTANT ? recipient : undefined;
 
   return await prisma.$transaction(async (tx) => {

packages/lib/server-only/field/update-document-fields.ts

@@ -11,10 +11,11 @@ import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { canRecipientFieldsBeModified } from '../../utils/recipients';
+import { getDocumentWhereInput } from '../document/get-document-by-id';
 
 export interface UpdateDocumentFieldsOptions {
   userId: number;
-  teamId?: number;
+  teamId: number;
   documentId: number;
   fields: {
     id: number;
@@ -36,25 +37,14 @@ export const updateDocumentFields = async ({
   fields,
   requestMetadata,
 }: UpdateDocumentFieldsOptions) => {
+  const { documentWhereInput } = await getDocumentWhereInput({
+    documentId,
+    userId,
+    teamId,
+  });
+
   const document = await prisma.document.findFirst({
-    where: {
-      id: documentId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
-    },
+    where: documentWhereInput,
     include: {
       recipients: true,
       fields: true,

packages/lib/server-only/field/update-field.ts

@@ -6,12 +6,13 @@ import { prisma } from '@documenso/prisma';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData, diffFieldChanges } from '../../utils/document-audit-logs';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export type UpdateFieldOptions = {
   fieldId: number;
   documentId: number;
   userId: number;
-  teamId?: number;
+  teamId: number;
   recipientId?: number;
   type?: FieldType;
   pageNumber?: number;
@@ -47,21 +48,7 @@ export const updateField = async ({
       id: fieldId,
       document: {
         id: documentId,
-        ...(teamId
-          ? {
-              team: {
-                id: teamId,
-                members: {
-                  some: {
-                    userId,
-                  },
-                },
-              },
-            }
-          : {
-              userId,
-              teamId: null,
-            }),
+        team: buildTeamWhereQuery({ teamId, userId }),
       },
     },
   });
@@ -101,14 +88,7 @@ export const updateField = async ({
 
     if (teamId) {
       team = await prisma.team.findFirst({
-        where: {
-          id: teamId,
-          members: {
-            some: {
-              userId,
-            },
-          },
-        },
+        where: buildTeamWhereQuery({ teamId, userId }),
       });
     }
 

packages/lib/server-only/field/update-template-fields.ts

@@ -5,10 +5,11 @@ import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { canRecipientFieldsBeModified } from '../../utils/recipients';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface UpdateTemplateFieldsOptions {
   userId: number;
-  teamId?: number;
+  teamId: number;
   templateId: number;
   fields: {
     id: number;
@@ -31,21 +32,7 @@ export const updateTemplateFields = async ({
   const template = await prisma.template.findFirst({
     where: {
       id: templateId,
-      ...(teamId
-        ? {
-            team: {
-              id: teamId,
-              members: {
-                some: {
-                  userId,
-                },
-              },
-            },
-          }
-        : {
-            userId,
-            teamId: null,
-          }),
+      team: buildTeamWhereQuery({ teamId, userId }),
     },
     include: {
       recipients: true,

packages/lib/server-only/folder/create-folder.ts

@@ -0,0 +1,38 @@
+import { prisma } from '@documenso/prisma';
+
+import type { TFolderType } from '../../types/folder-type';
+import { FolderType } from '../../types/folder-type';
+import { determineDocumentVisibility } from '../../utils/document-visibility';
+import { getTeamById } from '../team/get-team';
+import { getTeamSettings } from '../team/get-team-settings';
+
+export interface CreateFolderOptions {
+  userId: number;
+  teamId: number;
+  name: string;
+  parentId?: string | null;
+  type?: TFolderType;
+}
+
+export const createFolder = async ({
+  userId,
+  teamId,
+  name,
+  parentId,
+  type = FolderType.DOCUMENT,
+}: CreateFolderOptions) => {
+  const team = await getTeamById({ userId, teamId });
+
+  const settings = await getTeamSettings({ userId, teamId });
+
+  return await prisma.folder.create({
+    data: {
+      name,
+      userId,
+      teamId,
+      parentId,
+      type,
+      visibility: determineDocumentVisibility(settings.documentVisibility, team.currentTeamRole),
+    },
+  });
+};

