feat: allow editing pending documents (#1346)

## Description

Adds the ability for the document owner to edit recipients and their
fields after the document has been sent.

A recipient can only be updated or deleted if:
- The recipient has not inserted any fields
- Has not completed the document

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

- **New Features**
- Added new localization messages to clarify user actions regarding
document signing.
  - Enhanced French translations for improved user interaction.

- **Improvements**
- Updated localization strings in German and English for clearer
feedback on signer and recipient statuses.
- Improved overall structure of localization files for better
maintainability.

- **Dependency Updates**
- Upgraded `next-axiom` and `remeda` libraries to their latest versions,
potentially enhancing performance and stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Mythie <me@lucasjamessmith.me>

packages/lib/server-only/field/set-fields-for-document.ts

@@ -1,3 +1,5 @@
+import { isDeepEqual } from 'remeda';
+
 import { validateCheckboxField } from '@documenso/lib/advanced-fields-validation/validate-checkbox';
 import { validateDropdownField } from '@documenso/lib/advanced-fields-validation/validate-dropdown';
 import { validateNumberField } from '@documenso/lib/advanced-fields-validation/validate-number';
@@ -20,22 +22,15 @@ import {
 } from '@documenso/lib/utils/document-audit-logs';
 import { prisma } from '@documenso/prisma';
 import type { Field } from '@documenso/prisma/client';
-import { FieldType, SendStatus, SigningStatus } from '@documenso/prisma/client';
+import { FieldType } from '@documenso/prisma/client';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+import { canRecipientFieldsBeModified } from '../../utils/recipients';
 
 export interface SetFieldsForDocumentOptions {
   userId: number;
   documentId: number;
-  fields: {
-    id?: number | null;
-    type: FieldType;
-    signerEmail: string;
-    pageNumber: number;
-    pageX: number;
-    pageY: number;
-    pageWidth: number;
-    pageHeight: number;
-    fieldMeta?: FieldMeta;
-  }[];
+  fields: FieldData[];
   requestMetadata?: RequestMetadata;
 }
 
@@ -63,6 +58,9 @@ export const setFieldsForDocument = async ({
         },
       ],
     },
+    include: {
+      Recipient: true,
+    },
   });
 
   const user = await prisma.user.findFirstOrThrow({
@@ -97,21 +95,36 @@ export const setFieldsForDocument = async ({
     (existingField) => !fields.find((field) => field.id === existingField.id),
   );
 
-  const linkedFields = fields
-    .map((field) => {
-      const existing = existingFields.find((existingField) => existingField.id === field.id);
+  const linkedFields = fields.map((field) => {
+    const existing = existingFields.find((existingField) => existingField.id === field.id);
 
-      return {
-        ...field,
-        _persisted: existing,
-      };
-    })
-    .filter((field) => {
-      return (
-        field._persisted?.Recipient?.sendStatus !== SendStatus.SENT &&
-        field._persisted?.Recipient?.signingStatus !== SigningStatus.SIGNED
+    const recipient = document.Recipient.find(
+      (recipient) => recipient.email.toLowerCase() === field.signerEmail.toLowerCase(),
+    );
+
+    // Each field MUST have a recipient associated with it.
+    if (!recipient) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST, `Recipient not found for field ${field.id}`);
+    }
+
+    // Check whether the existing field can be modified.
+    if (
+      existing &&
+      hasFieldBeenChanged(existing, field) &&
+      !canRecipientFieldsBeModified(recipient, existingFields)
+    ) {
+      throw new AppError(
+        AppErrorCode.INVALID_REQUEST,
+        'Cannot modify a field where the recipient has already interacted with the document',
       );
-    });
+    }
+
+    return {
+      ...field,
+      _persisted: existing,
+      _recipient: recipient,
+    };
+  });
 
   const persistedFields = await prisma.$transaction(async (tx) => {
     return await Promise.all(
@@ -322,3 +335,33 @@ export const setFieldsForDocument = async ({
 
   return [...filteredFields, ...persistedFields];
 };
+
+/**
+ * If you change this you MUST update the `hasFieldBeenChanged` function.
+ */
+type FieldData = {
+  id?: number | null;
+  type: FieldType;
+  signerEmail: string;
+  pageNumber: number;
+  pageX: number;
+  pageY: number;
+  pageWidth: number;
+  pageHeight: number;
+  fieldMeta?: FieldMeta;
+};
+
+const hasFieldBeenChanged = (field: Field, newFieldData: FieldData) => {
+  const currentFieldMeta = field.fieldMeta || null;
+  const newFieldMeta = newFieldData.fieldMeta || null;
+
+  return (
+    field.type !== newFieldData.type ||
+    field.page !== newFieldData.pageNumber ||
+    field.positionX.toNumber() !== newFieldData.pageX ||
+    field.positionY.toNumber() !== newFieldData.pageY ||
+    field.width.toNumber() !== newFieldData.pageWidth ||
+    field.height.toNumber() !== newFieldData.pageHeight ||
+    !isDeepEqual(currentFieldMeta, newFieldMeta)
+  );
+};

packages/lib/server-only/recipient/set-recipients-for-document.ts

@@ -1,4 +1,9 @@
+import { createElement } from 'react';
+
 import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
+import { mailer } from '@documenso/email/mailer';
+import { render } from '@documenso/email/render';
+import RecipientRemovedFromDocumentTemplate from '@documenso/email/templates/recipient-removed-from-document';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import {
   type TRecipientActionAuthTypes,
@@ -16,20 +21,16 @@ import type { Recipient } from '@documenso/prisma/client';
 import { RecipientRole } from '@documenso/prisma/client';
 import { SendStatus, SigningStatus } from '@documenso/prisma/client';
 
