feat: add template and field endpoints (#1572)

packages/lib/server-only/recipient/create-document-recipients.ts

@@ -0,0 +1,167 @@
+import { z } from 'zod';
+
+import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
+import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
+import type { TRecipientAccessAuthTypes } from '@documenso/lib/types/document-auth';
+import { type TRecipientActionAuthTypes } from '@documenso/lib/types/document-auth';
+import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
+import { nanoid } from '@documenso/lib/universal/id';
+import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
+import { createRecipientAuthOptions } from '@documenso/lib/utils/document-auth';
+import { prisma } from '@documenso/prisma';
+import { RecipientRole } from '@documenso/prisma/client';
+import { SendStatus, SigningStatus } from '@documenso/prisma/client';
+import { ZRecipientBaseResponseSchema } from '@documenso/trpc/server/recipient-router/schema';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+
+export interface CreateDocumentRecipientsOptions {
+  userId: number;
+  teamId?: number;
+  documentId: number;
+  recipients: {
+    email: string;
+    name: string;
+    role: RecipientRole;
+    signingOrder?: number | null;
+    accessAuth?: TRecipientAccessAuthTypes | null;
+    actionAuth?: TRecipientActionAuthTypes | null;
+  }[];
+  requestMetadata: ApiRequestMetadata;
+}
+
+export const ZCreateDocumentRecipientsResponseSchema = z.object({
+  recipients: ZRecipientBaseResponseSchema.array(),
+});
+
+export type TCreateDocumentRecipientsResponse = z.infer<
+  typeof ZCreateDocumentRecipientsResponseSchema
+>;
+
+export const createDocumentRecipients = async ({
+  userId,
+  teamId,
+  documentId,
+  recipients: recipientsToCreate,
+  requestMetadata,
+}: CreateDocumentRecipientsOptions): Promise<TCreateDocumentRecipientsResponse> => {
+  const document = await prisma.document.findFirst({
+    where: {
+      id: documentId,
+      ...(teamId
+        ? {
+            team: {
+              id: teamId,
+              members: {
+                some: {
+                  userId,
+                },
+              },
+            },
+          }
+        : {
+            userId,
+            teamId: null,
+          }),
+    },
+    include: {
+      Recipient: true,
+    },
+  });
+
+  if (!document) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Document not found',
+    });
+  }
+
+  if (document.completedAt) {
+    throw new AppError(AppErrorCode.INVALID_REQUEST, {
+      message: 'Document already complete',
+    });
+  }
+
+  const recipientsHaveActionAuth = recipientsToCreate.some((recipient) => recipient.actionAuth);
+
+  // Check if user has permission to set the global action auth.
+  if (recipientsHaveActionAuth) {
+    const isEnterprise = await isUserEnterprise({
+      userId,
+      teamId,
+    });
+
+    if (!isEnterprise) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, {
+        message: 'You do not have permission to set the action auth',
+      });
+    }
+  }
+
+  const normalizedRecipients = recipientsToCreate.map((recipient) => ({
+    ...recipient,
+    email: recipient.email.toLowerCase(),
+  }));
+
+  const duplicateRecipients = normalizedRecipients.filter((newRecipient) => {
+    const existingRecipient = document.Recipient.find(
+      (existingRecipient) => existingRecipient.email === newRecipient.email,
+    );
+
+    return existingRecipient !== undefined;
+  });
+
+  if (duplicateRecipients.length > 0) {
+    throw new AppError(AppErrorCode.INVALID_REQUEST, {
+      message: `Duplicate recipient(s) found for ${duplicateRecipients.map((recipient) => recipient.email).join(', ')}`,
+    });
+  }
+
+  const createdRecipients = await prisma.$transaction(async (tx) => {
+    return await Promise.all(
+      normalizedRecipients.map(async (recipient) => {
+        const authOptions = createRecipientAuthOptions({
+          accessAuth: recipient.accessAuth || null,
+          actionAuth: recipient.actionAuth || null,
+        });
+
+        const createdRecipient = await tx.recipient.create({
+          data: {
+            documentId,
+            name: recipient.name,
+            email: recipient.email,
+            role: recipient.role,
+            signingOrder: recipient.signingOrder,
+            token: nanoid(),
+            sendStatus: recipient.role === RecipientRole.CC ? SendStatus.SENT : SendStatus.NOT_SENT,
+            signingStatus:
+              recipient.role === RecipientRole.CC ? SigningStatus.SIGNED : SigningStatus.NOT_SIGNED,
+            authOptions,
+          },
+        });
+
+        // Handle recipient created audit log.
+        await tx.documentAuditLog.create({
+          data: createDocumentAuditLogData({
+            type: DOCUMENT_AUDIT_LOG_TYPE.RECIPIENT_CREATED,
+            documentId: documentId,
+            metadata: requestMetadata,
+            data: {
+              recipientEmail: createdRecipient.email,
+              recipientName: createdRecipient.name,
+              recipientId: createdRecipient.id,
+              recipientRole: createdRecipient.role,
+              accessAuth: recipient.accessAuth || undefined,
+              actionAuth: recipient.actionAuth || undefined,
+            },
+          }),
+        });
+
+        return createdRecipient;
+      }),
+    );
+  });
+
+  return {
+    recipients: createdRecipients,
+  };
+};

