Merge branch "main"

packages/lib/server-only/document/create-document.ts

@@ -5,7 +5,9 @@ import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-log
 import type { RequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
 import { prisma } from '@documenso/prisma';
-import { DocumentSource, WebhookTriggerEvents } from '@documenso/prisma/client';
+import { DocumentSource, DocumentVisibility, WebhookTriggerEvents } from '@documenso/prisma/client';
+import type { Team, TeamGlobalSettings } from '@documenso/prisma/client';
+import { TeamMemberRole } from '@documenso/prisma/client';
 
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 
@@ -48,6 +50,51 @@ export const createDocument = async ({
     throw new AppError(AppErrorCode.NOT_FOUND, 'Team not found');
   }
 
+  let team: (Team & { teamGlobalSettings: TeamGlobalSettings | null }) | null = null;
+  let userTeamRole: TeamMemberRole | undefined;
+
+  if (teamId) {
+    const teamWithUserRole = await prisma.team.findFirstOrThrow({
+      where: {
+        id: teamId,
+      },
+      include: {
+        teamGlobalSettings: true,
+        members: {
+          where: {
+            userId: userId,
+          },
+          select: {
+            role: true,
+          },
+        },
+      },
+    });
+
+    team = teamWithUserRole;
+    userTeamRole = teamWithUserRole.members[0]?.role;
+  }
+
+  const determineVisibility = (
+    globalVisibility: DocumentVisibility | null | undefined,
+    userRole: TeamMemberRole,
+  ): DocumentVisibility => {
+    const defaultVisibility = globalVisibility ?? DocumentVisibility.EVERYONE;
+
+    if (userRole === TeamMemberRole.ADMIN) {
+      return defaultVisibility;
+    }
+
+    if (userRole === TeamMemberRole.MANAGER) {
+      if (defaultVisibility === DocumentVisibility.ADMIN) {
+        return DocumentVisibility.MANAGER_AND_ABOVE;
+      }
+      return defaultVisibility;
+    }
+
+    return DocumentVisibility.EVERYONE;
+  };
+
   return await prisma.$transaction(async (tx) => {
     const document = await tx.document.create({
       data: {
@@ -56,8 +103,17 @@ export const createDocument = async ({
         documentDataId,
         userId,
         teamId,
+        visibility: determineVisibility(
+          team?.teamGlobalSettings?.documentVisibility,
+          userTeamRole ?? TeamMemberRole.MEMBER,
+        ),
         formValues,
         source: DocumentSource.DOCUMENT,
+        documentMeta: {
+          create: {
+            language: team?.teamGlobalSettings?.documentLanguage,
+          },
+        },
       },
     });
 

packages/lib/server-only/document/delete-document.ts

@@ -7,16 +7,25 @@ import { msg } from '@lingui/macro';
 import { mailer } from '@documenso/email/mailer';
 import DocumentCancelTemplate from '@documenso/email/templates/document-cancel';
 import { prisma } from '@documenso/prisma';
-import type { Document, DocumentMeta, Recipient, User } from '@documenso/prisma/client';
+import type {
+  Document,
+  DocumentMeta,
+  Recipient,
+  Team,
+  TeamGlobalSettings,
+  User,
+} from '@documenso/prisma/client';
 import { DocumentStatus, SendStatus } from '@documenso/prisma/client';
 
 import { getI18nInstance } from '../../client-only/providers/i18n.server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
 import { FROM_ADDRESS, FROM_NAME } from '../../constants/email';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
+import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
+import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
 
 export type DeleteDocumentOptions = {
   id: number;
@@ -49,8 +58,9 @@ export const deleteDocument = async ({
       Recipient: true,
       documentMeta: true,
       team: {
-        select: {
+        include: {
           members: true,
+          teamGlobalSettings: true,
         },
       },
     },
@@ -73,6 +83,7 @@ export const deleteDocument = async ({
     await handleDocumentOwnerDelete({
       document,
       user,
+      team: document.team,
       requestMetadata,
     });
   }
@@ -113,6 +124,11 @@ type HandleDocumentOwnerDeleteOptions = {
     Recipient: Recipient[];
     documentMeta: DocumentMeta | null;
   };
+  team?:
+    | (Team & {
+        teamGlobalSettings?: TeamGlobalSettings | null;
+      })
+    | null;
   user: User;
   requestMetadata?: RequestMetadata;
 };
@@ -120,6 +136,7 @@ type HandleDocumentOwnerDeleteOptions = {
 const handleDocumentOwnerDelete = async ({
   document,
   user,
+  team,
   requestMetadata,
 }: HandleDocumentOwnerDeleteOptions) => {
   if (document.deletedAt) {
@@ -178,6 +195,14 @@ const handleDocumentOwnerDelete = async ({
     });
   });
 
