feat: add pending signed pdf downloads for recipients

Recipients can download a PDF that contains the inserted fields while
the envelope is in the PENDING state.

The token file route accepts the `pending` version. The PDF contains
only the fields from recipients who signed and the fields of the
recipient who makes the request. This is the same set of fields that
the signing page shows to the recipient.

The signing page and the completion page show the download dialog for
pending envelopes. The dialog does not show the "Partial" button for
legacy envelopes.

apps/remix/app/components/dialogs/envelope-download-dialog.tsx

@@ -29,9 +29,9 @@ type EnvelopeDownloadDialogProps = {
    * button is hidden for them.
    *
    * Optional: omit it on call sites where the status can never be PENDING (DRAFT,
-   * COMPLETED, REJECTED) or when a recipient token is set, since the Partial button
-   * is also gated on those. Pass it from team-side call sites that can render the
-   * dialog for a PENDING envelope.
+   * COMPLETED, REJECTED) or that only render v2 envelopes, such as the v2 signing
+   * page. Pass it from call sites that can render the dialog for a PENDING
+   * envelope of either version.
    */
   isLegacy?: boolean;
   envelopeItems?: EnvelopeItemToDownload[];
@@ -67,12 +67,10 @@ export const EnvelopeDownloadDialog = ({
 
   // The dialog shows the original document alongside one of:
   //   - "Signed" (when the envelope is COMPLETED)
-  //   - "Partial" (when the envelope is PENDING, not legacy, and we are on the
-  //     team/owner side; recipients are intentionally not offered this since the
-  //     partial PDF carries no PKI signature and would create a leak vector for
-  //     half-executed contracts; legacy envelopes use a different rendering
-  //     pipeline that the partial-download helper does not implement)
-  //   - nothing (DRAFT, REJECTED, PENDING with recipient token, or legacy PENDING)
+  //   - "Partial" (when the envelope is PENDING and not legacy; legacy envelopes
+  //     use a different rendering pipeline that the partial-download helper does
+  //     not implement)
+  //   - nothing (DRAFT, REJECTED, or legacy PENDING)
   const secondaryDownload = useMemo<{ version: 'signed' | 'pending'; label: string } | null>(() => {
     if (envelopeStatus === DocumentStatus.COMPLETED) {
       return {
@@ -81,7 +79,7 @@ export const EnvelopeDownloadDialog = ({
       };
     }
 
-    if (envelopeStatus === DocumentStatus.PENDING && !token && !isLegacy) {
+    if (envelopeStatus === DocumentStatus.PENDING && !isLegacy) {
       return {
         version: 'pending',
         label: t({ message: 'Partial', context: 'Partially signed document (adjective)' }),
@@ -89,7 +87,7 @@ export const EnvelopeDownloadDialog = ({
     }
 
     return null;
-  }, [envelopeStatus, isLegacy, token, t]);
+  }, [envelopeStatus, isLegacy, t]);
 
   const { data: envelopeItemsPayload, isLoading: isLoadingEnvelopeItems } = trpc.envelope.item.getManyByToken.useQuery(
     {

apps/remix/app/routes/_recipient+/sign.$token+/complete.tsx

@@ -148,6 +148,13 @@ export default function CompletedSigningPage({ loaderData }: Route.ComponentProp
     );
   }
 
+  // The envelope may complete or get rejected while this page polls, so derive
+  // the download dialog status from the live signing status.
+  const envelopeStatus = match(signingStatus)
+    .with('COMPLETED', () => DocumentStatus.COMPLETED)
+    .with('REJECTED', () => DocumentStatus.REJECTED)
+    .otherwise(() => document.status);
+
   return (
     <>
       <RecipientBranding branding={branding} cspNonce={cspNonce} />
@@ -255,10 +262,11 @@ export default function CompletedSigningPage({ loaderData }: Route.ComponentProp
                 className="w-full max-w-none md:flex-1"
               />
 
-              {isDocumentCompleted(document) && (
+              {(isDocumentCompleted(envelopeStatus) || envelopeStatus === DocumentStatus.PENDING) && (
                 <EnvelopeDownloadDialog
                   envelopeId={document.envelopeId}
-                  envelopeStatus={document.status}
+                  envelopeStatus={envelopeStatus}
+                  isLegacy={document.internalVersion === 1}
                   envelopeItems={document.envelopeItems}
                   token={recipient?.token}
                   trigger={

apps/remix/server/api/download/download.ts

@@ -83,16 +83,7 @@ export const downloadRoute = new Hono<HonoEnv>()
             },
           },
           include: {
-            envelope: {
-              include: {
-                recipients: {
-                  select: {
-                    role: true,
-                    signingStatus: true,
-                  },
-                },
-              },
-            },
+            envelope: true,
             documentData: true,
           },
         });

apps/remix/server/api/files/files.helpers.ts

@@ -11,8 +11,7 @@ import {
   DocumentStatus,
   type EnvelopeType,
   EnvelopeType as EnvelopeTypeEnum,
-  type RecipientRole,
-  type SigningStatus,
+  SigningStatus,
   type TemplateType,
   TemplateType as TemplateTypeEnum,
 } from '@prisma/client';
@@ -55,17 +54,13 @@ type EnvelopeForPendingDownload = {
   id: string;
   status: DocumentStatus;
   internalVersion: number;
-  recipients: Array<{
-    role: RecipientRole;
-    signingStatus: SigningStatus;
-  }>;
 };
 