packages/lib/server-only/recipient/create-template-recipients.ts

@@ -0,0 +1,139 @@
+import { z } from 'zod';
+
+import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
+import type { TRecipientAccessAuthTypes } from '@documenso/lib/types/document-auth';
+import { type TRecipientActionAuthTypes } from '@documenso/lib/types/document-auth';
+import { nanoid } from '@documenso/lib/universal/id';
+import { createRecipientAuthOptions } from '@documenso/lib/utils/document-auth';
+import { prisma } from '@documenso/prisma';
+import { RecipientRole } from '@documenso/prisma/client';
+import { SendStatus, SigningStatus } from '@documenso/prisma/client';
+import { ZRecipientBaseResponseSchema } from '@documenso/trpc/server/recipient-router/schema';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+
+export interface CreateTemplateRecipientsOptions {
+  userId: number;
+  teamId?: number;
+  templateId: number;
+  recipients: {
+    email: string;
+    name: string;
+    role: RecipientRole;
+    signingOrder?: number | null;
+    accessAuth?: TRecipientAccessAuthTypes | null;
+    actionAuth?: TRecipientActionAuthTypes | null;
+  }[];
+}
+
+export const ZCreateTemplateRecipientsResponseSchema = z.object({
+  recipients: ZRecipientBaseResponseSchema.array(),
+});
+
+export type TCreateTemplateRecipientsResponse = z.infer<
+  typeof ZCreateTemplateRecipientsResponseSchema
+>;
+
+export const createTemplateRecipients = async ({
+  userId,
+  teamId,
+  templateId,
+  recipients: recipientsToCreate,
+}: CreateTemplateRecipientsOptions): Promise<TCreateTemplateRecipientsResponse> => {
+  const template = await prisma.template.findFirst({
+    where: {
+      id: templateId,
+      ...(teamId
+        ? {
+            team: {
+              id: teamId,
+              members: {
+                some: {
+                  userId,
+                },
+              },
+            },
+          }
+        : {
+            userId,
+            teamId: null,
+          }),
+    },
+    include: {
+      Recipient: true,
+    },
+  });
+
+  if (!template) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Template not found',
+    });
+  }
+
+  const recipientsHaveActionAuth = recipientsToCreate.some((recipient) => recipient.actionAuth);
+
+  // Check if user has permission to set the global action auth.
+  if (recipientsHaveActionAuth) {
+    const isEnterprise = await isUserEnterprise({
+      userId,
+      teamId,
+    });
+
+    if (!isEnterprise) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, {
+        message: 'You do not have permission to set the action auth',
+      });
+    }
+  }
+
+  const normalizedRecipients = recipientsToCreate.map((recipient) => ({
+    ...recipient,
+    email: recipient.email.toLowerCase(),
+  }));
+
+  const duplicateRecipients = normalizedRecipients.filter((newRecipient) => {
+    const existingRecipient = template.Recipient.find(
+      (existingRecipient) => existingRecipient.email === newRecipient.email,
+    );
+
+    return existingRecipient !== undefined;
+  });
+
+  if (duplicateRecipients.length > 0) {
+    throw new AppError(AppErrorCode.INVALID_REQUEST, {
+      message: `Duplicate recipient(s) found for ${duplicateRecipients.map((recipient) => recipient.email).join(', ')}`,
+    });
+  }
+
+  const createdRecipients = await prisma.$transaction(async (tx) => {
+    return await Promise.all(
+      normalizedRecipients.map(async (recipient) => {
+        const authOptions = createRecipientAuthOptions({
+          accessAuth: recipient.accessAuth || null,
+          actionAuth: recipient.actionAuth || null,
+        });
+
+        const createdRecipient = await tx.recipient.create({
+          data: {
+            templateId,
+            name: recipient.name,
+            email: recipient.email,
+            role: recipient.role,
+            signingOrder: recipient.signingOrder,
+            token: nanoid(),
+            sendStatus: recipient.role === RecipientRole.CC ? SendStatus.SENT : SendStatus.NOT_SENT,
+            signingStatus:
+              recipient.role === RecipientRole.CC ? SigningStatus.SIGNED : SigningStatus.NOT_SIGNED,
+            authOptions,
+          },
+        });
+
+        return createdRecipient;
+      }),
+    );
+  });
+
+  return {
+    recipients: createdRecipients,
+  };
+};

