Merge branch 'main' into feat/api-tokens-last-used-timestamp

packages/trpc/server/recipient-router/router.ts

@@ -603,7 +603,7 @@ export const recipientRouter = router({
         // can't complete via this route — they go through the CSC sync sign
         // flow (`enterprise.csc.signEnvelope`). This route returns the redirect URL
         // for the credential-scope OAuth round-trip.
-        const envelope = await prisma.envelope.findFirstOrThrow({
+        const envelope = await prisma.envelope.findFirst({
           where: {
             ...unsafeBuildEnvelopeIdQuery({ type: 'documentId', id: documentId }, EnvelopeType.DOCUMENT),
             recipients: { some: { token } },
@@ -611,6 +611,16 @@ export const recipientRouter = router({
           select: { signatureLevel: true, internalVersion: true },
         });
 
+        // The most common cause is a stale signing page: the document was
+        // deleted, or the recipient was removed, after the link was opened.
+        // Surface a NOT_FOUND instead of leaking a Prisma P2025 as a 500.
+        if (!envelope) {
+          throw new AppError(AppErrorCode.NOT_FOUND, {
+            message: 'Document not found for the provided signing token',
+            statusCode: 404,
+          });
+        }
+
         if (isTspEnvelope(envelope)) {
           return await prepareCscRecipientSigning({
             recipientToken: token,