Merge branch 'main' into feat/acroform-field-import

packages/app-tests/e2e/admin/global-search.spec.ts

@@ -0,0 +1,439 @@
+import { seedPendingDocument } from '@documenso/prisma/seed/documents';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, test } from '@playwright/test';
+import { customAlphabet } from 'nanoid';
+
+import { apiSignin } from '../fixtures/authentication';
+import { openCommandMenu } from '../fixtures/command-menu';
+
+test.describe.configure({ mode: 'parallel' });
+
+const nanoid = customAlphabet('1234567890abcdef', 10);
+
+const ADMIN_PROMPT_PLACEHOLDER = 'Search documents, users, organisations…';
+
+test('[ADMIN][GLOBAL_SEARCH]: numeric query shows verified user result and navigates', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: targetUser } = await seedUser();
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill(String(targetUser.id));
+
+  await expect(page.getByText('Global Users', { exact: true })).toBeVisible();
+
+  // The category chips include the admin groups with their result counts.
+  await expect(page.getByRole('button', { name: /Global Users/ })).toBeVisible();
+
+  const userOption = page.getByRole('option').filter({ hasText: targetUser.email }).first();
+
+  // Admin results are real links so they support native link behaviour such
+  // as opening in a new tab.
+  await expect(userOption.getByRole('link')).toHaveAttribute('href', `/admin/users/${targetUser.id}`);
+
+  await userOption.click();
+
+  await page.waitForURL(`/admin/users/${targetUser.id}`);
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: numeric query shows verified team result and navigates', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { team: targetTeam } = await seedUser();
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill(String(targetTeam.id));
+
+  await expect(page.getByText('Global Teams', { exact: true })).toBeVisible();
+
+  await page.getByRole('option').filter({ hasText: targetTeam.url }).first().click();
+
+  await page.waitForURL(`/admin/teams/${targetTeam.id}`);
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: text query shows document result and navigates', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: sender, team } = await seedUser();
+
+  const document = await seedPendingDocument(sender, team.id, [], {
+    createDocumentOptions: { title: `admin-ui-search-${nanoid()}` },
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill(document.title);
+
+  await expect(page.getByText('Global Documents', { exact: true })).toBeVisible();
+
+  await page.getByRole('option').filter({ hasText: document.secondaryId }).first().click();
+
+  await page.waitForURL(`/admin/documents/${document.id}`);
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: envelope_ prefixed query resolves exact document', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: sender, team } = await seedUser();
+
+  const document = await seedPendingDocument(sender, team.id, [], {
+    createDocumentOptions: { title: `admin-ui-search-${nanoid()}` },
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill(document.id);
+
+  await expect(page.getByText('Global Documents', { exact: true })).toBeVisible();
+  await expect(page.getByRole('option').filter({ hasText: document.title }).first()).toBeVisible();
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: admin search requires more than 3 characters unless numeric', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  const adminSearchRequests: string[] = [];
+
+  page.on('request', (request) => {
+    if (request.url().includes('admin.search')) {
+      adminSearchRequests.push(request.url());
+    }
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  const input = page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first();
+
+  // A 3 character non-numeric query must not trigger the admin search. The
+  // personal document search fires for any non-empty query, so its response
+  // is the synchronization anchor proving the debounced queries have fired.
+  const documentSearchResponse = page.waitForResponse((response) => response.url().includes('document.search'));
+
+  await input.fill('abc');
+
+  await documentSearchResponse;
+
+  await expect(page.getByText(/^Global /)).toHaveCount(0);
+  expect(adminSearchRequests).toHaveLength(0);
+
+  // A numeric query fires regardless of length.
+  const adminSearchRequest = page.waitForRequest((request) => request.url().includes('admin.search'));
+
+  await input.fill('7');
+
+  await adminSearchRequest;
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: search bar position stays fixed while searching', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: targetUser } = await seedUser();
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  const input = page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first();
+
+  const initialY = (await input.boundingBox())?.y;
+
+  expect(initialY).toBeGreaterThan(0);
+
+  // The height of the prompt may change as results come and go, but the
+  // search bar must never move.
+  await input.fill(String(targetUser.id));
+
+  await expect(page.getByText('Global Users', { exact: true })).toBeVisible();
+
+  const resultsY = (await input.boundingBox())?.y;
+
+  expect(resultsY).toBe(initialY);
+
+  // The search bar must not move when there are no results at all.
+  await input.fill('zzzz-no-such-thing-9x7q');
+
+  await expect(page.getByText('No results for')).toBeVisible();
+
+  const emptyY = (await input.boundingBox())?.y;
+
+  expect(emptyY).toBe(initialY);
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: default view shows the document page links outside a team context', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  // Admin pages have no current team, the page links must still show.
+  await page.goto('/admin/stats');
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await expect(page.getByRole('option').filter({ hasText: 'All documents' })).toBeVisible();
+  await expect(page.getByRole('option').filter({ hasText: 'Draft documents' })).toBeVisible();
+  await expect(page.getByRole('option').filter({ hasText: 'All templates' })).toBeVisible();
+
+  // Chips only show for categories with actual results, not for the
+  // hardcoded page links.
+  await expect(page.getByRole('button', { name: /^Documents/ })).toHaveCount(0);
+  await expect(page.getByRole('button', { name: /^Templates/ })).toHaveCount(0);
+  await expect(page.getByRole('button', { name: /^Settings/ })).toBeVisible();
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: theme can be changed from the prompt', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByRole('option').filter({ hasText: 'Change theme' }).first().click();
+
+  // The sub page has a contextual placeholder and a back option.
+  await expect(page.getByPlaceholder('Search themes…')).toBeVisible();
+  await expect(page.getByRole('option').filter({ hasText: 'Back' }).first()).toBeVisible();
+
+  await expect(page.getByRole('option').filter({ hasText: 'Dark Mode' })).toBeVisible();
+
+  await page.getByRole('option').filter({ hasText: 'Dark Mode' }).first().click();
+
+  await expect(page.locator('html')).toHaveClass(/dark/);
+
+  // The back option returns to the root view.
+  await page.getByRole('option').filter({ hasText: 'Back' }).first().click();
+
+  await expect(page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first()).toBeVisible();
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: capped admin groups offer a view all link', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  const namePrefix = `viewall-${nanoid()}`;
+
+  // Seed enough users sharing a name prefix to hit the 5 result cap.
+  for (let i = 0; i < 5; i++) {
+    await seedUser({ name: `${namePrefix}-${i}` });
+  }
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill(namePrefix);
+
+  await expect(page.getByText('Global Users', { exact: true })).toBeVisible();
+
+  const viewAllOption = page.getByRole('option').filter({ hasText: 'View all results' }).first();
+
+  await expect(viewAllOption.getByRole('link')).toHaveAttribute(
+    'href',
+    `/admin/users?search=${encodeURIComponent(namePrefix)}`,
+  );
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: first result is highlighted after every search', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: firstUser } = await seedUser();
+  const { user: secondUser } = await seedUser();
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  const input = page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first();
+
+  // First search selects the first result.
+  await input.fill(String(firstUser.id));
+
+  await expect(page.getByRole('option').filter({ hasText: firstUser.email }).first()).toBeVisible();
+  await expect(page.locator('[cmdk-item]').first()).toHaveAttribute('aria-selected', 'true');
+
+  // A subsequent search with entirely new results must select the first
+  // result again.
+  await input.fill(String(secondUser.id));
+
+  await expect(page.getByRole('option').filter({ hasText: secondUser.email }).first()).toBeVisible();
+  await expect(page.locator('[cmdk-item]').first()).toHaveAttribute('aria-selected', 'true');
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: static items match fuzzy queries', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  // "setg" is a non-contiguous abbreviation of "Settings".
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill('setg');
+
+  // Wait for the debounced filter to apply first, "Draft documents" can
+  // never match "setg" under either matching strategy.
+  await expect(page.getByRole('option').filter({ hasText: 'Draft documents' })).toHaveCount(0);
+
+  await expect(page.getByRole('option').filter({ hasText: 'Settings' }).first()).toBeVisible();
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: page scrollbar is hidden while the prompt is open', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await expect
+    .poll(async () => await page.evaluate(() => getComputedStyle(document.documentElement).overflow))
+    .toBe('hidden');
+
+  await page.keyboard.press('Escape');
+
+  await expect
+    .poll(async () => await page.evaluate(() => getComputedStyle(document.documentElement).overflow))
+    .toBe('visible');
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: non-admin gets the prompt without the admin search', async ({ page }) => {
+  const { user, team } = await seedUser({ isAdmin: false });
+
+  const document = await seedPendingDocument(user, team.id, []);
+
+  const adminSearchRequests: string[] = [];
+
+  page.on('request', (request) => {
+    if (request.url().includes('admin.search')) {
+      adminSearchRequests.push(request.url());
+    }
+  });
+
+  await apiSignin({ page, email: user.email });
+
+  // Non-admins get the same prompt with a non-admin placeholder.
+  await openCommandMenu(page, 'Type a command or search...');
+
+  await expect(page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER)).toHaveCount(0);
+
+  await page.getByPlaceholder('Type a command or search...').first().fill(document.title);
+
+  // Wait for the regular (non-admin) search to resolve so we know the
+  // debounced queries have fired.
+  await expect(page.getByRole('option', { name: document.title })).toBeVisible();
+
+  await expect(page.getByText(/^Global /)).toHaveCount(0);
+  expect(adminSearchRequests).toHaveLength(0);
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: typing on a sub page fires no search requests', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  const searchRequests: string[] = [];
+
+  page.on('request', (request) => {
+    if (/api\/trpc\/(document|template|admin)\.search/.test(request.url())) {
+      searchRequests.push(request.url());
+    }
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByRole('option').filter({ hasText: 'Change theme' }).first().click();
+
+  const input = page.getByPlaceholder('Search themes…');
+
+  await expect(input).toBeVisible();
+
+  // Long enough to pass the admin search threshold if it were enabled.
+  await input.fill('dark');
+
+  // The client-side filter applying proves the typing registered.
+  await expect(page.getByRole('option').filter({ hasText: 'Dark Mode' })).toBeVisible();
+  await expect(page.getByRole('option').filter({ hasText: 'Light Mode' })).toHaveCount(0);
+
+  // Wait out the 200ms search debounce with a wide margin before asserting
+  // that no requests fired: there is no response to anchor on when the
+  // desired behaviour is "no requests at all".
+  await page.waitForTimeout(750);
+
+  expect(searchRequests).toHaveLength(0);
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: failed searches show an error state instead of no results', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  await page.route(/api\/trpc\/(document|template|admin)\.search/, async (route) => {
+    await route.fulfill({ status: 500, contentType: 'application/json', body: '{}' });
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill('zzzz-no-such-thing-9x7q');
+
+  // A failed search must be honest about it, not claim there are no results.
+  await expect(page.getByText('Something went wrong')).toBeVisible();
+  await expect(page.getByText('No results for')).toHaveCount(0);
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: partial search failure still shows results with a notice', async ({ page }) => {
+  const { user: adminUser, team } = await seedUser({ isAdmin: true });
+
+  const document = await seedPendingDocument(adminUser, team.id, [], {
+    createDocumentOptions: { title: `partial-fail-${nanoid()}` },
+  });
+
+  // Only the admin search fails: the personal searches succeed.
+  await page.route(/api\/trpc\/admin\.search/, async (route) => {
+    await route.fulfill({ status: 500, contentType: 'application/json', body: '{}' });
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill(document.title);
+
+  // The successful personal document search must still render its results.
+  await expect(page.getByRole('option', { name: document.title })).toBeVisible();
+
+  // The failed admin search must be flagged rather than silently dropped.
+  await expect(page.getByText('Some searches failed')).toBeVisible();
+});
+
+test('[ADMIN][GLOBAL_SEARCH]: over-length query skips the admin search without erroring', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  const adminSearchRequests: string[] = [];
+
+  page.on('request', (request) => {
+    if (request.url().includes('admin.search')) {
+      adminSearchRequests.push(request.url());
+    }
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  await openCommandMenu(page, ADMIN_PROMPT_PLACEHOLDER);
+
+  // The admin search endpoint rejects queries longer than 100 characters, so
+  // the client must not send them. The personal searches accept up to 1024
+  // characters and still run, anchoring the debounced query flush.
+  const documentSearchResponse = page.waitForResponse((response) => response.url().includes('document.search'));
+
+  await page.getByPlaceholder(ADMIN_PROMPT_PLACEHOLDER).first().fill('a'.repeat(150));
+
+  await documentSearchResponse;
+
+  // The personal searches ran and found nothing: the honest empty state, with
+  // no error in sight.
+  await expect(page.getByText('No results for')).toBeVisible();
+  await expect(page.getByText('Something went wrong')).toHaveCount(0);
+
+  expect(adminSearchRequests).toHaveLength(0);
+});

packages/app-tests/e2e/admin/organisations/update-organisation-member-role.spec.ts

@@ -338,7 +338,7 @@ test('[ADMIN]: verify role hierarchy after promotion', async ({ page }) => {
   });
 
   // Verify they can access organisation settings (owner permission)
-  await expect(page.getByText('Organisation Settings')).toBeVisible();
+  await expect(page.getByTestId('unified-settings-sidebar')).toBeVisible();
   await expect(page.getByRole('button', { name: 'Delete' })).toBeVisible();
 });
 
@@ -524,7 +524,7 @@ test('[ADMIN]: verify organisation access after ownership change', async ({ page
   });
 
   // Should be able to access organisation settings
-  await expect(page.getByText('Organisation Settings')).toBeVisible();
+  await expect(page.getByTestId('unified-settings-sidebar')).toBeVisible();
   await expect(page.getByLabel('Organisation Name*')).toBeVisible();
   await expect(page.getByLabel('Organisation Name*')).toBeEnabled();
 
@@ -539,5 +539,5 @@ test('[ADMIN]: verify organisation access after ownership change', async ({ page
   });
 
   // Should still be able to access settings (as they should now be an admin)
-  await expect(page.getByText('Organisation Settings')).toBeVisible();
+  await expect(page.getByTestId('unified-settings-sidebar')).toBeVisible();
 });

packages/app-tests/e2e/api/trpc/admin/admin-search.spec.ts

@@ -0,0 +1,249 @@
+import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
+import { seedPendingDocument } from '@documenso/prisma/seed/documents';
+import { seedUser } from '@documenso/prisma/seed/users';
+import type { Page } from '@playwright/test';
+import { expect, test } from '@playwright/test';
+import { customAlphabet } from 'nanoid';
+
+import { apiSignin } from '../../../fixtures/authentication';
+
+const nanoid = customAlphabet('1234567890abcdef', 10);
+
+const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
+
+test.describe.configure({ mode: 'parallel' });
+
+type AdminSearchGroup = {
+  type: string;
+  results: Array<{ label: string; sublabel?: string; path: string; value: string }>;
+};
+
+const callAdminSearch = async (page: Page, query: string) => {
+  const inputParam = encodeURIComponent(JSON.stringify({ json: { query } }));
+  const url = `${WEBAPP_BASE_URL}/api/trpc/admin.search?input=${inputParam}`;
+
+  const res = await page.context().request.get(url);
+
+  return {
+    res,
+    groups: res.ok()
+      ? // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+        ((await res.json()).result.data.json.groups as AdminSearchGroup[])
+      : null,
+  };
+};
+
+const findGroup = (groups: AdminSearchGroup[] | null, type: string) =>
+  (groups ?? []).find((group) => group.type === type);
+
+// ─── Access control ──────────────────────────────────────────────────────────
+
+test('[ADMIN][TRPC][SEARCH]: unauthenticated request is rejected with 401', async ({ page }) => {
+  const { res } = await callAdminSearch(page, 'anything');
+
+  expect(res.ok()).toBeFalsy();
+  expect(res.status()).toBe(401);
+});
+
+test('[ADMIN][TRPC][SEARCH]: non-admin authenticated user is rejected with 401', async ({ page }) => {
+  const { user: nonAdminUser } = await seedUser({ isAdmin: false });
+
+  await apiSignin({ page, email: nonAdminUser.email });
+
+  const { res } = await callAdminSearch(page, 'anything');
+
+  expect(res.ok()).toBeFalsy();
+  expect(res.status()).toBe(401);
+});
+
+// ─── Numeric queries: verified ID lookups ────────────────────────────────────
+
+test('[ADMIN][TRPC][SEARCH]: numeric query returns verified user and team rows', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: targetUser, team: targetTeam } = await seedUser();
+
+  await apiSignin({ page, email: adminUser.email });
+
+  // Search by user ID.
+  const userSearch = await callAdminSearch(page, String(targetUser.id));
+
+  expect(userSearch.res.ok()).toBeTruthy();
+
+  const userGroup = findGroup(userSearch.groups, 'user');
+  expect(userGroup).toBeDefined();
+  expect(userGroup?.results).toHaveLength(1);
+  expect(userGroup?.results[0].path).toBe(`/admin/users/${targetUser.id}`);
+  expect(userGroup?.results[0].sublabel).toContain(targetUser.email);
+
+  // The cmdk `value` contract: value must contain the raw query.
+  expect(userGroup?.results[0].value).toContain(String(targetUser.id));
+
+  // Search by team ID.
+  const teamSearch = await callAdminSearch(page, String(targetTeam.id));
+
+  expect(teamSearch.res.ok()).toBeTruthy();
+
+  const teamGroup = findGroup(teamSearch.groups, 'team');
+  expect(teamGroup).toBeDefined();
+  expect(teamGroup?.results).toHaveLength(1);
+  expect(teamGroup?.results[0].path).toBe(`/admin/teams/${targetTeam.id}`);
+  expect(teamGroup?.results[0].label).toBe(targetTeam.name);
+});
+
+test('[ADMIN][TRPC][SEARCH]: numeric query returns verified document and recipient rows', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: sender, team } = await seedUser();
+  const { user: recipientUser } = await seedUser();
+
+  const document = await seedPendingDocument(sender, team.id, [recipientUser]);
+  const legacyDocumentId = document.secondaryId.replace('document_', '');
+  const recipient = document.recipients[0];
+
+  await apiSignin({ page, email: adminUser.email });
+
+  // Search by legacy document ID (bare number).
+  const documentSearch = await callAdminSearch(page, legacyDocumentId);
+
+  expect(documentSearch.res.ok()).toBeTruthy();
+
+  const documentGroup = findGroup(documentSearch.groups, 'document');
+  expect(documentGroup).toBeDefined();
+  expect(documentGroup?.results).toHaveLength(1);
+  expect(documentGroup?.results[0].path).toBe(`/admin/documents/${document.id}`);
+  expect(documentGroup?.results[0].label).toBe(document.title);
+
+  // Search by recipient ID: links to the parent document.
+  const recipientSearch = await callAdminSearch(page, String(recipient.id));
+
+  expect(recipientSearch.res.ok()).toBeTruthy();
+
+  const recipientGroup = findGroup(recipientSearch.groups, 'recipient');
+  expect(recipientGroup).toBeDefined();
+  expect(recipientGroup?.results).toHaveLength(1);
+  expect(recipientGroup?.results[0].path).toBe(`/admin/documents/${document.id}`);
+  expect(recipientGroup?.results[0].label).toBe(recipient.email);
+  expect(recipientGroup?.results[0].sublabel).toBe(`#${recipient.id} · ${recipient.name} · ${document.title}`);
+
+  // Search by the full document_<id> secondary ID: exercises the prefix branch.
+  const secondaryIdSearch = await callAdminSearch(page, document.secondaryId);
+
+  expect(secondaryIdSearch.res.ok()).toBeTruthy();
+
+  const secondaryIdGroup = findGroup(secondaryIdSearch.groups, 'document');
+  expect(secondaryIdGroup).toBeDefined();
+  expect(secondaryIdGroup?.results[0].path).toBe(`/admin/documents/${document.id}`);
+});
+
+test('[ADMIN][TRPC][SEARCH]: numeric query with no matches returns no groups', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  const { res, groups } = await callAdminSearch(page, '999999999');
+
+  expect(res.ok()).toBeTruthy();
+  expect(groups).toEqual([]);
+});
+
+test('[ADMIN][TRPC][SEARCH]: oversized number does not error and falls back to text search', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: sender, team } = await seedUser();
+
+  // 99999999999999 exceeds Int4, so it cannot be an ID lookup: it must be
+  // treated as text (and must not 500).
+  const oversizedNumber = '99999999999999';
+
+  const document = await seedPendingDocument(sender, team.id, [], {
+    createDocumentOptions: { title: `${oversizedNumber}-${nanoid()}` },
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  const { res, groups } = await callAdminSearch(page, oversizedNumber);
+
+  expect(res.ok()).toBeTruthy();
+
+  const documentGroup = findGroup(groups, 'document');
+  expect(documentGroup).toBeDefined();
+  expect(documentGroup?.results.map((result) => result.path)).toContain(`/admin/documents/${document.id}`);
+});
+
+// ─── Prefixed ID queries: exact lookups ──────────────────────────────────────
+
+test('[ADMIN][TRPC][SEARCH]: envelope_ and org_ prefixes resolve exact matches', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: sender, organisation, team } = await seedUser();
+
+  const document = await seedPendingDocument(sender, team.id, []);
+
+  await apiSignin({ page, email: adminUser.email });
+
+  // envelope_<id> resolves the document.
+  const envelopeSearch = await callAdminSearch(page, document.id);
+
+  expect(envelopeSearch.res.ok()).toBeTruthy();
+
+  const documentGroup = findGroup(envelopeSearch.groups, 'document');
+  expect(documentGroup).toBeDefined();
+  expect(documentGroup?.results[0].path).toBe(`/admin/documents/${document.id}`);
+
+  // Only the document group is returned for a recognized prefix.
+  expect(envelopeSearch.groups).toHaveLength(1);
+
+  // org_<id> resolves the organisation.
+  const orgSearch = await callAdminSearch(page, organisation.id);
+
+  expect(orgSearch.res.ok()).toBeTruthy();
+
+  const orgGroup = findGroup(orgSearch.groups, 'organisation');
+  expect(orgGroup).toBeDefined();
+  expect(orgGroup?.results[0].path).toBe(`/admin/organisations/${organisation.id}`);
+  expect(orgGroup?.results[0].label).toBe(organisation.name);
+
+  // Only the organisation group is returned for a recognized prefix.
+  expect(orgSearch.groups).toHaveLength(1);
+});
+
+// ─── Free text queries ───────────────────────────────────────────────────────
+
+test('[ADMIN][TRPC][SEARCH]: text query matches documents by title and users by email', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+  const { user: sender, team } = await seedUser();
+
+  // A unique title: the default seeded title is shared across the whole suite,
+  // and global search only returns the newest few matches.
+  const document = await seedPendingDocument(sender, team.id, [], {
+    createDocumentOptions: { title: `admin-search-${nanoid()}` },
+  });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  // Search by document title.
+  const titleSearch = await callAdminSearch(page, document.title);
+
+  expect(titleSearch.res.ok()).toBeTruthy();
+
+  const documentGroup = findGroup(titleSearch.groups, 'document');
+  expect(documentGroup).toBeDefined();
+  expect(documentGroup?.results.map((result) => result.path)).toContain(`/admin/documents/${document.id}`);
+
+  // Search by user email (emails are unique nanoid-based, so this is specific).
+  const emailSearch = await callAdminSearch(page, sender.email);
+
+  expect(emailSearch.res.ok()).toBeTruthy();
+
+  const userGroup = findGroup(emailSearch.groups, 'user');
+  expect(userGroup).toBeDefined();
+  expect(userGroup?.results[0].path).toBe(`/admin/users/${sender.id}`);
+});
+
+test('[ADMIN][TRPC][SEARCH]: gibberish query returns no groups', async ({ page }) => {
+  const { user: adminUser } = await seedUser({ isAdmin: true });
+
+  await apiSignin({ page, email: adminUser.email });
+
+  const { res, groups } = await callAdminSearch(page, 'zzzz-no-such-thing-9x7q');
+
+  expect(res.ok()).toBeTruthy();
+  expect(groups).toEqual([]);
+});

packages/app-tests/e2e/api/v1/document-sending.spec.ts

@@ -2,10 +2,20 @@ import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
 import { createApiToken } from '@documenso/lib/server-only/public-api/create-api-token';
 import { mapSecondaryIdToDocumentId } from '@documenso/lib/utils/envelope';
 import { prisma } from '@documenso/prisma';
-import { FieldType, RecipientRole } from '@documenso/prisma/client';
+import {
+  DocumentSigningOrder,
+  DocumentStatus,
+  FieldType,
+  RecipientRole,
+  SendStatus,
+  SigningStatus,
+} from '@documenso/prisma/client';
 import { seedBlankDocument, seedPendingDocumentWithFullFields } from '@documenso/prisma/seed/documents';
 import { seedUser } from '@documenso/prisma/seed/users';
 import { expect, test } from '@playwright/test';
+import { nanoid } from 'nanoid';
+
+import { signSignaturePad } from '../../fixtures/signature';
 