packages/lib/server-only/recipient/delete-document-recipient.ts

@@ -0,0 +1,161 @@
+import { createElement } from 'react';
+
+import { msg } from '@lingui/macro';
+
+import { mailer } from '@documenso/email/mailer';
+import RecipientRemovedFromDocumentTemplate from '@documenso/email/templates/recipient-removed-from-document';
+import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
+import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
+import { prisma } from '@documenso/prisma';
+import { SendStatus } from '@documenso/prisma/client';
+
+import { getI18nInstance } from '../../client-only/providers/i18n.server';
+import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
+import { FROM_ADDRESS, FROM_NAME } from '../../constants/email';
+import { AppError, AppErrorCode } from '../../errors/app-error';
+import { extractDerivedDocumentEmailSettings } from '../../types/document-email';
+import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
+import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
+
+export interface DeleteDocumentRecipientOptions {
+  userId: number;
+  teamId?: number;
+  recipientId: number;
+  requestMetadata: ApiRequestMetadata;
+}
+
+export const deleteDocumentRecipient = async ({
+  userId,
+  teamId,
+  recipientId,
+  requestMetadata,
+}: DeleteDocumentRecipientOptions): Promise<void> => {
+  const document = await prisma.document.findFirst({
+    where: {
+      Recipient: {
+        some: {
+          id: recipientId,
+        },
+      },
+      ...(teamId
+        ? {
+            team: {
+              id: teamId,
+              members: {
+                some: {
+                  userId,
+                },
+              },
+            },
+          }
+        : {
+            userId,
+            teamId: null,
+          }),
+    },
+    include: {
+      documentMeta: true,
+      team: true,
+      Recipient: {
+        where: {
+          id: recipientId,
+        },
+      },
+    },
+  });
+
+  const user = await prisma.user.findFirst({
+    where: {
+      id: userId,
+    },
+    select: {
+      id: true,
+      name: true,
+      email: true,
+    },
+  });
+
+  if (!document) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Document not found',
+    });
+  }
+
+  if (document.completedAt) {
+    throw new AppError(AppErrorCode.INVALID_REQUEST, {
+      message: 'Document already complete',
+    });
+  }
+
+  if (!user) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'User not found',
+    });
+  }
+
+  const recipientToDelete = document.Recipient[0];
+
+  if (!recipientToDelete || recipientToDelete.id !== recipientId) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Recipient not found',
+    });
+  }
+
+  await prisma.$transaction(async (tx) => {
+    await tx.recipient.delete({
+      where: {
+        id: recipientId,
+      },
+    });
+
+    await tx.documentAuditLog.create({
+      data: createDocumentAuditLogData({
+        type: DOCUMENT_AUDIT_LOG_TYPE.RECIPIENT_DELETED,
+        documentId: document.id,
+        metadata: requestMetadata,
+        data: {
+          recipientEmail: recipientToDelete.email,
+          recipientName: recipientToDelete.name,
+          recipientId: recipientToDelete.id,
+          recipientRole: recipientToDelete.role,
+        },
+      }),
+    });
+  });
+
+  const isRecipientRemovedEmailEnabled = extractDerivedDocumentEmailSettings(
+    document.documentMeta,
+  ).recipientRemoved;
+
+  // Send email to deleted recipient.
+  if (recipientToDelete.sendStatus === SendStatus.SENT && isRecipientRemovedEmailEnabled) {
+    const assetBaseUrl = NEXT_PUBLIC_WEBAPP_URL() || 'http://localhost:3000';
+
+    const template = createElement(RecipientRemovedFromDocumentTemplate, {
+      documentName: document.title,
+      inviterName: document.team?.name || user.name || undefined,
+      assetBaseUrl,
+    });
+
+    const [html, text] = await Promise.all([
+      renderEmailWithI18N(template, { lang: document.documentMeta?.language }),
+      renderEmailWithI18N(template, { lang: document.documentMeta?.language, plainText: true }),
+    ]);
+
+    const i18n = await getI18nInstance(document.documentMeta?.language);
+
+    await mailer.sendMail({
+      to: {
+        address: recipientToDelete.email,
+        name: recipientToDelete.name,
+      },
+      from: {
+        name: FROM_NAME,
+        address: FROM_ADDRESS,
+      },
+      subject: i18n._(msg`You have been removed from a document`),
+      html,
+      text,
+    });
+  }
+};