packages/lib/server-only/folder/delete-folder.ts

@@ -0,0 +1,57 @@
+import { DocumentVisibility, TeamMemberRole } from '@prisma/client';
+import { match } from 'ts-pattern';
+
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+
+import { buildTeamWhereQuery } from '../../utils/teams';
+import { getTeamById } from '../team/get-team';
+
+export interface DeleteFolderOptions {
+  userId: number;
+  teamId: number;
+  folderId: string;
+}
+
+export const deleteFolder = async ({ userId, teamId, folderId }: DeleteFolderOptions) => {
+  const team = await getTeamById({ userId, teamId });
+
+  const folder = await prisma.folder.findFirst({
+    where: {
+      id: folderId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
+    },
+    include: {
+      documents: true,
+      subfolders: true,
+      templates: true,
+    },
+  });
+
+  if (!folder) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Folder not found',
+    });
+  }
+
+  const hasPermission = match(team.currentTeamRole)
+    .with(TeamMemberRole.ADMIN, () => true)
+    .with(TeamMemberRole.MANAGER, () => folder.visibility !== DocumentVisibility.ADMIN)
+    .with(TeamMemberRole.MEMBER, () => folder.visibility === DocumentVisibility.EVERYONE)
+    .otherwise(() => false);
+
+  if (!hasPermission) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'You do not have permission to delete this folder',
+    });
+  }
+
+  return await prisma.folder.delete({
+    where: {
+      id: folderId,
+    },
+  });
+};

packages/lib/server-only/folder/find-folders.ts

@@ -0,0 +1,122 @@
+import { TeamMemberRole } from '@prisma/client';
+import { match } from 'ts-pattern';
+
+import { prisma } from '@documenso/prisma';
+
+import { DocumentVisibility } from '../../types/document-visibility';
+import type { TFolderType } from '../../types/folder-type';
+import { getTeamById } from '../team/get-team';
+
+export interface FindFoldersOptions {
+  userId: number;
+  teamId: number;
+  parentId?: string | null;
+  type?: TFolderType;
+}
+
+export const findFolders = async ({ userId, teamId, parentId, type }: FindFoldersOptions) => {
+  const team = await getTeamById({ userId, teamId });
+
+  const visibilityFilters = match(team.currentTeamRole)
+    .with(TeamMemberRole.ADMIN, () => ({
+      visibility: {
+        in: [
+          DocumentVisibility.EVERYONE,
+          DocumentVisibility.MANAGER_AND_ABOVE,
+          DocumentVisibility.ADMIN,
+        ],
+      },
+    }))
+    .with(TeamMemberRole.MANAGER, () => ({
+      visibility: {
+        in: [DocumentVisibility.EVERYONE, DocumentVisibility.MANAGER_AND_ABOVE],
+      },
+    }))
+    .otherwise(() => ({ visibility: DocumentVisibility.EVERYONE }));
+
+  const whereClause = {
+    AND: [
+      { parentId },
+      {
+        OR: [
+          { teamId, ...visibilityFilters },
+          { userId, teamId },
+        ],
+      },
+    ],
+  };
+
+  try {
+    const folders = await prisma.folder.findMany({
+      where: {
+        ...whereClause,
+        ...(type ? { type } : {}),
+      },
+      orderBy: [{ pinned: 'desc' }, { createdAt: 'desc' }],
+    });
+
+    const foldersWithDetails = await Promise.all(
+      folders.map(async (folder) => {
+        try {
+          const [subfolders, documentCount, templateCount, subfolderCount] = await Promise.all([
+            prisma.folder.findMany({
+              where: {
+                parentId: folder.id,
+                teamId,
+                ...visibilityFilters,
+              },
+              orderBy: {
+                createdAt: 'desc',
+              },
+            }),
+            prisma.document.count({
+              where: {
+                folderId: folder.id,
+              },
+            }),
+            prisma.template.count({
+              where: {
+                folderId: folder.id,
+              },
+            }),
+            prisma.folder.count({
+              where: {
+                parentId: folder.id,
+                teamId,
+                ...visibilityFilters,
+              },
+            }),
+          ]);
+
+          const subfoldersWithEmptySubfolders = subfolders.map((subfolder) => ({
+            ...subfolder,
+            subfolders: [],
+            _count: {
+              documents: 0,
+              templates: 0,
+              subfolders: 0,
+            },
+          }));
+
+          return {
+            ...folder,
+            subfolders: subfoldersWithEmptySubfolders,
+            _count: {
+              documents: documentCount,
+              templates: templateCount,
+              subfolders: subfolderCount,
+            },
+          };
+        } catch (error) {
+          console.error('Error processing folder:', folder.id, error);
+          throw error;
+        }
+      }),
+    );
+
+    return foldersWithDetails;
+  } catch (error) {
+    console.error('Error in findFolders:', error);
+    throw error;
+  }
+};