 test.describe('Document API', () => {
   test('sendDocument: should respect sendCompletionEmails setting', async ({ request }) => {
@@ -432,4 +442,194 @@ test.describe('Document API', () => {
     expect(response.ok()).toBeTruthy();
     expect(response.status()).toBe(200);
   });
+
+  test('sendDocument: should complete document immediately when all recipients are CC', async ({ request }) => {
+    const { user, team } = await seedUser();
+
+    // Create a blank document and get it with envelope items
+    const blankDocument = await seedBlankDocument(user, team.id);
+    const document = await prisma.envelope.findUniqueOrThrow({
+      where: { id: blankDocument.id },
+      include: { envelopeItems: true },
+    });
+
+    // Add two CC recipients without any fields, mirroring the production
+    // state where CC recipients are created pre-signed.
+    for (const email of ['cc1@example.com', 'cc2@example.com']) {
+      await prisma.recipient.create({
+        data: {
+          email,
+          name: 'Test CC',
+          role: RecipientRole.CC,
+          signingStatus: SigningStatus.SIGNED,
+          sendStatus: SendStatus.SENT,
+          token: nanoid(),
+          envelopeId: document.id,
+        },
+      });
+    }
+
+    const { token } = await createApiToken({
+      userId: user.id,
+      teamId: team.id,
+      tokenName: 'test',
+      expiresIn: null,
+    });
+
+    const response = await request.post(
+      `${NEXT_PUBLIC_WEBAPP_URL()}/api/v1/documents/${mapSecondaryIdToDocumentId(document.secondaryId)}/send`,
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+        },
+        data: {},
+      },
+    );
+
+    expect(response.ok()).toBeTruthy();
+    expect(response.status()).toBe(200);
+
+    // The document seals asynchronously and completes without anyone signing.
+    await expect
+      .poll(
+        async () => {
+          const updatedDocument = await prisma.envelope.findFirstOrThrow({
+            where: { id: document.id },
+          });
+
+          return updatedDocument.status;
+        },
+        { timeout: 30_000 },
+      )
+      .toBe(DocumentStatus.COMPLETED);
+  });
+
+  test('sendDocument: should not block initial sequential send when CC recipient is first in signing order', async ({
+    request,
+    page,
+  }) => {
+    const { user, team } = await seedUser();
+
+    // Create a blank document and get it with envelope items
+    const blankDocument = await seedBlankDocument(user, team.id);
+    const document = await prisma.envelope.findUniqueOrThrow({
+      where: { id: blankDocument.id },
+      include: { envelopeItems: true },
+    });
+
+    await prisma.documentMeta.update({
+      where: { id: document.documentMetaId },
+      data: { signingOrder: DocumentSigningOrder.SEQUENTIAL },
+    });
+
+    // CC recipient first in the signing order, mirroring the production
+    // state where CC recipients are created pre-signed.
+    await prisma.recipient.create({
+      data: {
+        email: 'cc@example.com',
+        name: 'Test CC',
+        role: RecipientRole.CC,
+        signingOrder: 1,
+        signingStatus: SigningStatus.SIGNED,
+        sendStatus: SendStatus.SENT,
+        token: nanoid(),
+        envelopeId: document.id,
+      },
+    });
+
+    const [signerA, signerB] = await Promise.all(
+      [
+        { email: 'signer-a@example.com', name: 'Signer A', signingOrder: 2 },
+        { email: 'signer-b@example.com', name: 'Signer B', signingOrder: 3 },
+      ].map(async ({ email, name, signingOrder }) =>
+        prisma.recipient.create({
+          data: {
+            email,
+            name,
+            role: RecipientRole.SIGNER,
+            signingOrder,
+            token: nanoid(),
+            envelopeId: document.id,
+            fields: {
+              create: {
+                type: FieldType.SIGNATURE,
+                page: 1,
+                positionX: signingOrder * 10,
+                positionY: 10,
+                width: 5,
+                height: 5,
+                customText: '',
+                inserted: false,
+                envelopeId: document.id,
+                envelopeItemId: document.envelopeItems[0].id,
+                fieldMeta: { type: 'signature', fontSize: 14 },
+              },
+            },
+          },
+        }),
+      ),
+    );
+
+    const { token } = await createApiToken({
+      userId: user.id,
+      teamId: team.id,
+      tokenName: 'test',
+      expiresIn: null,
+    });
+
+    const response = await request.post(
+      `${NEXT_PUBLIC_WEBAPP_URL()}/api/v1/documents/${mapSecondaryIdToDocumentId(document.secondaryId)}/send`,
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+        },
+        data: {},
+      },
+    );
+
+    expect(response.ok()).toBeTruthy();
+    expect(response.status()).toBe(200);
+
+    // The CC recipient at order 1 must not block signer A at order 2.
+    await page.goto(`/sign/${signerA.token}`);
+    await expect(page).not.toHaveURL(`/sign/${signerA.token}/waiting`);
+    await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
+
+    // Signer B at order 3 must still wait for signer A.
+    await page.goto(`/sign/${signerB.token}`);
+    await expect(page).toHaveURL(`/sign/${signerB.token}/waiting`);
+
+    // Sign as signer A then signer B.
+    for (const signer of [signerA, signerB]) {
+      await page.goto(`/sign/${signer.token}`);
+      await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
+      await signSignaturePad(page);
+
+      const signerField = await prisma.field.findFirstOrThrow({
+        where: { recipientId: signer.id },
+      });
+
+      await page.locator(`#field-${signerField.id}`).getByRole('button').click();
+
+      await page.getByRole('button', { name: 'Complete' }).click();
+      await page.getByRole('button', { name: 'Sign' }).click();
+      await page.waitForURL(`/sign/${signer.token}/complete`);
+    }
+
+    // The document completes without any action from the CC recipient.
+    await expect
+      .poll(
+        async () => {
+          const updatedDocument = await prisma.envelope.findFirstOrThrow({
+            where: { id: document.id },
+          });
+
+          return updatedDocument.status;
+        },
+        { timeout: 30_000 },
+      )
+      .toBe(DocumentStatus.COMPLETED);
+  });
 });

packages/app-tests/e2e/api/v1/organisation-rate-limits.spec.ts

@@ -50,7 +50,7 @@ import type { Organisation, Team, User } from '@prisma/client';
  *
  * --- GLOBAL LIMIT AWARENESS ---
  * apps/remix/server/router.ts applies a GLOBAL per-IP limiter to /api/v1/*:
- *   apiV1RateLimit = 100 requests / 1 minute (action `api.v1`, see rate-limits.ts).
+ *   apiV1RateLimit = 1000 requests / 1 minute (action `api.v1`, see rate-limits.ts).
  * Every per-org limit/quota configured here is kept FAR below that ceiling (single
  * digits) and the suite runs serially so the shared-IP global bucket is never the
  * thing that trips. A global-limit 429 is shaped `{ error }` whereas an org-limit
@@ -62,7 +62,7 @@ const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
 const baseUrl = `${WEBAPP_BASE_URL}/api/v1`;
 
 // Run serially: all workers share one IP, and the global /api/v1 limiter is
-// per-IP. Serial execution keeps the shared global bucket well under 100/min.
+// per-IP. Serial execution keeps the shared global bucket well under 1000/min.
 test.describe.configure({ mode: 'serial' });
 
 // This suite is only meaningful with real rate limiting enabled. CI sets the
@@ -125,7 +125,7 @@ const setClaimLimits = async (team: Team, limits: ClaimLimits) => {
  * GLOBAL /api/v1 IP bucket so a fresh scenario starts from zero.
  *
  * - The org windowed limiter keys its rows `ip:org:<id>`.
- * - The GLOBAL limiter (apps/remix/server/router.ts -> apiV1RateLimit, 100/min
+ * - The GLOBAL limiter (apps/remix/server/router.ts -> apiV1RateLimit, 1000/min
  *   per IP, action `api.v1`) is shared by EVERY v1 request from this test client.
  *   Across the suite (and especially across repeated local runs within the same
  *   minute) that shared bucket would otherwise fill up and trip BEFORE the org

packages/app-tests/e2e/api/v2/find-documents.spec.ts

@@ -1,7 +1,13 @@
 import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
 import { createApiToken } from '@documenso/lib/server-only/public-api/create-api-token';
 import { prisma } from '@documenso/prisma';
-import { DocumentStatus, DocumentVisibility, TeamMemberRole } from '@documenso/prisma/client';
+import {
+  DocumentStatus,
+  DocumentVisibility,
+  RecipientRole,
+  SigningStatus,
+  TeamMemberRole,
+} from '@documenso/prisma/client';
 import {
   seedBlankDocument,
   seedCompletedDocument,
@@ -1560,3 +1566,307 @@ test.describe('Find Documents API - Adversarial: Cross-Team templateId', () => {
     expect(ownTemplate!.data[0].title).toBe('TeamA Doc from Template');
   });
 });
+
+test.describe('Find Documents API - Expired Recipient Filter', () => {
+  const PAST = new Date(Date.now() - 24 * 60 * 60 * 1000);
+  const FUTURE = new Date(Date.now() + 24 * 60 * 60 * 1000);
+
+  test('hasExpiredRecipients=true returns only docs with an expired, unsigned, non-CC recipient', async ({
+    request,
+  }) => {
+    const { user, team } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    const { token } = await createApiToken({
+      userId: user.id,
+      teamId: team.id,
+      tokenName: 'expired-token',
+      expiresIn: null,
+    });
+
+    const expiredDoc = await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired Recipient Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: expiredDoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    const activeDoc = await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Active Recipient Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: activeDoc.id },
+      data: { expiresAt: FUTURE },
+    });
+
+    await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'No Expiry Doc' },
+    });
+
+    const { json } = await findDocuments(request, token, { hasExpiredRecipients: 'true' });
+    const titles = json!.data.map((d) => d.title);
+    expect(titles).toContain('Expired Recipient Doc');
+    expect(titles).not.toContain('Active Recipient Doc');
+    expect(titles).not.toContain('No Expiry Doc');
+    expect(json!.count).toBe(1);
+  });
+
+  test('hasExpiredRecipients=false (and omitted) does not filter by expiry', async ({ request }) => {
+    const { user, team } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    const { token } = await createApiToken({
+      userId: user.id,
+      teamId: team.id,
+      tokenName: 'expired-false-token',
+      expiresIn: null,
+    });
+
+    const expiredDoc = await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: expiredDoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Active Doc' },
+    });
+
+    // "false" must NOT be coerced to true — both docs should be returned.
+    const { json: falseJson } = await findDocuments(request, token, { hasExpiredRecipients: 'false' });
+    expect(falseJson!.count).toBe(2);
+
+    const { json: omittedJson } = await findDocuments(request, token);
+    expect(omittedJson!.count).toBe(2);
+  });
+
+  test('excludes signed and CC recipients from the expired filter', async ({ request }) => {
+    const { user, team } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    const { token } = await createApiToken({
+      userId: user.id,
+      teamId: team.id,
+      tokenName: 'expired-exclude-token',
+      expiresIn: null,
+    });
+
+    const signedDoc = await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired but Signed' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: signedDoc.id },
+      data: { expiresAt: PAST, signingStatus: SigningStatus.SIGNED },
+    });
+
+    const ccDoc = await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired but CC' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: ccDoc.id },
+      data: { expiresAt: PAST, role: RecipientRole.CC },
+    });
+
+    const validDoc = await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired Unsigned Signer' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: validDoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    const { json } = await findDocuments(request, token, { hasExpiredRecipients: 'true' });
+    const titles = json!.data.map((d) => d.title);
+    expect(titles).toContain('Expired Unsigned Signer');
+    expect(titles).not.toContain('Expired but Signed');
+    expect(titles).not.toContain('Expired but CC');
+    expect(json!.count).toBe(1);
+  });
+});
+
+// ─── Adversarial: Expired Recipient Filter cross-tenant isolation ────────────
+// The expired filter adds an EXISTS subquery over Recipient. These tests ensure
+// that predicate never widens visibility past the caller's team/access scope.
+
+test.describe('Find Documents API - Adversarial: Cross-Team Expired Recipient Filter', () => {
+  const PAST = new Date(Date.now() - 24 * 60 * 60 * 1000);
+
+  test('token scoped to team A must NOT see team B docs with expired recipients', async ({ request }) => {
+    const { user: userA, team: teamA } = await seedUser();
+    const { user: userB, team: teamB } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    const { token: tokenA } = await createApiToken({
+      userId: userA.id,
+      teamId: teamA.id,
+      tokenName: 'teamA-expired-token',
+      expiresIn: null,
+    });
+
+    // Team A: one expired doc the caller is legitimately allowed to see.
+    const teamADoc = await seedPendingDocument(userA, teamA.id, [recipient], {
+      createDocumentOptions: { title: 'TeamA Expired Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamADoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    // Team B: an expired doc that must remain invisible to team A's token.
+    const teamBDoc = await seedPendingDocument(userB, teamB.id, [recipient], {
+      createDocumentOptions: { title: 'TeamB Expired Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamBDoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    const { json } = await findDocuments(request, tokenA, { hasExpiredRecipients: 'true' });
+    const titles = json!.data.map((d) => d.title);
+    expect(titles).toContain('TeamA Expired Doc');
+    expect(titles).not.toContain('TeamB Expired Doc');
+    expect(json!.count).toBe(1);
+  });
+
+  test('shared recipient email across teams does not leak the other team expired docs', async ({ request }) => {
+    // A recipient with the SAME email is on expired docs in both teams. The
+    // filter must still scope strictly to the token's team.
+    const { user: userA, team: teamA } = await seedUser();
+    const { user: userB, team: teamB } = await seedUser();
+    const { user: sharedRecipient } = await seedUser();
+
+    const { token: tokenB } = await createApiToken({
+      userId: userB.id,
+      teamId: teamB.id,
+      tokenName: 'teamB-expired-token',
+      expiresIn: null,
+    });
+
+    const teamADoc = await seedPendingDocument(userA, teamA.id, [sharedRecipient], {
+      createDocumentOptions: { title: 'TeamA Shared-Recipient Expired' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamADoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    const teamBDoc = await seedPendingDocument(userB, teamB.id, [sharedRecipient], {
+      createDocumentOptions: { title: 'TeamB Shared-Recipient Expired' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamBDoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    const { json } = await findDocuments(request, tokenB, { hasExpiredRecipients: 'true' });
+    const titles = json!.data.map((d) => d.title);
+    expect(titles).toContain('TeamB Shared-Recipient Expired');
+    expect(titles).not.toContain('TeamA Shared-Recipient Expired');
+    expect(json!.count).toBe(1);
+  });
+
+  test('x-team-id spoofing with status=EXPIRED is rejected for a non-member', async ({ page }) => {
+    const { team: teamA, owner: ownerA } = await seedTeam();
+    const { team: teamB, owner: ownerB } = await seedTeam();
+    const { user: recipient } = await seedUser();
+
+    const teamADoc = await seedPendingDocument(ownerA, teamA.id, [recipient], {
+      createDocumentOptions: { title: 'TeamA Expired Secret' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamADoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    // ownerB is NOT a member of teamA.
+    await apiSignin({ page, email: ownerB.email });
+
+    const res = await trpcQuery(page, 'document.findDocumentsInternal', teamA.id, {
+      status: 'EXPIRED',
+      page: 1,
+      perPage: 100,
+    });
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(404);
+  });
+
+  test('EXPIRED pseudo-status via session only returns the caller team expired docs (positive control)', async ({
+    page,
+  }) => {
+    const { team: teamA, owner: ownerA } = await seedTeam();
+    const { team: teamB, owner: ownerB } = await seedTeam();
+    const { user: recipient } = await seedUser();
+
+    const teamADoc = await seedPendingDocument(ownerA, teamA.id, [recipient], {
+      createDocumentOptions: { title: 'TeamA Expired Visible' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamADoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    const teamBDoc = await seedPendingDocument(ownerB, teamB.id, [recipient], {
+      createDocumentOptions: { title: 'TeamB Expired Hidden' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamBDoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    await apiSignin({ page, email: ownerA.email });
+
+    const res = await trpcQuery(page, 'document.findDocumentsInternal', teamA.id, {
+      status: 'EXPIRED',
+      page: 1,
+      perPage: 100,
+    });
+
+    expect(res.ok()).toBeTruthy();
+    const data = await res.json();
+    const docs = data.result.data.json.data;
+    const titles = docs.map((d: { title: string }) => d.title);
+    expect(titles).toContain('TeamA Expired Visible');
+    expect(titles).not.toContain('TeamB Expired Hidden');
+  });
+
+  test('EXPIRED stats count is scoped to the caller team and excludes other-team expired docs', async ({ page }) => {
+    const { team: teamA, owner: ownerA } = await seedTeam();
+    const { team: teamB, owner: ownerB } = await seedTeam();
+    const { user: recipient } = await seedUser();
+
+    // One expired doc in team A.
+    const teamADoc = await seedPendingDocument(ownerA, teamA.id, [recipient], {
+      createDocumentOptions: { title: 'TeamA Expired For Stats' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamADoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    // Two expired docs in team B — must NOT bleed into team A's EXPIRED count.
+    for (const title of ['TeamB Expired For Stats 1', 'TeamB Expired For Stats 2']) {
+      const doc = await seedPendingDocument(ownerB, teamB.id, [recipient], {
+        createDocumentOptions: { title },
+      });
+      await prisma.recipient.updateMany({
+        where: { envelopeId: doc.id },
+        data: { expiresAt: PAST },
+      });
+    }
+
+    await apiSignin({ page, email: ownerA.email });
+
+    const res = await trpcQuery(page, 'document.findDocumentsInternal', teamA.id, {
+      page: 1,
+      perPage: 100,
+    });
+
+    expect(res.ok()).toBeTruthy();
+    const data = await res.json();
+    expect(data.result.data.json.stats.EXPIRED).toBe(1);
+  });
+});

packages/app-tests/e2e/api/v2/find-envelopes.spec.ts

@@ -1055,3 +1055,120 @@ test.describe('Find Envelopes API - Cross-User Isolation', () => {
     expect(titles).not.toContain('Member Org Team Env');
   });
 });
+
+test.describe('Find Envelopes API - Expired Recipient Filter', () => {
+  test('hasExpiredRecipients=true returns only envelopes with an expired, unsigned recipient', async ({ request }) => {
+    const { user, team } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    const { token } = await createApiToken({
+      userId: user.id,
+      teamId: team.id,
+      tokenName: 'env-expired-token',
+      expiresIn: null,
+    });
+
+    const expiredEnvelope = await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired Envelope' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: expiredEnvelope.id },
+      data: { expiresAt: new Date(Date.now() - 24 * 60 * 60 * 1000) },
+    });
+
+    await seedPendingDocument(user, team.id, [recipient], {
+      createDocumentOptions: { title: 'Active Envelope' },
+    });
+
+    const { json } = await findEnvelopes(request, token, {
+      type: EnvelopeType.DOCUMENT,
+      hasExpiredRecipients: 'true',
+    });
+    const titles = json!.data.map((d) => d.title);
+    expect(titles).toContain('Expired Envelope');
+    expect(titles).not.toContain('Active Envelope');
+    expect(json!.count).toBe(1);
+  });
+});
+
+// ─── Adversarial: Expired Recipient Filter cross-tenant isolation ────────────
+
+test.describe('Find Envelopes API - Adversarial: Cross-Team Expired Recipient Filter', () => {
+  const PAST = new Date(Date.now() - 24 * 60 * 60 * 1000);
+
+  test('token scoped to team A must NOT see team B envelopes with expired recipients', async ({ request }) => {
+    const { user: userA, team: teamA } = await seedUser();
+    const { user: userB, team: teamB } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    const { token: tokenA } = await createApiToken({
+      userId: userA.id,
+      teamId: teamA.id,
+      tokenName: 'env-teamA-expired-token',
+      expiresIn: null,
+    });
+
+    const teamAEnvelope = await seedPendingDocument(userA, teamA.id, [recipient], {
+      createDocumentOptions: { title: 'TeamA Expired Envelope' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamAEnvelope.id },
+      data: { expiresAt: PAST },
+    });
+
+    const teamBEnvelope = await seedPendingDocument(userB, teamB.id, [recipient], {
+      createDocumentOptions: { title: 'TeamB Expired Envelope' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamBEnvelope.id },
+      data: { expiresAt: PAST },
+    });
+
+    const { json } = await findEnvelopes(request, tokenA, {
+      type: EnvelopeType.DOCUMENT,
+      hasExpiredRecipients: 'true',
+    });
+    const titles = json!.data.map((d) => d.title);
+    expect(titles).toContain('TeamA Expired Envelope');
+    expect(titles).not.toContain('TeamB Expired Envelope');
+    expect(json!.count).toBe(1);
+  });
+
+  test('shared recipient email across teams does not leak the other team expired envelopes', async ({ request }) => {
+    const { user: userA, team: teamA } = await seedUser();
+    const { user: userB, team: teamB } = await seedUser();
+    const { user: sharedRecipient } = await seedUser();
+
+    const { token: tokenB } = await createApiToken({
+      userId: userB.id,
+      teamId: teamB.id,
+      tokenName: 'env-teamB-expired-token',
+      expiresIn: null,
+    });
+
+    const teamAEnvelope = await seedPendingDocument(userA, teamA.id, [sharedRecipient], {
+      createDocumentOptions: { title: 'TeamA Shared Expired Envelope' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamAEnvelope.id },
+      data: { expiresAt: PAST },
+    });
+
+    const teamBEnvelope = await seedPendingDocument(userB, teamB.id, [sharedRecipient], {
+      createDocumentOptions: { title: 'TeamB Shared Expired Envelope' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: teamBEnvelope.id },
+      data: { expiresAt: PAST },
+    });
+
+    const { json } = await findEnvelopes(request, tokenB, {
+      type: EnvelopeType.DOCUMENT,
+      hasExpiredRecipients: 'true',
+    });
+    const titles = json!.data.map((d) => d.title);
+    expect(titles).toContain('TeamB Shared Expired Envelope');
+    expect(titles).not.toContain('TeamA Shared Expired Envelope');
+    expect(json!.count).toBe(1);
+  });
+});

packages/app-tests/e2e/api/v2/organisation-rate-limits.spec.ts

@@ -37,7 +37,7 @@ import type { Organisation, Team, User } from '@prisma/client';
  *
  * --- GLOBAL LIMIT AWARENESS ---
  * apps/remix/server/router.ts applies a GLOBAL per-IP limiter to /api/v2/*:
- *   apiV2RateLimit = 100 requests / 1 minute (see rate-limits.ts).
+ *   apiV2RateLimit = 1000 requests / 1 minute (see rate-limits.ts).
  * Every per-org limit/quota configured here is kept FAR below that ceiling (single
  * digits) and the suite runs serially so the shared-IP global bucket is never the
  * thing that trips. A global-limit 429 is shaped `{ error }` whereas an org-limit
@@ -49,7 +49,7 @@ const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
 const baseUrl = `${WEBAPP_BASE_URL}/api/v2-beta`;
 
 // Run serially: all workers share one IP, and the global /api/v2 limiter is
-// per-IP. Serial execution keeps the shared global bucket well under 100/min.
+// per-IP. Serial execution keeps the shared global bucket well under 1000/min.
 test.describe.configure({ mode: 'serial' });
 
 // This suite is only meaningful with real rate limiting enabled. CI sets the

packages/app-tests/e2e/api/v2/unauthorized-api-access/api-access-file-download.spec.ts

@@ -0,0 +1,118 @@
+import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
+import { seedDraftDocument, seedPendingDocument } from '@documenso/prisma/seed/documents';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, test } from '@playwright/test';
+
+import { apiSignin } from '../../../fixtures/authentication';
+
+const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
+
+test.describe.configure({
+  mode: 'parallel',
+});
+
+const downloadUrl = (envelopeId: string, envelopeItemId: string, version: 'original' | 'signed' | 'pending') =>
+  `${WEBAPP_BASE_URL}/api/files/envelope/${envelopeId}/envelopeItem/${envelopeItemId}/download/${version}`;
+
+const seedOwnerWithDraft = async () => {
+  const owner = await seedUser();
+
+  const draft = await seedDraftDocument(owner.user, owner.team.id, [], {
+    createDocumentOptions: { title: 'File Download Auth Test' },
+  });
+
+  return { owner, draft, draftItem: draft.envelopeItems[0] };
+};
+
+test.describe('Envelope item file download endpoint authorization', () => {
+  test('rejects an unauthenticated download request', async ({ request }) => {
+    const { draft, draftItem } = await seedOwnerWithDraft();
+
+    const res = await request.get(downloadUrl(draft.id, draftItem.id, 'original'));
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(401);
+  });
+
+  test('rejects a download request from a user outside the organisation', async ({ page }) => {
+    const { draft, draftItem } = await seedOwnerWithDraft();
+    const { user: outsider } = await seedUser();
+
+    await apiSignin({ page, email: outsider.email });
+
+    const res = await page.request.get(downloadUrl(draft.id, draftItem.id, 'original'));
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(403);
+  });
+
+  test('returns 404 for a nonexistent envelope', async ({ page }) => {
+    const { user } = await seedUser();
+
+    await apiSignin({ page, email: user.email });
+
+    const res = await page.request.get(
+      downloadUrl('envelope_does_not_exist', 'envelope_item_does_not_exist', 'original'),
+    );
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(404);
+  });
+
+  test('rejects a pending version download for a draft envelope', async ({ page }) => {
+    const { owner, draft, draftItem } = await seedOwnerWithDraft();
+
+    await apiSignin({ page, email: owner.user.email });
+
+    const res = await page.request.get(downloadUrl(draft.id, draftItem.id, 'pending'));
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(400);
+  });
+
+  test('rejects a pending version download for a legacy envelope', async ({ page }) => {
+    const owner = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    // Default internalVersion is 1 (legacy).
+    const pendingDocument = await seedPendingDocument(owner.user, owner.team.id, [recipient], {
+      createDocumentOptions: { title: 'Legacy Pending Download Test' },
+    });
+
+    const envelopeItem = pendingDocument.envelopeItems[0];
+
+    await apiSignin({ page, email: owner.user.email });
+
+    const res = await page.request.get(downloadUrl(pendingDocument.id, envelopeItem.id, 'pending'));
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(400);
+  });
+
+  test('allows the owner to download their own document', async ({ page }) => {
+    const { owner, draft, draftItem } = await seedOwnerWithDraft();
+
+    await apiSignin({ page, email: owner.user.email });
+
+    const res = await page.request.get(downloadUrl(draft.id, draftItem.id, 'original'));
+
+    expect(res.ok()).toBeTruthy();
+    expect(res.headers()['content-type']).toContain('application/pdf');
+
+    const body = await res.body();
+
+    // %PDF magic bytes.
+    expect(Array.from(body.subarray(0, 4))).toEqual([0x25, 0x50, 0x44, 0x46]);
+  });
+
+  test('rejects a recipient-token download with an invalid token', async ({ request }) => {
+    const { draftItem } = await seedOwnerWithDraft();
+
+    const res = await request.get(
+      `${WEBAPP_BASE_URL}/api/files/token/invalid-token-12345/envelopeItem/${draftItem.id}/download/original`,
+    );
+
+    expect(res.ok()).toBeFalsy();
+    expect(res.status()).toBe(404);
+  });
+});

packages/app-tests/e2e/api/v2/unauthorized-api-access/api-access-file-upload.spec.ts

@@ -44,46 +44,6 @@ test.describe('File upload endpoint authorization', () => {
     expect(res.status()).toBe(401);
   });
 