+  const isDocumentDeleteEmailEnabled = extractDerivedDocumentEmailSettings(
+    document.documentMeta,
+  ).documentDeleted;
+
+  if (!isDocumentDeleteEmailEnabled) {
+    return deletedDocument;
+  }
+
   // Send cancellation emails to recipients.
   await Promise.all(
     document.Recipient.map(async (recipient) => {
@@ -194,9 +219,17 @@ const handleDocumentOwnerDelete = async ({
         assetBaseUrl,
       });
 
+      const branding = team?.teamGlobalSettings
+        ? teamGlobalSettingsToBranding(team.teamGlobalSettings)
+        : undefined;
+
       const [html, text] = await Promise.all([
-        renderEmailWithI18N(template, { lang: document.documentMeta?.language }),
-        renderEmailWithI18N(template, { lang: document.documentMeta?.language, plainText: true }),
+        renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+        renderEmailWithI18N(template, {
+          lang: document.documentMeta?.language,
+          branding,
+          plainText: true,
+        }),
       ]);
 
       const i18n = await getI18nInstance(document.documentMeta?.language);

packages/lib/server-only/document/find-documents.ts

@@ -124,11 +124,18 @@ export const findDocuments = async ({
       }))
       .otherwise(() => ({ visibility: DocumentVisibility.EVERYONE })),
     {
-      Recipient: {
-        some: {
-          email: user.email,
+      OR: [
+        {
+          Recipient: {
+            some: {
+              email: user.email,
+            },
+          },
         },
-      },
+        {
+          userId: user.id,
+        },
+      ],
     },
   ];
 

packages/lib/server-only/document/get-document-by-id.ts

@@ -143,11 +143,18 @@ export const getDocumentWhereInput = async ({
       ])
       .otherwise(() => [{ visibility: DocumentVisibility.EVERYONE }]),
     {
-      Recipient: {
-        some: {
-          email: user.email,
+      OR: [
+        {
+          Recipient: {
+            some: {
+              email: user.email,
+            },
+          },
         },
-      },
+        {
+          userId: user.id,
+        },
+      ],
     },
   ];
 

packages/lib/server-only/document/get-stats.ts

@@ -6,11 +6,10 @@ import { prisma } from '@documenso/prisma';
 import { TeamMemberRole } from '@documenso/prisma/client';
 import type { Prisma, User } from '@documenso/prisma/client';
 import { SigningStatus } from '@documenso/prisma/client';
+import { DocumentVisibility } from '@documenso/prisma/client';
 import { isExtendedDocumentStatus } from '@documenso/prisma/guards/is-extended-document-status';
 import { ExtendedDocumentStatus } from '@documenso/prisma/types/extended-document-status';
 
-import { DocumentVisibility } from '../../types/document-visibility';
-
 export type GetStatsInput = {
   user: User;
   team?: Omit<GetTeamCountsOption, 'createdAt'>;
@@ -207,47 +206,45 @@ const getTeamCounts = async (options: GetTeamCountsOption) => {
   let notSignedCountsGroupByArgs = null;
   let hasSignedCountsGroupByArgs = null;
 
