refactor: deduplicate QR share helpers and fix polling leak

Extract shared tokenFingerprint() and isPublicDocumentAccessEnabled()
helpers, reuse rateLimitResponse from rate-limit-middleware, deduplicate
Prisma include across view/download handlers, convert error if-chain to
if/else-if, move MAX_QR_RETRY_COUNT to module scope, and stop
refetchInterval once document reaches terminal status.

packages/lib/server-only/document/get-document-by-access-token.ts

@@ -1,6 +1,7 @@
 import { DocumentStatus, EnvelopeType } from '@prisma/client';
 
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { isPublicDocumentAccessEnabled } from '@documenso/lib/universal/document-access';
 import { prisma } from '@documenso/prisma';
 
 import { mapSecondaryIdToDocumentId } from '../../utils/envelope';
@@ -88,12 +89,7 @@ export const getDocumentByAccessToken = async ({ token }: GetDocumentByAccessTok
     });
   }
 
-  const allowPublicCompletedDocumentAccess =
-    result.team?.teamGlobalSettings?.allowPublicCompletedDocumentAccess ??
-    result.team?.organisation.organisationGlobalSettings.allowPublicCompletedDocumentAccess ??
-    true;
-
-  if (!allowPublicCompletedDocumentAccess) {
+  if (!isPublicDocumentAccessEnabled(result.team)) {
     throw new AppError(AppErrorCode.UNAUTHORIZED, {
       message: 'Public completed-document access is disabled for this document',
       statusCode: 403,

packages/lib/universal/crypto.ts

@@ -31,4 +31,8 @@ export const symmetricDecrypt = ({ key, data }: SymmetricDecryptOptions) => {
   return chacha.decrypt(dataAsBytes);
 };
 
+export const tokenFingerprint = (token: string): string => {
+  return bytesToHex(sha256(token)).slice(0, 16);
+};
+
 export { sha256 };

packages/lib/universal/document-access.ts

@@ -0,0 +1,21 @@
+type PublicAccessTeam = {
+  teamGlobalSettings?: {
+    allowPublicCompletedDocumentAccess: boolean | null;
+  } | null;
+  organisation: {
+    organisationGlobalSettings: {
+      allowPublicCompletedDocumentAccess: boolean;
+    };
+  };
+} | null;
+
+export const isPublicDocumentAccessEnabled = (team: PublicAccessTeam): boolean => {
+  if (!team) {
+    return true;
+  }
+
+  return (
+    team.teamGlobalSettings?.allowPublicCompletedDocumentAccess ??
+    team.organisation.organisationGlobalSettings.allowPublicCompletedDocumentAccess
+  );
+};