packages/lib/server-only/recipient/delete-template-recipient.ts

@@ -0,0 +1,67 @@
+import { prisma } from '@documenso/prisma';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+
+export interface DeleteTemplateRecipientOptions {
+  userId: number;
+  teamId?: number;
+  recipientId: number;
+}
+
+export const deleteTemplateRecipient = async ({
+  userId,
+  teamId,
+  recipientId,
+}: DeleteTemplateRecipientOptions): Promise<void> => {
+  const template = await prisma.template.findFirst({
+    where: {
+      Recipient: {
+        some: {
+          id: recipientId,
+        },
+      },
+      ...(teamId
+        ? {
+            team: {
+              id: teamId,
+              members: {
+                some: {
+                  userId,
+                },
+              },
+            },
+          }
+        : {
+            userId,
+            teamId: null,
+          }),
+    },
+    include: {
+      Recipient: {
+        where: {
+          id: recipientId,
+        },
+      },
+    },
+  });
+
+  if (!template) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Template not found',
+    });
+  }
+
+  const recipientToDelete = template.Recipient[0];
+
+  if (!recipientToDelete || recipientToDelete.id !== recipientId) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Recipient not found',
+    });
+  }
+
+  await prisma.recipient.delete({
+    where: {
+      id: recipientId,
+    },
+  });
+};

packages/lib/server-only/recipient/get-recipient-by-id.ts

@@ -29,25 +29,21 @@ export const getRecipientById = async ({
   const recipient = await prisma.recipient.findFirst({
     where: {
       id: recipientId,
-      Document: {
-        OR: [
-          teamId === undefined
-            ? {
-                userId,
-                teamId: null,
-              }
-            : {
-                teamId,
-                team: {
-                  members: {
-                    some: {
-                      userId,
-                    },
-                  },
+      Document: teamId
+        ? {
+            team: {
+              id: teamId,
+              members: {
+                some: {
+                  userId,
                 },
               },
-        ],
-      },
+            },
+          }
+        : {
+            userId,
+            teamId: null,
+          },
     },
     include: {
       Field: true,

packages/lib/server-only/recipient/get-recipients-for-document.ts

@@ -14,23 +14,21 @@ export const getRecipientsForDocument = async ({
   const recipients = await prisma.recipient.findMany({
     where: {
       documentId,
-      Document: {
-        OR: [
-          {
-            userId,
-          },
-          {
-            teamId,
+      Document: teamId
+        ? {
             team: {
+              id: teamId,
               members: {
                 some: {
                   userId,
                 },
               },
             },
+          }
+        : {
+            userId,
+            teamId: null,
           },
-        ],
-      },
     },
     orderBy: {
       id: 'asc',

packages/lib/server-only/recipient/get-recipients-for-template.ts

@@ -3,31 +3,32 @@ import { prisma } from '@documenso/prisma';
 export interface GetRecipientsForTemplateOptions {
   templateId: number;
   userId: number;
+  teamId?: number;
 }
 
 export const getRecipientsForTemplate = async ({
   templateId,
   userId,
+  teamId,
 }: GetRecipientsForTemplateOptions) => {
   const recipients = await prisma.recipient.findMany({
     where: {
       templateId,
-      Template: {
-        OR: [
-          {
-            userId,
-          },
-          {
+      Template: teamId
+        ? {
             team: {
+              id: teamId,
               members: {
                 some: {
                   userId,
                 },
               },
             },
+          }
+        : {
+            userId,
+            teamId: null,
           },
-        ],
-      },
     },
     orderBy: {
       id: 'asc',

packages/lib/server-only/recipient/set-document-recipients.ts

@@ -7,11 +7,12 @@ import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-ent
 import { mailer } from '@documenso/email/mailer';
 import RecipientRemovedFromDocumentTemplate from '@documenso/email/templates/recipient-removed-from-document';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
+import type { TRecipientAccessAuthTypes } from '@documenso/lib/types/document-auth';
 import {
   type TRecipientActionAuthTypes,
   ZRecipientAuthOptionsSchema,
 } from '@documenso/lib/types/document-auth';
-import type { RequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
+import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import { nanoid } from '@documenso/lib/universal/id';
 import {
   createDocumentAuditLogData,
@@ -33,29 +34,27 @@ import { canRecipientBeModified } from '../../utils/recipients';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
 import { teamGlobalSettingsToBranding } from '../../utils/team-global-settings-to-branding';
 
-export interface SetRecipientsForDocumentOptions {
+export interface SetDocumentRecipientsOptions {
   userId: number;
   teamId?: number;
   documentId: number;
   recipients: RecipientData[];
-  requestMetadata?: RequestMetadata;
+  requestMetadata: ApiRequestMetadata;
 }
 