-  test('rejects an unauthenticated presigned-post-url request', async ({ request }) => {
-    const res = await request.post(`${WEBAPP_BASE_URL}/api/files/presigned-post-url`, {
-      headers: { 'Content-Type': 'application/json' },
-      data: { fileName: 'test.pdf', contentType: 'application/pdf' },
-    });
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(401);
-  });
-
-  test('rejects a presigned-post-url request with an invalid presign token', async ({ request }) => {
-    const res = await request.post(`${WEBAPP_BASE_URL}/api/files/presigned-post-url`, {
-      headers: {
-        'Content-Type': 'application/json',
-        Authorization: 'Bearer not-a-real-token',
-      },
-      data: { fileName: 'test.pdf', contentType: 'application/pdf' },
-    });
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(401);
-  });
-
-  test('rejects a presigned-post-url request with a disallowed content type', async ({ request }) => {
-    const { user, team } = await seedUser();
-    const presignToken = await createPresignTokenForUser(user.id, team.id);
-
-    const res = await request.post(`${WEBAPP_BASE_URL}/api/files/presigned-post-url`, {
-      headers: {
-        'Content-Type': 'application/json',
-        Authorization: `Bearer ${presignToken}`,
-      },
-      data: { fileName: 'malware.exe', contentType: 'application/x-msdownload' },
-    });
-
-    // Authenticated, but the content type is not on the allow-list.
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(400);
-  });
-
   test('allows an upload-pdf request authorized by a valid presign token', async ({ request }) => {
     const { user, team } = await seedUser();
     const presignToken = await createPresignTokenForUser(user.id, team.id);

packages/app-tests/e2e/branding-logo-optimise.spec.ts

@@ -0,0 +1,37 @@
+import { optimiseBrandingLogo } from '@documenso/lib/utils/images/logo';
+import { expect, test } from '@playwright/test';
+import sharp from 'sharp';
+
+const makePng = async (width = 1200, height = 1200) =>
+  sharp({
+    create: { width, height, channels: 3, background: { r: 10, g: 20, b: 30 } },
+  })
+    .png()
+    .toBuffer();
+
+test.describe('optimiseBrandingLogo', () => {
+  test('re-encodes a valid image to a PNG buffer', async () => {
+    const input = await makePng();
+
+    const output = await optimiseBrandingLogo(input);
+
+    const metadata = await sharp(output).metadata();
+
+    expect(metadata.format).toBe('png');
+  });
+
+  test('bounds the image to a maximum of 512px on its largest side', async () => {
+    const input = await makePng(2000, 1000);
+
+    const output = await optimiseBrandingLogo(input);
+
+    const metadata = await sharp(output).metadata();
+
+    expect(metadata.width).toBeLessThanOrEqual(512);
+    expect(metadata.height).toBeLessThanOrEqual(512);
+  });
+
+  test('rejects input that is not a valid image', async () => {
+    await expect(optimiseBrandingLogo(Buffer.from('this is not an image'))).rejects.toThrow();
+  });
+});

packages/app-tests/e2e/branding-logo-upload.spec.ts

@@ -0,0 +1,225 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
+import { prisma } from '@documenso/prisma';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, type Page, test } from '@playwright/test';
+
+import { apiSignin } from './fixtures/authentication';
+
+test.describe.configure({ mode: 'parallel' });
+
+const LOGO_PATH = path.join(__dirname, '../../assets/logo.png');
+
+type MultipartFile = { name: string; mimeType: string; buffer: Buffer };
+
+const enableBrandingAndUpload = async (page: Page) => {
+  // Enable custom branding so the file input is no longer disabled.
+  await page.getByTestId('enable-branding').click();
+  await page.getByRole('option', { name: 'Yes' }).click();
+
+  // Upload the logo file through the real multipart route.
+  await page.locator('input[type="file"]').setInputFiles(LOGO_PATH);
+
+  await page.getByRole('button', { name: 'Save changes' }).first().click();
+  await expect(page.getByText('Your branding preferences have been updated').first()).toBeVisible();
+};
+
+/**
+ * POST a logo straight to the dedicated multipart tRPC route using the
+ * authenticated browser cookies. This bypasses the client-side form validation,
+ * which is the only way to exercise the server-side image validation /
+ * sanitisation (`zfdBrandingImageFile` + `optimiseBrandingLogo`) and the entitlement gate.
+ */
+const postOrganisationBrandingLogo = async (page: Page, organisationId: string, file: MultipartFile | null) => {
+  const multipart: Record<string, string | MultipartFile> = {
+    payload: JSON.stringify({ organisationId }),
+  };
+
+  if (file) {
+    multipart.brandingLogo = file;
+  }
+
+  return await page
+    .context()
+    .request.post(`${NEXT_PUBLIC_WEBAPP_URL()}/api/trpc/organisation.settings.updateBrandingLogo`, { multipart });
+};
+
+/**
+ * Grant the organisation the custom-branding entitlement. The positive branding
+ * flows require it whenever billing is enabled; with billing disabled the gate is
+ * bypassed, so this keeps these tests valid in both modes.
+ */
+const grantCustomBranding = async (organisationClaimId: string) => {
+  await prisma.organisationClaim.update({
+    where: { id: organisationClaimId },
+    data: { flags: { allowLegacyEnvelopes: true, allowCustomBranding: true } },
+  });
+};
+
+test('[BRANDING_LOGO]: uploads an organisation branding logo via the dedicated route', async ({ page }) => {
+  const { user, organisation } = await seedUser({ isPersonalOrganisation: false });
+
+  await grantCustomBranding(organisation.organisationClaim.id);
+
+  await apiSignin({
+    page,
+    email: user.email,
+    redirectPath: `/o/${organisation.url}/settings/branding`,
+  });
+
+  await enableBrandingAndUpload(page);
+
+  const settings = await prisma.organisationGlobalSettings.findUniqueOrThrow({
+    where: { id: organisation.organisationGlobalSettingsId },
+  });
+
+  expect(settings.brandingLogo).toBeTruthy();
+
+  const parsed = JSON.parse(settings.brandingLogo);
+  expect(parsed).toHaveProperty('type');
+  expect(parsed).toHaveProperty('data');
+});
+
+test('[BRANDING_LOGO]: uploads a team branding logo via the dedicated route', async ({ page }) => {
+  const { user, team, organisation } = await seedUser({ isPersonalOrganisation: false });
+
+  await grantCustomBranding(organisation.organisationClaim.id);
+
+  await apiSignin({
+    page,
+    email: user.email,
+    redirectPath: `/t/${team.url}/settings/branding`,
+  });
+
+  await enableBrandingAndUpload(page);
+
+  // TeamGlobalSettings has no `teamId` column (the FK lives on Team), so read it
+  // through the team relation.
+  const teamWithSettings = await prisma.team.findUniqueOrThrow({
+    where: { id: team.id },
+    include: { teamGlobalSettings: true },
+  });
+
+  expect(teamWithSettings.teamGlobalSettings?.brandingLogo).toBeTruthy();
+
+  const parsed = JSON.parse(teamWithSettings.teamGlobalSettings?.brandingLogo ?? '');
+  expect(parsed).toHaveProperty('type');
+  expect(parsed).toHaveProperty('data');
+});
+
+test('[BRANDING_LOGO]: clears the organisation branding logo when the user removes it', async ({ page }) => {
+  const { user, organisation } = await seedUser({ isPersonalOrganisation: false });
+
+  await grantCustomBranding(organisation.organisationClaim.id);
+
+  await apiSignin({
+    page,
+    email: user.email,
+    redirectPath: `/o/${organisation.url}/settings/branding`,
+  });
+
+  await enableBrandingAndUpload(page);
+
+  // Confirm the logo was stored before we clear it.
+  const settings = await prisma.organisationGlobalSettings.findUniqueOrThrow({
+    where: { id: organisation.organisationGlobalSettingsId },
+  });
+
+  expect(settings.brandingLogo).toBeTruthy();
+
+  // Remove the logo and save again.
+  await page.getByRole('button', { name: 'Remove' }).click();
+  await page.getByRole('button', { name: 'Save changes' }).first().click();
+
+  // Clearing the logo persists an empty string via the dedicated route.
+  await expect
+    .poll(async () => {
+      const updated = await prisma.organisationGlobalSettings.findUniqueOrThrow({
+        where: { id: organisation.organisationGlobalSettingsId },
+      });
+
+      return updated.brandingLogo;
+    })
+    .toBe('');
+});
+
+test('[BRANDING_LOGO]: validates and sanitises the logo on the server', async ({ page }) => {
+  const { user, organisation } = await seedUser({ isPersonalOrganisation: false });
+
+  await grantCustomBranding(organisation.organisationClaim.id);
+
+  await apiSignin({
+    page,
+    email: user.email,
+    redirectPath: `/o/${organisation.url}/settings/branding`,
+  });
+
+  // Positive control: a genuine PNG is accepted and stored. This also proves the
+  // direct multipart request shape matches what the route expects.
+  const validResponse = await postOrganisationBrandingLogo(page, organisation.id, {
+    name: 'logo.png',
+    mimeType: 'image/png',
+    buffer: fs.readFileSync(LOGO_PATH),
+  });
+
+  expect(validResponse.ok()).toBeTruthy();
+
+  const afterValid = await prisma.organisationGlobalSettings.findUniqueOrThrow({
+    where: { id: organisation.organisationGlobalSettingsId },
+  });
+
+  expect(afterValid.brandingLogo).toBeTruthy();
+
+  // Bytes that pass the MIME/size allowlist but are not a real image must be
+  // rejected by the server (the `sharp` re-encode) without changing stored state.
+  const invalidResponse = await postOrganisationBrandingLogo(page, organisation.id, {
+    name: 'fake.png',
+    mimeType: 'image/png',
+    buffer: Buffer.from('this is definitely not a valid png'),
+  });
+
+  expect(invalidResponse.ok()).toBeFalsy();
+  expect(invalidResponse.status()).toBeGreaterThanOrEqual(400);
+  expect(invalidResponse.status()).toBeLessThan(500);
+
+  const afterInvalid = await prisma.organisationGlobalSettings.findUniqueOrThrow({
+    where: { id: organisation.organisationGlobalSettingsId },
+  });
+
+  // The previously stored, valid logo is left untouched by the rejected upload.
+  expect(afterInvalid.brandingLogo).toBe(afterValid.brandingLogo);
+});
+
+test('[BRANDING_LOGO]: rejects setting a logo without the custom-branding entitlement', async ({ page }) => {
+  // The entitlement is only enforced when billing is enabled; with billing off
+  // the check is intentionally skipped server-side, so this can't be exercised.
+  test.skip(
+    process.env.NEXT_PUBLIC_FEATURE_BILLING_ENABLED !== 'true',
+    'Entitlement is only enforced when billing is enabled.',
+  );
+
+  // Seeded organisations have no `allowCustomBranding` claim flag.
+  const { user, organisation } = await seedUser({ isPersonalOrganisation: false });
+
+  await apiSignin({
+    page,
+    email: user.email,
+    redirectPath: `/o/${organisation.url}/settings/branding`,
+  });
+
+  const response = await postOrganisationBrandingLogo(page, organisation.id, {
+    name: 'logo.png',
+    mimeType: 'image/png',
+    buffer: fs.readFileSync(LOGO_PATH),
+  });
+
+  expect(response.ok()).toBeFalsy();
+
+  const settings = await prisma.organisationGlobalSettings.findUniqueOrThrow({
+    where: { id: organisation.organisationGlobalSettingsId },
+  });
+
+  expect(settings.brandingLogo).toBeFalsy();
+});

packages/app-tests/e2e/command-menu/document-search.spec.ts

@@ -3,6 +3,9 @@ import { seedUser } from '@documenso/prisma/seed/users';
 import { expect, test } from '@playwright/test';
 
 import { apiSignin } from '../fixtures/authentication';
+import { openCommandMenu } from '../fixtures/command-menu';
+
+const COMMAND_MENU_PLACEHOLDER = 'Type a command or search...';
 
 test('[COMMAND_MENU]: should see sent documents', async ({ page }) => {
   const { user, team } = await seedUser();
@@ -14,9 +17,9 @@ test('[COMMAND_MENU]: should see sent documents', async ({ page }) => {
     email: user.email,
   });
 
-  await page.keyboard.press('Meta+K');
+  await openCommandMenu(page, COMMAND_MENU_PLACEHOLDER);
 
-  await page.getByPlaceholder('Type a command or search...').first().fill(document.title);
+  await page.getByPlaceholder(COMMAND_MENU_PLACEHOLDER).first().fill(document.title);
   await expect(page.getByRole('option', { name: document.title })).toBeVisible();
 });
 
@@ -30,9 +33,9 @@ test('[COMMAND_MENU]: should see received documents', async ({ page }) => {
     email: recipient.email,
   });
 
-  await page.keyboard.press('Meta+K');
+  await openCommandMenu(page, COMMAND_MENU_PLACEHOLDER);
 
-  await page.getByPlaceholder('Type a command or search...').first().fill(document.title);
+  await page.getByPlaceholder(COMMAND_MENU_PLACEHOLDER).first().fill(document.title);
   await expect(page.getByRole('option', { name: document.title })).toBeVisible();
 });
 
@@ -46,8 +49,8 @@ test('[COMMAND_MENU]: should be able to search by recipient', async ({ page }) =
     email: user.email,
   });
 
-  await page.keyboard.press('Meta+K');
+  await openCommandMenu(page, COMMAND_MENU_PLACEHOLDER);
 
-  await page.getByPlaceholder('Type a command or search...').first().fill(recipient.email);
+  await page.getByPlaceholder(COMMAND_MENU_PLACEHOLDER).first().fill(recipient.email);
   await expect(page.getByRole('option', { name: document.title })).toBeVisible();
 });

packages/app-tests/e2e/document-auth/next-recipient-dictation.spec.ts

@@ -2,7 +2,14 @@ import { prisma } from '@documenso/prisma';
 import { seedPendingDocumentWithFullFields } from '@documenso/prisma/seed/documents';
 import { seedUser } from '@documenso/prisma/seed/users';
 import { expect, test } from '@playwright/test';
-import { DocumentSigningOrder, DocumentStatus, FieldType, RecipientRole, SigningStatus } from '@prisma/client';
+import {
+  DocumentSigningOrder,
+  DocumentStatus,
+  FieldType,
+  RecipientRole,
+  SendStatus,
+  SigningStatus,
+} from '@prisma/client';
 
 import { signDirectSignaturePad, signSignaturePad } from '../fixtures/signature';
 
@@ -370,3 +377,221 @@ test('[NEXT_RECIPIENT_DICTATION]: should allow assistant to dictate next signer'
     expect(thirdRecipient.role).toBe(RecipientRole.SIGNER);
   }).toPass();
 });
+
+test('[NEXT_RECIPIENT_DICTATION]: should skip CC recipient when dictating next signer', async ({ page }) => {
+  const { user, team } = await seedUser();
+  const { user: firstSigner } = await seedUser();
+  const { user: ccUser } = await seedUser();
+  const { user: secondSigner } = await seedUser();
+
+  const { recipients, document } = await seedPendingDocumentWithFullFields({
+    owner: user,
+    teamId: team.id,
+    recipients: [firstSigner, ccUser, secondSigner],
+    recipientsCreateOptions: [
+      { signingOrder: 1 },
+      {
+        // CC recipients are created pre-signed, mirroring production behaviour.
+        signingOrder: 2,
+        role: RecipientRole.CC,
+        signingStatus: SigningStatus.SIGNED,
+        sendStatus: SendStatus.SENT,
+      },
+      { signingOrder: 3 },
+    ],
+    updateDocumentOptions: {
+      documentMeta: {
+        upsert: {
+          create: {
+            allowDictateNextSigner: true,
+            signingOrder: DocumentSigningOrder.SEQUENTIAL,
+          },
+          update: {
+            allowDictateNextSigner: true,
+            signingOrder: DocumentSigningOrder.SEQUENTIAL,
+          },
+        },
+      },
+    },
+  });
+
+  const firstRecipient = recipients.find((r) => r.email === firstSigner.email);
+  const ccRecipient = recipients.find((r) => r.email === ccUser.email);
+
+  if (!firstRecipient || !ccRecipient) {
+    throw new Error('Recipients not found');
+  }
+
+  // CC recipients cannot have fields.
+  await prisma.field.deleteMany({
+    where: {
+      recipientId: ccRecipient.id,
+    },
+  });
+
+  const { token, fields } = firstRecipient;
+
+  const signUrl = `/sign/${token}`;
+
+  await page.goto(signUrl);
+  await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
+
+  await signSignaturePad(page);
+
+  // Fill in all fields
+  for (const field of fields) {
+    await page.locator(`#field-${field.id}`).getByRole('button').click();
+
+    if (field.type === FieldType.TEXT) {
+      await page.locator('#custom-text').fill('TEXT');
+      await page.getByRole('button', { name: 'Save' }).click();
+    }
+
+    await expect(page.locator(`#field-${field.id}`)).toHaveAttribute('data-inserted', 'true');
+  }
+
+  // Complete signing and verify the offered next recipient
+  await page.getByRole('button', { name: 'Complete' }).click();
+
+  await expect(page.getByRole('dialog')).toBeVisible();
+  await expect(page.getByText('Next Recipient Name')).toBeVisible();
+
+  // The dictation dialog must offer the second signer, not the CC recipient.
+  const dialog = page.getByRole('dialog');
+  await expect(dialog.getByLabel('Name')).toHaveValue(secondSigner.name ?? '');
+  await expect(dialog.getByLabel('Email')).toHaveValue(secondSigner.email);
+
+  // Submit and verify completion
+  await page.getByRole('button', { name: 'Sign' }).click();
+  await page.waitForURL(`${signUrl}/complete`);
+
+  // Verify document and recipient states
+  const updatedDocument = await prisma.envelope.findUniqueOrThrow({
+    where: { id: document.id },
+    include: {
+      recipients: {
+        orderBy: { signingOrder: 'asc' },
+      },
+    },
+  });
+
+  // Document should still be pending as the second signer has not signed
+  expect(updatedDocument.status).toBe(DocumentStatus.PENDING);
+
+  // The CC recipient must remain untouched
+  const updatedCcRecipient = updatedDocument.recipients[1];
+  expect(updatedCcRecipient.email).toBe(ccUser.email);
+  expect(updatedCcRecipient.role).toBe(RecipientRole.CC);
+  expect(updatedCcRecipient.signingStatus).toBe(SigningStatus.SIGNED);
+
+  // The second signer must remain the next pending recipient
+  const updatedSecondRecipient = updatedDocument.recipients[2];
+  expect(updatedSecondRecipient.email).toBe(secondSigner.email);
+  expect(updatedSecondRecipient.signingOrder).toBe(3);
+  expect(updatedSecondRecipient.signingStatus).toBe(SigningStatus.NOT_SIGNED);
+});
+
+test('[NEXT_RECIPIENT_DICTATION]: should not offer dictation when CC recipient is last', async ({ page }) => {
+  const { user, team } = await seedUser();
+  const { user: firstSigner } = await seedUser();
+  const { user: secondSigner } = await seedUser();
+  const { user: ccUser } = await seedUser();
+
+  const { recipients, document } = await seedPendingDocumentWithFullFields({
+    owner: user,
+    teamId: team.id,
+    recipients: [firstSigner, secondSigner, ccUser],
+    recipientsCreateOptions: [
+      { signingOrder: 1 },
+      { signingOrder: 2 },
+      {
+        // CC recipients are created pre-signed, mirroring production behaviour.
+        signingOrder: 3,
+        role: RecipientRole.CC,
+        signingStatus: SigningStatus.SIGNED,
+        sendStatus: SendStatus.SENT,
+      },
+    ],
+    updateDocumentOptions: {
+      documentMeta: {
+        upsert: {
+          create: {
+            allowDictateNextSigner: true,
+            signingOrder: DocumentSigningOrder.SEQUENTIAL,
+          },
+          update: {
+            allowDictateNextSigner: true,
+            signingOrder: DocumentSigningOrder.SEQUENTIAL,
+          },
+        },
+      },
+    },
+  });
+
+  const firstRecipient = recipients.find((r) => r.email === firstSigner.email);
+  const secondRecipient = recipients.find((r) => r.email === secondSigner.email);
+  const ccRecipient = recipients.find((r) => r.email === ccUser.email);
+
+  if (!firstRecipient || !secondRecipient || !ccRecipient) {
+    throw new Error('Recipients not found');
+  }
+
+  // CC recipients cannot have fields.
+  await prisma.field.deleteMany({
+    where: {
+      recipientId: ccRecipient.id,
+    },
+  });
+
+  // Sign as both signers in order.
+  for (const recipient of [firstRecipient, secondRecipient]) {
+    const { token, fields } = recipient;
+
+    const signUrl = `/sign/${token}`;
+
+    await page.goto(signUrl);
+    await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
+
+    await signSignaturePad(page);
+
+    // Fill in all fields
+    for (const field of fields) {
+      await page.locator(`#field-${field.id}`).getByRole('button').click();
+
+      if (field.type === FieldType.TEXT) {
+        await page.locator('#custom-text').fill('TEXT');
+        await page.getByRole('button', { name: 'Save' }).click();
+      }
+
+      await expect(page.locator(`#field-${field.id}`)).toHaveAttribute('data-inserted', 'true');
+    }
+
+    // Complete signing
+    await page.getByRole('button', { name: 'Complete' }).click();
+
+    await expect(page.getByRole('dialog')).toBeVisible();
+
+    if (recipient.id === secondRecipient.id) {
+      // The last actionable signer must not be offered the CC recipient.
+      await expect(page.getByText('Next Recipient Name')).not.toBeVisible();
+    }
+
+    // Submit and verify completion
+    await page.getByRole('button', { name: 'Sign' }).click();
+    await page.waitForURL(`${signUrl}/complete`);
+  }
+
+  // The document completes without any action from the CC recipient.
+  await expect
+    .poll(
+      async () => {
+        const finalDocument = await prisma.envelope.findUniqueOrThrow({
+          where: { id: document.id },
+        });
+
+        return finalDocument.status;
+      },
+      { timeout: 30_000 },
+    )
+    .toBe(DocumentStatus.COMPLETED);
+});

packages/app-tests/e2e/document-flow/stepper-component.spec.ts

@@ -4,7 +4,14 @@ import { prisma } from '@documenso/prisma';
 import { seedBlankDocument, seedPendingDocumentWithFullFields } from '@documenso/prisma/seed/documents';
 import { seedUser } from '@documenso/prisma/seed/users';
 import { expect, test } from '@playwright/test';
-import { DocumentSigningOrder, DocumentStatus, FieldType, RecipientRole, SigningStatus } from '@prisma/client';
+import {
+  DocumentSigningOrder,
+  DocumentStatus,
+  FieldType,
+  RecipientRole,
+  SendStatus,
+  SigningStatus,
+} from '@prisma/client';
 import { DateTime } from 'luxon';
 
 import { apiSignin } from '../fixtures/authentication';
@@ -225,15 +232,20 @@ test('[DOCUMENT_FLOW]: should be able to create a document with multiple recipie
   await page.getByLabel('Receives copy').click();
   await page.getByRole('button', { name: 'Add Signer' }).click();
 
-  await page.getByLabel('Email').nth(2).fill('user3@example.com');
-  await page.getByLabel('Name').nth(2).fill('User 3');
-  await page.getByRole('combobox').nth(2).click();
+  // CC recipients are kept last, so new rows are inserted above the CC row.
+  await expect(page.getByLabel('Email')).toHaveCount(3);
+
+  await page.getByLabel('Email').nth(1).fill('user3@example.com');
+  await page.getByLabel('Name').nth(1).fill('User 3');
+  await page.getByRole('combobox').nth(1).click();
   await page.getByLabel('Needs to approve').click();
   await page.getByRole('button', { name: 'Add Signer' }).click();
 