-  const visibilityFilters = [
-    ...match(options.currentTeamMemberRole)
-      .with(TeamMemberRole.ADMIN, () => [
-        { visibility: DocumentVisibility.EVERYONE },
-        { visibility: DocumentVisibility.MANAGER_AND_ABOVE },
-        { visibility: DocumentVisibility.ADMIN },
-      ])
-      .with(TeamMemberRole.MANAGER, () => [
-        { visibility: DocumentVisibility.EVERYONE },
-        { visibility: DocumentVisibility.MANAGER_AND_ABOVE },
-      ])
-      .otherwise(() => [{ visibility: DocumentVisibility.EVERYONE }]),
-  ];
-
-  ownerCountsWhereInput = {
-    ...ownerCountsWhereInput,
-    OR: [
+  const visibilityFiltersWhereInput: Prisma.DocumentWhereInput = {
+    AND: [
+      { deletedAt: null },
       {
-        AND: [
-          {
-            visibility: {
-              in: visibilityFilters.map((filter) => filter.visibility),
-            },
-          },
-          {
-            Recipient: {
-              none: {
-                email: options.currentUserEmail,
+        OR: [
+          match(options.currentTeamMemberRole)
+            .with(TeamMemberRole.ADMIN, () => ({
+              visibility: {
+                in: [
+                  DocumentVisibility.EVERYONE,
+                  DocumentVisibility.MANAGER_AND_ABOVE,
+                  DocumentVisibility.ADMIN,
+                ],
               },
-            },
+            }))
+            .with(TeamMemberRole.MANAGER, () => ({
+              visibility: {
+                in: [DocumentVisibility.EVERYONE, DocumentVisibility.MANAGER_AND_ABOVE],
+              },
+            }))
+            .otherwise(() => ({
+              visibility: {
+                equals: DocumentVisibility.EVERYONE,
+              },
+            })),
+          {
+            OR: [
+              { userId: options.userId },
+              { Recipient: { some: { email: options.currentUserEmail } } },
+            ],
           },
         ],
       },
-      {
-        Recipient: {
-          some: {
-            email: options.currentUserEmail,
-          },
-        },
-      },
     ],
+  };
+
+  ownerCountsWhereInput = {
+    ...ownerCountsWhereInput,
+    ...visibilityFiltersWhereInput,
     ...searchFilter,
   };
 

packages/lib/server-only/document/resend-document.tsx

@@ -19,7 +19,9 @@ import type { Prisma } from '@documenso/prisma/client';
 
 import { getI18nInstance } from '../../client-only/providers/i18n.server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
+import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
+import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
 import { getDocumentWhereInput } from './get-document-by-id';
 
 export type ResendDocumentOptions = {
@@ -65,6 +67,7 @@ export const resendDocument = async ({
         select: {
           teamEmail: true,
           name: true,
+          teamGlobalSettings: true,
         },
       },
     },
@@ -89,6 +92,14 @@ export const resendDocument = async ({
     throw new Error('Can not send completed document');
   }
 
+  const isRecipientSigningRequestEmailEnabled = extractDerivedDocumentEmailSettings(
+    document.documentMeta,
+  ).recipientSigningRequest;
+
+  if (!isRecipientSigningRequestEmailEnabled) {
+    return;
+  }
+
   await Promise.all(
     document.Recipient.map(async (recipient) => {
       if (recipient.role === RecipientRole.CC) {
@@ -149,12 +160,20 @@ export const resendDocument = async ({
         teamName: document.team?.name,
       });
 
+      const branding = document.team?.teamGlobalSettings
+        ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
+        : undefined;
+
       await prisma.$transaction(
         async (tx) => {
           const [html, text] = await Promise.all([
-            renderEmailWithI18N(template, { lang: document.documentMeta?.language }),
             renderEmailWithI18N(template, {
               lang: document.documentMeta?.language,
+              branding,
+            }),
+            renderEmailWithI18N(template, {
+              lang: document.documentMeta?.language,
+              branding,
               plainText: true,
             }),
           ]);

packages/lib/server-only/document/send-completed-email.ts

@@ -10,11 +10,13 @@ import { DocumentSource } from '@documenso/prisma/client';
 import { getI18nInstance } from '../../client-only/providers/i18n.server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
+import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { getFile } from '../../universal/upload/get-file';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
 import { renderCustomEmailTemplate } from '../../utils/render-custom-email-template';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
+import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
 
 export interface SendDocumentOptions {
   documentId: number;
@@ -35,6 +37,7 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
         select: {
           id: true,
           url: true,
+          teamGlobalSettings: true,
         },
       },
     },
@@ -66,17 +69,32 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
 
   const i18n = await getI18nInstance(document.documentMeta?.language);
 