 /**
  * Options shape varies by `version`:
  * - `signed` / `original`: serves stored bytes; only needs envelope `status` for cache headers.
  * - `pending`: generates a fresh PDF with currently-inserted fields burned in; needs the
- *   full envelope (id, status, internalVersion, recipients) plus envelopeItemId to query fields.
+ *   envelope (id, status, internalVersion) plus envelopeItemId to query fields.
  */
 type HandleEnvelopeItemFileRequestOptions = {
   title: string;
@@ -81,6 +76,13 @@ type HandleEnvelopeItemFileRequestOptions = {
       version: 'pending';
       envelopeItemId: string;
       envelope: EnvelopeForPendingDownload;
+
+      /**
+       * When set, only fields from recipients who have signed, plus the fields of
+       * the recipient owning this token, are burned in. Keeps recipient downloads
+       * in parity with what the signing page shows them.
+       */
+      recipientToken?: string;
     }
 );
 
@@ -165,6 +167,7 @@ const handlePendingFileRequest = async ({
   envelopeItemId,
   envelope,
   documentData,
+  recipientToken,
   context: c,
 }: PendingFileRequestOptions) => {
   if (envelope.status !== DocumentStatus.PENDING) {
@@ -191,6 +194,13 @@ const handlePendingFileRequest = async ({
     where: {
       envelopeItemId,
       inserted: true,
+      ...(recipientToken
+        ? {
+            recipient: {
+              OR: [{ signingStatus: SigningStatus.SIGNED }, { token: recipientToken }],
+            },
+          }
+        : {}),
     },
     include: {
       signature: true,

apps/remix/server/api/files/files.ts

@@ -160,12 +160,6 @@ export const filesRoute = new Hono<HonoEnv>()
                 documentData: true,
               },
             },
-            recipients: {
-              select: {
-                role: true,
-                signingStatus: true,
-              },
-            },
           },
         });
 
@@ -289,52 +283,80 @@ export const filesRoute = new Hono<HonoEnv>()
     '/token/:token/envelopeItem/:envelopeItemId/download/:version?',
     sValidator('param', ZGetEnvelopeItemFileTokenDownloadRequestParamsSchema),
     async (c) => {
-      const { token, envelopeItemId, version } = c.req.valid('param');
+      const logger = c.get('logger');
 
-      let envelopeWhereQuery: Prisma.EnvelopeItemWhereUniqueInput = {
-        id: envelopeItemId,
-        envelope: {
-          recipients: {
-            some: {
-              token,
-            },
-          },
-        },
-      };
+      try {
+        const { token, envelopeItemId, version } = c.req.valid('param');
 
-      if (token.startsWith('qr_')) {
-        envelopeWhereQuery = {
+        let envelopeWhereQuery: Prisma.EnvelopeItemWhereUniqueInput = {
           id: envelopeItemId,
           envelope: {
-            qrToken: token,
+            recipients: {
+              some: {
+                token,
+              },
+            },
           },
         };
+
+        if (token.startsWith('qr_')) {
+          envelopeWhereQuery = {
+            id: envelopeItemId,
+            envelope: {
+              qrToken: token,
+            },
+          };
+        }
+
+        const envelopeItem = await prisma.envelopeItem.findUnique({
+          where: envelopeWhereQuery,
+          include: {
+            envelope: true,
+            documentData: true,
+          },
+        });
+
+        if (!envelopeItem) {
+          return c.json({ error: 'Envelope item not found' }, 404);
+        }
+
+        if (!envelopeItem.documentData) {
+          return c.json({ error: 'Document data not found' }, 404);
+        }
+
+        const baseOptions = {
+          title: envelopeItem.title,
+          documentData: envelopeItem.documentData,
+          isDownload: true,
+          context: c,
+        } as const;
+
+        if (version === 'pending') {
+          return await handleEnvelopeItemFileRequest({
+            ...baseOptions,
+            version,
+            envelopeItemId: envelopeItem.id,
+            envelope: envelopeItem.envelope,
+            recipientToken: token,
+          });
+        }
+
+        return await handleEnvelopeItemFileRequest({
+          ...baseOptions,
+          version,
+          status: envelopeItem.envelope.status,
+        });
+      } catch (error) {
+        logger.error(error);
+
+        if (error instanceof AppError) {
+          const { status, body } = AppError.toRestAPIError(error);
+
+          return c.json({ error: body.message, code: error.code }, status);
+        }
+
+        return c.json({ error: 'Internal server error' }, 500);
       }
-
-      const envelopeItem = await prisma.envelopeItem.findUnique({
-        where: envelopeWhereQuery,
-        include: {
-          envelope: true,
-          documentData: true,
-        },
-      });
-
-      if (!envelopeItem) {
-        return c.json({ error: 'Envelope item not found' }, 404);
-      }
-
-      if (!envelopeItem.documentData) {
-        return c.json({ error: 'Document data not found' }, 404);
-      }
-
-      return await handleEnvelopeItemFileRequest({
-        title: envelopeItem.title,
-        status: envelopeItem.envelope.status,
-        documentData: envelopeItem.documentData,
-        version,
-        isDownload: true,
-        context: c,
-      });
     },
   );
 

apps/remix/server/api/files/files.types.ts

@@ -44,7 +44,7 @@ export type TGetEnvelopeItemFileDownloadRequestParams = z.infer<typeof ZGetEnvel
 export const ZGetEnvelopeItemFileTokenDownloadRequestParamsSchema = z.object({
   token: z.string().min(1),
   envelopeItemId: z.string().min(1),
-  version: z.enum(['signed', 'original']).default('signed'),
+  version: z.enum(['signed', 'original', 'pending']).default('signed'),
 });
 
 export type TGetEnvelopeItemFileTokenDownloadRequestParams = z.infer<