feat: unify settings (#3128)

packages/trpc/server/document-router/find-inbox.ts

@@ -1,6 +1,5 @@
 import type { FindResultResponse } from '@documenso/lib/types/search-params';
 import { mapEnvelopesToDocumentMany } from '@documenso/lib/utils/document';
-import { maskRecipientTokensForDocument } from '@documenso/lib/utils/mask-recipient-tokens-for-document';
 import { prisma } from '@documenso/prisma';
 import type { Envelope, Prisma } from '@prisma/client';
 import { DocumentStatus, EnvelopeType, RecipientRole } from '@prisma/client';
@@ -106,12 +105,15 @@ export const findInbox = async ({ userId, page = 1, perPage = 10, orderBy }: Fin
     }),
   ]);
 
-  const maskedData = data.map((document) =>
-    maskRecipientTokensForDocument({
-      document,
-      user,
-    }),
-  );
+  // Not using the maskRecipientTokensForDocument helper here because it needs a
+  // rework due to recipients vs Recipient.
+  const maskedData = data.map((document) => ({
+    ...document,
+    recipients: document.recipients.map((recipient) => ({
+      ...recipient,
+      token: recipient.email === user.email ? recipient.token : '',
+    })),
+  }));
 
   return {
     data: maskedData,

packages/trpc/server/enterprise-router/create-subscription.ts

@@ -12,7 +12,7 @@ import { ZCreateSubscriptionRequestSchema } from './create-subscription.types';
 export const createSubscriptionRoute = authenticatedProcedure
   .input(ZCreateSubscriptionRequestSchema)
   .mutation(async ({ ctx, input }) => {
-    const { organisationId, priceId, isPersonalLayoutMode } = input;
+    const { organisationId, priceId } = input;
 
     ctx.logger.info({
       input: {
@@ -70,9 +70,7 @@ export const createSubscriptionRoute = authenticatedProcedure
       });
     }
 
-    const returnUrl = isPersonalLayoutMode
-      ? `${NEXT_PUBLIC_WEBAPP_URL()}/settings/billing-personal`
-      : `${NEXT_PUBLIC_WEBAPP_URL()}/o/${organisation.url}/settings/billing`;
+    const returnUrl = `${NEXT_PUBLIC_WEBAPP_URL()}/o/${organisation.url}/settings/billing`;
 
     const redirectUrl = await createCheckoutSession({
       customerId,

packages/trpc/server/enterprise-router/create-subscription.types.ts

@@ -3,5 +3,4 @@ import { z } from 'zod';
 export const ZCreateSubscriptionRequestSchema = z.object({
   organisationId: z.string().describe('The organisation to create the subscription for'),
   priceId: z.string().describe('The price to create the subscription for'),
-  isPersonalLayoutMode: z.boolean().optional(),
 });

packages/trpc/server/enterprise-router/manage-subscription.ts

@@ -12,7 +12,7 @@ import { ZManageSubscriptionRequestSchema } from './manage-subscription.types';
 export const manageSubscriptionRoute = authenticatedProcedure
   .input(ZManageSubscriptionRequestSchema)
   .mutation(async ({ ctx, input }) => {
-    const { organisationId, isPersonalLayoutMode } = input;
+    const { organisationId } = input;
 
     ctx.logger.info({
       input: {
@@ -93,9 +93,7 @@ export const manageSubscriptionRoute = authenticatedProcedure
       });
     }
 
-    const returnUrl = isPersonalLayoutMode
-      ? `${NEXT_PUBLIC_WEBAPP_URL()}/settings/billing-personal`
-      : `${NEXT_PUBLIC_WEBAPP_URL()}/o/${organisation.url}/settings/billing`;
+    const returnUrl = `${NEXT_PUBLIC_WEBAPP_URL()}/o/${organisation.url}/settings/billing`;
 
     const redirectUrl = await getPortalSession({
       customerId,

packages/trpc/server/enterprise-router/manage-subscription.types.ts

@@ -2,5 +2,4 @@ import { z } from 'zod';
 
 export const ZManageSubscriptionRequestSchema = z.object({
   organisationId: z.string().describe('The organisation to manage the subscription for'),
-  isPersonalLayoutMode: z.boolean().optional(),
 });

packages/trpc/server/envelope-router/sign-envelope-field.ts

@@ -4,6 +4,7 @@ import { validateFieldAuth } from '@documenso/lib/server-only/document/validate-
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
 import { extractFieldInsertionValues } from '@documenso/lib/utils/envelope-signing';
+import { assertRecipientNotExpired } from '@documenso/lib/utils/recipients';
 import { prisma } from '@documenso/prisma';
 import { DocumentStatus, FieldType, RecipientRole, SigningStatus } from '@prisma/client';
 import { match } from 'ts-pattern';
@@ -108,6 +109,12 @@ export const signEnvelopeFieldRoute = procedure
       });
     }
 