+import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
+import { FROM_ADDRESS, FROM_NAME } from '../../constants/email';
 import { AppError, AppErrorCode } from '../../errors/app-error';
+import { canRecipientBeModified } from '../../utils/recipients';
 
 export interface SetRecipientsForDocumentOptions {
   userId: number;
   teamId?: number;
   documentId: number;
-  recipients: {
-    id?: number | null;
-    email: string;
-    name: string;
-    role: RecipientRole;
-    signingOrder?: number | null;
-    actionAuth?: TRecipientActionAuthTypes | null;
-  }[];
+  recipients: RecipientData[];
   requestMetadata?: RequestMetadata;
 }
 
@@ -59,6 +60,9 @@ export const setRecipientsForDocument = async ({
             teamId: null,
           }),
     },
+    include: {
+      Field: true,
+    },
   });
 
   const user = await prisma.user.findFirstOrThrow({
@@ -116,25 +120,28 @@ export const setRecipientsForDocument = async ({
       ),
   );
 
-  const linkedRecipients = normalizedRecipients
-    .map((recipient) => {
-      const existing = existingRecipients.find(
-        (existingRecipient) =>
-          existingRecipient.id === recipient.id || existingRecipient.email === recipient.email,
-      );
+  const linkedRecipients = normalizedRecipients.map((recipient) => {
+    const existing = existingRecipients.find(
+      (existingRecipient) =>
+        existingRecipient.id === recipient.id || existingRecipient.email === recipient.email,
+    );
 
-      return {
-        ...recipient,
-        _persisted: existing,
-      };
-    })
-    .filter((recipient) => {
-      return (
-        recipient._persisted?.role === RecipientRole.CC ||
-        (recipient._persisted?.sendStatus !== SendStatus.SENT &&
-          recipient._persisted?.signingStatus !== SigningStatus.SIGNED)
+    if (
+      existing &&
+      hasRecipientBeenChanged(existing, recipient) &&
+      !canRecipientBeModified(existing, document.Field)
+    ) {
+      throw new AppError(
+        AppErrorCode.INVALID_REQUEST,
+        'Cannot modify a recipient who has already interacted with the document',
       );
-    });
+    }
+
+    return {
+      ...recipient,
+      _persisted: existing,
+    };
+  });
 
   const persistedRecipients = await prisma.$transaction(async (tx) => {
     return await Promise.all(
@@ -268,6 +275,37 @@ export const setRecipientsForDocument = async ({
         ),
       });
     });
+
+    // Send emails to deleted recipients.
+    await Promise.all(
+      removedRecipients.map(async (recipient) => {
+        if (recipient.sendStatus !== SendStatus.SENT) {
+          return;
+        }
+
+        const assetBaseUrl = NEXT_PUBLIC_WEBAPP_URL() || 'http://localhost:3000';
+
+        const template = createElement(RecipientRemovedFromDocumentTemplate, {
+          documentName: document.title,
+          inviterName: user.name || undefined,
+          assetBaseUrl,
+        });
+
+        await mailer.sendMail({
+          to: {
+            address: recipient.email,
+            name: recipient.name,
+          },
+          from: {
+            name: FROM_NAME,
+            address: FROM_ADDRESS,
+          },
+          subject: 'You have been removed from a document',
+          html: render(template),
+          text: render(template, { plainText: true }),
+        });
+      }),
+    );
   }
 
   // Filter out recipients that have been removed or have been updated.
@@ -284,3 +322,27 @@ export const setRecipientsForDocument = async ({
 
   return [...filteredRecipients, ...persistedRecipients];
 };
+
+/**
+ * If you change this you MUST update the `hasRecipientBeenChanged` function.
+ */
+type RecipientData = {
+  id?: number | null;
+  email: string;
+  name: string;
+  role: RecipientRole;
+  signingOrder?: number | null;
+  actionAuth?: TRecipientActionAuthTypes | null;
+};
+
+const hasRecipientBeenChanged = (recipient: Recipient, newRecipientData: RecipientData) => {
+  const authOptions = ZRecipientAuthOptionsSchema.parse(recipient.authOptions);
+
+  return (
+    recipient.email !== newRecipientData.email ||
+    recipient.name !== newRecipientData.name ||
+    recipient.role !== newRecipientData.role ||
+    recipient.signingOrder !== newRecipientData.signingOrder ||
+    authOptions.actionAuth !== newRecipientData.actionAuth
+  );
+};