-  await page.getByLabel('Email').nth(3).fill('user4@example.com');
-  await page.getByLabel('Name').nth(3).fill('User 4');
-  await page.getByRole('combobox').nth(3).click();
+  await expect(page.getByLabel('Email')).toHaveCount(4);
+
+  await page.getByLabel('Email').nth(2).fill('user4@example.com');
+  await page.getByLabel('Name').nth(2).fill('User 4');
+  await page.getByRole('combobox').nth(2).click();
   await page.getByLabel('Needs to view').click();
 
   await page.getByRole('button', { name: 'Continue' }).click();
@@ -661,3 +673,182 @@ test('[DOCUMENT_FLOW]: should prevent out-of-order signing in sequential mode',
   await expect(page).not.toHaveURL(`/sign/${activeRecipient?.token}/waiting`);
   await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
 });
+
+test('[DOCUMENT_FLOW]: should skip CC recipients in sequential signing order', async ({ page }) => {
+  const { user, team } = await seedUser();
+
+  const { document, recipients } = await seedPendingDocumentWithFullFields({
+    teamId: team.id,
+    owner: user,
+    recipients: ['signer1@example.com', 'cc@example.com', 'signer2@example.com'],
+    fields: [FieldType.SIGNATURE],
+    recipientsCreateOptions: [
+      { signingOrder: 1 },
+      {
+        // CC recipients are created pre-signed, mirroring production behaviour.
+        signingOrder: 2,
+        role: RecipientRole.CC,
+        signingStatus: SigningStatus.SIGNED,
+        sendStatus: SendStatus.SENT,
+      },
+      { signingOrder: 3 },
+    ],
+  });
+
+  await prisma.documentMeta.update({
+    where: {
+      id: document.documentMetaId,
+    },
+    data: {
+      signingOrder: DocumentSigningOrder.SEQUENTIAL,
+    },
+  });
+
+  const firstSigner = recipients.find((r) => r.email === 'signer1@example.com');
+  const ccRecipient = recipients.find((r) => r.email === 'cc@example.com');
+  const lastSigner = recipients.find((r) => r.email === 'signer2@example.com');
+
+  // CC recipients cannot have fields.
+  await prisma.field.deleteMany({
+    where: {
+      recipientId: ccRecipient?.id,
+    },
+  });
+
+  // Sequential order is enforced: the last signer must wait while the first signer is pending.
+  await page.goto(`/sign/${lastSigner?.token}`);
+  await expect(page).toHaveURL(`/sign/${lastSigner?.token}/waiting`);
+
+  // Sign as the first signer.
+  await page.goto(`/sign/${firstSigner?.token}`);
+  await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
+  await signSignaturePad(page);
+
+  const firstSignerField = await prisma.field.findFirstOrThrow({
+    where: { recipientId: firstSigner?.id },
+  });
+
+  await page.locator(`#field-${firstSignerField.id}`).getByRole('button').click();
+
+  await page.getByRole('button', { name: 'Complete' }).click();
+  await page.getByRole('button', { name: 'Sign' }).click();
+  await page.waitForURL(`/sign/${firstSigner?.token}/complete`);
+
+  // The CC recipient at order 2 must not block the last signer at order 3.
+  await page.goto(`/sign/${lastSigner?.token}`);
+  await expect(page).not.toHaveURL(`/sign/${lastSigner?.token}/waiting`);
+  await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
+
+  await signSignaturePad(page);
+
+  const lastSignerField = await prisma.field.findFirstOrThrow({
+    where: { recipientId: lastSigner?.id },
+  });
+
+  await page.locator(`#field-${lastSignerField.id}`).getByRole('button').click();
+
+  await page.getByRole('button', { name: 'Complete' }).click();
+  await page.getByRole('button', { name: 'Sign' }).click();
+  await page.waitForURL(`/sign/${lastSigner?.token}/complete`);
+
+  // The document completes without any action from the CC recipient.
+  await expect
+    .poll(
+      async () => {
+        const finalDocument = await prisma.envelope.findFirstOrThrow({
+          where: { id: document.id },
+        });
+
+        return finalDocument.status;
+      },
+      { timeout: 30_000 },
+    )
+    .toBe(DocumentStatus.COMPLETED);
+});
+
+test('[DOCUMENT_FLOW]: should skip unsigned CC recipients in sequential signing order', async ({ page }) => {
+  const { user, team } = await seedUser();
+
+  const { document, recipients } = await seedPendingDocumentWithFullFields({
+    teamId: team.id,
+    owner: user,
+    recipients: ['signer1@example.com', 'cc@example.com', 'signer2@example.com'],
+    fields: [FieldType.SIGNATURE],
+    recipientsCreateOptions: [
+      { signingOrder: 1 },
+      {
+        // Legacy/inconsistent data: a CC recipient that was never marked as signed.
+        signingOrder: 2,
+        role: RecipientRole.CC,
+        signingStatus: SigningStatus.NOT_SIGNED,
+      },
+      { signingOrder: 3 },
+    ],
+  });
+
+  await prisma.documentMeta.update({
+    where: {
+      id: document.documentMetaId,
+    },
+    data: {
+      signingOrder: DocumentSigningOrder.SEQUENTIAL,
+    },
+  });
+
+  const firstSigner = recipients.find((r) => r.email === 'signer1@example.com');
+  const ccRecipient = recipients.find((r) => r.email === 'cc@example.com');
+  const lastSigner = recipients.find((r) => r.email === 'signer2@example.com');
+
+  // CC recipients cannot have fields.
+  await prisma.field.deleteMany({
+    where: {
+      recipientId: ccRecipient?.id,
+    },
+  });
+
+  // Sign as the first signer.
+  await page.goto(`/sign/${firstSigner?.token}`);
+  await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
+  await signSignaturePad(page);
+
+  const firstSignerField = await prisma.field.findFirstOrThrow({
+    where: { recipientId: firstSigner?.id },
+  });
+
+  await page.locator(`#field-${firstSignerField.id}`).getByRole('button').click();
+
+  await page.getByRole('button', { name: 'Complete' }).click();
+  await page.getByRole('button', { name: 'Sign' }).click();
+  await page.waitForURL(`/sign/${firstSigner?.token}/complete`);
+
+  // The unsigned CC recipient at order 2 must not block the last signer at order 3.
+  await page.goto(`/sign/${lastSigner?.token}`);
+  await expect(page).not.toHaveURL(`/sign/${lastSigner?.token}/waiting`);
+  await expect(page.getByRole('heading', { name: 'Sign Document' })).toBeVisible();
+
+  await signSignaturePad(page);
+
+  const lastSignerField = await prisma.field.findFirstOrThrow({
+    where: { recipientId: lastSigner?.id },
+  });
+
+  await page.locator(`#field-${lastSignerField.id}`).getByRole('button').click();
+
+  await page.getByRole('button', { name: 'Complete' }).click();
+  await page.getByRole('button', { name: 'Sign' }).click();
+  await page.waitForURL(`/sign/${lastSigner?.token}/complete`);
+
+  // The document completes without any action from the CC recipient.
+  await expect
+    .poll(
+      async () => {
+        const finalDocument = await prisma.envelope.findFirstOrThrow({
+          where: { id: document.id },
+        });
+
+        return finalDocument.status;
+      },
+      { timeout: 30_000 },
+    )
+    .toBe(DocumentStatus.COMPLETED);
+});

packages/app-tests/e2e/documents/bulk-document-actions.spec.ts

@@ -1,3 +1,5 @@
+import fs from 'node:fs';
+import { createTeam } from '@documenso/lib/server-only/team/create-team';
 import { prisma } from '@documenso/prisma';
 import { seedCompletedDocument, seedDraftDocument, seedPendingDocument } from '@documenso/prisma/seed/documents';
 import { seedBlankFolder } from '@documenso/prisma/seed/folders';
@@ -5,6 +7,7 @@ import { seedTeam, seedTeamMember } from '@documenso/prisma/seed/teams';
 import { seedUser } from '@documenso/prisma/seed/users';
 import { expect, test } from '@playwright/test';
 import { DocumentStatus, TeamMemberRole } from '@prisma/client';
+import { unzipSync } from 'fflate';
 
 import { apiSignin, apiSignout } from '../fixtures/authentication';
 import { expectToastTextToBeVisible } from '../fixtures/generic';
@@ -50,10 +53,10 @@ test('[BULK_ACTIONS]: can select multiple documents with checkboxes', async ({ p
   });
 
   await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
-  await expect(page.getByText('1 selected')).toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
 
   await page.locator('tr', { hasText: 'Bulk Test Doc 2' }).getByRole('checkbox').click();
-  await expect(page.getByText('2 selected')).toBeVisible();
+  await expect(page.getByText(/2\s*selected/)).toBeVisible();
 });
 
 test('[BULK_ACTIONS]: header checkbox selects all documents on page', async ({ page }) => {
@@ -67,7 +70,7 @@ test('[BULK_ACTIONS]: header checkbox selects all documents on page', async ({ p
 
   await page.locator('thead').getByRole('checkbox').click();
 
-  await expect(page.getByText(`${documents.length} selected`)).toBeVisible();
+  await expect(page.getByText(new RegExp(`${documents.length}\\s*selected`))).toBeVisible();
 });
 
 test('[BULK_ACTIONS]: can clear selection with X button', async ({ page }) => {
@@ -80,11 +83,11 @@ test('[BULK_ACTIONS]: can clear selection with X button', async ({ page }) => {
   });
 
   await page.locator('thead').getByRole('checkbox').click();
-  await expect(page.getByText(/\d+ selected/)).toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).toBeVisible();
 
   await page.getByLabel('Clear selection').click();
 
-  await expect(page.getByText(/\d+ selected/)).not.toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).not.toBeVisible();
 });
 
 test('[BULK_ACTIONS]: can move multiple documents to a folder', async ({ page }) => {
@@ -98,13 +101,13 @@ test('[BULK_ACTIONS]: can move multiple documents to a folder', async ({ page })
 
   await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
   await page.locator('tr', { hasText: 'Bulk Test Doc 2' }).getByRole('checkbox').click();
-  await page.getByRole('button', { name: 'Move to Folder' }).click();
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
 
   await expect(page.getByRole('dialog')).toBeVisible();
   await expect(page.getByText('Move Documents to Folder')).toBeVisible();
 
   await page.getByRole('button', { name: folder.name }).click();
-  await page.getByRole('button', { name: 'Move' }).click();
+  await page.getByRole('dialog').getByRole('button', { name: 'Move' }).click();
 
   await expectToastTextToBeVisible(page, 'Selected items have been moved.');
 
@@ -113,6 +116,122 @@ test('[BULK_ACTIONS]: can move multiple documents to a folder', async ({ page })
   await expect(page.getByRole('link', { name: 'Bulk Test Doc 2' })).toBeVisible();
 });
 
+test('[BULK_ACTIONS]: selection does not leak between teams', async ({ page }) => {
+  const { sender } = await seedBulkActionsTestRequirements();
+
+  const teamBUrl = `team-b-${Date.now()}`;
+
+  await createTeam({
+    userId: sender.user.id,
+    teamName: 'Team B',
+    teamUrl: teamBUrl,
+    organisationId: sender.organisation.id,
+    inheritMembers: true,
+  });
+
+  const teamB = await prisma.team.findFirstOrThrow({
+    where: { url: teamBUrl },
+  });
+
+  await seedDraftDocument(sender.user, teamB.id, [], {
+    createDocumentOptions: { title: 'Team B Doc' },
+  });
+
+  await apiSignin({
+    page,
+    email: sender.user.email,
+    redirectPath: `/t/${sender.team.url}/documents`,
+  });
+
+  await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
+
+  // The selection made in team A must not appear in team B.
+  await page.goto(`/t/${teamBUrl}/documents`);
+  await expect(page.getByRole('link', { name: 'Team B Doc' })).toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).not.toBeVisible();
+
+  // Returning to team A restores its selection.
+  await page.goto(`/t/${sender.team.url}/documents`);
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
+});
+
+test('[BULK_ACTIONS]: escape clears selection unless a dialog is open', async ({ page }) => {
+  const { sender } = await seedBulkActionsTestRequirements();
+
+  await apiSignin({
+    page,
+    email: sender.user.email,
+    redirectPath: `/t/${sender.team.url}/documents`,
+  });
+
+  await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
+
+  // Escape while a dialog is open should close the dialog but keep the selection.
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
+  await expect(page.getByRole('dialog')).toBeVisible();
+
+  await page.keyboard.press('Escape');
+
+  await expect(page.getByRole('dialog')).not.toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
+
+  // Escape with no dialog open should clear the selection.
+  await page.keyboard.press('Escape');
+
+  await expect(page.getByText(/1\s*selected/)).not.toBeVisible();
+});
+
+test('[BULK_ACTIONS]: can bulk download multiple documents as a zip', async ({ page }) => {
+  const { sender, documents } = await seedBulkActionsTestRequirements();
+
+  const [doc1, doc2] = documents;
+
+  await apiSignin({
+    page,
+    email: sender.user.email,
+    redirectPath: `/t/${sender.team.url}/documents`,
+  });
+
+  await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
+  await page.locator('tr', { hasText: 'Bulk Test Doc 2' }).getByRole('checkbox').click();
+
+  await page.getByRole('button', { name: 'Download', exact: true }).click();
+
+  const dialog = page.getByRole('dialog');
+
+  await expect(dialog).toBeVisible();
+  await expect(dialog.getByText('Download Documents')).toBeVisible();
+  await expect(dialog.getByText('Bulk Test Doc 1')).toBeVisible();
+  await expect(dialog.getByText('Bulk Test Doc 2')).toBeVisible();
+  await expect(dialog.getByText('Draft').first()).toBeVisible();
+
+  const downloadPromise = page.waitForEvent('download', { timeout: 10_000 });
+
+  await dialog.getByRole('button', { name: 'Download' }).click();
+
+  const download = await downloadPromise;
+
+  expect(download.suggestedFilename()).toMatch(/^documenso-documents-\d{4}-\d{2}-\d{2}\.zip$/);
+
+  const downloadPath = await download.path();
+  const zipContents = unzipSync(new Uint8Array(fs.readFileSync(downloadPath)));
+
+  // Each envelope's files are nested inside an `envelopeId_title` folder.
+  expect(Object.keys(zipContents).sort()).toEqual(
+    [`${doc1.id}_Bulk Test Doc 1/Bulk Test Doc 1.pdf`, `${doc2.id}_Bulk Test Doc 2/Bulk Test Doc 2.pdf`].sort(),
+  );
+
+  // Each entry should be a valid non-empty PDF (%PDF magic bytes).
+  for (const entry of Object.values(zipContents)) {
+    expect(Array.from(entry.slice(0, 4))).toEqual([0x25, 0x50, 0x44, 0x46]);
+  }
+
+  await expectToastTextToBeVisible(page, 'Documents downloaded');
+  await expect(page.getByText(/\d+\s*selected/)).not.toBeVisible();
+});
+
 test('[BULK_ACTIONS]: can delete multiple draft documents', async ({ page }) => {
   const { sender } = await seedBulkActionsTestRequirements();
 
@@ -152,14 +271,14 @@ test('[BULK_ACTIONS]: selection clears after successful move', async ({ page })
   });
 
   await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
-  await expect(page.getByText('1 selected')).toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
 
-  await page.getByRole('button', { name: 'Move to Folder' }).click();
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
   await page.getByRole('button', { name: folder.name }).click();
-  await page.getByRole('button', { name: 'Move' }).click();
+  await page.getByRole('dialog').getByRole('button', { name: 'Move' }).click();
 
   await expectToastTextToBeVisible(page, 'Selected items have been moved.');
-  await expect(page.getByText(/\d+ selected/)).not.toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).not.toBeVisible();
 });
 
 test('[BULK_ACTIONS]: selection clears after successful delete', async ({ page }) => {
@@ -172,13 +291,13 @@ test('[BULK_ACTIONS]: selection clears after successful delete', async ({ page }
   });
 
   await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
-  await expect(page.getByText('1 selected')).toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
 
   await page.getByRole('button', { name: 'Delete' }).click();
   await page.getByRole('dialog').getByRole('button', { name: 'Delete' }).click();
 
   await expectToastTextToBeVisible(page, 'Documents deleted');
-  await expect(page.getByText(/\d+ selected/)).not.toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).not.toBeVisible();
 });
 
 test('[BULK_ACTIONS]: can search for folders in move dialog', async ({ page }) => {
@@ -199,7 +318,7 @@ test('[BULK_ACTIONS]: can search for folders in move dialog', async ({ page }) =
 
   await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
 
-  await page.getByRole('button', { name: 'Move to Folder' }).click();
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
   await expect(page.getByRole('dialog')).toBeVisible();
 
   await expect(page.getByRole('button', { name: folder.name })).toBeVisible();
@@ -236,14 +355,14 @@ test('[BULK_ACTIONS]: can move documents from folder to home (root)', async ({ p
   await expect(page.getByRole('link', { name: 'Bulk Test Doc 1' })).toBeVisible();
 
   await page.locator('tr', { hasText: 'Bulk Test Doc 1' }).getByRole('checkbox').click();
-  await expect(page.getByText('1 selected')).toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
 
-  await page.getByRole('button', { name: 'Move to Folder' }).click();
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
   await expect(page.getByRole('dialog')).toBeVisible();
 
   await page.getByRole('button', { name: 'Home (No Folder)' }).click();
 
-  await page.getByRole('button', { name: 'Move' }).click();
+  await page.getByRole('dialog').getByRole('button', { name: 'Move' }).click();
 
   await expectToastTextToBeVisible(page, 'Selected items have been moved.');
 

packages/app-tests/e2e/documents/cancel-documents.spec.ts

@@ -7,7 +7,7 @@ import { expect, type Page, test } from '@playwright/test';
 import { DocumentStatus, TeamMemberRole } from '@prisma/client';
 
 import { apiSignin, apiSignout } from '../fixtures/authentication';
-import { checkDocumentTabCount } from '../fixtures/documents';
+import { checkDocumentCounts, selectDocumentStatusFilter } from '../fixtures/documents';
 import { expectToastTextToBeVisible, openDropdownMenu } from '../fixtures/generic';
 
 test.describe.configure({ mode: 'serial' });
@@ -61,13 +61,10 @@ test('[DOCUMENTS]: cancelling a pending document keeps it in the owner dashboard
   await expectToastTextToBeVisible(page, 'Document cancelled');
 
   // The document must remain in the dashboard, unlike deleting a pending document.
-  await checkDocumentTabCount(page, 'Inbox', 0);
-  await checkDocumentTabCount(page, 'Pending', 0);
-  await checkDocumentTabCount(page, 'Cancelled', 1);
-  await checkDocumentTabCount(page, 'All', 1);
+  await checkDocumentCounts(page, { inbox: 0, pending: 0, cancelled: 1, all: 1 });
 
   // The cancelled document is still listed.
-  await page.getByRole('tab', { name: 'Cancelled' }).click();
+  await selectDocumentStatusFilter(page, 'Cancelled');
   await expect(page.getByRole('link', { name: 'Document 1 - Pending' })).toBeVisible();
 
   // The envelope status is persisted as CANCELLED.
@@ -131,7 +128,7 @@ test('[DOCUMENTS]: a cancelled document can be deleted, hiding it from the owner
   await expectToastTextToBeVisible(page, 'Document cancelled');
 
   // Delete the now-cancelled document. Being terminal, it should soft delete (hide).
-  await page.getByRole('tab', { name: 'Cancelled' }).click();
+  await selectDocumentStatusFilter(page, 'Cancelled');
 
   const documentActionBtn = page
     .locator('tr', { hasText: 'Document 1 - Pending' })

packages/app-tests/e2e/documents/delete-documents.spec.ts

@@ -3,7 +3,7 @@ import { seedUser } from '@documenso/prisma/seed/users';
 import { expect, test } from '@playwright/test';
 
 import { apiSignin, apiSignout } from '../fixtures/authentication';
-import { checkDocumentTabCount } from '../fixtures/documents';
+import { checkDocumentCounts } from '../fixtures/documents';
 import { expectToastTextToBeVisible, openDropdownMenu } from '../fixtures/generic';
 
 test.describe.configure({ mode: 'serial' });
@@ -174,11 +174,7 @@ test('[DOCUMENTS]: deleting draft documents should permanently remove it', async
   await expect(page.getByRole('row', { name: /Document 1 - Draft/ })).not.toBeVisible();
 
   // Check document counts.
-  await checkDocumentTabCount(page, 'Inbox', 0);
-  await checkDocumentTabCount(page, 'Pending', 1);
-  await checkDocumentTabCount(page, 'Completed', 1);
-  await checkDocumentTabCount(page, 'Draft', 0);
-  await checkDocumentTabCount(page, 'All', 2);
+  await checkDocumentCounts(page, { inbox: 0, pending: 1, completed: 1, draft: 0, all: 2 });
 });
 
 test('[DOCUMENTS]: deleting pending documents should permanently remove it', async ({ page }) => {
@@ -207,11 +203,7 @@ test('[DOCUMENTS]: deleting pending documents should permanently remove it', asy
   await expect(page.getByRole('row', { name: /Document 1 - Pending/ })).not.toBeVisible();
 
   // Check document counts.
-  await checkDocumentTabCount(page, 'Inbox', 0);
-  await checkDocumentTabCount(page, 'Pending', 0);
-  await checkDocumentTabCount(page, 'Completed', 1);
-  await checkDocumentTabCount(page, 'Draft', 1);
-  await checkDocumentTabCount(page, 'All', 2);
+  await checkDocumentCounts(page, { inbox: 0, pending: 0, completed: 1, draft: 1, all: 2 });
 });
 
 test('[DOCUMENTS]: deleting completed documents as an owner should hide it from only the owner', async ({ page }) => {
@@ -239,11 +231,7 @@ test('[DOCUMENTS]: deleting completed documents as an owner should hide it from
 
   // Check document counts.
   await expect(page.getByRole('row', { name: /Document 1 - Completed/ })).not.toBeVisible();
-  await checkDocumentTabCount(page, 'Inbox', 0);
-  await checkDocumentTabCount(page, 'Pending', 1);
-  await checkDocumentTabCount(page, 'Completed', 0);
-  await checkDocumentTabCount(page, 'Draft', 1);
-  await checkDocumentTabCount(page, 'All', 2);
+  await checkDocumentCounts(page, { inbox: 0, pending: 1, completed: 0, draft: 1, all: 2 });
 
   // Sign into the recipient account.
   await apiSignout({ page });
@@ -255,11 +243,7 @@ test('[DOCUMENTS]: deleting completed documents as an owner should hide it from
 
   // Check document counts.
   await expect(page.getByRole('row', { name: /Document 1 - Completed/ })).toBeVisible();
-  await checkDocumentTabCount(page, 'Inbox', 1);
-  await checkDocumentTabCount(page, 'Pending', 0);
-  await checkDocumentTabCount(page, 'Completed', 1);
-  await checkDocumentTabCount(page, 'Draft', 0);
-  await checkDocumentTabCount(page, 'All', 2);
+  await checkDocumentCounts(page, { inbox: 1, pending: 0, completed: 1, draft: 0, all: 2 });
 });
 
 test('[DOCUMENTS]: deleting documents as a recipient should only hide it for them', async ({ page }) => {
@@ -300,11 +284,7 @@ test('[DOCUMENTS]: deleting documents as a recipient should only hide it for the
   // Check document counts.
   await expect(page.getByRole('row', { name: /Document 1 - Completed/ })).not.toBeVisible();
   await expect(page.getByRole('row', { name: /Document 1 - Pending/ })).not.toBeVisible();
-  await checkDocumentTabCount(page, 'Inbox', 0);
-  await checkDocumentTabCount(page, 'Pending', 0);
-  await checkDocumentTabCount(page, 'Completed', 0);
-  await checkDocumentTabCount(page, 'Draft', 0);
-  await checkDocumentTabCount(page, 'All', 0);
+  await checkDocumentCounts(page, { inbox: 0, pending: 0, completed: 0, draft: 0, all: 0 });
 
   // Sign into the sender account.
   await apiSignout({ page });
@@ -315,11 +295,7 @@ test('[DOCUMENTS]: deleting documents as a recipient should only hide it for the
   });
 
   // Check document counts for sender.
-  await checkDocumentTabCount(page, 'Inbox', 0);
-  await checkDocumentTabCount(page, 'Pending', 1);
-  await checkDocumentTabCount(page, 'Completed', 1);
-  await checkDocumentTabCount(page, 'Draft', 1);
-  await checkDocumentTabCount(page, 'All', 3);
+  await checkDocumentCounts(page, { inbox: 0, pending: 1, completed: 1, draft: 1, all: 3 });
 
   // Sign into the other recipient account.
   await apiSignout({ page });
@@ -330,9 +306,5 @@ test('[DOCUMENTS]: deleting documents as a recipient should only hide it for the
   });
 
   // Check document counts for other recipient.
-  await checkDocumentTabCount(page, 'Inbox', 1);
-  await checkDocumentTabCount(page, 'Pending', 0);
-  await checkDocumentTabCount(page, 'Completed', 1);
-  await checkDocumentTabCount(page, 'Draft', 0);
-  await checkDocumentTabCount(page, 'All', 2);
+  await checkDocumentCounts(page, { inbox: 1, pending: 0, completed: 1, draft: 0, all: 2 });
 });

packages/app-tests/e2e/documents/find-documents.spec.ts

@@ -10,10 +10,17 @@ import { seedOrganisationMembers } from '@documenso/prisma/seed/organisations';
 import { seedTeam, seedTeamEmail, seedTeamMember } from '@documenso/prisma/seed/teams';
 import { seedUser } from '@documenso/prisma/seed/users';
 import { expect, test } from '@playwright/test';
-import { DocumentStatus, DocumentVisibility, OrganisationMemberRole, TeamMemberRole } from '@prisma/client';
+import {
+  DocumentStatus,
+  DocumentVisibility,
+  OrganisationMemberRole,
+  RecipientRole,
+  SigningStatus,
+  TeamMemberRole,
+} from '@prisma/client';
 
 import { apiSignin, apiSignout } from '../fixtures/authentication';
-import { checkDocumentTabCount } from '../fixtures/documents';
+import { checkDocumentCounts, checkDocumentTabCount, toggleDocumentSenderFilter } from '../fixtures/documents';
 
 test.describe.configure({
   mode: 'parallel',
@@ -54,10 +61,7 @@ test.describe('Find Documents UI - Personal Context', () => {
       redirectPath: `/t/${team.url}/documents`,
     });
 
-    await checkDocumentTabCount(page, 'All', 3);
-    await checkDocumentTabCount(page, 'Draft', 1);
-    await checkDocumentTabCount(page, 'Pending', 1);
-    await checkDocumentTabCount(page, 'Completed', 1);
+    await checkDocumentCounts(page, { draft: 1, pending: 1, completed: 1, all: 3 });
   });
 
   test('received documents from other teams should NOT appear in personal context', async ({ page }) => {
@@ -133,10 +137,9 @@ test.describe('Find Documents UI - Personal Context', () => {
       redirectPath: `/t/${ownerTeam.url}/documents`,
     });
 
-    // Inbox should be 0 since there's no team email and received docs are on sender's team
-    await checkDocumentTabCount(page, 'Inbox', 0);
-    // Owner's own doc should still show in All
-    await checkDocumentTabCount(page, 'All', 1);
+    // Inbox should be 0 since there's no team email and received docs are on sender's team.
+    // Owner's own doc should still show in All.
+    await checkDocumentCounts(page, { inbox: 0, all: 1 });
     await expect(page.getByRole('link', { name: 'Owner Draft Control' })).toBeVisible();
   });
 
@@ -700,9 +703,8 @@ test.describe('Find Documents UI - Team with Team Email', () => {
       redirectPath: `/t/${team.url}/documents`,
     });
 
-    await checkDocumentTabCount(page, 'Inbox', 0);
-    // But pending should still show
-    await checkDocumentTabCount(page, 'Pending', 1);
+    // Inbox should be 0, but pending should still show.
+    await checkDocumentCounts(page, { inbox: 0, pending: 1 });
   });
 
   test('documents sent BY team email user should appear in team context', async ({ page }) => {
@@ -803,12 +805,9 @@ test.describe('Find Documents UI - Data Isolation & No Leaking', () => {
     });
 
     // UserA should see only their own docs
-    await checkDocumentTabCount(page, 'All', 3);
-    await checkDocumentTabCount(page, 'Draft', 1);
-    await checkDocumentTabCount(page, 'Completed', 1);
+    await checkDocumentCounts(page, { draft: 1, completed: 1, all: 3 });
 
     // Verify no B docs leaked
-    await page.getByRole('tab', { name: 'All' }).click();
     await expect(page.getByRole('link', { name: 'A Own Draft' })).toBeVisible();
     await expect(page.getByRole('link', { name: 'B Draft Private', exact: true })).not.toBeVisible();
     await expect(page.getByRole('link', { name: 'B Pending Private', exact: true })).not.toBeVisible();
@@ -959,9 +958,9 @@ test.describe('Find Documents UI - Data Isolation & No Leaking', () => {
       redirectPath: `/t/${outsideTeam.url}/documents`,
     });
 