-  // If the document owner is not a recipient then send the email to them separately
-  if (!document.Recipient.find((recipient) => recipient.email === owner.email)) {
+  const isDocumentCompletedEmailEnabled = extractDerivedDocumentEmailSettings(
+    document.documentMeta,
+  ).documentCompleted;
+
+  // If the document owner is not a recipient, OR recipient emails are disabled, then send the email to them separately.
+  if (
+    !document.Recipient.find((recipient) => recipient.email === owner.email) ||
+    !isDocumentCompletedEmailEnabled
+  ) {
     const template = createElement(DocumentCompletedEmailTemplate, {
       documentName: document.title,
       assetBaseUrl,
       downloadLink: documentOwnerDownloadLink,
     });
 
+    const branding = document.team?.teamGlobalSettings
+      ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
+      : undefined;
+
     const [html, text] = await Promise.all([
-      renderEmailWithI18N(template, { lang: document.documentMeta?.language }),
-      renderEmailWithI18N(template, { lang: document.documentMeta?.language, plainText: true }),
+      renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+      renderEmailWithI18N(template, {
+        lang: document.documentMeta?.language,
+        branding,
+        plainText: true,
+      }),
     ]);
 
     await mailer.sendMail({
@@ -119,6 +137,10 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
     });
   }
 
+  if (!isDocumentCompletedEmailEnabled) {
+    return;
+  }
+
   await Promise.all(
     document.Recipient.map(async (recipient) => {
       const customEmailTemplate = {
@@ -139,9 +161,17 @@ export const sendCompletedEmail = async ({ documentId, requestMetadata }: SendDo
             : undefined,
       });
 
+      const branding = document.team?.teamGlobalSettings
+        ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
+        : undefined;
+
       const [html, text] = await Promise.all([
-        renderEmailWithI18N(template, { lang: document.documentMeta?.language }),
-        renderEmailWithI18N(template, { lang: document.documentMeta?.language, plainText: true }),
+        renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+        renderEmailWithI18N(template, {
+          lang: document.documentMeta?.language,
+          branding,
+          plainText: true,
+        }),
       ]);
 
       await mailer.sendMail({

packages/lib/server-only/document/send-delete-email.ts

@@ -8,7 +8,9 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../client-only/providers/i18n.server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
+import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
+import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
 
 export interface SendDeleteEmailOptions {
   documentId: number;
@@ -22,6 +24,12 @@ export const sendDeleteEmail = async ({ documentId, reason }: SendDeleteEmailOpt
     },
     include: {
       User: true,
+      documentMeta: true,
+      team: {
+        include: {
+          teamGlobalSettings: true,
+        },
+      },
     },
   });
 
@@ -29,6 +37,14 @@ export const sendDeleteEmail = async ({ documentId, reason }: SendDeleteEmailOpt
     throw new Error('Document not found');
   }
 
+  const isDocumentDeletedEmailEnabled = extractDerivedDocumentEmailSettings(
+    document.documentMeta,
+  ).documentDeleted;
+
+  if (!isDocumentDeletedEmailEnabled) {
+    return;
+  }
+
   const { email, name } = document.User;
 
   const assetBaseUrl = NEXT_PUBLIC_WEBAPP_URL() || 'http://localhost:3000';
@@ -39,9 +55,17 @@ export const sendDeleteEmail = async ({ documentId, reason }: SendDeleteEmailOpt
     assetBaseUrl,
   });
 
