Ryan/documenso
1
0
Fork 1
mirror of https://github.com/documenso/documenso.git synced 2025-11-13 00:03:33 +10:00
Code Issues Packages Projects Releases Wiki Activity

allow adding field via recipient token for signing

Browse Source
This commit is contained in:
Timur Ercan
2023-03-20 15:11:20 +01:00
parent dd67e1a6f0
commit 7d6bd00a22
3 changed files with 32 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/web/components/editor/pdf-signer.tsx
View File

@ -173,7 +173,11 @@ export default function PDFSigner(props: any) {
FieldType.FREE_SIGNATURE
);
createOrUpdateField(props.document, freeSignatureField).then((res) => {
createOrUpdateField(
props.document,
freeSignatureField,
recipient.token
).then((res) => {
setFields(fields.concat(res));
setDialogField(res);
setOpen(true);

34
apps/web/pages/api/documents/[id]/fields/index.ts
View File

@ -36,8 +36,10 @@ async function getHandler(req: NextApiRequest, res: NextApiResponse) {
}
async function postHandler(req: NextApiRequest, res: NextApiResponse) {
const user = await getUserFromToken(req, res);
const { id: documentId } = req.query;
const { token: recipientToken } = req.query;
let user = null;
if (!recipientToken) user = await getUserFromToken(req, res);
if (!user && !recipientToken) return res.status(401).end();
const body: {
id: number;
type: FieldType;
@ -48,18 +50,30 @@ async function postHandler(req: NextApiRequest, res: NextApiResponse) {
customText: string;
} = req.body;
if (!user) return;
const { id: documentId } = req.query;
if (!documentId) {
res.status(400).send("Missing parameter documentId.");
return;
return res.status(400).send("Missing parameter documentId.");
}
const document: PrismaDocument = await getDocument(+documentId, req, res);
if (recipientToken) {
const recipient = await prisma.recipient.findFirst({
where: { token: recipientToken?.toString() },
});
// todo entity ownerships checks
if (document.userId !== user.id) {
return res.status(401).send("User does not have access to this document.");
if (!recipient || recipient?.documentId !== +documentId)
return res
.status(401)
.send("Recipient does not have access to this document.");
}
if (user) {
const document: PrismaDocument = await getDocument(+documentId, req, res);
// todo entity ownerships checks
if (document.userId !== user.id) {
return res
.status(401)
.send("User does not have access to this document.");
}
}
const field = await prisma.field.upsert({