-    // Only the outside user's own draft should appear (cross-team docs are not visible)
-    await checkDocumentTabCount(page, 'Inbox', 0); // No team email → 0
-    await checkDocumentTabCount(page, 'All', 1); // Check All tab last so we can verify visible links
+    // Only the outside user's own draft should appear (cross-team docs are not visible).
+    // Inbox is 0 since there is no team email.
+    await checkDocumentCounts(page, { inbox: 0, all: 1 });
     await expect(page.getByRole('link', { name: 'Outside Own Draft' })).toBeVisible();
     await expect(page.getByRole('link', { name: 'Team Doc For Outside User', exact: true })).not.toBeVisible();
     await expect(page.getByRole('link', { name: 'Team Doc For Other User Only', exact: true })).not.toBeVisible();
@@ -1006,12 +1005,10 @@ test.describe('Find Documents UI - Tab Counts Consistency', () => {
       redirectPath: `/t/${ownerTeam.url}/documents`,
     });
 
-    // Only owner's own docs appear (received docs are on sender's team)
-    await checkDocumentTabCount(page, 'Draft', 2);
-    await checkDocumentTabCount(page, 'Pending', 1);
-    await checkDocumentTabCount(page, 'Inbox', 0); // No team email → inbox returns null → 0
-    await checkDocumentTabCount(page, 'Completed', 1); // Only owned completed (received is on sender's team)
-    await checkDocumentTabCount(page, 'All', 4); // 2 drafts + 1 pending + 1 completed
+    // Only owner's own docs appear (received docs are on sender's team).
+    // Inbox is 0 since there is no team email, and only the owned completed
+    // doc counts (received is on sender's team). All = 2 drafts + 1 pending + 1 completed.
+    await checkDocumentCounts(page, { inbox: 0, draft: 2, pending: 1, completed: 1, all: 4 });
   });
 
   test('team context tab counts should be accurate with mixed documents', async ({ page }) => {
@@ -1063,10 +1060,7 @@ test.describe('Find Documents UI - Tab Counts Consistency', () => {
       redirectPath: `/t/${team.url}/documents`,
     });
 
-    await checkDocumentTabCount(page, 'Draft', 2);
-    await checkDocumentTabCount(page, 'Pending', 1);
-    await checkDocumentTabCount(page, 'Completed', 1);
-    await checkDocumentTabCount(page, 'All', 4);
+    await checkDocumentCounts(page, { draft: 2, pending: 1, completed: 1, all: 4 });
   });
 
   test('team with team email tab counts should include received documents', async ({ page }) => {
@@ -1100,11 +1094,9 @@ test.describe('Find Documents UI - Tab Counts Consistency', () => {
       redirectPath: `/t/${team.url}/documents`,
     });
 
-    await checkDocumentTabCount(page, 'Draft', 1);
-    await checkDocumentTabCount(page, 'Inbox', 1); // One pending doc received by team email (NOT_SIGNED)
-    await checkDocumentTabCount(page, 'Pending', 1); // Own pending
-    await checkDocumentTabCount(page, 'Completed', 1); // Received completed via email
-    await checkDocumentTabCount(page, 'All', 4); // All of the above
+    // Inbox = one pending doc received by team email (NOT_SIGNED), pending = own
+    // pending, completed = received completed via email, all = all of the above.
+    await checkDocumentCounts(page, { inbox: 1, draft: 1, pending: 1, completed: 1, all: 4 });
   });
 });
 
@@ -1156,12 +1148,139 @@ test.describe('Find Documents UI - Sender Filter', () => {
     await checkDocumentTabCount(page, 'All', 3);
 
     // Filter by member1
-    await page.locator('button').filter({ hasText: 'Sender: All' }).click();
-    await page.getByRole('option', { name: member1.name ?? '' }).click();
-    await page.waitForURL(/senderIds/);
+    await toggleDocumentSenderFilter(page, member1.name ?? '');
 
     // Should only show member1's doc
     await checkDocumentTabCount(page, 'All', 1);
     await expect(page.getByRole('link', { name: 'Member1 Sent Doc' })).toBeVisible();
   });
 });
+
+test.describe('Find Documents UI - Rejected and Expired Tabs', () => {
+  const PAST = new Date(Date.now() - 24 * 60 * 60 * 1000);
+
+  test('rejected tab lists rejected documents and counts them independently', async ({ page }) => {
+    const { user: owner, team } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    // A rejected document: envelope status REJECTED + a recipient who rejected.
+    const rejectedDoc = await seedPendingDocument(owner, team.id, [recipient], {
+      createDocumentOptions: { title: 'Rejected Doc' },
+    });
+    await prisma.envelope.update({
+      where: { id: rejectedDoc.id },
+      data: { status: DocumentStatus.REJECTED },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: rejectedDoc.id },
+      data: { signingStatus: SigningStatus.REJECTED },
+    });
+
+    // A plain pending document (noise — must not appear under Rejected).
+    await seedPendingDocument(owner, team.id, [recipient], {
+      createDocumentOptions: { title: 'Plain Pending Doc' },
+    });
+
+    await apiSignin({
+      page,
+      email: owner.email,
+      redirectPath: `/t/${team.url}/documents`,
+    });
+
+    await checkDocumentTabCount(page, 'Rejected', 1);
+    await expect(page.getByRole('link', { name: 'Rejected Doc' })).toBeVisible();
+    await expect(page.getByRole('link', { name: 'Plain Pending Doc' })).not.toBeVisible();
+  });
+
+  test('expired tab lists documents with an expired recipient and shows empty state otherwise', async ({ page }) => {
+    const { user: owner, team } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    const expiredDoc = await seedPendingDocument(owner, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: expiredDoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    // Active pending doc — recipient link not expired.
+    await seedPendingDocument(owner, team.id, [recipient], {
+      createDocumentOptions: { title: 'Active Doc' },
+    });
+
+    await apiSignin({
+      page,
+      email: owner.email,
+      redirectPath: `/t/${team.url}/documents`,
+    });
+
+    // Expired doc is still PENDING, so it appears under both Pending and Expired.
+    await checkDocumentTabCount(page, 'Pending', 2);
+    await checkDocumentTabCount(page, 'Expired', 1);
+    await expect(page.getByRole('link', { name: 'Expired Doc' })).toBeVisible();
+    await expect(page.getByRole('link', { name: 'Active Doc' })).not.toBeVisible();
+  });
+
+  test('expired tab excludes signed and CC recipients', async ({ page }) => {
+    const { user: owner, team } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    // Expired but already signed — must NOT count as expired.
+    const signedDoc = await seedPendingDocument(owner, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired Signed Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: signedDoc.id },
+      data: { expiresAt: PAST, signingStatus: SigningStatus.SIGNED },
+    });
+
+    // Expired but CC — must NOT count as expired.
+    const ccDoc = await seedPendingDocument(owner, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired CC Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: ccDoc.id },
+      data: { expiresAt: PAST, role: RecipientRole.CC },
+    });
+
+    // Expired, unsigned, non-CC — the only one that should appear.
+    const validDoc = await seedPendingDocument(owner, team.id, [recipient], {
+      createDocumentOptions: { title: 'Expired Valid Doc' },
+    });
+    await prisma.recipient.updateMany({
+      where: { envelopeId: validDoc.id },
+      data: { expiresAt: PAST },
+    });
+
+    await apiSignin({
+      page,
+      email: owner.email,
+      redirectPath: `/t/${team.url}/documents`,
+    });
+
+    await checkDocumentTabCount(page, 'Expired', 1);
+    await expect(page.getByRole('link', { name: 'Expired Valid Doc' })).toBeVisible();
+    await expect(page.getByRole('link', { name: 'Expired Signed Doc' })).not.toBeVisible();
+    await expect(page.getByRole('link', { name: 'Expired CC Doc' })).not.toBeVisible();
+  });
+
+  test('rejected and expired tabs show tailored empty states when nothing matches', async ({ page }) => {
+    const { user: owner, team } = await seedUser();
+    const { user: recipient } = await seedUser();
+
+    await seedPendingDocument(owner, team.id, [recipient], {
+      createDocumentOptions: { title: 'Just Pending' },
+    });
+
+    await apiSignin({
+      page,
+      email: owner.email,
+      redirectPath: `/t/${team.url}/documents`,
+    });
+
+    // count === 0 asserts the empty-document-state is visible.
+    await checkDocumentTabCount(page, 'Rejected', 0);
+    await checkDocumentTabCount(page, 'Expired', 0);
+  });
+});

packages/app-tests/e2e/envelope-editor-v2/envelope-direct-template-validation.spec.ts

@@ -0,0 +1,76 @@
+import { seedDirectTemplate } from '@documenso/prisma/seed/templates';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, type Page, test } from '@playwright/test';
+
+import { apiSignin } from '../fixtures/authentication';
+import { clickEnvelopeEditorStep } from '../fixtures/envelope-editor';
+
+const INVALID_DIRECT_TEMPLATE_ALERT_TITLE = 'Invalid direct link template';
+
+/**
+ * Place a field on the PDF canvas in the envelope editor.
+ */
+const placeFieldOnPdf = async (root: Page, fieldName: 'Signature' | 'Text', position: { x: number; y: number }) => {
+  await root.getByRole('button', { name: fieldName, exact: true }).click();
+
+  const canvas = root.locator('.konva-container canvas').first();
+  await expect(canvas).toBeVisible();
+  await canvas.click({ position });
+};
+
+/**
+ * Seed a V2 direct template and open it in the native template editor.
+ *
+ * Only the native template editor is covered here: direct links only exist
+ * for templates and are not part of the embedded editor surfaces.
+ */
+const openDirectTemplateEditor = async (page: Page, options: { createDirectRecipientSignatureField: boolean }) => {
+  const { user, team } = await seedUser();
+
+  const template = await seedDirectTemplate({
+    title: `E2E Direct Template Validation ${Date.now()}`,
+    userId: user.id,
+    teamId: team.id,
+    internalVersion: 2,
+    createDirectRecipientSignatureField: options.createDirectRecipientSignatureField,
+  });
+
+  await apiSignin({
+    page,
+    email: user.email,
+    redirectPath: `/t/${team.url}/templates/${template.id}/edit`,
+  });
+
+  return { user, team, template };
+};
+
+test.describe('template editor', () => {
+  test('shows invalid direct template warning when a signer has no signature field', async ({ page }) => {
+    await openDirectTemplateEditor(page, { createDirectRecipientSignatureField: false });
+
+    await expect(page.getByText(INVALID_DIRECT_TEMPLATE_ALERT_TITLE)).toBeVisible();
+    await expect(page.getByText('are missing a signature field')).toBeVisible();
+  });
+
+  test('does not show the warning when all signers have signature fields', async ({ page }) => {
+    await openDirectTemplateEditor(page, { createDirectRecipientSignatureField: true });
+
+    // Wait for the editor to render before asserting the banner is absent.
+    await expect(page.getByTestId('envelope-editor-step-upload')).toBeVisible();
+    await expect(page.getByText(INVALID_DIRECT_TEMPLATE_ALERT_TITLE)).not.toBeVisible();
+  });
+
+  test('warning disappears after placing a signature field', async ({ page }) => {
+    await openDirectTemplateEditor(page, { createDirectRecipientSignatureField: false });
+
+    await expect(page.getByText(INVALID_DIRECT_TEMPLATE_ALERT_TITLE)).toBeVisible();
+
+    // Place a signature field for the direct recipient (auto-selected single recipient).
+    await clickEnvelopeEditorStep(page, 'addFields');
+    await expect(page.locator('.konva-container canvas').first()).toBeVisible();
+    await placeFieldOnPdf(page, 'Signature', { x: 120, y: 140 });
+
+    // The banner clears once the field is autosaved and the envelope state updates.
+    await expect(page.getByText(INVALID_DIRECT_TEMPLATE_ALERT_TITLE)).not.toBeVisible({ timeout: 15_000 });
+  });
+});

packages/app-tests/e2e/envelope-editor-v2/envelope-recipient-autosave-race.spec.ts

@@ -0,0 +1,199 @@
+import { prisma } from '@documenso/prisma';
+import { expect, type Page, test } from '@playwright/test';
+
+import {
+  clickAddSignerButton,
+  clickEnvelopeEditorStep,
+  getRecipientEmailInputs,
+  openDocumentEnvelopeEditor,
+  setRecipientEmail,
+  setRecipientName,
+  type TEnvelopeEditorSurface,
+} from '../fixtures/envelope-editor';
+
+/**
+ * Reproduction for the recipient autosave race condition.
+ *
+ * Symptom (production only, where there is real network lag):
+ *   1. The author adds a recipient and types its name/email.
+ *   2. They navigate to the "Add Fields" step.
+ *   3. The recipient selector shows the default "Recipient 1" placeholder
+ *      instead of the recipient they just typed, and the typed name/email is
+ *      silently lost.
+ *
+ * Theory (see packages/lib/client-only/hooks/use-envelope-autosave.ts):
+ *   When the author navigates, `flushAutosave()` is awaited before the Add
+ *   Fields page renders. If an *earlier* (empty) recipient save is still
+ *   in-flight at that moment, `flush()` awaits that in-flight save and returns
+ *   WITHOUT committing the newer typed data sitting in `lastArgsRef` (whose
+ *   debounce timer it just cleared). The typed data is dropped, the empty
+ *   recipient persists, and the selector renders "Recipient 1".
+ *
+ * This only happens when a save is still in-flight at navigation time, which is
+ * why it never reproduces locally (fast saves) but does on a laggy network.
+ *
+ * The test below simulates that lag by holding the first `envelope.recipient.set`
+ * request open. It asserts the CORRECT behaviour (typed recipient survives), so
+ * it is RED while the bug exists and GREEN once the autosave hook is fixed.
+ */
+
+const RECIPIENT_SET_PROCEDURE = 'envelope.recipient.set';
+
+// How long to hold the first recipient autosave "in-flight" to emulate prod lag.
+const SIMULATED_NETWORK_LAG_MS = 5000;
+
+const FIRST_RECIPIENT = {
+  name: 'Alice Author',
+  email: 'alice-autosave-race@example.com',
+};
+
+const SECOND_RECIPIENT = {
+  name: 'Bob Builder',
+  email: 'bob-autosave-race@example.com',
+};
+
+type RecipientSetLagHandle = {
+  /** Resolves the instant the first recipient.set request is in-flight on the client. */
+  firstRecipientSetInFlight: Promise<void>;
+  /** Raw request bodies of every recipient.set call we intercepted. */
+  recipientSetRequestBodies: string[];
+};
+
+/**
+ * Installs a fake "production network lag" on the recipient autosave mutation.
+ *
+ * Only the FIRST recipient.set request is held open for `lagMs` (this is the save
+ * that must still be in-flight at navigation time for the race to occur). It
+ * resolves `firstRecipientSetInFlight` the instant it is intercepted so the test
+ * can keep typing while that save is pending. Subsequent recipient.set requests
+ * (e.g. the follow-up save the fixed hook issues) are forwarded immediately so the
+ * test does not pay the lag twice.
+ */
+const installRecipientSetLag = async (page: Page, lagMs: number): Promise<RecipientSetLagHandle> => {
+  let markFirstInFlight: () => void = () => {};
+
+  const firstRecipientSetInFlight = new Promise<void>((resolve) => {
+    markFirstInFlight = resolve;
+  });
+
+  const recipientSetRequestBodies: string[] = [];
+
+  await page.route('**/api/trpc/**', async (route) => {
+    const request = route.request();
+
+    if (request.method() !== 'POST' || !request.url().includes(RECIPIENT_SET_PROCEDURE)) {
+      await route.continue();
+      return;
+    }
+
+    const callIndex = recipientSetRequestBodies.length + 1;
+    recipientSetRequestBodies.push(request.postData() ?? '');
+
+    if (callIndex === 1) {
+      // eslint-disable-next-line no-console
+      console.log(`[test] holding first ${RECIPIENT_SET_PROCEDURE} for ${lagMs}ms (simulated network lag)`);
+
+      // The empty save is now in-flight from the client's perspective.
+      markFirstInFlight();
+
+      await new Promise((resolve) => setTimeout(resolve, lagMs));
+    } else {
+      // eslint-disable-next-line no-console
+      console.log(`[test] forwarding ${RECIPIENT_SET_PROCEDURE} #${callIndex} (no lag)`);
+    }
+
+    await route.continue();
+  });
+
+  return { firstRecipientSetInFlight, recipientSetRequestBodies };
+};
+
+const assertEnvelopeRecipientsPersisted = async (surface: TEnvelopeEditorSurface) => {
+  if (!surface.envelopeId) {
+    throw new Error('Expected the document editor surface to have an envelopeId');
+  }
+
+  const envelope = await prisma.envelope.findFirstOrThrow({
+    where: { id: surface.envelopeId },
+    include: {
+      recipients: {
+        orderBy: { signingOrder: 'asc' },
+      },
+    },
+  });
+
+  const persistedEmails = envelope.recipients.map((recipient) => recipient.email).filter(Boolean);
+
+  // eslint-disable-next-line no-console
+  console.log(
+    '[test] persisted recipients:',
+    JSON.stringify(
+      envelope.recipients.map((recipient) => ({ name: recipient.name, email: recipient.email })),
+      null,
+      2,
+    ),
+  );
+
+  expect(persistedEmails).toContain(FIRST_RECIPIENT.email);
+  expect(persistedEmails).toContain(SECOND_RECIPIENT.email);
+};
+
+test.describe('envelope editor recipient autosave race (network lag)', () => {
+  test('document editor: typed recipient survives navigation to Add Fields', async ({ page }) => {
+    const surface = await openDocumentEnvelopeEditor(page);
+
+    const { firstRecipientSetInFlight, recipientSetRequestBodies } = await installRecipientSetLag(
+      page,
+      SIMULATED_NETWORK_LAG_MS,
+    );
+
+    // 1. Add a second signer row. A blank document already has one empty default
+    //    signer, so this schedules an autosave of TWO empty recipients
+    //    (name='' / email='') - this is the save that will be in-flight.
+    await clickAddSignerButton(surface.root);
+    await expect(getRecipientEmailInputs(surface.root)).toHaveCount(2);
+
+    // 2. Wait until that empty autosave is actually in-flight on the client. This
+    //    is the precondition the bug needs: a slow save holding the autosave lock.
+    await firstRecipientSetInFlight;
+
+    // 3. The author now fills in the recipients they are adding.
+    await setRecipientName(surface.root, 0, FIRST_RECIPIENT.name);
+    await setRecipientEmail(surface.root, 0, FIRST_RECIPIENT.email);
+    await setRecipientName(surface.root, 1, SECOND_RECIPIENT.name);
+    await setRecipientEmail(surface.root, 1, SECOND_RECIPIENT.email);
+
+    // 4. Immediately navigate to Add Fields (before the typed data's debounce
+    //    fires). flushAutosave() awaits the in-flight EMPTY save; with the bug
+    //    present it returns without ever committing the typed data.
+    await clickEnvelopeEditorStep(surface.root, 'addFields');
+
+    // 5. Wait for the Add Fields page to render (after the lagged flush resolves).
+    await expect(surface.root.getByText('Selected Recipient')).toBeVisible({
+      timeout: SIMULATED_NETWORK_LAG_MS + 15000,
+    });
+
+    // Diagnostics - the request bodies show what actually reached the server.
+    // Buggy: only the first (empty) save is ever sent. Fixed: a follow-up save
+    // carrying the typed recipients is sent too.
+    // eslint-disable-next-line no-console
+    console.log('\n===== AUTOSAVE RACE DIAGNOSTICS =====');
+    // eslint-disable-next-line no-console
+    console.log(`recipient.set requests sent to server: ${recipientSetRequestBodies.length}`);
+    // eslint-disable-next-line no-console
+    console.log(
+      `server ever received "${FIRST_RECIPIENT.email}": ${recipientSetRequestBodies.some((body) => body.includes(FIRST_RECIPIENT.email))}`,
+    );
+    // eslint-disable-next-line no-console
+    console.log('=====================================\n');
+
+    // 6. THE USER-VISIBLE BUG: the selected recipient must be the one we typed
+    //    (Alice), not the default "Recipient 1" placeholder.
+    const selectedRecipientSection = surface.root.locator('section').filter({ hasText: 'Selected Recipient' });
+
+    await expect(selectedRecipientSection.getByRole('combobox')).toContainText(FIRST_RECIPIENT.name);
+
+    // 7. THE DATA LOSS: the typed recipients must actually be persisted.
+    await assertEnvelopeRecipientsPersisted(surface);
+  });
+});

packages/app-tests/e2e/envelope-editor-v2/envelope-recipient-cc-order.spec.ts

@@ -0,0 +1,155 @@
+import { nanoid } from '@documenso/lib/universal/id';
+import { prisma } from '@documenso/prisma';
+import { seedBlankDocument } from '@documenso/prisma/seed/documents';
+import { seedUser } from '@documenso/prisma/seed/users';
+import type { Page } from '@playwright/test';
+import { expect, test } from '@playwright/test';
+import { DocumentSigningOrder, RecipientRole } from '@prisma/client';
+
+import { apiSignin } from '../fixtures/authentication';
+import {
+  assertRecipientRole,
+  getRecipientEmailInputs,
+  getRecipientRows,
+  getSigningOrderInputs,
+  openDocumentEnvelopeEditor,
+  setRecipientEmail,
+  setRecipientName,
+  setRecipientRole,
+  toggleSigningOrder,
+} from '../fixtures/envelope-editor';
+
+const SIGNER_A = { email: 'cc-order-signer-a@example.com', name: 'Signer A' };
+const SIGNER_B = { email: 'cc-order-signer-b@example.com', name: 'Signer B' };
+const CC_RECIPIENT = { email: 'cc-order-cc@example.com', name: 'CC Recipient' };
+
+const assertCcDisplayedLastWithNoOrderInput = async (root: Page) => {
+  // CC recipient is displayed last despite being added/stored mid-list.
+  await expect(getRecipientEmailInputs(root)).toHaveCount(3);
+  await expect(getRecipientEmailInputs(root).nth(0)).toHaveValue(SIGNER_A.email);
+  await expect(getRecipientEmailInputs(root).nth(1)).toHaveValue(SIGNER_B.email);
+  await expect(getRecipientEmailInputs(root).nth(2)).toHaveValue(CC_RECIPIENT.email);
+
+  await assertRecipientRole(root, 0, 'Needs to sign');
+  await assertRecipientRole(root, 1, 'Needs to sign');
+  await assertRecipientRole(root, 2, 'Receives copy');
+
+  // Only the two signers have signing order inputs, showing 1 and 2.
+  await expect(getSigningOrderInputs(root)).toHaveCount(2);
+  await expect(getSigningOrderInputs(root).nth(0)).toHaveValue('1');
+  await expect(getSigningOrderInputs(root).nth(1)).toHaveValue('2');
+
+  // The CC row itself renders no signing order input (placeholder div instead).
+  const ccRow = getRecipientRows(root).nth(2);
+  await expect(ccRow.locator('[data-testid="signing-order-input"]')).toHaveCount(0);
+};
+
+test.describe('document editor', () => {
+  test('CC recipient added mid-list is displayed last with no signing order input', async ({ page }) => {
+    const surface = await openDocumentEnvelopeEditor(page);
+    const { root } = surface;
+
+    await toggleSigningOrder(root, true);
+
+    // Add signer A into the initial empty row.
+    await setRecipientEmail(root, 0, SIGNER_A.email);
+    await setRecipientName(root, 0, SIGNER_A.name);
+
+    // Add the CC recipient second.
+    await root.getByRole('button', { name: 'Add Signer' }).click();
+    await setRecipientEmail(root, 1, CC_RECIPIENT.email);
+    await setRecipientName(root, 1, CC_RECIPIENT.name);
+    await setRecipientRole(root, 1, 'Receives copy');
+
+    // Once the row becomes CC, its signing order input disappears.
+    await expect(getSigningOrderInputs(root)).toHaveCount(1);
+
+    // Add signer B third. The new row is inserted before the CC recipient,
+    // which is kept last by the client-side sorting.
+    await root.getByRole('button', { name: 'Add Signer' }).click();
+    await expect(getRecipientEmailInputs(root).nth(2)).toHaveValue(CC_RECIPIENT.email);
+
+    await setRecipientEmail(root, 1, SIGNER_B.email);
+    await setRecipientName(root, 1, SIGNER_B.name);
+
+    await assertCcDisplayedLastWithNoOrderInput(root);
+
+    // The editor autosaves with a debounce, poll the DB until all three
+    // recipients have been persisted before reloading the page.
+    await expect
+      .poll(
+        async () => {
+          const recipients = await prisma.recipient.findMany({
+            where: { envelopeId: surface.envelopeId },
+          });
+
+          return recipients.length;
+        },
+        { timeout: 15_000 },
+      )
+      .toBe(3);
+
+    // Reload the editor and assert the CC recipient is still displayed last.
+    await root.reload();
+    await expect(root.getByRole('heading', { name: 'Recipients' })).toBeVisible();
+
+    await assertCcDisplayedLastWithNoOrderInput(root);
+  });
+
+  test('CC recipient seeded with mid-list signing order is displayed last', async ({ page }) => {
+    const { user, team } = await seedUser();
+
+    const document = await seedBlankDocument(user, team.id, {
+      internalVersion: 2,
+    });
+
+    // Seed a CC recipient directly in the DB with a mid-list signing order
+    // (2 of 3) BEFORE opening the editor, so the editor's autosave cannot
+    // race with the seeded recipients, and assert the editor renders it last.
+    await prisma.envelope.update({
+      where: { id: document.id },
+      data: {
+        documentMeta: {
+          update: { signingOrder: DocumentSigningOrder.SEQUENTIAL },
+        },
+        recipients: {
+          createMany: {
+            data: [
+              {
+                email: SIGNER_A.email,
+                name: SIGNER_A.name,
+                token: nanoid(),
+                role: RecipientRole.SIGNER,
+                signingOrder: 1,
+              },
+              {
+                email: CC_RECIPIENT.email,
+                name: CC_RECIPIENT.name,
+                token: nanoid(),
+                role: RecipientRole.CC,
+                signingOrder: 2,
+              },
+              {
+                email: SIGNER_B.email,
+                name: SIGNER_B.name,
+                token: nanoid(),
+                role: RecipientRole.SIGNER,
+                signingOrder: 3,
+              },
+            ],
+          },
+        },
+      },
+    });
+
+    await apiSignin({
+      page,
+      email: user.email,
+      redirectPath: `/t/${team.url}/documents/${document.id}/edit?step=uploadAndRecipients`,
+    });
+
+    await expect(page.getByRole('heading', { name: 'Recipients' })).toBeVisible();
+
+    await assertCcDisplayedLastWithNoOrderInput(page);
+  });
+});

packages/app-tests/e2e/envelopes/envelope-expiration-settings.spec.ts

@@ -15,11 +15,11 @@ test('[ENVELOPE_EXPIRATION]: set custom expiration period at organisation level'
   await apiSignin({
     page,
     email: user.email,
-    redirectPath: `/o/${organisation.url}/settings/document`,
+    redirectPath: `/o/${organisation.url}/settings/reminders`,
   });
 