-export const ZSetRecipientsForDocumentResponseSchema = z.object({
+export const ZSetDocumentRecipientsResponseSchema = z.object({
   recipients: RecipientSchema.array(),
 });
 
-export type TSetRecipientsForDocumentResponse = z.infer<
-  typeof ZSetRecipientsForDocumentResponseSchema
->;
+export type TSetDocumentRecipientsResponse = z.infer<typeof ZSetDocumentRecipientsResponseSchema>;
 
-export const setRecipientsForDocument = async ({
+export const setDocumentRecipients = async ({
   userId,
   teamId,
   documentId,
   recipients,
   requestMetadata,
-}: SetRecipientsForDocumentOptions): Promise<TSetRecipientsForDocumentResponse> => {
+}: SetDocumentRecipientsOptions): Promise<TSetDocumentRecipientsResponse> => {
   const document = await prisma.document.findFirst({
     where: {
       id: documentId,
@@ -167,10 +166,10 @@ export const setRecipientsForDocument = async ({
       linkedRecipients.map(async (recipient) => {
         let authOptions = ZRecipientAuthOptionsSchema.parse(recipient._persisted?.authOptions);
 
-        if (recipient.actionAuth !== undefined) {
+        if (recipient.actionAuth !== undefined || recipient.accessAuth !== undefined) {
           authOptions = createRecipientAuthOptions({
-            accessAuth: authOptions.accessAuth,
-            actionAuth: recipient.actionAuth,
+            accessAuth: recipient.accessAuth || authOptions.accessAuth,
+            actionAuth: recipient.actionAuth || authOptions.actionAuth,
           });
         }
 
@@ -236,8 +235,7 @@ export const setRecipientsForDocument = async ({
             data: createDocumentAuditLogData({
               type: DOCUMENT_AUDIT_LOG_TYPE.RECIPIENT_UPDATED,
               documentId: documentId,
-              user,
-              requestMetadata,
+              metadata: requestMetadata,
               data: {
                 changes,
                 ...baseAuditLog,
@@ -252,10 +250,10 @@ export const setRecipientsForDocument = async ({
             data: createDocumentAuditLogData({
               type: DOCUMENT_AUDIT_LOG_TYPE.RECIPIENT_CREATED,
               documentId: documentId,
-              user,
-              requestMetadata,
+              metadata: requestMetadata,
               data: {
                 ...baseAuditLog,
+                accessAuth: recipient.accessAuth || undefined,
                 actionAuth: recipient.actionAuth || undefined,
               },
             }),
@@ -282,8 +280,7 @@ export const setRecipientsForDocument = async ({
           createDocumentAuditLogData({
             type: DOCUMENT_AUDIT_LOG_TYPE.RECIPIENT_DELETED,
             documentId: documentId,
-            user,
-            requestMetadata,
+            metadata: requestMetadata,
             data: {
               recipientEmail: recipient.email,
               recipientName: recipient.name,
@@ -368,6 +365,7 @@ type RecipientData = {
   name: string;
   role: RecipientRole;
   signingOrder?: number | null;
+  accessAuth?: TRecipientAccessAuthTypes | null;
   actionAuth?: TRecipientActionAuthTypes | null;
 };
 
@@ -379,6 +377,7 @@ const hasRecipientBeenChanged = (recipient: Recipient, newRecipientData: Recipie
     recipient.name !== newRecipientData.name ||
     recipient.role !== newRecipientData.role ||
     recipient.signingOrder !== newRecipientData.signingOrder ||
+    authOptions.accessAuth !== newRecipientData.accessAuth ||
     authOptions.actionAuth !== newRecipientData.actionAuth
   );
 };

packages/lib/server-only/recipient/set-template-recipients.ts

@@ -18,7 +18,7 @@ import {
 import { nanoid } from '../../universal/id';
 import { createRecipientAuthOptions } from '../../utils/document-auth';
 
-export type SetRecipientsForTemplateOptions = {
+export type SetTemplateRecipientsOptions = {
   userId: number;
   teamId?: number;
   templateId: number;
@@ -32,37 +32,36 @@ export type SetRecipientsForTemplateOptions = {
   }[];
 };
 
-export const ZSetRecipientsForTemplateResponseSchema = z.object({
+export const ZSetTemplateRecipientsResponseSchema = z.object({
   recipients: RecipientSchema.array(),
 });
 
-export type TSetRecipientsForTemplateResponse = z.infer<
-  typeof ZSetRecipientsForTemplateResponseSchema
->;
+export type TSetTemplateRecipientsResponse = z.infer<typeof ZSetTemplateRecipientsResponseSchema>;
 