packages/lib/server-only/folder/get-folder-breadcrumbs.ts

@@ -0,0 +1,79 @@
+import { TeamMemberRole } from '@prisma/client';
+import { match } from 'ts-pattern';
+
+import { prisma } from '@documenso/prisma';
+
+import { DocumentVisibility } from '../../types/document-visibility';
+import type { TFolderType } from '../../types/folder-type';
+import { getTeamById } from '../team/get-team';
+
+export interface GetFolderBreadcrumbsOptions {
+  userId: number;
+  teamId: number;
+  folderId: string;
+  type?: TFolderType;
+}
+
+export const getFolderBreadcrumbs = async ({
+  userId,
+  teamId,
+  folderId,
+  type,
+}: GetFolderBreadcrumbsOptions) => {
+  const team = await getTeamById({ userId, teamId });
+
+  const visibilityFilters = match(team.currentTeamRole)
+    .with(TeamMemberRole.ADMIN, () => ({
+      visibility: {
+        in: [
+          DocumentVisibility.EVERYONE,
+          DocumentVisibility.MANAGER_AND_ABOVE,
+          DocumentVisibility.ADMIN,
+        ],
+      },
+    }))
+    .with(TeamMemberRole.MANAGER, () => ({
+      visibility: {
+        in: [DocumentVisibility.EVERYONE, DocumentVisibility.MANAGER_AND_ABOVE],
+      },
+    }))
+    .otherwise(() => ({ visibility: DocumentVisibility.EVERYONE }));
+
+  const whereClause = (folderId: string) => ({
+    id: folderId,
+    ...(type ? { type } : {}),
+    OR: [
+      { teamId, ...visibilityFilters },
+      { userId, teamId },
+    ],
+  });
+
+  const breadcrumbs = [];
+  let currentFolderId = folderId;
+
+  const currentFolder = await prisma.folder.findFirst({
+    where: whereClause(currentFolderId),
+  });
+
+  if (!currentFolder) {
+    return [];
+  }
+
+  breadcrumbs.push(currentFolder);
+
+  while (currentFolder?.parentId) {
+    const parentFolder = await prisma.folder.findFirst({
+      where: whereClause(currentFolder.parentId),
+    });
+
+    if (!parentFolder) {
+      break;
+    }
+
+    breadcrumbs.unshift(parentFolder);
+    currentFolderId = parentFolder.id;
+    currentFolder.parentId = parentFolder.parentId;
+  }
+
+  return breadcrumbs;
+};

packages/lib/server-only/folder/get-folder-by-id.ts

@@ -0,0 +1,58 @@
+import { TeamMemberRole } from '@prisma/client';
+import { match } from 'ts-pattern';
+
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+
+import { DocumentVisibility } from '../../types/document-visibility';
+import type { TFolderType } from '../../types/folder-type';
+import { getTeamById } from '../team/get-team';
+
+export interface GetFolderByIdOptions {
+  userId: number;
+  teamId: number;
+  folderId?: string;
+  type?: TFolderType;
+}
+
+export const getFolderById = async ({ userId, teamId, folderId, type }: GetFolderByIdOptions) => {
+  const team = await getTeamById({ userId, teamId });
+
+  const visibilityFilters = match(team.currentTeamRole)
+    .with(TeamMemberRole.ADMIN, () => ({
+      visibility: {
+        in: [
+          DocumentVisibility.EVERYONE,
+          DocumentVisibility.MANAGER_AND_ABOVE,
+          DocumentVisibility.ADMIN,
+        ],
+      },
+    }))
+    .with(TeamMemberRole.MANAGER, () => ({
+      visibility: {
+        in: [DocumentVisibility.EVERYONE, DocumentVisibility.MANAGER_AND_ABOVE],
+      },
+    }))
+    .otherwise(() => ({ visibility: DocumentVisibility.EVERYONE }));
+
+  const whereClause = {
+    id: folderId,
+    ...(type ? { type } : {}),
+    OR: [
+      { teamId, ...visibilityFilters },
+      { userId, teamId },
+    ],
+  };
+
+  const folder = await prisma.folder.findFirst({
+    where: whereClause,
+  });
+
+  if (!folder) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Folder not found',
+    });
+  }
+
+  return folder;
+};