   // Wait for the form to load.
-  await expect(page.getByTestId('document-language-trigger')).toBeVisible();
+  await expect(page.getByTestId('envelope-expiration-mode')).toBeVisible();
 
   // Change the amount to 2.
   const amountInput = page.getByTestId('envelope-expiration-amount');
@@ -36,7 +36,7 @@ test('[ENVELOPE_EXPIRATION]: set custom expiration period at organisation level'
   await page.getByRole('option', { name: 'Weeks' }).click();
 
   await page.getByRole('button', { name: 'Save changes' }).first().click();
-  await expect(page.getByText('Your document preferences have been updated').first()).toBeVisible();
+  await expect(page.getByText('Your reminder preferences have been updated').first()).toBeVisible();
 
   // Verify via database.
   const orgSettings = await prisma.organisationGlobalSettings.findUniqueOrThrow({
@@ -54,18 +54,18 @@ test('[ENVELOPE_EXPIRATION]: disable expiration at organisation level', async ({
   await apiSignin({
     page,
     email: user.email,
-    redirectPath: `/o/${organisation.url}/settings/document`,
+    redirectPath: `/o/${organisation.url}/settings/reminders`,
   });
 
-  await expect(page.getByTestId('document-language-trigger')).toBeVisible();
-
   // Find the mode select (shows "Custom duration") and change to "Never expires".
   const modeTrigger = page.getByTestId('envelope-expiration-mode');
+  await expect(modeTrigger).toBeVisible();
+
   await modeTrigger.click();
   await page.getByRole('option', { name: 'Never expires' }).click();
 
   await page.getByRole('button', { name: 'Save changes' }).first().click();
-  await expect(page.getByText('Your document preferences have been updated').first()).toBeVisible();
+  await expect(page.getByText('Your reminder preferences have been updated').first()).toBeVisible();
 
   // Verify via database.
   const orgSettings = await prisma.organisationGlobalSettings.findUniqueOrThrow({
@@ -106,11 +106,9 @@ test('[ENVELOPE_EXPIRATION]: team overrides organisation expiration', async ({ p
   await apiSignin({
     page,
     email: user.email,
-    redirectPath: `/t/${team.url}/settings/document`,
+    redirectPath: `/t/${team.url}/settings/reminders`,
   });
 
-  await expect(page.getByTestId('document-language-trigger')).toBeVisible();
-
   // The expiration picker mode select should show "Inherit from organisation" by default.
   const modeTrigger = page.getByTestId('envelope-expiration-mode');
   await expect(modeTrigger).toBeVisible();
@@ -129,7 +127,7 @@ test('[ENVELOPE_EXPIRATION]: team overrides organisation expiration', async ({ p
   await page.getByRole('option', { name: 'Days' }).click();
 
   await page.getByRole('button', { name: 'Save changes' }).first().click();
-  await expect(page.getByText('Your document preferences have been updated').first()).toBeVisible();
+  await expect(page.getByText('Your reminder preferences have been updated').first()).toBeVisible();
 
   // Verify team setting is overridden.
   const teamSettings = await getTeamSettings({ teamId: team.id });

packages/app-tests/e2e/envelopes/envelope-expiration-signing.spec.ts

@@ -1,9 +1,11 @@
+import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
 import { prisma } from '@documenso/prisma';
 import { FieldType } from '@documenso/prisma/client';
 import { seedPendingDocumentWithFullFields } from '@documenso/prisma/seed/documents';
 import { seedUser } from '@documenso/prisma/seed/users';
-import { expect, test } from '@playwright/test';
+import { type APIRequestContext, expect, test } from '@playwright/test';
 
+import { apiSeedPendingDocument } from '../fixtures/api-seeds';
 import { apiSignin } from '../fixtures/authentication';
 import { signSignaturePad } from '../fixtures/signature';
 
@@ -128,3 +130,82 @@ test('[ENVELOPE_EXPIRATION]: expired recipient cannot complete signing', async (
     }).toPass({ timeout: 10_000 });
   }
 });
+
+const trpcMutation = async (request: APIRequestContext, procedure: string, input: Record<string, unknown>) => {
+  return await request.post(`${NEXT_PUBLIC_WEBAPP_URL()}/api/trpc/${procedure}`, {
+    headers: { 'content-type': 'application/json' },
+    data: JSON.stringify({ json: input }),
+  });
+};
+
+/**
+ * The signing page loader only redirects expired recipients, which a direct API call
+ * bypasses. The tests above exercise the V1 signing path; this covers the V2 route
+ * (`envelope.field.sign`), which must reject on the server regardless of the UI.
+ */
+test('[ENVELOPE_EXPIRATION]: expired recipient cannot sign a field via the V2 API', async ({ request }) => {
+  const { envelope, distributeResult } = await apiSeedPendingDocument(request, {
+    title: '[TEST] Expired recipient V2 signing',
+    recipients: [
+      {
+        email: `expired-v2-${Date.now()}@test.documenso.com`,
+        name: 'Expired Signer',
+        role: 'SIGNER',
+        signingOrder: 1,
+      },
+    ],
+    fieldsPerRecipient: [
+      [
+        { type: FieldType.SIGNATURE, page: 1, positionX: 5, positionY: 5, width: 5, height: 5 },
+        { type: FieldType.TEXT, page: 1, positionX: 5, positionY: 15, width: 5, height: 5 },
+      ],
+    ],
+  });
+
+  const recipient = distributeResult.recipients[0];
+
+  const seededEnvelope = await prisma.envelope.findUniqueOrThrow({
+    where: { id: envelope.id },
+    include: { fields: true },
+  });
+
+  const textField = seededEnvelope.fields.find((field) => field.type === FieldType.TEXT);
+
+  if (!textField) {
+    throw new Error('TEXT field not found on the seeded envelope');
+  }
+
+  // Sanity check: the recipient can sign while the signing window is open.
+  const beforeExpiry = await trpcMutation(request, 'envelope.field.sign', {
+    token: recipient.token,
+    fieldId: textField.id,
+    fieldValue: { type: FieldType.TEXT, value: 'before' },
+  });
+
+  expect(beforeExpiry.ok()).toBeTruthy();
+
+  await prisma.field.update({
+    where: { id: textField.id },
+    data: { inserted: false, customText: '' },
+  });
+
+  await prisma.recipient.update({
+    where: { id: recipient.id },
+    data: { expiresAt: new Date(Date.now() - 60_000) },
+  });
+
+  const afterExpiry = await trpcMutation(request, 'envelope.field.sign', {
+    token: recipient.token,
+    fieldId: textField.id,
+    fieldValue: { type: FieldType.TEXT, value: 'after' },
+  });
+
+  expect(afterExpiry.ok()).toBeFalsy();
+
+  const fieldAfter = await prisma.field.findUniqueOrThrow({
+    where: { id: textField.id },
+  });
+
+  expect(fieldAfter.inserted).toBe(false);
+  expect(fieldAfter.customText).toBe('');
+});

packages/app-tests/e2e/features/include-document-certificate.spec.ts

@@ -313,20 +313,14 @@ test.describe('Signing Certificate Tests', () => {
     await apiSignin({
       page,
       email: owner.email,
-      redirectPath: `/t/${team.url}/settings/document`,
+      redirectPath: `/t/${team.url}/settings/certificates`,
     });
 
-    await page
-      .getByRole('group')
-      .locator('div')
-      .filter({ hasText: 'Include the Signing' })
-      .getByRole('combobox')
-      .click();
+    await page.getByTestId('include-signing-certificate-trigger').click();
     await page.getByRole('option', { name: 'No' }).click();
 
     await page.getByRole('button', { name: 'Save changes' }).first().click();
-
-    await page.waitForTimeout(1000);
+    await expect(page.getByText('Your certificate preferences have been updated').first()).toBeVisible();
 
     // Verify the setting was saved
     const updatedTeam = await prisma.team.findFirstOrThrow({
@@ -337,23 +331,21 @@ test.describe('Signing Certificate Tests', () => {
     expect(updatedTeam.teamGlobalSettings?.includeSigningCertificate).toBe(false);
 
     // Toggle the setting back to true
-    await page
-      .getByRole('group')
-      .locator('div')
-      .filter({ hasText: 'Include the Signing' })
-      .getByRole('combobox')
-      .click();
+    await page.getByTestId('include-signing-certificate-trigger').click();
     await page.getByRole('option', { name: 'Yes' }).click();
     await page.getByRole('button', { name: 'Save changes' }).first().click();
 
-    await page.waitForTimeout(1000);
+    // The toast from the first save may still be visible, so poll the database
+    // for the saved value instead of waiting on UI signals.
+    await expect
+      .poll(async () => {
+        const updatedTeam = await prisma.team.findFirstOrThrow({
+          where: { id: team.id },
+          include: { teamGlobalSettings: true },
+        });
 
-    // Verify the setting was saved
-    const updatedTeam2 = await prisma.team.findFirstOrThrow({
-      where: { id: team.id },
-      include: { teamGlobalSettings: true },
-    });
-
-    expect(updatedTeam2.teamGlobalSettings?.includeSigningCertificate).toBe(true);
+        return updatedTeam.teamGlobalSettings?.includeSigningCertificate;
+      })
+      .toBe(true);
   });
 });

packages/app-tests/e2e/fixtures/command-menu.ts

@@ -0,0 +1,18 @@
+import type { Page } from '@playwright/test';
+import { expect } from '@playwright/test';
+
+/**
+ * Opens the app command menu via the keyboard shortcut.
+ *
+ * Retries the shortcut until the menu appears since the keypress is a no-op
+ * when it happens before the page has hydrated.
+ *
+ * @param placeholder The search input placeholder to wait for, which differs
+ *   between admin and non-admin users.
+ */
+export const openCommandMenu = async (page: Page, placeholder: string) => {
+  await expect(async () => {
+    await page.keyboard.press('Meta+K');
+    await expect(page.getByPlaceholder(placeholder).first()).toBeVisible({ timeout: 1_000 });
+  }).toPass({ timeout: 15_000 });
+};

packages/app-tests/e2e/fixtures/documents.ts

@@ -1,11 +1,116 @@
 import type { Page } from '@playwright/test';
 import { expect } from '@playwright/test';
 
-export const checkDocumentTabCount = async (page: Page, tabName: string, count: number) => {
-  await page.getByRole('tab', { name: tabName }).click();
+type DocumentStatusCounts = {
+  inbox?: number;
+  pending?: number;
+  completed?: number;
+  draft?: number;
+  cancelled?: number;
+  rejected?: number;
+  expired?: number;
+  all?: number;
+};
 
-  if (tabName !== 'All') {
-    await expect(page.getByRole('tab', { name: tabName })).toContainText(count.toString());
+const STATUS_KEYS = {
+  inbox: 'INBOX',
+  pending: 'PENDING',
+  completed: 'COMPLETED',
+  draft: 'DRAFT',
+  cancelled: 'CANCELLED',
+  rejected: 'REJECTED',
+  expired: 'EXPIRED',
+  all: 'ALL',
+} as const;
+
+/**
+ * Check the counts for multiple document statuses in one go via the
+ * visually hidden stats rendered alongside the status filter.
+ *
+ * When `all` is provided the status filter is also cleared and the
+ * unfiltered table count (or empty state) is verified.
+ */
+export const checkDocumentCounts = async (page: Page, counts: DocumentStatusCounts) => {
+  for (const [key, status] of Object.entries(STATUS_KEYS)) {
+    const count = counts[key as keyof typeof STATUS_KEYS];
+
+    if (count === undefined) {
+      continue;
+    }
+
+    await expect(page.getByTestId(`documents-status-count-${status}`)).toHaveText(count.toString());
+  }
+
+  if (counts.all !== undefined) {
+    await clearDocumentStatusFilter(page);
+
+    if (counts.all === 0) {
+      await expect(page.getByTestId('empty-document-state')).toBeVisible();
+      return;
+    }
+
+    await expect(page.getByTestId('data-table-count')).toContainText(`Showing ${counts.all}`);
+  }
+};
+
+/**
+ * Select a status in the documents status filter pill.
+ *
+ * No-op if the status is already selected, since selecting the active
+ * option again would clear the filter.
+ */
+export const selectDocumentStatusFilter = async (page: Page, statusName: string) => {
+  const currentStatus = new URL(page.url()).searchParams.get('status');
+
+  if (currentStatus === statusName.toUpperCase()) {
+    return;
+  }
+
+  await page.getByTestId('documents-table-status-filter').click();
+  await page.getByRole('option', { name: statusName }).click();
+};
+
+/**
+ * Toggle a sender in the documents sender filter pill.
+ *
+ * The sender filter is a multi select, so the popover stays open after
+ * picking and is closed with Escape.
+ */
+export const toggleDocumentSenderFilter = async (page: Page, senderName: string) => {
+  await page.getByTestId('documents-table-sender-filter').click();
+  await page.getByRole('option', { name: senderName }).click();
+  await page.waitForURL(/senderIds/);
+  await page.keyboard.press('Escape');
+};
+
+/**
+ * Clear the documents status filter pill, returning to the "All" view.
+ */
+export const clearDocumentStatusFilter = async (page: Page) => {
+  const currentStatus = new URL(page.url()).searchParams.get('status');
+
+  if (!currentStatus) {
+    return;
+  }
+
+  await page.getByTestId('documents-table-status-filter').click();
+  await page.getByRole('option', { name: 'Clear' }).click();
+};
+
+/**
+ * Apply a status filter (or 'All' to clear it) and verify both the hidden
+ * stats count and the resulting table.
+ *
+ * The count is not asserted against the stats for 'All', since tests use it
+ * with search queries applied which only the table respects.
+ */
+export const checkDocumentTabCount = async (page: Page, tabName: string, count: number) => {
+  if (tabName === 'All') {
+    await clearDocumentStatusFilter(page);
+  } else {
+    await expect(page.getByTestId(`documents-status-count-${tabName.toUpperCase()}`)).toHaveText(count.toString());
+
+    await selectDocumentStatusFilter(page, tabName);
   }
 
   if (count === 0) {

packages/app-tests/e2e/organisations/organisation-team-preferences.spec.ts

@@ -35,12 +35,24 @@ test('[ORGANISATIONS]: manage document preferences', async ({ page }) => {
   await page.getByTestId('signature-types-trigger').click();
   await page.getByRole('option', { name: 'Draw' }).click();
   await page.getByRole('option', { name: 'Upload' }).click();
+  await page.keyboard.press('Escape');
+
+  await page.getByRole('button', { name: 'Save changes' }).first().click();
+  await expect(page.getByText('Your document preferences have been updated').first()).toBeVisible();
+
+  // Sender details moved to the email preferences page.
+  await page.goto(`/o/${organisation.url}/settings/email`);
   await page.getByTestId('include-sender-details-trigger').click();
   await page.getByRole('option', { name: 'No' }).click();
+  await page.getByRole('button', { name: 'Save changes' }).first().click();
+  await expect(page.getByText('Your email preferences have been updated').first()).toBeVisible();
+
+  // The signing certificate toggle moved to the certificates page.
+  await page.goto(`/o/${organisation.url}/settings/certificates`);
   await page.getByTestId('include-signing-certificate-trigger').click();
   await page.getByRole('option', { name: 'No' }).click();
   await page.getByRole('button', { name: 'Save changes' }).first().click();
-  await expect(page.getByText('Your document preferences have been updated').first()).toBeVisible();
+  await expect(page.getByText('Your certificate preferences have been updated').first()).toBeVisible();
 
   const teamSettings = await getTeamSettings({
     teamId: team.id,
@@ -236,8 +248,14 @@ test('[ORGANISATIONS]: manage email preferences', async ({ page }) => {
   await page.getByRole('textbox', { name: 'Reply to email' }).click();
   await page.getByRole('textbox', { name: 'Reply to email' }).fill('team@example.com');
 
-  // Change email document settings inheritance to controlled
-  await page.getByRole('combobox').filter({ hasText: 'Inherit from organisation' }).click();
+  // Change email document settings inheritance to controlled. Scope to the
+  // email-document-settings field — the sender-details select on this page also
+  // renders an "Inherit from organisation" value.
+  await page
+    .getByTestId('inheritable-email-document-settings')
+    .getByRole('combobox')
+    .filter({ hasText: 'Inherit from organisation' })
+    .click();
   await page.getByRole('option', { name: 'Override organisation settings' }).click();
 
   // Update some email settings

packages/app-tests/e2e/public-profiles/public-profiles.spec.ts

@@ -6,6 +6,7 @@ import { expect, test } from '@playwright/test';
 
 import { apiSignin } from '../fixtures/authentication';
 import { expectToastTextToBeVisible } from '../fixtures/generic';
+import { signSignaturePad } from '../fixtures/signature';
 
 test('[PUBLIC_PROFILE]: create team profile', async ({ page }) => {
   const { user, team } = await seedUser();
@@ -73,11 +74,53 @@ test('[PUBLIC_PROFILE]: create team profile', async ({ page }) => {
   await expect(page.locator('body')).toContainText('public-direct-template-title');
   await expect(page.locator('body')).toContainText('public-direct-template-description');
 
+  const directSignatureField = directTemplate.fields[0];
+
+  if (!directSignatureField) {
+    throw new Error('Expected seeded direct template signature field to exist');
+  }
+
   await page.getByRole('link', { name: 'Sign' }).click();
   await page.getByRole('button', { name: 'Continue' }).click();
+
+  await signSignaturePad(page);
+  await page.locator(`#field-${directSignatureField.id}`).getByRole('button').click();
+  await expect(page.locator(`#field-${directSignatureField.id}`)).toHaveAttribute('data-inserted', 'true');
+
   await page.getByRole('button', { name: 'Complete' }).click();
   await page.getByRole('button', { name: 'Sign' }).click();
 
   await expect(page.getByRole('heading', { name: 'Document Signed' })).toBeVisible();
   await expect(page.getByRole('heading')).toContainText('Document Signed');
 });
+
+test('[PUBLIC_PROFILE]: empty-profile settings hint only shows to team managers', async ({ page }) => {
+  const { user, team } = await seedUser();
+
+  // Enable the team's public profile with no linked templates so the empty
+  // state (and its "manage your profile" hint) renders.
+  await prisma.teamProfile.upsert({
+    where: { teamId: team.id },
+    update: { enabled: true },
+    create: { teamId: team.id, enabled: true },
+  });
+
+  // The team owner manages the team → sees the hint linking straight to the
+  // team's public-profile settings.
+  await apiSignin({ page, email: user.email });
+  await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/p/${team.url}`);
+
+  const settingsLink = page.getByRole('link', { name: 'public profile settings' });
+  await expect(settingsLink).toBeVisible();
+  await expect(settingsLink).toHaveAttribute('href', `/t/${team.url}/settings/public-profile`);
+
+  // A different signed-in user who doesn't manage this team sees the empty state
+  // but no settings hint.
+  const { user: stranger } = await seedUser();
+
+  await apiSignin({ page, email: stranger.email });
+  await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/p/${team.url}`);
+
+  await expect(page.getByText("hasn't added any documents")).toBeVisible();
+  await expect(page.getByRole('link', { name: 'public profile settings' })).toHaveCount(0);
+});

packages/app-tests/e2e/settings/preferred-team-cookie.spec.ts

@@ -0,0 +1,82 @@
+import { seedOrganisationMembers } from '@documenso/prisma/seed/organisations';
+import { seedTeam } from '@documenso/prisma/seed/teams';
+import type { Page } from '@playwright/test';
+import { expect, test } from '@playwright/test';
+import { OrganisationMemberRole } from '@prisma/client';
+
+import { apiSignin } from '../fixtures/authentication';
+
+const readPreferredTeamUrl = async (page: Page) => {
+  const cookies = await page.context().cookies();
+
+  return cookies.find((cookie) => cookie.name === 'preferred-team-url')?.value ?? null;
+};
+
+/**
+ * Two organisations the signed-in user administers, each with its own team.
+ */
+const seedTwoOrganisations = async () => {
+  const { owner, team: teamA, organisation: orgA } = await seedTeam();
+  const { organisation: orgB, team: teamB } = await seedTeam();
+
+  await seedOrganisationMembers({
+    members: [{ email: owner.email, organisationRole: OrganisationMemberRole.ADMIN }],
+    organisationId: orgB.id,
+  });
+
+  return { owner, orgA, teamA, orgB, teamB };
+};
+
+const switchOrganisationInSettings = async (page: Page, organisationUrl: string) => {
+  const sidebar = page.getByTestId('unified-settings-sidebar');
+
+  await sidebar.getByTestId('settings-org-switcher-trigger').click();
+  await page.getByTestId(`settings-org-switcher-item-${organisationUrl}`).click();
+  await page.waitForURL(`/o/${organisationUrl}/settings/general`);
+};
+
+test.describe('Preferred team cookie', () => {
+  test('switching organisation in settings records a team from that organisation', async ({ page }) => {
+    const { owner, teamA, orgB, teamB } = await seedTwoOrganisations();
+
+    await apiSignin({ page, email: owner.email });
+
+    await page.goto(`/t/${teamA.url}/settings/general`);
+    expect(await readPreferredTeamUrl(page)).toBe(teamA.url);
+
+    await switchOrganisationInSettings(page, orgB.url);
+
+    // Recorded by the settings layout, which posts asynchronously rather than blocking the
+    // navigation, so the swap lands shortly after the URL changes.
+    await expect.poll(() => readPreferredTeamUrl(page)).toBe(teamB.url);
+  });
+
+  test('app root redirects into the organisation last selected in settings', async ({ page }) => {
+    const { owner, teamA, orgB, teamB } = await seedTwoOrganisations();
+
+    await apiSignin({ page, email: owner.email });
+
+    await page.goto(`/t/${teamA.url}/settings/general`);
+    await switchOrganisationInSettings(page, orgB.url);
+
+    await expect.poll(() => readPreferredTeamUrl(page)).toBe(teamB.url);
+
+    await page.goto('/');
+    await expect(page).toHaveURL(`/t/${teamB.url}/documents`);
+  });
+
+  test('switching team in settings records the newly selected team', async ({ page }) => {
+    const { owner, teamA, orgB, teamB } = await seedTwoOrganisations();
+
+    await apiSignin({ page, email: owner.email });
+
+    await page.goto(`/t/${teamB.url}/settings/general`);
+    expect(await readPreferredTeamUrl(page)).toBe(teamB.url);
+
+    await page.goto(`/t/${teamA.url}/settings/general`);
+    expect(await readPreferredTeamUrl(page)).toBe(teamA.url);
+
+    await page.goto('/');
+    await expect(page).toHaveURL(`/t/${teamA.url}/documents`);
+  });
+});