+    // Both are checked because an assistant may insert values into a field belonging to
+    // another recipient, and neither signing window may have closed. For every other
+    // role these reference the same recipient.
+    assertRecipientNotExpired(recipient);
+    assertRecipientNotExpired(field.recipient);
+
     if (recipient.signingStatus === SigningStatus.SIGNED || field.recipient.signingStatus === SigningStatus.SIGNED) {
       throw new AppError(AppErrorCode.INVALID_REQUEST, {
         message: `Recipient ${recipient.id} has already signed`,

packages/trpc/server/organisation-router/update-organisation-settings.ts

@@ -124,11 +124,10 @@ export const updateOrganisationSettingsRoute = authenticatedProcedure
     const isChangingIncludeSenderDetails =
       includeSenderDetails !== undefined && includeSenderDetails !== currentIncludeSenderDetails;
 
-    if (isPersonalOrganisation && isChangingIncludeSenderDetails) {
-      throw new AppError(AppErrorCode.INVALID_BODY, {
-        message: 'Personal organisations cannot update the sender details',
-      });
-    }
+    // Personal teams cannot change the sender details — drop the field (no-op)
+    // instead of rejecting the whole update.
+    const derivedIncludeSenderDetails =
+      isPersonalOrganisation && isChangingIncludeSenderDetails ? undefined : includeSenderDetails;
 
     // Sanitize custom branding CSS at write time so we can store the safe
     // result and skip per-render sanitisation. Warnings are returned to the
@@ -160,7 +159,7 @@ export const updateOrganisationSettingsRoute = authenticatedProcedure
             documentLanguage,
             documentTimezone,
             documentDateFormat,
-            includeSenderDetails,
+            includeSenderDetails: derivedIncludeSenderDetails,
             includeSigningCertificate,
             includeAuditLog,
             typedSignatureEnabled,

packages/trpc/server/team-router/complete-team-email-verification.ts

@@ -0,0 +1,87 @@
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { isTokenExpired } from '@documenso/lib/utils/token-verification';
+import { prisma } from '@documenso/prisma';
+import { procedure } from '../trpc';
+import {
+  ZCompleteTeamEmailVerificationRequestSchema,
+  ZCompleteTeamEmailVerificationResponseSchema,
+} from './complete-team-email-verification.types';
+
+/**
+ * Unauthenicated procedure.
+ */
+export const completeTeamEmailVerificationRoute = procedure
+  .input(ZCompleteTeamEmailVerificationRequestSchema)
+  .output(ZCompleteTeamEmailVerificationResponseSchema)
+  .mutation(async ({ input }) => {
+    const { token } = input;
+
+    const teamEmailVerification = await prisma.teamEmailVerification.findUnique({
+      where: {
+        token,
+      },
+      include: {
+        team: {
+          select: {
+            id: true,
+            name: true,
+          },
+        },
+      },
+    });
+
+    if (!teamEmailVerification || isTokenExpired(teamEmailVerification.expiresAt)) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Verification token is invalid or has expired.',
+      });
+    }
+
+    const { team, email, name } = teamEmailVerification;
+
+    if (teamEmailVerification.completed) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST, {
+        message: 'Team email verification has already been completed.',
+      });
+    }
+
+    await prisma.$transaction(async (tx) => {
+      const existingTeamEmail = await tx.teamEmail.findFirst({
+        where: {
+          OR: [{ email }, { teamId: team.id }],
+        },
+      });
+
+      if (existingTeamEmail) {
+        throw new AppError(AppErrorCode.ALREADY_EXISTS, {
+          message: 'Email already taken by another team, or this team already has an email.',
+        });
+      }
+
+      await tx.teamEmailVerification.updateMany({
+        where: {
+          teamId: team.id,
+          email,
+        },
+        data: {
+          completed: true,
+        },
+      });
+
+      await tx.teamEmailVerification.deleteMany({
+        where: {
+          teamId: team.id,
+          expiresAt: {
+            lt: new Date(),
+          },
+        },
+      });
+
+      await tx.teamEmail.create({
+        data: {
+          teamId: team.id,
+          email,
+          name,
+        },
+      });
+    });
+  });