packages/lib/server-only/folder/move-document-to-folder.ts

@@ -0,0 +1,92 @@
+import { TeamMemberRole } from '@prisma/client';
+import { match } from 'ts-pattern';
+
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { DocumentVisibility } from '@documenso/lib/types/document-visibility';
+import { FolderType } from '@documenso/lib/types/folder-type';
+import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
+import { prisma } from '@documenso/prisma';
+
+import { getTeamById } from '../team/get-team';
+
+export interface MoveDocumentToFolderOptions {
+  userId: number;
+  teamId: number;
+  documentId: number;
+  folderId?: string | null;
+  requestMetadata?: ApiRequestMetadata;
+}
+
+export const moveDocumentToFolder = async ({
+  userId,
+  teamId,
+  documentId,
+  folderId,
+}: MoveDocumentToFolderOptions) => {
+  const team = await getTeamById({ userId, teamId });
+
+  const visibilityFilters = match(team.currentTeamRole)
+    .with(TeamMemberRole.ADMIN, () => ({
+      visibility: {
+        in: [
+          DocumentVisibility.EVERYONE,
+          DocumentVisibility.MANAGER_AND_ABOVE,
+          DocumentVisibility.ADMIN,
+        ],
+      },
+    }))
+    .with(TeamMemberRole.MANAGER, () => ({
+      visibility: {
+        in: [DocumentVisibility.EVERYONE, DocumentVisibility.MANAGER_AND_ABOVE],
+      },
+    }))
+    .otherwise(() => ({ visibility: DocumentVisibility.EVERYONE }));
+
+  const documentWhereClause = {
+    id: documentId,
+    OR: [
+      { teamId, ...visibilityFilters },
+      { userId, teamId },
+    ],
+  };
+
+  const document = await prisma.document.findFirst({
+    where: documentWhereClause,
+  });
+
+  if (!document) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Document not found',
+    });
+  }
+
+  if (folderId) {
+    const folderWhereClause = {
+      id: folderId,
+      type: FolderType.DOCUMENT,
+      OR: [
+        { teamId, ...visibilityFilters },
+        { userId, teamId },
+      ],
+    };
+
+    const folder = await prisma.folder.findFirst({
+      where: folderWhereClause,
+    });
+
+    if (!folder) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Folder not found',
+      });
+    }
+  }
+
+  return await prisma.document.update({
+    where: {
+      id: documentId,
+    },
+    data: {
+      folderId,
+    },
+  });
+};

packages/lib/server-only/folder/move-folder.ts

@@ -0,0 +1,89 @@
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
+import { prisma } from '@documenso/prisma';
+
+import { buildTeamWhereQuery } from '../../utils/teams';
+
+export interface MoveFolderOptions {
+  userId: number;
+  teamId?: number;
+  folderId?: string;
+  parentId?: string | null;
+  requestMetadata?: ApiRequestMetadata;
+}
+
+export const moveFolder = async ({ userId, teamId, folderId, parentId }: MoveFolderOptions) => {
+  return await prisma.$transaction(async (tx) => {
+    const folder = await tx.folder.findFirst({
+      where: {
+        id: folderId,
+        team: buildTeamWhereQuery({
+          teamId,
+          userId,
+        }),
+      },
+    });
+
+    if (!folder) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Folder not found',
+      });
+    }
+
+    if (parentId) {
+      const parentFolder = await tx.folder.findFirst({
+        where: {
+          id: parentId,
+          userId,
+          teamId,
+          type: folder.type,
+        },
+      });
+
+      if (!parentFolder) {
+        throw new AppError(AppErrorCode.NOT_FOUND, {
+          message: 'Parent folder not found',
+        });
+      }
+
+      if (parentId === folderId) {
+        throw new AppError(AppErrorCode.INVALID_REQUEST, {
+          message: 'Cannot move a folder into itself',
+        });
+      }
+
+      let currentParentId = parentFolder.parentId;
+      while (currentParentId) {
+        if (currentParentId === folderId) {
+          throw new AppError(AppErrorCode.INVALID_REQUEST, {
+            message: 'Cannot move a folder into its descendant',
+          });
+        }
+
+        const currentParent = await tx.folder.findUnique({
+          where: {
+            id: currentParentId,
+          },
+          select: {
+            parentId: true,
+          },
+        });
+
+        if (!currentParent) {
+          break;
+        }
+
+        currentParentId = currentParent.parentId;
+      }
+    }
+
+    return await tx.folder.update({
+      where: {
+        id: folderId,
+      },
+      data: {
+        parentId,
+      },
+    });
+  });
+};

packages/lib/server-only/folder/move-template-to-folder.ts

@@ -0,0 +1,63 @@
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { FolderType } from '@documenso/lib/types/folder-type';
+import { prisma } from '@documenso/prisma';
+
+import { buildTeamWhereQuery } from '../../utils/teams';
+
+export interface MoveTemplateToFolderOptions {
+  userId: number;
+  teamId?: number;
+  templateId: number;
+  folderId?: string | null;
+}
+
+export const moveTemplateToFolder = async ({
+  userId,
+  teamId,
+  templateId,
+  folderId,
+}: MoveTemplateToFolderOptions) => {
+  const template = await prisma.template.findFirst({
+    where: {
+      id: templateId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
+    },
+  });
+
+  if (!template) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Template not found',
+    });
+  }
+
+  if (folderId !== null) {
+    const folder = await prisma.folder.findFirst({
+      where: {
+        id: folderId,
+        team: buildTeamWhereQuery({
+          teamId,
+          userId,
+        }),
+        type: FolderType.TEMPLATE,
+      },
+    });
+
+    if (!folder) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Folder not found',
+      });
+    }
+  }
+
+  return await prisma.template.update({
+    where: {
+      id: templateId,
+    },
+    data: {
+      folderId,
+    },
+  });
+};