packages/app-tests/e2e/settings/unified-settings.spec.ts

@@ -0,0 +1,554 @@
+import { createTeam } from '@documenso/lib/server-only/team/create-team';
+import { nanoid } from '@documenso/lib/universal/id';
+import { prisma } from '@documenso/prisma';
+import { seedTeam, seedTeamMember } from '@documenso/prisma/seed/teams';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, test } from '@playwright/test';
+import { TeamMemberRole } from '@prisma/client';
+
+import { apiSignin } from '../fixtures/authentication';
+
+/**
+ * Every seeded user is given their own organisation. Removing it leaves the user with only
+ * the access that was explicitly granted, which is how we reach the "team access only" and
+ * "no organisations at all" states.
+ */
+const deleteOwnedOrganisations = async (userId: number) => {
+  await prisma.organisation.deleteMany({
+    where: {
+      ownerUserId: userId,
+    },
+  });
+};
+
+test.describe('Unified Settings', () => {
+  test('shows both groups for the team owner at team scope', async ({ page }) => {
+    const { owner, team, organisation } = await seedTeam();
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team.url}/settings`);
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await expect(sidebar).toBeVisible();
+
+    const groups = sidebar.getByTestId('unified-settings-sidebar-group');
+    // Organisation + Team groups, plus the always-visible Account group.
+    await expect(groups).toHaveCount(3);
+
+    await expect(sidebar.getByTestId('settings-org-switcher-trigger')).toContainText(organisation.name);
+    await expect(sidebar.getByTestId('settings-team-switcher-trigger')).toContainText(team.name);
+
+    // Nav item labels are lingui `msg` descriptors resolved to strings at render —
+    // assert the visible text so a broken translation (blank / [object Object])
+    // would fail here. Test ids are scope-qualified because item keys repeat across groups.
+    await expect(sidebar.getByTestId('unified-settings-nav-team-members')).toContainText('Members');
+    await expect(sidebar.getByTestId('unified-settings-nav-team-preferences')).toContainText('Preferences');
+    await expect(sidebar.getByTestId('unified-settings-nav-organisation-members')).toContainText('Members');
+    await expect(sidebar.getByTestId('unified-settings-nav-account-profile')).toContainText('Profile');
+  });
+
+  test('shows both groups for the team owner at org scope (team-fallback)', async ({ page }) => {
+    const { owner, team, organisation } = await seedTeam();
+
+    await apiSignin({ page, email: owner.email });
+    // At org scope `useOptionalCurrentTeam()` is null, but the layout falls
+    // back to the user's first manageable team in the current org so both
+    // groups still render.
+    await page.goto(`/o/${organisation.url}/settings`);
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await expect(sidebar).toBeVisible();
+
+    const groups = sidebar.getByTestId('unified-settings-sidebar-group');
+    // Organisation + Team groups, plus the always-visible Account group.
+    await expect(groups).toHaveCount(3);
+
+    await expect(sidebar.getByTestId('settings-org-switcher-trigger')).toContainText(organisation.name);
+    // Team switcher shows the fallback team (the user's first manageable team in this org).
+    await expect(sidebar.getByTestId('settings-team-switcher-trigger')).toContainText(team.name);
+
+    // The empty state is only for users who can't manage the organisation.
+    await expect(sidebar.getByTestId('unified-settings-organisation-empty-state')).toHaveCount(0);
+  });
+
+  test('sidebar is flush with the left viewport edge', async ({ page }) => {
+    const { owner, organisation } = await seedTeam();
+
+    // Wide viewport — a centered max-w-screen-xl container would offset the
+    // sidebar by (1600 - 1280) / 2 = 160px+, while flush-left is ~16px (the
+    // aside's own internal padding).
+    await page.setViewportSize({ width: 1600, height: 900 });
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/o/${organisation.url}/settings`);
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await expect(sidebar).toBeVisible();
+
+    const box = await sidebar.boundingBox();
+
+    expect(box?.x ?? Number.MAX_SAFE_INTEGER).toBeLessThan(100);
+
+    // The app header stretches to the full viewport width on settings pages.
+    const headerContainer = page.getByTestId('app-header-container');
+    const headerBox = await headerContainer.boundingBox();
+
+    expect(headerBox?.x ?? Number.MAX_SAFE_INTEGER).toBeLessThan(50);
+    expect((headerBox?.x ?? 0) + (headerBox?.width ?? 0)).toBeGreaterThan(1550);
+
+    // Outside of settings the header keeps its centered max-w-screen-xl container.
+    await page.goto(`/o/${organisation.url}`);
+    await expect(headerContainer).toBeVisible();
+
+    const centeredHeaderBox = await headerContainer.boundingBox();
+
+    expect(centeredHeaderBox?.x ?? 0).toBeGreaterThan(100);
+  });
+
+  test('content is centered within the pane beside the sidebar', async ({ page }) => {
+    const { owner, organisation } = await seedTeam();
+
+    await page.setViewportSize({ width: 1600, height: 900 });
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/o/${organisation.url}/settings`);
+
+    const content = page.getByTestId('unified-settings-content');
+    await expect(content).toBeVisible();
+
+    const contentBox = await content.boundingBox();
+
+    // The pane spans from the sidebar's right edge (fixed 320px aside) to the
+    // viewport edge. The content container should be centered within it.
+    const paneCenter = (320 + 1600) / 2;
+    const contentCenter = (contentBox?.x ?? 0) + (contentBox?.width ?? 0) / 2;
+
+    expect(Math.abs(contentCenter - paneCenter)).toBeLessThan(24);
+  });
+
+  test('keeps current section when switching teams', async ({ page }) => {
+    // Seed one team, then add a second team to the same organisation.
+    const { owner, team: team1, organisation } = await seedTeam();
+
+    const team2Url = `team-two-${nanoid()}`;
+
+    await createTeam({
+      userId: owner.id,
+      teamName: 'Team Two',
+      teamUrl: team2Url,
+      organisationId: organisation.id,
+      inheritMembers: true,
+    });
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team1.url}/settings/members`);
+
+    // Scope to the desktop sidebar — the mobile sidebar also renders the
+    // same testid.
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await sidebar.getByTestId('settings-team-switcher-trigger').click();
+
+    // The popover content matches the trigger width.
+    const triggerBox = await sidebar.getByTestId('settings-team-switcher-trigger').boundingBox();
+    const contentBox = await page.getByTestId('settings-team-switcher-content').boundingBox();
+
+    expect(Math.abs((contentBox?.width ?? 0) - (triggerBox?.width ?? -1))).toBeLessThan(2);
+
+    await page.getByTestId(`settings-team-switcher-item-${team2Url}`).click();
+
+    await page.waitForURL(`/t/${team2Url}/settings/members`);
+    await expect(page).toHaveURL(`/t/${team2Url}/settings/members`);
+  });
+
+  test('account settings keep the organisation the user was working in', async ({ page }) => {
+    // The user administers their own organisation, but only manages a team in the seeded
+    // one — so the two differ in whether organisation settings are reachable.
+    const { team: teamInOtherOrg, organisation: otherOrganisation } = await seedTeam();
+
+    const user = await seedTeamMember({ teamId: teamInOtherOrg.id, role: TeamMemberRole.MANAGER });
+
+    const ownedOrganisation = await prisma.organisation.findFirstOrThrow({
+      where: { ownerUserId: user.id },
+      include: { teams: true },
+    });
+
+    // Both are seeded as "Personal Organisation", so rename them to tell the switcher apart.
+    await prisma.organisation.update({ where: { id: ownedOrganisation.id }, data: { name: 'Org I Administer' } });
+    await prisma.organisation.update({
+      where: { id: otherOrganisation.id },
+      data: { name: 'Org I Only Have A Team In' },
+    });
+
+    await apiSignin({ page, email: user.email });
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    const orgTrigger = sidebar.getByTestId('settings-org-switcher-trigger');
+
+    // `organisations` comes back unordered, so which one account scope falls back to isn't
+    // fixed. Read it cold, then work in the *other* one — otherwise the test can pass just
+    // because the fallback already happened to be the right organisation.
+    await page.goto('/settings/profile');
+
+    const fallbackIsOwned = ((await orgTrigger.textContent()) ?? '').includes('Org I Administer');
+
+    const target = fallbackIsOwned
+      ? { name: 'Org I Only Have A Team In', teamUrl: teamInOtherOrg.url }
+      : { name: 'Org I Administer', teamUrl: ownedOrganisation.teams[0].url };
+
+    await page.goto(`/t/${target.teamUrl}/settings/general`);
+    await expect(orgTrigger).toContainText(target.name);
+
+    // Account scope has no organisation in the URL either, so it must not silently jump
+    // back to whichever organisation happens to be first.
+    await sidebar.getByTestId('unified-settings-nav-account-profile').click();
+    await page.waitForURL('/settings/profile');
+    await expect(page.getByTestId('settings-scope-breadcrumb-chip')).toContainText('Account Settings');
+
+    await expect(orgTrigger).toContainText(target.name);
+  });
+
+  test('team switcher keeps the selected team when moving to organisation scope', async ({ page }) => {
+    const { owner, team: team1, organisation } = await seedTeam();
+
+    // Lowercased to match what `ZTeamUrlSchema` stores — `createTeam` is called directly
+    // here, bypassing the tRPC input schema that would normalise it in the real flow.
+    const team2Url = `team-two-${nanoid()}`.toLowerCase();
+
+    await createTeam({
+      userId: owner.id,
+      teamName: 'Team Two',
+      teamUrl: team2Url,
+      organisationId: organisation.id,
+      inheritMembers: true,
+    });
+
+    await apiSignin({ page, email: owner.email });
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    const trigger = sidebar.getByTestId('settings-team-switcher-trigger');
+
+    // `organisation.teams` comes back unordered, so which team the sidebar falls back to
+    // isn't fixed. Read it first, then deliberately select the *other* one — otherwise the
+    // test can pass simply because the fallback already happened to be the right team.
+    await page.goto(`/o/${organisation.url}/settings/general`);
+
+    const fallbackIsTeam2 = ((await trigger.textContent()) ?? '').includes('Team Two');
+    const selected = fallbackIsTeam2 ? { url: team1.url, name: team1.name } : { url: team2Url, name: 'Team Two' };
+
+    await page.goto(`/t/${team2Url}/settings/general`);
+    await trigger.click();
+    await page.getByTestId(`settings-team-switcher-item-${selected.url}`).click();
+    await page.waitForURL(`/t/${selected.url}/settings/general`);
+    await expect(trigger).toContainText(selected.name);
+
+    // Organisation scope has no team in the URL, so the sidebar has to remember which team
+    // the user picked rather than falling back to whichever one happens to be first.
+    await sidebar.getByTestId('unified-settings-nav-organisation-general').click();
+    await page.waitForURL(`/o/${organisation.url}/settings/general`);
+
+    // Wait for the organisation page to actually render — asserting straight after
+    // `waitForURL` can read the previous scope's still-mounted sidebar and pass falsely.
+    await expect(page.getByTestId('settings-scope-breadcrumb-chip')).toContainText('Organisation Settings');
+
+    await expect(trigger).toContainText(selected.name);
+
+    // The selection must also survive in the cookie — otherwise the app root would send the
+    // user back to the wrong team.
+    await expect
+      .poll(async () => {
+        const cookies = await page.context().cookies();
+
+        return cookies.find((cookie) => cookie.name === 'preferred-team-url')?.value ?? null;
+      })
+      .toBe(selected.url);
+  });
+
+  test('inheritable field toggles between INHERITED and OVERRIDDEN', async ({ page }) => {
+    const { owner, team } = await seedTeam();
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team.url}/settings/document`);
+
+    const langStatus = page.getByTestId('document-language-status');
+    await expect(langStatus).toHaveText(/inherited/i);
+
+    // Open the language select and pick a non-default value.
+    await page.getByTestId('document-language-trigger').click();
+    await page
+      .getByRole('option', { name: /english/i })
+      .first()
+      .click();
+
+    await expect(langStatus).toHaveText(/override/i);
+
+    // Selecting the inherit option stages the field back to inherited.
+    await page.getByTestId('document-language-trigger').click();
+    await page.getByRole('option', { name: /inherit from organisation/i }).click();
+
+    await expect(langStatus).toHaveText(/inherited/i);
+  });
+
+  test('branding fields toggle between INHERITED and OVERRIDDEN', async ({ page }) => {
+    const { owner, team } = await seedTeam();
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team.url}/settings/branding`);
+
+    const enabledStatus = page.getByTestId('branding-enabled-status');
+    const urlStatus = page.getByTestId('branding-url-status');
+
+    await expect(enabledStatus).toHaveText(/inherited/i);
+    await expect(urlStatus).toHaveText(/inherited/i);
+
+    // Enable branding — unlocks the other fields and overrides the tri-state select.
+    await page.getByTestId('enable-branding').click();
+    await page.getByRole('option', { name: /yes/i }).click();
+
+    await expect(enabledStatus).toHaveText(/override/i);
+
+    // Override the brand website (inherit sentinel is the empty string).
+    await page.getByPlaceholder('https://example.com').fill('https://example.org');
+
+    await expect(urlStatus).toHaveText(/override/i);
+
+    // Clearing the field stages it back to its inherit sentinel (empty string).
+    await page.getByPlaceholder('https://example.com').fill('');
+
+    await expect(urlStatus).toHaveText(/inherited/i);
+  });
+
+  test('reminders page renders extracted fields with inheritance badges', async ({ page }) => {
+    const { owner, team } = await seedTeam();
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team.url}/settings/reminders`);
+
+    await expect(page.getByTestId('envelope-expiration-period-status')).toHaveText(/inherited/i);
+    await expect(page.getByTestId('reminder-settings-status')).toHaveText(/inherited/i);
+
+    // The fields were extracted out of the document preferences page.
+    await page.goto(`/t/${team.url}/settings/document`);
+    await expect(page.getByTestId('document-language-status')).toBeVisible();
+    await expect(page.getByTestId('envelope-expiration-period-status')).not.toBeVisible();
+  });
+
+  test('certificates page renders extracted fields with inheritance badges', async ({ page }) => {
+    const { owner, team } = await seedTeam();
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team.url}/settings/certificates`);
+
+    await expect(page.getByTestId('include-signing-certificate-status')).toHaveText(/inherited/i);
+    await expect(page.getByTestId('include-audit-log-status')).toHaveText(/inherited/i);
+  });
+
+  test('send on behalf of team lives on the email preferences page', async ({ page }) => {
+    const { owner, team } = await seedTeam();
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team.url}/settings/email`);
+
+    await expect(page.getByTestId('include-sender-details-status')).toHaveText(/inherited/i);
+
+    // Moved out of the document preferences page.
+    await page.goto(`/t/${team.url}/settings/document`);
+    await expect(page.getByTestId('document-language-status')).toBeVisible();
+    await expect(page.getByTestId('include-sender-details-status')).not.toBeVisible();
+  });
+
+  test('account settings render inside the unified layout', async ({ page }) => {
+    const { owner } = await seedTeam();
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto('/settings/profile');
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await expect(sidebar).toBeVisible();
+
+    // Org + team groups render via the manageable-organisation fallback, and the
+    // Account group is always present.
+    await expect(sidebar.getByTestId('unified-settings-sidebar-group')).toHaveCount(3);
+
+    await expect(page.getByTestId('settings-scope-breadcrumb-chip')).toContainText('Account Settings');
+  });
+
+  test('personal team can save email preferences', async ({ page }) => {
+    const { user, team } = await seedUser({ isPersonalOrganisation: true });
+
+    await apiSignin({ page, email: user.email });
+    await page.goto(`/t/${team.url}/settings/email`);
+
+    // The sender-details field is hidden for personal orgs and its unchanged
+    // inherit sentinel is echoed back on submit — the server must drop it as a
+    // no-op rather than rejecting the whole update.
+    await page.getByPlaceholder('noreply@example.com').fill('replies@example.com');
+
+    await page.getByRole('button', { name: /save changes/i }).click();
+
+    await expect(page.getByText('Email preferences updated').first()).toBeVisible({ timeout: 15_000 });
+  });
+
+  test('content pane scrolls back to top when navigating between sections', async ({ page }) => {
+    const { owner, team } = await seedTeam();
+
+    // Short (but still md+) viewport so the document preferences page overflows
+    // the internally-scrolling content pane.
+    await page.setViewportSize({ width: 1280, height: 720 });
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team.url}/settings/document`);
+
+    // Wait for the preferences form itself — the pane only overflows once the
+    // form has loaded (the query-loading spinner is shorter than the pane).
+    await expect(page.getByTestId('document-language-trigger')).toBeVisible();
+
+    // The content pane is the <main> wrapping the content container.
+    const contentPane = page.getByTestId('unified-settings-content').locator('..');
+
+    // Scroll the pane down (the document preferences page overflows it).
+    await contentPane.evaluate((el) => el.scrollTo(0, el.scrollHeight));
+
+    const scrolledOffset = await contentPane.evaluate((el) => el.scrollTop);
+    expect(scrolledOffset).toBeGreaterThan(0);
+
+    // Navigate to another section via the sidebar (the members testid exists in
+    // both scope groups, so target the team group's link by href).
+    await page.getByTestId('unified-settings-sidebar').locator(`a[href="/t/${team.url}/settings/members"]`).click();
+    await expect(page).toHaveURL(`/t/${team.url}/settings/members`);
+
+    await expect.poll(async () => await contentPane.evaluate((el) => el.scrollTop)).toBe(0);
+  });
+
+  test('deleted personal-layout URL returns 404', async ({ page }) => {
+    const { user } = await seedUser();
+
+    await apiSignin({ page, email: user.email });
+    const response = await page.goto('/settings/document');
+
+    expect(response?.status()).toBe(404);
+  });
+
+  test('team-only access shows the org switcher but no organisation pages', async ({ page }) => {
+    const { team, organisation } = await seedTeam();
+
+    const manager = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MANAGER });
+    await deleteOwnedOrganisations(manager.id);
+
+    await apiSignin({ page, email: manager.email });
+    await page.goto(`/t/${team.url}/settings/general`);
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await expect(sidebar).toBeVisible();
+
+    // The Organisation group still renders so it can host the switcher — that's the only
+    // way this user can move between organisations — but it exposes no pages.
+    await expect(sidebar.getByTestId('settings-org-switcher-trigger')).toContainText(organisation.name);
+    await expect(sidebar.getByTestId('unified-settings-nav-organisation-general')).toHaveCount(0);
+    await expect(sidebar.getByTestId('unified-settings-nav-organisation-members')).toHaveCount(0);
+    await expect(sidebar.getByTestId('unified-settings-nav-organisation-billing')).toHaveCount(0);
+
+    // An empty group would just look broken, so it explains itself directly under the switcher.
+    const emptyState = sidebar.getByTestId('unified-settings-organisation-empty-state');
+    await expect(emptyState).toBeVisible();
+    await expect(emptyState).toContainText(/permission to manage this organisation/i);
+
+    // Team and account pages remain navigable.
+    await expect(sidebar.getByTestId('unified-settings-nav-team-general')).toBeVisible();
+    await expect(sidebar.getByTestId('unified-settings-nav-team-members')).toBeVisible();
+    await expect(sidebar.getByTestId('unified-settings-nav-account-profile')).toBeVisible();
+  });
+
+  test('team-only access is rejected from organisation settings', async ({ page }) => {
+    const { team, organisation } = await seedTeam();
+
+    const manager = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MANAGER });
+    await deleteOwnedOrganisations(manager.id);
+
+    await apiSignin({ page, email: manager.email });
+
+    // Managing a team must not grant access to the organisation scope.
+    await page.goto(`/o/${organisation.url}/settings/general`);
+
+    await expect(page.getByRole('heading', { name: 'Unauthorized' })).toBeVisible();
+    await expect(page.getByRole('link', { name: /go to your settings/i })).toBeVisible();
+    await expect(page.getByTestId('unified-settings-sidebar')).toHaveCount(0);
+  });
+
+  test('team member without manage permission is rejected from team settings', async ({ page }) => {
+    const { team } = await seedTeam();
+
+    const member = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MEMBER });
+
+    await apiSignin({ page, email: member.email });
+    await page.goto(`/t/${team.url}/settings/general`);
+
+    // The team settings loader redirects out of the settings tree on a full page load.
+    await expect(page).not.toHaveURL(/\/settings\//);
+    await expect(page.getByTestId('unified-settings-sidebar')).toHaveCount(0);
+  });
+
+  test('user with no organisations only sees account settings', async ({ page }) => {
+    const { user } = await seedUser();
+
+    await deleteOwnedOrganisations(user.id);
+
+    await apiSignin({ page, email: user.email });
+    await page.goto('/settings/profile');
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await expect(sidebar).toBeVisible();
+
+    await expect(sidebar.getByTestId('unified-settings-sidebar-group')).toHaveCount(1);
+    await expect(sidebar.getByTestId('unified-settings-nav-account-profile')).toBeVisible();
+    await expect(sidebar.getByTestId('unified-settings-nav-account-security')).toBeVisible();
+
+    // No organisation in context means no switcher and no scoped groups.
+    await expect(sidebar.getByTestId('settings-org-switcher-trigger')).toHaveCount(0);
+    await expect(sidebar.getByTestId('settings-team-switcher-trigger')).toHaveCount(0);
+  });
+
+  test('switching to an organisation the user cannot manage lands in team scope', async ({ page }) => {
+    const { team: otherTeam, organisation: otherOrganisation } = await seedTeam();
+
+    // `seedTeamMember` seeds the user with their own organisation (which they own) and
+    // then grants them a team role in the seeded organisation — exactly the mixed-access
+    // shape the switcher has to handle.
+    const manager = await seedTeamMember({ teamId: otherTeam.id, role: TeamMemberRole.MANAGER });
+
+    const ownedOrganisation = await prisma.organisation.findFirstOrThrow({
+      where: { ownerUserId: manager.id },
+    });
+
+    await apiSignin({ page, email: manager.email });
+    await page.goto(`/o/${ownedOrganisation.url}/settings/members`);
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await sidebar.getByTestId('settings-org-switcher-trigger').click();
+    await page.getByTestId(`settings-org-switcher-item-${otherOrganisation.url}`).click();
+
+    // `members` exists under both scopes so the section carries over, but the scope drops
+    // to team because the user can't manage the destination organisation.
+    await page.waitForURL(`/t/${otherTeam.url}/settings/members`);
+  });
+
+  test('switching scope falls back to General when the section does not exist there', async ({ page }) => {
+    const { team: otherTeam, organisation: otherOrganisation } = await seedTeam();
+
+    const manager = await seedTeamMember({ teamId: otherTeam.id, role: TeamMemberRole.MANAGER });
+
+    const ownedOrganisation = await prisma.organisation.findFirstOrThrow({
+      where: { ownerUserId: manager.id },
+    });
+
+    await apiSignin({ page, email: manager.email });
+
+    // `teams` only exists under organisation scope.
+    await page.goto(`/o/${ownedOrganisation.url}/settings/teams`);
+
+    const sidebar = page.getByTestId('unified-settings-sidebar');
+    await sidebar.getByTestId('settings-org-switcher-trigger').click();
+    await page.getByTestId(`settings-org-switcher-item-${otherOrganisation.url}`).click();
+
+    await page.waitForURL(`/t/${otherTeam.url}/settings/general`);
+  });
+});

packages/app-tests/e2e/signing-branding.spec.ts

@@ -142,3 +142,38 @@ test('[SIGNING_BRANDING]: embedded signing does not render custom logo Brand Web
   await expect(page.locator(`a[href="${BRANDING_URL}"]`)).toHaveCount(0);
   await expect(page.getByRole('link', { name: `${team.name}'s Logo` })).toHaveCount(0);
 });
+
+test('[SIGNING_BRANDING]: custom logo renders when branding is enabled and is hidden when disabled', async ({
+  page,
+}) => {
+  const { user, team, organisation } = await seedUser();
+
+  await enableOrganisationBranding({
+    organisationGlobalSettingsId: organisation.organisationGlobalSettingsId,
+  });
+
+  const { recipients } = await seedPendingDocumentWithFullFields({
+    owner: user,
+    teamId: team.id,
+    recipients: ['enabled-disabled-branding-signer@test.documenso.com'],
+    fields: [FieldType.SIGNATURE],
+    updateDocumentOptions: { internalVersion: 2 },
+  });
+
+  // Branding enabled → the custom logo is rendered on the signing page.
+  await page.goto(`/sign/${recipients[0].token}`);
+  await expectPlainBrandingLogo(page, `${team.name}'s Logo`);
+
+  // Disable branding while keeping the stored logo (the team inherits this).
+  await prisma.organisationGlobalSettings.update({
+    where: { id: organisation.organisationGlobalSettingsId },
+    data: { brandingEnabled: false },
+  });
+
+  // Branding disabled → the custom logo is gone and the Documenso fallback
+  // (an internal link to "/") is shown instead.
+  await page.goto(`/sign/${recipients[0].token}`);
+
+  await expect(page.getByRole('img', { name: `${team.name}'s Logo` })).toHaveCount(0);
+  await expect(page.locator('a[href="/"]').first()).toBeVisible();
+});

packages/app-tests/e2e/teams/default-recipients.spec.ts

@@ -110,7 +110,7 @@ test.describe('Default Recipients', () => {
     await page.getByRole('button', { name: 'Add Signer' }).click();
 
     // Add a regular signer using the v2 editor
-    await page.getByTestId('signer-email-input').last().fill('regular-signer@documenso.com');
+    await page.getByTestId('signer-email-input').first().fill('regular-signer@documenso.com');
     await page
       .getByPlaceholder(/Recipient/)
       .first()

packages/app-tests/e2e/teams/manage-team.spec.ts

@@ -69,5 +69,6 @@ test('[TEAMS]: update team', async ({ page }) => {
   await page.getByRole('button', { name: 'Save changes' }).click();
 
   // Check we have been redirected to the new team URL and the name is updated.
-  await page.waitForURL(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${updatedTeamId}/settings`);
+  // The team settings index redirects to the explicit General route.
+  await page.waitForURL(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${updatedTeamId}/settings/general`);
 });

packages/app-tests/e2e/teams/team-documents.spec.ts

@@ -5,7 +5,7 @@ import { expect, test } from '@playwright/test';
 import { DocumentStatus, DocumentVisibility, TeamMemberRole } from '@prisma/client';
 
 import { apiSignin, apiSignout } from '../fixtures/authentication';
-import { checkDocumentTabCount } from '../fixtures/documents';
+import { checkDocumentCounts, checkDocumentTabCount, toggleDocumentSenderFilter } from '../fixtures/documents';
 import { expectTextToBeVisible, expectToastTextToBeVisible, openDropdownMenu } from '../fixtures/generic';
 
 test('[TEAMS]: check team documents count', async ({ page }) => {
@@ -20,23 +20,13 @@ test('[TEAMS]: check team documents count', async ({ page }) => {
     });
 
     // Check document counts.
-    await checkDocumentTabCount(page, 'Inbox', 0);
-    await checkDocumentTabCount(page, 'Pending', 2);
-    await checkDocumentTabCount(page, 'Completed', 1);
-    await checkDocumentTabCount(page, 'Draft', 2);
-    await checkDocumentTabCount(page, 'All', 5);
+    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 1, draft: 2, all: 5 });
 
     // Apply filter.
-    await page.locator('button').filter({ hasText: 'Sender: All' }).click();
-    await page.getByRole('option', { name: teamMember2.name ?? '' }).click();
-    await page.waitForURL(/senderIds/);
+    await toggleDocumentSenderFilter(page, teamMember2.name ?? '');
 
     // Check counts after filtering.
-    await checkDocumentTabCount(page, 'Inbox', 0);
-    await checkDocumentTabCount(page, 'Pending', 2);
-    await checkDocumentTabCount(page, 'Completed', 0);
-    await checkDocumentTabCount(page, 'Draft', 1);
-    await checkDocumentTabCount(page, 'All', 3);
+    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 0, draft: 1, all: 3 });
 
     await apiSignout({ page });
   }
@@ -115,23 +105,13 @@ test('[TEAMS]: check team documents count with internal team email', async ({ pa
     });
 
     // Check document counts.
-    await checkDocumentTabCount(page, 'Inbox', 2);
-    await checkDocumentTabCount(page, 'Pending', 3);
-    await checkDocumentTabCount(page, 'Completed', 3);
-    await checkDocumentTabCount(page, 'Draft', 3);
-    await checkDocumentTabCount(page, 'All', 11);
+    await checkDocumentCounts(page, { inbox: 2, pending: 3, completed: 3, draft: 3, all: 11 });
 
     // Apply filter.
-    await page.locator('button').filter({ hasText: 'Sender: All' }).click();
-    await page.getByRole('option', { name: teamMember2.name ?? '' }).click();
-    await page.waitForURL(/senderIds/);
+    await toggleDocumentSenderFilter(page, teamMember2.name ?? '');
 