packages/trpc/server/team-router/complete-team-email-verification.types.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+
+export const ZCompleteTeamEmailVerificationRequestSchema = z.object({
+  token: z.string().min(1),
+});
+
+export const ZCompleteTeamEmailVerificationResponseSchema = z.void();
+
+export type TCompleteTeamEmailVerificationRequest = z.infer<typeof ZCompleteTeamEmailVerificationRequestSchema>;
+
+export type TCompleteTeamEmailVerificationResponse = z.infer<typeof ZCompleteTeamEmailVerificationResponseSchema>;

packages/trpc/server/team-router/router.ts

@@ -1,11 +1,11 @@
 import { createTeamEmailVerification } from '@documenso/lib/server-only/team/create-team-email-verification';
 import { deleteTeamEmail } from '@documenso/lib/server-only/team/delete-team-email';
 import { deleteTeamEmailVerification } from '@documenso/lib/server-only/team/delete-team-email-verification';
-import { getTeamEmailByEmail } from '@documenso/lib/server-only/team/get-team-email-by-email';
 import { resendTeamEmailVerification } from '@documenso/lib/server-only/team/resend-team-email-verification';
 import { updateTeamEmail } from '@documenso/lib/server-only/team/update-team-email';
-
+import { prisma } from '@documenso/prisma';
 import { authenticatedProcedure, router } from '../trpc';
+import { completeTeamEmailVerificationRoute } from './complete-team-email-verification';
 import { createTeamRoute } from './create-team';
 import { createTeamGroupsRoute } from './create-team-groups';
 import { createTeamMembersRoute } from './create-team-members';
@@ -58,7 +58,22 @@ export const teamRouter = router({
   // Todo: Refactor into routes.
   email: {
     get: authenticatedProcedure.query(async ({ ctx }) => {
-      return await getTeamEmailByEmail({ email: ctx.user.email });
+      const teamEmail = await prisma.teamEmail.findUnique({
+        where: {
+          email: ctx.user.email,
+        },
+        include: {
+          team: {
+            select: {
+              id: true,
+              name: true,
+              url: true,
+            },
+          },
+        },
+      });
+
+      return teamEmail || null;
     }),
     update: authenticatedProcedure.input(ZUpdateTeamEmailMutationSchema).mutation(async ({ input, ctx }) => {
       ctx.logger.info({
@@ -67,7 +82,7 @@ export const teamRouter = router({
         },
       });
 
-      return await updateTeamEmail({
+      await updateTeamEmail({
         userId: ctx.user.id,
         ...input,
       });
@@ -81,7 +96,7 @@ export const teamRouter = router({
         },
       });
 
-      return await deleteTeamEmail({
+      await deleteTeamEmail({
         userId: ctx.user.id,
         userEmail: ctx.user.email,
         teamId,
@@ -99,7 +114,7 @@ export const teamRouter = router({
             },
           });
 
-          return await createTeamEmailVerification({
+          await createTeamEmailVerification({
             teamId,
             userId: ctx.user.id,
             data: {
@@ -108,6 +123,7 @@ export const teamRouter = router({
             },
           });
         }),
+      complete: completeTeamEmailVerificationRoute,
       resend: authenticatedProcedure
         .input(ZResendTeamEmailVerificationMutationSchema)
         .mutation(async ({ input, ctx }) => {
@@ -135,7 +151,7 @@ export const teamRouter = router({
             },
           });
 
-          return await deleteTeamEmailVerification({
+          await deleteTeamEmailVerification({
             userId: ctx.user.id,
             teamId,
           });

packages/trpc/server/team-router/update-team-settings.ts

@@ -124,11 +124,10 @@ export const updateTeamSettingsRoute = authenticatedProcedure
     const isChangingIncludeSenderDetails =
       includeSenderDetails !== undefined && includeSenderDetails !== currentIncludeSenderDetails;
 
-    if (isPersonalOrganisation && isChangingIncludeSenderDetails) {
-      throw new AppError(AppErrorCode.INVALID_BODY, {
-        message: 'Personal teams cannot update the sender details',
-      });
-    }
+    // Personal teams cannot change the sender details — drop the field (no-op)
+    // instead of rejecting the whole update.
+    const derivedIncludeSenderDetails =
+      isPersonalOrganisation && isChangingIncludeSenderDetails ? undefined : includeSenderDetails;
 
     // Sanitize custom branding CSS at write time. `null` means inherit-from-org
     // for teams, so only run the sanitiser when an explicit string is provided.
@@ -163,7 +162,7 @@ export const updateTeamSettingsRoute = authenticatedProcedure
             documentLanguage,
             documentTimezone,
             documentDateFormat,
-            includeSenderDetails,
+            includeSenderDetails: derivedIncludeSenderDetails,
             includeSigningCertificate,
             includeAuditLog,
             typedSignatureEnabled,