fix: wip

packages/lib/server-only/field/sign-field-with-token.ts

@@ -13,6 +13,7 @@ import { match } from 'ts-pattern';
 import { AUTO_SIGNABLE_FIELD_TYPES } from '../../constants/autosign';
 import { DEFAULT_DOCUMENT_DATE_FORMAT } from '../../constants/date-formats';
 import { DEFAULT_DOCUMENT_TIME_ZONE } from '../../constants/time-zones';
+import { AppError, AppErrorCode } from '../../errors/app-error';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
 import type { TRecipientActionAuth } from '../../types/document-auth';
 import {
@@ -24,7 +25,7 @@ import {
 } from '../../types/field-meta';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
-import { assertRecipientNotExpired } from '../../utils/recipients';
+import { assertRecipientNotExpired, getFieldOwnerWhereInput } from '../../utils/recipients';
 import { validateFieldAuth } from '../document/validate-field-auth';
 
 export type SignFieldWithTokenOptions = {
@@ -65,21 +66,7 @@ export const signFieldWithToken = async ({
   const field = await prisma.field.findFirstOrThrow({
     where: {
       id: fieldId,
-      recipient: {
-        ...(recipient.role !== RecipientRole.ASSISTANT
-          ? {
-              id: recipient.id,
-            }
-          : {
-              signingStatus: {
-                not: SigningStatus.SIGNED,
-              },
-              signingOrder: {
-                gte: recipient.signingOrder ?? 0,
-              },
-              envelopeId: recipient.envelopeId,
-            }),
-      },
+      recipient: getFieldOwnerWhereInput(recipient),
     },
     include: {
       envelope: {
@@ -124,6 +111,18 @@ export const signFieldWithToken = async ({
     throw new Error(`Field ${fieldId} has no recipientId`);
   }
 
+  // Mirrors the V2 guard in `sign-envelope-field.ts`: assistants may prefill
+  // other recipients' fields but never their signature fields.
+  if (
+    field.type === FieldType.SIGNATURE &&
+    recipient.role === RecipientRole.ASSISTANT &&
+    field.recipientId !== recipient.id
+  ) {
+    throw new AppError(AppErrorCode.INVALID_REQUEST, {
+      message: 'Assistant recipients cannot sign signature fields',
+    });
+  }
+
   if (field.type === FieldType.NUMBER && field.fieldMeta) {
     const numberFieldParsedMeta = ZNumberFieldMeta.parse(field.fieldMeta);
     const errors = validateNumberField(value, numberFieldParsedMeta, true);