-export const setRecipientsForTemplate = async ({
+export const setTemplateRecipients = async ({
   userId,
   teamId,
   templateId,
   recipients,
-}: SetRecipientsForTemplateOptions): Promise<TSetRecipientsForTemplateResponse> => {
+}: SetTemplateRecipientsOptions): Promise<TSetTemplateRecipientsResponse> => {
   const template = await prisma.template.findFirst({
     where: {
       id: templateId,
-      OR: [
-        {
-          userId,
-        },
-        {
-          team: {
-            members: {
-              some: {
-                userId,
+      ...(teamId
+        ? {
+            team: {
+              id: teamId,
+              members: {
+                some: {
+                  userId,
+                },
               },
             },
-          },
-        },
-      ],
+          }
+        : {
+            userId,
+            teamId: null,
+          }),
     },
     include: {
       directLink: true,

packages/lib/server-only/recipient/update-document-recipients.ts

@@ -0,0 +1,246 @@
+import { z } from 'zod';
+
+import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
+import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
+import type { TRecipientAccessAuthTypes } from '@documenso/lib/types/document-auth';
+import {
+  type TRecipientActionAuthTypes,
+  ZRecipientAuthOptionsSchema,
+} from '@documenso/lib/types/document-auth';
+import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
+import {
+  createDocumentAuditLogData,
+  diffRecipientChanges,
+} from '@documenso/lib/utils/document-audit-logs';
+import { createRecipientAuthOptions } from '@documenso/lib/utils/document-auth';
+import { prisma } from '@documenso/prisma';
+import type { Recipient } from '@documenso/prisma/client';
+import { RecipientRole } from '@documenso/prisma/client';
+import { SendStatus, SigningStatus } from '@documenso/prisma/client';
+import { ZRecipientResponseSchema } from '@documenso/trpc/server/recipient-router/schema';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+import { canRecipientBeModified } from '../../utils/recipients';
+
+export interface UpdateDocumentRecipientsOptions {
+  userId: number;
+  teamId?: number;
+  documentId: number;
+  recipients: RecipientData[];
+  requestMetadata: ApiRequestMetadata;
+}
+
+export const ZUpdateDocumentRecipientsResponseSchema = z.object({
+  recipients: ZRecipientResponseSchema.array(),
+});
+
+export type TUpdateDocumentRecipientsResponse = z.infer<
+  typeof ZUpdateDocumentRecipientsResponseSchema
+>;
+
+export const updateDocumentRecipients = async ({
+  userId,
+  teamId,
+  documentId,
+  recipients,
+  requestMetadata,
+}: UpdateDocumentRecipientsOptions): Promise<TUpdateDocumentRecipientsResponse> => {
+  const document = await prisma.document.findFirst({
+    where: {
+      id: documentId,
+      ...(teamId
+        ? {
+            team: {
+              id: teamId,
+              members: {
+                some: {
+                  userId,
+                },
+              },
+            },
+          }
+        : {
+            userId,
+            teamId: null,
+          }),
+    },
+    include: {
+      Field: true,
+      Recipient: true,
+    },
+  });
+
+  if (!document) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Document not found',
+    });
+  }
+
+  if (document.completedAt) {
+    throw new AppError(AppErrorCode.INVALID_REQUEST, {
+      message: 'Document already complete',
+    });
+  }
+
+  const recipientsHaveActionAuth = recipients.some((recipient) => recipient.actionAuth);
+
+  // Check if user has permission to set the global action auth.
+  if (recipientsHaveActionAuth) {
+    const isEnterprise = await isUserEnterprise({
+      userId,
+      teamId,
+    });
+
+    if (!isEnterprise) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, {
+        message: 'You do not have permission to set the action auth',
+      });
+    }
+  }
+
+  const recipientsToUpdate = recipients.map((recipient) => {
+    const originalRecipient = document.Recipient.find(
+      (existingRecipient) => existingRecipient.id === recipient.id,
+    );
+
+    if (!originalRecipient) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: `Recipient with id ${recipient.id} not found`,
+      });
+    }
+
+    const duplicateRecipientWithSameEmail = document.Recipient.find(
+      (existingRecipient) =>