+  const branding = document.team?.teamGlobalSettings
+    ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
+    : undefined;
+
   const [html, text] = await Promise.all([
-    renderEmailWithI18N(template),
-    renderEmailWithI18N(template, { plainText: true }),
+    renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+    renderEmailWithI18N(template, {
+      lang: document.documentMeta?.language,
+      branding,
+      plainText: true,
+    }),
   ]);
 
   const i18n = await getI18nInstance();

packages/lib/server-only/document/send-document.tsx

@@ -13,6 +13,7 @@ import {
 import { WebhookTriggerEvents } from '@documenso/prisma/client';
 
 import { jobs } from '../../jobs/client';
+import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import { getFile } from '../../universal/upload/get-file';
 import { insertFormValuesInPdf } from '../pdf/insert-form-values-in-pdf';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
@@ -29,7 +30,7 @@ export const sendDocument = async ({
   documentId,
   userId,
   teamId,
-  sendEmail = true,
+  sendEmail,
   requestMetadata,
 }: SendDocumentOptions) => {
   const user = await prisma.user.findFirstOrThrow({
@@ -156,7 +157,14 @@ export const sendDocument = async ({
   //   throw new Error('Some signers have not been assigned a signature field.');
   // }
 
-  if (sendEmail) {
+  const isRecipientSigningRequestEmailEnabled = extractDerivedDocumentEmailSettings(
+    document.documentMeta,
+  ).recipientSigningRequest;
+
+  // Only send email if one of the following is true:
+  // - It is explicitly set
+  // - The email is enabled for signing requests AND sendEmail is undefined
+  if (sendEmail || (isRecipientSigningRequestEmailEnabled && sendEmail === undefined)) {
     await Promise.all(
       recipientsToNotify.map(async (recipient) => {
         if (recipient.sendStatus === SendStatus.SENT || recipient.role === RecipientRole.CC) {

packages/lib/server-only/document/send-pending-email.ts

@@ -8,7 +8,9 @@ import { prisma } from '@documenso/prisma';
 
 import { getI18nInstance } from '../../client-only/providers/i18n.server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
+import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
+import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
 
 export interface SendPendingEmailOptions {
   documentId: number;
@@ -32,6 +34,11 @@ export const sendPendingEmail = async ({ documentId, recipientId }: SendPendingE
         },
       },
       documentMeta: true,
+      team: {
+        include: {
+          teamGlobalSettings: true,
+        },
+      },
     },
   });
 
@@ -43,6 +50,14 @@ export const sendPendingEmail = async ({ documentId, recipientId }: SendPendingE
     throw new Error('Document has no recipients');
   }
 
+  const isDocumentPendingEmailEnabled = extractDerivedDocumentEmailSettings(
+    document.documentMeta,
+  ).documentPending;
+
+  if (!isDocumentPendingEmailEnabled) {
+    return;
+  }
+
   const [recipient] = document.Recipient;
 
   const { email, name } = recipient;
@@ -54,12 +69,20 @@ export const sendPendingEmail = async ({ documentId, recipientId }: SendPendingE
     assetBaseUrl,
   });
 
+  const branding = document.team?.teamGlobalSettings
+    ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
+    : undefined;
+
   const [html, text] = await Promise.all([
-    renderEmailWithI18N(template, { lang: document.documentMeta?.language }),
-    renderEmailWithI18N(template, { lang: document.documentMeta?.language, plainText: true }),
+    renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+    renderEmailWithI18N(template, {
+      lang: document.documentMeta?.language,
+      branding,
+      plainText: true,
+    }),
   ]);
 
-  const i18n = await getI18nInstance();
+  const i18n = await getI18nInstance(document.documentMeta?.language);
 
   await mailer.sendMail({
     to: {

packages/lib/server-only/document/super-delete-document.ts

@@ -13,9 +13,11 @@ import { getI18nInstance } from '../../client-only/providers/i18n.server';
 import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
 import { FROM_ADDRESS, FROM_NAME } from '../../constants/email';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
+import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
+import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
 
 export type SuperDeleteDocumentOptions = {
   id: number;
@@ -31,6 +33,11 @@ export const superDeleteDocument = async ({ id, requestMetadata }: SuperDeleteDo
       Recipient: true,
       documentMeta: true,
       User: true,
+      team: {
+        include: {
+          teamGlobalSettings: true,
+        },
+      },
     },
   });
 
@@ -40,8 +47,16 @@ export const superDeleteDocument = async ({ id, requestMetadata }: SuperDeleteDo
 
   const { status, User: user } = document;
 