     // Check counts after filtering.
-    await checkDocumentTabCount(page, 'Inbox', 0);
-    await checkDocumentTabCount(page, 'Pending', 2);
-    await checkDocumentTabCount(page, 'Completed', 0);
-    await checkDocumentTabCount(page, 'Draft', 1);
-    await checkDocumentTabCount(page, 'All', 3);
+    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 0, draft: 1, all: 3 });
 
     await apiSignout({ page });
   }
@@ -202,23 +182,13 @@ test('[TEAMS]: check team documents count with external team email', async ({ pa
   });
 
   // Check document counts.
-  await checkDocumentTabCount(page, 'Inbox', 3);
-  await checkDocumentTabCount(page, 'Pending', 2);
-  await checkDocumentTabCount(page, 'Completed', 2);
-  await checkDocumentTabCount(page, 'Draft', 2);
-  await checkDocumentTabCount(page, 'All', 9);
+  await checkDocumentCounts(page, { inbox: 3, pending: 2, completed: 2, draft: 2, all: 9 });
 
   // Apply filter.
-  await page.locator('button').filter({ hasText: 'Sender: All' }).click();
-  await page.getByRole('option', { name: teamMember2.name ?? '' }).click();
-  await page.waitForURL(/senderIds/);
+  await toggleDocumentSenderFilter(page, teamMember2.name ?? '');
 
   // Check counts after filtering.
-  await checkDocumentTabCount(page, 'Inbox', 0);
-  await checkDocumentTabCount(page, 'Pending', 2);
-  await checkDocumentTabCount(page, 'Completed', 0);
-  await checkDocumentTabCount(page, 'Draft', 1);
-  await checkDocumentTabCount(page, 'All', 3);
+  await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 0, draft: 1, all: 3 });
 });
 
 test('[TEAMS]: resend pending team document', async ({ page }) => {
@@ -273,11 +243,7 @@ test('[TEAMS]: delete draft team document', async ({ page }) => {
     });
 
     // Check document counts.
-    await checkDocumentTabCount(page, 'Inbox', 0);
-    await checkDocumentTabCount(page, 'Pending', 2);
-    await checkDocumentTabCount(page, 'Completed', 1);
-    await checkDocumentTabCount(page, 'Draft', 1);
-    await checkDocumentTabCount(page, 'All', 4);
+    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 1, draft: 1, all: 4 });
 
     await apiSignout({ page });
   }
@@ -316,11 +282,7 @@ test('[TEAMS]: delete pending team document', async ({ page }) => {
     });
 
     // Check document counts.
-    await checkDocumentTabCount(page, 'Inbox', 0);
-    await checkDocumentTabCount(page, 'Pending', 1);
-    await checkDocumentTabCount(page, 'Completed', 1);
-    await checkDocumentTabCount(page, 'Draft', 2);
-    await checkDocumentTabCount(page, 'All', 4);
+    await checkDocumentCounts(page, { inbox: 0, pending: 1, completed: 1, draft: 2, all: 4 });
 
     await apiSignout({ page });
   }
@@ -359,11 +321,7 @@ test('[TEAMS]: delete completed team document', async ({ page }) => {
     });
 
     // Check document counts.
-    await checkDocumentTabCount(page, 'Inbox', 0);
-    await checkDocumentTabCount(page, 'Pending', 2);
-    await checkDocumentTabCount(page, 'Completed', 0);
-    await checkDocumentTabCount(page, 'Draft', 2);
-    await checkDocumentTabCount(page, 'All', 4);
+    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 0, draft: 2, all: 4 });
 
     await apiSignout({ page });
   }

packages/app-tests/e2e/teams/team-email.spec.ts

@@ -1,4 +1,5 @@
 import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
+import { prisma } from '@documenso/prisma';
 import { seedTeamEmailVerification } from '@documenso/prisma/seed/teams';
 import { seedUser } from '@documenso/prisma/seed/users';
 import { expect, test } from '@playwright/test';
@@ -29,7 +30,33 @@ test('[TEAMS]: send team email request', async ({ page }) => {
 });
 
 test('[TEAMS]: accept team email request', async ({ page }) => {
-  const { user, team } = await seedUser();
+  const { team } = await seedUser();
+
+  const teamEmailVerification = await seedTeamEmailVerification({
+    email: `team-email-verification--${team.url}@test.documenso.com`,
+    teamId: team.id,
+  });
+
+  const getTeamEmail = async () => prisma.teamEmail.findUnique({ where: { teamId: team.id } });
+
+  expect(await getTeamEmail()).toBeNull();
+
+  await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/team/verify/email/${teamEmailVerification.token}`);
+
+  // Visiting the page (GET) must not verify the team email. An automated email link
+  // scanner or prefetcher must not be able to complete the verification.
+  await expect(page.getByRole('heading', { name: 'Verify team email' })).toBeVisible();
+  expect(await getTeamEmail()).toBeNull();
+
+  await page.getByRole('button', { name: 'Verify email' }).click();
+
+  await expect(page.getByRole('heading', { name: 'Team email verified!' })).toBeVisible();
+
+  expect(await getTeamEmail()).not.toBeNull();
+});
+
+test('[TEAMS]: team email verification link is invalid once completed', async ({ page }) => {
+  const { team } = await seedUser();
 
   const teamEmailVerification = await seedTeamEmailVerification({
     email: `team-email-verification--${team.url}@test.documenso.com`,
@@ -37,7 +64,11 @@ test('[TEAMS]: accept team email request', async ({ page }) => {
   });
 
   await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/team/verify/email/${teamEmailVerification.token}`);
-  await expect(page.getByRole('heading')).toContainText('Team email verified!');
+  await page.getByRole('button', { name: 'Verify email' }).click();
+  await expect(page.getByRole('heading', { name: 'Team email verified!' })).toBeVisible();
+
+  await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/team/verify/email/${teamEmailVerification.token}`);
+  await expect(page.getByRole('heading', { name: 'Team email already verified!' })).toBeVisible();
 });
 
 test('[TEAMS]: delete team email', async ({ page }) => {

packages/app-tests/e2e/teams/team-settings-save-bar.spec.ts

@@ -51,6 +51,10 @@ test('[ORGANISATIONS]: settings save bar floats when the form footer is off-scre
     isPersonalOrganisation: false,
   });
 
+  // Short (but still md+) viewport so the document preferences form overflows
+  // the internally-scrolling settings content pane.
+  await page.setViewportSize({ width: 1280, height: 720 });
+
   await apiSignin({
     page,
     email: user.email,
@@ -71,8 +75,10 @@ test('[ORGANISATIONS]: settings save bar floats when the form footer is off-scre
   await expect(page.getByRole('button', { name: 'Save changes' })).toBeVisible();
 
   // Scroll to the footer → the floating pill merges into the docked buttons and the
-  // notice disappears.
-  await page.evaluate(() => window.scrollTo(0, document.body.scrollHeight));
+  // notice disappears. The settings layout scrolls its content pane internally,
+  // so scroll that pane rather than the window.
+  const contentPane = page.getByTestId('unified-settings-content').locator('..');
+  await contentPane.evaluate((el) => el.scrollTo(0, el.scrollHeight));
 
   await expect(page.getByText('You have unsaved changes')).not.toBeVisible();
   await expect(page.getByRole('button', { name: 'Save changes' })).toBeVisible();

packages/app-tests/e2e/templates/bulk-template-actions.spec.ts

@@ -49,10 +49,10 @@ test('[BULK_ACTIONS]: can select multiple templates with checkboxes', async ({ p
   });
 
   await page.locator('tr', { hasText: 'Bulk Test Template 1' }).getByRole('checkbox').click();
-  await expect(page.getByText('1 selected')).toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
 
   await page.locator('tr', { hasText: 'Bulk Test Template 2' }).getByRole('checkbox').click();
-  await expect(page.getByText('2 selected')).toBeVisible();
+  await expect(page.getByText(/2\s*selected/)).toBeVisible();
 });
 
 test('[BULK_ACTIONS]: header checkbox selects all templates on page', async ({ page }) => {
@@ -66,7 +66,7 @@ test('[BULK_ACTIONS]: header checkbox selects all templates on page', async ({ p
 
   await page.locator('thead').getByRole('checkbox').click();
 
-  await expect(page.getByText(`${templates.length} selected`)).toBeVisible();
+  await expect(page.getByText(new RegExp(`${templates.length}\\s*selected`))).toBeVisible();
 });
 
 test('[BULK_ACTIONS]: can clear selection with X button', async ({ page }) => {
@@ -79,11 +79,11 @@ test('[BULK_ACTIONS]: can clear selection with X button', async ({ page }) => {
   });
 
   await page.locator('thead').getByRole('checkbox').click();
-  await expect(page.getByText(/\d+ selected/)).toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).toBeVisible();
 
   await page.getByLabel('Clear selection').click();
 
-  await expect(page.getByText(/\d+ selected/)).not.toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).not.toBeVisible();
 });
 
 test('[BULK_ACTIONS]: can move multiple templates to a folder', async ({ page }) => {
@@ -97,13 +97,13 @@ test('[BULK_ACTIONS]: can move multiple templates to a folder', async ({ page })
 
   await page.locator('tr', { hasText: 'Bulk Test Template 1' }).getByRole('checkbox').click();
   await page.locator('tr', { hasText: 'Bulk Test Template 2' }).getByRole('checkbox').click();
-  await page.getByRole('button', { name: 'Move to Folder' }).click();
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
 
   await expect(page.getByRole('dialog')).toBeVisible();
   await expect(page.getByText('Move Templates to Folder')).toBeVisible();
 
   await page.getByRole('button', { name: folder.name }).click();
-  await page.getByRole('button', { name: 'Move' }).click();
+  await page.getByRole('dialog').getByRole('button', { name: 'Move' }).click();
 
   await expectToastTextToBeVisible(page, 'Selected items have been moved.');
 
@@ -151,14 +151,14 @@ test('[BULK_ACTIONS]: selection clears after successful move', async ({ page })
   });
 
   await page.locator('tr', { hasText: 'Bulk Test Template 1' }).getByRole('checkbox').click();
-  await expect(page.getByText('1 selected')).toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
 
-  await page.getByRole('button', { name: 'Move to Folder' }).click();
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
   await page.getByRole('button', { name: folder.name }).click();
-  await page.getByRole('button', { name: 'Move' }).click();
+  await page.getByRole('dialog').getByRole('button', { name: 'Move' }).click();
 
   await expectToastTextToBeVisible(page, 'Selected items have been moved.');
-  await expect(page.getByText(/\d+ selected/)).not.toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).not.toBeVisible();
 });
 
 test('[BULK_ACTIONS]: selection clears after successful delete', async ({ page }) => {
@@ -171,13 +171,13 @@ test('[BULK_ACTIONS]: selection clears after successful delete', async ({ page }
   });
 
   await page.locator('tr', { hasText: 'Bulk Test Template 1' }).getByRole('checkbox').click();
-  await expect(page.getByText('1 selected')).toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
 
   await page.getByRole('button', { name: 'Delete' }).click();
   await page.getByRole('dialog').getByRole('button', { name: 'Delete' }).click();
 
   await expectToastTextToBeVisible(page, 'Templates deleted');
-  await expect(page.getByText(/\d+ selected/)).not.toBeVisible();
+  await expect(page.getByText(/\d+\s*selected/)).not.toBeVisible();
 });
 
 test('[BULK_ACTIONS]: can search for folders in move dialog', async ({ page }) => {
@@ -199,7 +199,7 @@ test('[BULK_ACTIONS]: can search for folders in move dialog', async ({ page }) =
 
   await page.locator('tr', { hasText: 'Bulk Test Template 1' }).getByRole('checkbox').click();
 
-  await page.getByRole('button', { name: 'Move to Folder' }).click();
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
   await expect(page.getByRole('dialog')).toBeVisible();
 
   await expect(page.getByRole('button', { name: folder.name })).toBeVisible();
@@ -236,14 +236,14 @@ test('[BULK_ACTIONS]: can move templates from folder to home (root)', async ({ p
   await expect(page.getByRole('link', { name: 'Bulk Test Template 1' })).toBeVisible();
 
   await page.locator('tr', { hasText: 'Bulk Test Template 1' }).getByRole('checkbox').click();
-  await expect(page.getByText('1 selected')).toBeVisible();
+  await expect(page.getByText(/1\s*selected/)).toBeVisible();
 
-  await page.getByRole('button', { name: 'Move to Folder' }).click();
+  await page.getByRole('button', { name: 'Move', exact: true }).click();
   await expect(page.getByRole('dialog')).toBeVisible();
 
   await page.getByRole('button', { name: 'Home (No Folder)' }).click();
 
-  await page.getByRole('button', { name: 'Move' }).click();
+  await page.getByRole('dialog').getByRole('button', { name: 'Move' }).click();
 
   await expectToastTextToBeVisible(page, 'Selected items have been moved.');
 

packages/app-tests/e2e/templates/direct-templates.spec.ts

@@ -197,7 +197,18 @@ test('[DIRECT_TEMPLATES]: V1 direct template link auth access', async ({ page })
   await expect(page.getByRole('heading', { name: 'General' })).toBeVisible();
   await expect(page.getByLabel('Email')).toBeDisabled();
 
+  const directSignatureField = directTemplateWithAuth.fields[0];
+
+  if (!directSignatureField) {
+    throw new Error('Expected seeded direct template signature field to exist');
+  }
+
   await page.getByRole('button', { name: 'Continue' }).click();
+
+  await signSignaturePad(page);
+  await page.locator(`#field-${directSignatureField.id}`).getByRole('button').click();
+  await expect(page.locator(`#field-${directSignatureField.id}`)).toHaveAttribute('data-inserted', 'true');
+
   await page.getByRole('button', { name: 'Complete' }).click();
 
   await page.getByRole('button', { name: 'Sign' }).click();
@@ -235,6 +246,37 @@ test('[DIRECT_TEMPLATES]: V2 direct template link auth access', async ({ page })
   await page.goto(directTemplatePath);
 
   await expect(page.getByRole('heading', { name: 'Personal direct template link' })).toBeVisible();
+
+  const directSignatureField = directTemplateWithAuth.fields[0];
+
+  if (!directSignatureField) {
+    throw new Error('Expected seeded direct template signature field to exist');
+  }
+
+  // Wait for the PDF and the Konva canvas overlay to be ready.
+  await expect(page.locator('img[data-page-number]').first()).toBeVisible({ timeout: 30_000 });
+  const canvas = page.locator('.konva-container canvas').first();
+  await expect(canvas).toBeVisible({ timeout: 30_000 });
+
+  // Sign the direct template recipient's signature field via the canvas-based V2 UI.
+  await signSignaturePad(page);
+
+  const canvasBox = await canvas.boundingBox();
+
+  if (!canvasBox) {
+    throw new Error('Canvas bounding box not found');
+  }
+
+  const x =
+    (Number(directSignatureField.positionX) / 100) * canvasBox.width +
+    ((Number(directSignatureField.width) / 100) * canvasBox.width) / 2;
+  const y =
+    (Number(directSignatureField.positionY) / 100) * canvasBox.height +
+    ((Number(directSignatureField.height) / 100) * canvasBox.height) / 2;
+
+  await canvas.click({ position: { x, y } });
+  await expect(page.getByText('0 Fields Remaining').first()).toBeVisible({ timeout: 10_000 });
+
   await page.getByRole('button', { name: 'Complete' }).click();
   await expect(page.getByLabel('Your Email')).not.toBeVisible();
 
@@ -266,6 +308,16 @@ test('[DIRECT_TEMPLATES]: use direct template link with 1 recipient', async ({ p
 
   await expect(page.getByText('Next Recipient Name')).not.toBeVisible();
 
+  const directSignatureField = template.fields[0];
+
+  if (!directSignatureField) {
+    throw new Error('Expected seeded direct template signature field to exist');
+  }
+
+  await signSignaturePad(page);
+  await page.locator(`#field-${directSignatureField.id}`).getByRole('button').click();
+  await expect(page.locator(`#field-${directSignatureField.id}`)).toHaveAttribute('data-inserted', 'true');
+
   await page.getByRole('button', { name: 'Complete' }).click();
   await page.getByRole('button', { name: 'Sign' }).click();
   await page.waitForURL(/\/sign/);
@@ -299,19 +351,13 @@ test('[DIRECT_TEMPLATES]: V1 use direct template link with 2 recipients with nex
     },
   });
 
-  const directTemplateRecipient = template.recipients[0];
+  // The seeded direct template already includes a signature field for the direct recipient.
+  const directSignatureField = template.fields[0];
 
-  if (!directTemplateRecipient) {
-    throw new Error('Expected direct template recipient to exist');
+  if (!directSignatureField) {
+    throw new Error('Expected seeded direct template signature field to exist');
   }
 
-  // All SIGNER recipients need a signature field for sendDocument to dispatch emails.
-  const directSignatureField = await seedSignatureFieldForRecipient({
-    envelopeId: template.id,
-    recipientId: directTemplateRecipient.id,
-    positionY: 10,
-  });
-
   const originalName = 'Signer 2';
   const originalSecondSignerEmail = seedTestEmail();
 
@@ -413,19 +459,13 @@ test('[DIRECT_TEMPLATES]: V2 use direct template link with 2 recipients with nex
     },
   });
 
-  const directTemplateRecipient = template.recipients[0];
+  // The seeded direct template already includes a signature field for the direct recipient.
+  const directSignatureField = template.fields[0];
 
-  if (!directTemplateRecipient) {
-    throw new Error('Expected direct template recipient to exist');
+  if (!directSignatureField) {
+    throw new Error('Expected seeded direct template signature field to exist');
   }
 
-  // All SIGNER recipients need a signature field for sendDocument to dispatch emails.
-  const directSignatureField = await seedSignatureFieldForRecipient({
-    envelopeId: template.id,
-    recipientId: directTemplateRecipient.id,
-    positionY: 10,
-  });
-
   const originalName = 'Signer 2';
   const originalSecondSignerEmail = seedTestEmail();
 
@@ -521,3 +561,48 @@ test('[DIRECT_TEMPLATES]: V2 use direct template link with 2 recipients with nex
   expect(updatedSecondRecipient.email).toBe(newSecondSignerEmail);
   await expectSigningRequestJobForRecipient(updatedSecondRecipient.id);
 });
+
+test('[DIRECT_TEMPLATES]: V1 direct template without signature fields shows invalid template page', async ({
+  page,
+}) => {
+  const { user, team } = await seedUser();
+
+  const template = await seedDirectTemplate({
+    title: 'V1 invalid direct template',
+    userId: user.id,
+    teamId: team.id,
+    createDirectRecipientSignatureField: false,
+  });
+
+  await page.goto(formatDirectTemplatePath(template.directLink?.token || ''));
+
+  await expect(page.getByRole('heading', { name: 'Invalid direct link template' })).toBeVisible();
+  await expect(page.getByText('This direct link template cannot be used because one or more signers')).toBeVisible();
+
+  // The signing flow must not render.
+  await expect(page.getByRole('heading', { name: 'General' })).not.toBeVisible();
+  await expect(page.getByRole('button', { name: 'Continue' })).not.toBeVisible();
+});
+
+test('[DIRECT_TEMPLATES]: V2 direct template without signature fields shows invalid template page', async ({
+  page,
+}) => {
+  const { user, team } = await seedUser();
+
+  const template = await seedDirectTemplate({
+    title: 'V2 invalid direct template',
+    userId: user.id,
+    teamId: team.id,
+    internalVersion: 2,
+    createDirectRecipientSignatureField: false,
+  });
+
+  await page.goto(formatDirectTemplatePath(template.directLink?.token || ''));
+
+  await expect(page.getByRole('heading', { name: 'Invalid direct link template' })).toBeVisible();
+  await expect(page.getByText('This direct link template cannot be used because one or more signers')).toBeVisible();
+
+  // The signing flow (PDF canvas) must not render.
+  await expect(page.locator('.konva-container canvas')).toHaveCount(0);
+  await expect(page.getByRole('button', { name: 'Complete' })).not.toBeVisible();
+});

packages/app-tests/e2e/templates/template-use-dialog.spec.ts

@@ -0,0 +1,101 @@
+import { FIELD_SIGNATURE_META_DEFAULT_VALUES } from '@documenso/lib/types/field-meta';
+import { prisma } from '@documenso/prisma';
+import { seedTemplate } from '@documenso/prisma/seed/templates';
+import { seedUser } from '@documenso/prisma/seed/users';
+import { expect, test } from '@playwright/test';
+import { DocumentStatus, FieldType } from '@prisma/client';
+
+import { apiSignin } from '../fixtures/authentication';
+import { expectToastTextToBeVisible } from '../fixtures/generic';
+
+const seedSignatureFieldForRecipient = async (options: { envelopeId: string; recipientId: number }) => {
+  const envelopeItem = await prisma.envelopeItem.findFirstOrThrow({
+    where: { envelopeId: options.envelopeId },
+  });
+
+  return await prisma.field.create({
+    data: {
+      envelopeId: options.envelopeId,
+      envelopeItemId: envelopeItem.id,
+      recipientId: options.recipientId,
+      type: FieldType.SIGNATURE,
+      page: 1,
+      positionX: 5,
+      positionY: 10,
+      width: 20,
+      height: 5,
+      customText: '',
+      inserted: false,
+      fieldMeta: FIELD_SIGNATURE_META_DEFAULT_VALUES,
+    },
+  });
+};
+
+test('[TEMPLATE_USE]: shows missing signature fields error when sending a template without signature fields', async ({
+  page,
+}) => {
+  const { user, team } = await seedUser();
+
+  // seedTemplate creates one SIGNER recipient and no fields.
+  await seedTemplate({
+    title: 'Template missing signature fields',
+    userId: user.id,
+    teamId: team.id,
+  });
+
+  await apiSignin({
+    page,
+    email: user.email,
+    redirectPath: `/t/${team.url}/templates`,
+  });
+
+  await page.getByRole('button', { name: 'Use Template' }).click();
+  await expect(page.getByRole('heading', { name: 'Create document from template' })).toBeVisible();
+
+  // Enable distribution so the document is sent on creation.
+  await page.locator('#distributeDocument').click();
+  await page.getByRole('button', { name: 'Create and send' }).click();
+
+  await expectToastTextToBeVisible(page, 'Missing signature fields');
+  await expectToastTextToBeVisible(
+    page,
+    'The document could not be sent because some signers do not have a signature field',
+  );
+});
+
+test('[TEMPLATE_USE]: creates and sends a document when signers have signature fields', async ({ page }) => {
+  const { user, team } = await seedUser();
+
+  const template = await seedTemplate({
+    title: 'Template with signature fields',
+    userId: user.id,
+    teamId: team.id,
+  });
+
+  await seedSignatureFieldForRecipient({
+    envelopeId: template.id,
+    recipientId: template.recipients[0].id,
+  });
+
+  await apiSignin({
+    page,
+    email: user.email,
+    redirectPath: `/t/${team.url}/templates`,
+  });
+
+  await page.getByRole('button', { name: 'Use Template' }).click();
+  await expect(page.getByRole('heading', { name: 'Create document from template' })).toBeVisible();
+
+  await page.locator('#distributeDocument').click();
+  await page.getByRole('button', { name: 'Create and send' }).click();
+
+  await page.waitForURL(new RegExp(`/t/${team.url}/documents/envelope_.*`));
+
+  const envelopeId = page.url().split('/').pop()?.split('?')[0];
+
+  const envelope = await prisma.envelope.findFirstOrThrow({
+    where: { id: envelopeId },
+  });
+
+  expect(envelope.status).toBe(DocumentStatus.PENDING);
+});

packages/app-tests/e2e/webhooks/webhook-secret-access.spec.ts

@@ -0,0 +1,74 @@
+import { prisma } from '@documenso/prisma';
+import { seedTeam, seedTeamMember } from '@documenso/prisma/seed/teams';
+import type { Page } from '@playwright/test';
+import { expect, test } from '@playwright/test';
+import { TeamMemberRole, WebhookTriggerEvents } from '@prisma/client';
+
+import { apiSignin } from '../fixtures/authentication';
+
+/**
+ * Calls the procedure the way an attacker would — directly, from the authenticated browser
+ * context, bypassing the UI entirely. The settings page is gated on MANAGE_TEAM, so going
+ * through the UI would only prove the page is hidden, not that the data is protected.
+ */
+const callGetTeamWebhooks = async (page: Page, teamId: number) =>
+  await page.evaluate(async (id) => {
+    const response = await fetch('/api/trpc/webhook.getTeamWebhooks', {
+      method: 'GET',
+      headers: { 'content-type': 'application/json', 'x-team-id': String(id) },
+    });
+
+    return { status: response.status, body: await response.text() };
+  }, teamId);
+
+test.describe('Webhook secret access', () => {
+  test('team managers can read webhook secrets', async ({ page }) => {
+    const { owner, team } = await seedTeam();
+
+    await prisma.webhook.create({
+      data: {
+        webhookUrl: 'https://example.com/hook',
+        eventTriggers: [WebhookTriggerEvents.DOCUMENT_SENT],
+        secret: 'super-secret-signing-key',
+        enabled: true,
+        userId: owner.id,
+        teamId: team.id,
+      },
+    });
+
+    await apiSignin({ page, email: owner.email });
+    await page.goto(`/t/${team.url}/settings/webhooks`);
+
+    const { status, body } = await callGetTeamWebhooks(page, team.id);
+
+    expect(status).toBe(200);
+    // The edit dialog reads the secret straight off these rows, so managers must get it.
+    expect(body).toContain('super-secret-signing-key');
+  });
+
+  test('team members without manage permission cannot read webhook secrets', async ({ page }) => {
+    const { owner, team } = await seedTeam();
+
+    await prisma.webhook.create({
+      data: {
+        webhookUrl: 'https://example.com/hook',
+        eventTriggers: [WebhookTriggerEvents.DOCUMENT_SENT],
+        secret: 'super-secret-signing-key',
+        enabled: true,
+        userId: owner.id,
+        teamId: team.id,
+      },
+    });
+
+    const member = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MEMBER });
+
+    await apiSignin({ page, email: member.email });
+    await page.goto(`/t/${team.url}/documents`);
+
+    const { status, body } = await callGetTeamWebhooks(page, team.id);
+
+    // Whatever the failure mode, the signing key must never appear in the response.
+    expect(body).not.toContain('super-secret-signing-key');
+    expect(status).not.toBe(200);
+  });
+});