+        existingRecipient.email === recipient.email && existingRecipient.id !== recipient.id,
+    );
+
+    if (duplicateRecipientWithSameEmail) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST, {
+        message: `Duplicate recipient with the same email found: ${duplicateRecipientWithSameEmail.email}`,
+      });
+    }
+
+    if (
+      hasRecipientBeenChanged(originalRecipient, recipient) &&
+      !canRecipientBeModified(originalRecipient, document.Field)
+    ) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST, {
+        message: 'Cannot modify a recipient who has already interacted with the document',
+      });
+    }
+
+    return {
+      originalRecipient,
+      updateData: recipient,
+    };
+  });
+
+  const updatedRecipients = await prisma.$transaction(async (tx) => {
+    return await Promise.all(
+      recipientsToUpdate.map(async ({ originalRecipient, updateData }) => {
+        let authOptions = ZRecipientAuthOptionsSchema.parse(originalRecipient.authOptions);
+
+        if (updateData.actionAuth !== undefined || updateData.accessAuth !== undefined) {
+          authOptions = createRecipientAuthOptions({
+            accessAuth: updateData.accessAuth || authOptions.accessAuth,
+            actionAuth: updateData.actionAuth || authOptions.actionAuth,
+          });
+        }
+
+        const mergedRecipient = {
+          ...originalRecipient,
+          ...updateData,
+        };
+
+        const updatedRecipient = await tx.recipient.update({
+          where: {
+            id: originalRecipient.id,
+            documentId,
+          },
+          data: {
+            name: mergedRecipient.name,
+            email: mergedRecipient.email,
+            role: mergedRecipient.role,
+            signingOrder: mergedRecipient.signingOrder,
+            documentId,
+            sendStatus:
+              mergedRecipient.role === RecipientRole.CC ? SendStatus.SENT : SendStatus.NOT_SENT,
+            signingStatus:
+              mergedRecipient.role === RecipientRole.CC
+                ? SigningStatus.SIGNED
+                : SigningStatus.NOT_SIGNED,
+            authOptions,
+          },
+          include: {
+            Field: true,
+          },
+        });
+
+        // Clear all fields if the recipient role is changed to a type that cannot have fields.
+        if (
+          originalRecipient.role !== updatedRecipient.role &&
+          (updatedRecipient.role === RecipientRole.CC ||
+            updatedRecipient.role === RecipientRole.VIEWER)
+        ) {
+          await tx.field.deleteMany({
+            where: {
+              recipientId: updatedRecipient.id,
+            },
+          });
+        }
+
+        const changes = diffRecipientChanges(originalRecipient, updatedRecipient);
+
+        // Handle recipient updated audit log.
+        if (changes.length > 0) {
+          await tx.documentAuditLog.create({
+            data: createDocumentAuditLogData({
+              type: DOCUMENT_AUDIT_LOG_TYPE.RECIPIENT_UPDATED,
+              documentId: documentId,
+              metadata: requestMetadata,
+              data: {
+                recipientEmail: updatedRecipient.email,
+                recipientName: updatedRecipient.name,
+                recipientId: updatedRecipient.id,
+                recipientRole: updatedRecipient.role,
+                changes,
+              },
+            }),
+          });
+        }
+
+        return updatedRecipient;
+      }),
+    );
+  });
+
+  return {
+    recipients: updatedRecipients,
+  };
+};
+
+/**
+ * If you change this you MUST update the `hasRecipientBeenChanged` function.
+ */
+type RecipientData = {
+  id: number;
+  email?: string;
+  name?: string;
+  role?: RecipientRole;
+  signingOrder?: number | null;
+  accessAuth?: TRecipientAccessAuthTypes | null;
+  actionAuth?: TRecipientActionAuthTypes | null;
+};
+
+const hasRecipientBeenChanged = (recipient: Recipient, newRecipientData: RecipientData) => {
+  const authOptions = ZRecipientAuthOptionsSchema.parse(recipient.authOptions);
+
+  return (
+    recipient.email !== newRecipientData.email ||
+    recipient.name !== newRecipientData.name ||
+    recipient.role !== newRecipientData.role ||
+    recipient.signingOrder !== newRecipientData.signingOrder ||
+    authOptions.accessAuth !== newRecipientData.accessAuth ||
+    authOptions.actionAuth !== newRecipientData.actionAuth
+  );
+};