+  const isDocumentDeletedEmailEnabled = extractDerivedDocumentEmailSettings(
+    document.documentMeta,
+  ).documentDeleted;
+
   // if the document is pending, send cancellation emails to all recipients
-  if (status === DocumentStatus.PENDING && document.Recipient.length > 0) {
+  if (
+    status === DocumentStatus.PENDING &&
+    document.Recipient.length > 0 &&
+    isDocumentDeletedEmailEnabled
+  ) {
     await Promise.all(
       document.Recipient.map(async (recipient) => {
         if (recipient.sendStatus !== SendStatus.SENT) {
@@ -56,9 +71,17 @@ export const superDeleteDocument = async ({ id, requestMetadata }: SuperDeleteDo
           assetBaseUrl,
         });
 
+        const branding = document.team?.teamGlobalSettings
+          ? teamGlobalSettingsToBranding(document.team.teamGlobalSettings)
+          : undefined;
+
         const [html, text] = await Promise.all([
-          renderEmailWithI18N(template, { lang: document.documentMeta?.language }),
-          renderEmailWithI18N(template, { lang: document.documentMeta?.language, plainText: true }),
+          renderEmailWithI18N(template, { lang: document.documentMeta?.language, branding }),
+          renderEmailWithI18N(template, {
+            lang: document.documentMeta?.language,
+            branding,
+            plainText: true,
+          }),
         ]);
 
         const i18n = await getI18nInstance(document.documentMeta?.language);

packages/lib/server-only/document/update-document-settings.ts

@@ -1,13 +1,15 @@
 'use server';
 
+import { match } from 'ts-pattern';
+
 import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import type { RequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import type { CreateDocumentAuditLogDataResponse } from '@documenso/lib/utils/document-audit-logs';
 import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
 import { prisma } from '@documenso/prisma';
-import type { DocumentVisibility } from '@documenso/prisma/client';
-import { DocumentStatus } from '@documenso/prisma/client';
+import { DocumentVisibility } from '@documenso/prisma/client';
+import { DocumentStatus, TeamMemberRole } from '@documenso/prisma/client';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import type { TDocumentAccessAuthTypes, TDocumentActionAuthTypes } from '../../types/document-auth';
@@ -20,7 +22,7 @@ export type UpdateDocumentSettingsOptions = {
   data: {
     title?: string;
     externalId?: string | null;
-    visibility?: string | null;
+    visibility?: DocumentVisibility | null;
     globalAccessAuth?: TDocumentAccessAuthTypes | null;
     globalActionAuth?: TDocumentActionAuthTypes | null;
   };
@@ -63,8 +65,62 @@ export const updateDocumentSettings = async ({
             teamId: null,
           }),
     },
+    include: {
+      team: {
+        select: {
+          members: {
+            where: {
+              userId,
+            },
+            select: {
+              role: true,
+            },
+          },
+        },
+      },
+    },
   });
 
+  if (teamId) {
+    const currentUserRole = document.team?.members[0]?.role;
+
+    match(currentUserRole)
+      .with(TeamMemberRole.ADMIN, () => true)
+      .with(TeamMemberRole.MANAGER, () => {
+        const allowedVisibilities: DocumentVisibility[] = [
+          DocumentVisibility.EVERYONE,
+          DocumentVisibility.MANAGER_AND_ABOVE,
+        ];
+
+        if (
+          !allowedVisibilities.includes(document.visibility) ||
+          (data.visibility && !allowedVisibilities.includes(data.visibility))
+        ) {
+          throw new AppError(
+            AppErrorCode.UNAUTHORIZED,
+            'You do not have permission to update the document visibility',
+          );
+        }
+      })
+      .with(TeamMemberRole.MEMBER, () => {
+        if (
+          document.visibility !== DocumentVisibility.EVERYONE ||
+          (data.visibility && data.visibility !== DocumentVisibility.EVERYONE)
+        ) {
+          throw new AppError(
+            AppErrorCode.UNAUTHORIZED,
+            'You do not have permission to update the document visibility',
+          );
+        }
+      })
+      .otherwise(() => {
+        throw new AppError(
+          AppErrorCode.UNAUTHORIZED,
+          'You do not have permission to update the document',
+        );
+      });
+  }
+
   const { documentAuthOption } = extractDocumentAuthMethods({
     documentAuth: document.authOptions,
   });