feat: add qr signatures

packages/prisma/migrations/20260719103520_add_anonymous_verification_token_type_and_value/migration.sql

@@ -0,0 +1,15 @@
+-- CreateEnum
+CREATE TYPE "AnonymousVerificationTokenType" AS ENUM ('PASSKEY', 'QR_SIGNATURE');
+
+-- AlterTable: add "type" as nullable, backfill existing rows (all are passkey
+-- challenges today), then enforce NOT NULL.
+ALTER TABLE "AnonymousVerificationToken" ADD COLUMN "type" "AnonymousVerificationTokenType";
+
+UPDATE "AnonymousVerificationToken" SET "type" = 'PASSKEY';
+
+ALTER TABLE "AnonymousVerificationToken" ALTER COLUMN "type" SET NOT NULL;
+
+-- AlterTable
+ALTER TABLE "AnonymousVerificationToken" ADD COLUMN "value" TEXT;
+
+ALTER TABLE "AnonymousVerificationToken" ADD COLUMN "metadata" JSONB;

packages/prisma/migrations/20260723050916_add_qr_signature_enabled/migration.sql

@@ -0,0 +1,10 @@
+-- AlterTable: add with DEFAULT false so every existing row is backfilled to
+-- disabled, then flip the column default to true so new rows are enabled.
+ALTER TABLE "DocumentMeta" ADD COLUMN "qrSignatureEnabled" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "DocumentMeta" ALTER COLUMN "qrSignatureEnabled" SET DEFAULT true;
+
+ALTER TABLE "OrganisationGlobalSettings" ADD COLUMN "qrSignatureEnabled" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "OrganisationGlobalSettings" ALTER COLUMN "qrSignatureEnabled" SET DEFAULT true;
+
+-- Existing teams stay NULL (inherit from organisation).
+ALTER TABLE "TeamGlobalSettings" ADD COLUMN "qrSignatureEnabled" BOOLEAN;

packages/prisma/schema.prisma

@@ -144,9 +144,18 @@ model Passkey {
   user User @relation(fields: [userId], references: [id], onDelete: Cascade)
 }
 
+enum AnonymousVerificationTokenType {
+  PASSKEY
+  QR_SIGNATURE
+}
+
 model AnonymousVerificationToken {
-  id        String   @id @unique @default(cuid())
-  token     String   @unique
+  id       String                         @id @unique @default(cuid())
+  type     AnonymousVerificationTokenType
+  token    String                         @unique
+  value    String?
+  metadata Json?
+
   expiresAt DateTime
   createdAt DateTime @default(now())
 }
@@ -570,6 +579,7 @@ model DocumentMeta {
   typedSignatureEnabled  Boolean @default(true)
   uploadSignatureEnabled Boolean @default(true)
   drawSignatureEnabled   Boolean @default(true)
+  qrSignatureEnabled     Boolean @default(true)
 
   language           String                     @default("en")
   distributionMethod DocumentDistributionMethod @default(EMAIL)
@@ -969,6 +979,7 @@ model OrganisationGlobalSettings {
   typedSignatureEnabled  Boolean @default(true)
   uploadSignatureEnabled Boolean @default(true)
   drawSignatureEnabled   Boolean @default(true)
+  qrSignatureEnabled     Boolean @default(true)
 
   defaultRecipients Json? /// [DefaultRecipient[]] @zod.custom.use(ZDefaultRecipientsSchema)
 
@@ -1012,6 +1023,7 @@ model TeamGlobalSettings {
   typedSignatureEnabled  Boolean?
   uploadSignatureEnabled Boolean?
   drawSignatureEnabled   Boolean?
+  qrSignatureEnabled     Boolean?
 
   defaultRecipients Json? /// [DefaultRecipient[]] @zod.custom.use(ZDefaultRecipientsSchema)