packages/lib/server-only/recipient/update-template-recipients.ts

@@ -0,0 +1,185 @@
+import { z } from 'zod';
+
+import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
+import type { TRecipientAccessAuthTypes } from '@documenso/lib/types/document-auth';
+import {
+  type TRecipientActionAuthTypes,
+  ZRecipientAuthOptionsSchema,
+} from '@documenso/lib/types/document-auth';
+import { createRecipientAuthOptions } from '@documenso/lib/utils/document-auth';
+import { prisma } from '@documenso/prisma';
+import { RecipientRole } from '@documenso/prisma/client';
+import { SendStatus, SigningStatus } from '@documenso/prisma/client';
+import { ZRecipientResponseSchema } from '@documenso/trpc/server/recipient-router/schema';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+
+export interface UpdateTemplateRecipientsOptions {
+  userId: number;
+  teamId?: number;
+  templateId: number;
+  recipients: {
+    id: number;
+    email?: string;
+    name?: string;
+    role?: RecipientRole;
+    signingOrder?: number | null;
+    accessAuth?: TRecipientAccessAuthTypes | null;
+    actionAuth?: TRecipientActionAuthTypes | null;
+  }[];
+}
+
+export const ZUpdateTemplateRecipientsResponseSchema = z.object({
+  recipients: ZRecipientResponseSchema.array(),
+});
+
+export type TUpdateTemplateRecipientsResponse = z.infer<
+  typeof ZUpdateTemplateRecipientsResponseSchema
+>;
+
+export const updateTemplateRecipients = async ({
+  userId,
+  teamId,
+  templateId,
+  recipients,
+}: UpdateTemplateRecipientsOptions): Promise<TUpdateTemplateRecipientsResponse> => {
+  const template = await prisma.template.findFirst({
+    where: {
+      id: templateId,
+      ...(teamId
+        ? {
+            team: {
+              id: teamId,
+              members: {
+                some: {
+                  userId,
+                },
+              },
+            },
+          }
+        : {
+            userId,
+            teamId: null,
+          }),
+    },
+    include: {
+      Recipient: true,
+    },
+  });
+
+  if (!template) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Template not found',
+    });
+  }
+
+  const recipientsHaveActionAuth = recipients.some((recipient) => recipient.actionAuth);
+
+  // Check if user has permission to set the global action auth.
+  if (recipientsHaveActionAuth) {
+    const isEnterprise = await isUserEnterprise({
+      userId,
+      teamId,
+    });
+
+    if (!isEnterprise) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, {
+        message: 'You do not have permission to set the action auth',
+      });
+    }
+  }
+
+  const recipientsToUpdate = recipients.map((recipient) => {
+    const originalRecipient = template.Recipient.find(
+      (existingRecipient) => existingRecipient.id === recipient.id,
+    );
+
+    if (!originalRecipient) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: `Recipient with id ${recipient.id} not found`,
+      });
+    }
+
+    const duplicateRecipientWithSameEmail = template.Recipient.find(
+      (existingRecipient) =>
+        existingRecipient.email === recipient.email && existingRecipient.id !== recipient.id,
+    );
+
+    if (duplicateRecipientWithSameEmail) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST, {
+        message: `Duplicate recipient with the same email found: ${duplicateRecipientWithSameEmail.email}`,
+      });
+    }
+
+    return {
+      originalRecipient,
+      recipientUpdateData: recipient,
+    };
+  });
+
+  const updatedRecipients = await prisma.$transaction(async (tx) => {
+    return await Promise.all(
+      recipientsToUpdate.map(async ({ originalRecipient, recipientUpdateData }) => {
+        let authOptions = ZRecipientAuthOptionsSchema.parse(originalRecipient.authOptions);
+
+        if (
+          recipientUpdateData.actionAuth !== undefined ||
+          recipientUpdateData.accessAuth !== undefined
+        ) {
+          authOptions = createRecipientAuthOptions({
+            accessAuth: recipientUpdateData.accessAuth || authOptions.accessAuth,
+            actionAuth: recipientUpdateData.actionAuth || authOptions.actionAuth,
+          });
+        }
+
+        const mergedRecipient = {
+          ...originalRecipient,
+          ...recipientUpdateData,
+        };
+
+        const updatedRecipient = await tx.recipient.update({
+          where: {
+            id: originalRecipient.id,
+            templateId,
+          },
+          data: {
+            name: mergedRecipient.name,
+            email: mergedRecipient.email,
+            role: mergedRecipient.role,
+            signingOrder: mergedRecipient.signingOrder,
+            templateId,
+            sendStatus:
+              mergedRecipient.role === RecipientRole.CC ? SendStatus.SENT : SendStatus.NOT_SENT,
+            signingStatus:
+              mergedRecipient.role === RecipientRole.CC
+                ? SigningStatus.SIGNED
+                : SigningStatus.NOT_SIGNED,
+            authOptions,
+          },
+          include: {
+            Field: true,
+          },
+        });
+
+        // Clear all fields if the recipient role is changed to a type that cannot have fields.
+        if (
+          originalRecipient.role !== updatedRecipient.role &&
+          (updatedRecipient.role === RecipientRole.CC ||
+            updatedRecipient.role === RecipientRole.VIEWER)
+        ) {
+          await tx.field.deleteMany({
+            where: {
+              recipientId: updatedRecipient.id,
+            },
+          });
+        }
+
+        return updatedRecipient;
+      }),
+    );
+  });
+
+  return {
+    recipients: updatedRecipients,
+  };
+};