From be3e45427ff72ecc5d4cac2a7fce6c51343410a4 Mon Sep 17 00:00:00 2001 From: Timur Ercan Date: Tue, 12 May 2026 14:58:39 +0200 Subject: [PATCH 01/15] chore: update fair use policy (#2798) ## Description refined fair use policy with examples and guidelines --- apps/docs/content/docs/policies/fair-use.mdx | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/apps/docs/content/docs/policies/fair-use.mdx b/apps/docs/content/docs/policies/fair-use.mdx index 416597fcd..0c4de348d 100644 --- a/apps/docs/content/docs/policies/fair-use.mdx +++ b/apps/docs/content/docs/policies/fair-use.mdx @@ -19,16 +19,19 @@ Use the limitless plans as much as you like. They are meant to offer a lot. Plea ### Do -- Sign as many documents as you need with the individual plan for your single business or organisation -- Use the API and automation tools to automate your signing workflows -- Experiment with plans and integrations while testing what you want to build +- Use team or platform plans to run your workflows, even with significant volume, as long as it aligns with the plan’s intended purpose. +- Experiment and automate freely within the plan features. +- If volume grows beyond what’s sustainable on your plan, we’ll reach out to discuss an upgrade. +- Assume that extreme usage will lead to us contacting you. You can scale up—or scale back. It’s about finding the right fit. ### Don't - -- Use an individual account API to power a platform or product -- Run a large company signing thousands of documents per day on a small team plan -- Expect enterprise-level support on a fair support plan -- Overthink this policy — if you are a paying customer, we want you to win +- Use an individual account's API to power a platform or product. +- Run a large company signing thousands of documents per day on a small team plan. +- Expect enterprise-level support on a fair support plan (i.e. business edition). +- Use a team plan to power an external platform or commercial product or platform beyond moderate testing. +- Expect a platform plan to support enterprise-level volumes indefinitely without a conversation. +- Don’t expect the platform plan to cover enterprise-scale volume or support. If you reach that point, we’ll reach out to guide you to the right fit. +- Don’t overthink this – if you’re building something valuable, we want to see you succeed. If we need to talk, we will. ## Rate Limits From 73a7335c8933540b7dd781153475393074c3e12a Mon Sep 17 00:00:00 2001 From: Anish Patil <91008239+anish1204@users.noreply.github.com> Date: Wed, 13 May 2026 08:41:13 +0530 Subject: [PATCH 02/15] refactor: remove unnecessary DateRange type assertion (#2790) --- apps/remix/app/components/filters/date-range-filter.tsx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/remix/app/components/filters/date-range-filter.tsx b/apps/remix/app/components/filters/date-range-filter.tsx index a4ec394c5..03eb2fccf 100644 --- a/apps/remix/app/components/filters/date-range-filter.tsx +++ b/apps/remix/app/components/filters/date-range-filter.tsx @@ -14,10 +14,10 @@ export const DateRangeFilter = ({ currentRange }: DateRangeFilterProps) => { const [isPending, startTransition] = useTransition(); const updateSearchParams = useUpdateSearchParams(); - const handleRangeChange = (value: string) => { + const handleRangeChange = (value: DateRange) => { startTransition(() => { updateSearchParams({ - dateRange: value as DateRange, + dateRange: value, page: 1, }); }); From 8dfd548c0825411e403482c184083235af3b0e90 Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Wed, 13 May 2026 15:06:06 +1000 Subject: [PATCH 03/15] chore: remove github action caches (#2802) --- .github/actions/node-install/action.yml | 20 +------------------ .github/actions/playwright-install/action.yml | 13 +----------- .github/workflows/ci.yml | 18 ----------------- .github/workflows/issue-assignee-check.yml | 1 - .github/workflows/pr-labeler.yml | 2 +- .github/workflows/pr-review-reminder.yml | 1 - .github/workflows/semantic-pull-requests.yml | 2 +- 7 files changed, 4 insertions(+), 53 deletions(-) diff --git a/.github/actions/node-install/action.yml b/.github/actions/node-install/action.yml index bea5a0a49..b01a28740 100644 --- a/.github/actions/node-install/action.yml +++ b/.github/actions/node-install/action.yml @@ -1,4 +1,4 @@ -name: 'Setup node and cache node_modules' +name: 'Setup node' inputs: node_version: required: false @@ -16,25 +16,7 @@ runs: shell: bash run: corepack enable npm - - name: Cache npm - uses: actions/cache@v3 - with: - path: ~/.npm - key: npm-${{ hashFiles('package-lock.json') }} - restore-keys: npm- - - - name: Cache node_modules - uses: actions/cache@v3 - id: cache-node-modules - with: - path: | - node_modules - packages/*/node_modules - apps/*/node_modules - key: modules-${{ hashFiles('package-lock.json') }} - - name: Install dependencies - if: steps.cache-node-modules.outputs.cache-hit != 'true' shell: bash run: | npm ci --no-audit diff --git a/.github/actions/playwright-install/action.yml b/.github/actions/playwright-install/action.yml index 27d0e66b4..ac3202f3d 100644 --- a/.github/actions/playwright-install/action.yml +++ b/.github/actions/playwright-install/action.yml @@ -1,19 +1,8 @@ name: Install playwright binaries -description: 'Install playwright, cache and restore if necessary' +description: 'Install playwright' runs: using: 'composite' steps: - - name: Cache playwright - id: cache-playwright - uses: actions/cache@v3 - with: - path: | - ~/.cache/ms-playwright - ${{ github.workspace }}/node_modules/playwright - key: playwright-${{ hashFiles('**/package-lock.json') }} - restore-keys: playwright- - - name: Install playwright - if: steps.cache-playwright.outputs.cache-hit != 'true' run: npx playwright install --with-deps shell: bash diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3a7afc44f..55ed7f27d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,14 +41,6 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - - name: Cache Docker layers - uses: actions/cache@v4 - with: - path: /tmp/.buildx-cache - key: ${{ runner.os }}-buildx-${{ github.sha }} - restore-keys: | - ${{ runner.os }}-buildx- - - name: Build Docker Image uses: docker/build-push-action@v5 with: @@ -56,13 +48,3 @@ jobs: context: . file: ./docker/Dockerfile tags: documenso-${{ github.sha }} - cache-from: type=local,src=/tmp/.buildx-cache - cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max - - - # Temp fix - # https://github.com/docker/build-push-action/issues/252 - # https://github.com/moby/buildkit/issues/1896 - name: Move cache - run: | - rm -rf /tmp/.buildx-cache - mv /tmp/.buildx-cache-new /tmp/.buildx-cache diff --git a/.github/workflows/issue-assignee-check.yml b/.github/workflows/issue-assignee-check.yml index b601a8dc3..de53564ec 100644 --- a/.github/workflows/issue-assignee-check.yml +++ b/.github/workflows/issue-assignee-check.yml @@ -20,7 +20,6 @@ jobs: uses: actions/setup-node@v4 with: node-version: '18' - cache: npm - name: Install Octokit run: npm install @octokit/rest@18 diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml index 1a5afd359..15fe7cbfa 100644 --- a/.github/workflows/pr-labeler.yml +++ b/.github/workflows/pr-labeler.yml @@ -1,7 +1,7 @@ name: 'PR Labeler' on: - - pull_request_target + - pull_request concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} diff --git a/.github/workflows/pr-review-reminder.yml b/.github/workflows/pr-review-reminder.yml index c81d9a34e..67dc32f34 100644 --- a/.github/workflows/pr-review-reminder.yml +++ b/.github/workflows/pr-review-reminder.yml @@ -20,7 +20,6 @@ jobs: uses: actions/setup-node@v4 with: node-version: '18' - cache: npm - name: Install Octokit run: npm install @octokit/rest@18 diff --git a/.github/workflows/semantic-pull-requests.yml b/.github/workflows/semantic-pull-requests.yml index 37b764652..76a1b2f42 100644 --- a/.github/workflows/semantic-pull-requests.yml +++ b/.github/workflows/semantic-pull-requests.yml @@ -1,7 +1,7 @@ name: 'Validate PR Name' on: - pull_request_target: + pull_request: types: - opened - reopened From bc184d445fc0f37bd717c09b6af8be317402e424 Mon Sep 17 00:00:00 2001 From: Lucas Smith Date: Wed, 13 May 2026 15:06:21 +1000 Subject: [PATCH 04/15] feat: support DOCX uploads via Gotenberg (#2801) Uploaded .docx files are converted to PDF on the server using a Gotenberg sidecar before entering the normal envelope pipeline. The feature is opt-in via NEXT_PRIVATE_DOCUMENT_CONVERSION_URL; when unset, only PDF uploads are accepted. A per-process circuit breaker opens for 30s after a conversion failure to shed load. Ships a dev Dockerfile that layers Microsoft Core Fonts and additional language fonts onto the upstream Gotenberg image for better fidelity. Co-authored-by: Ephraim Duncan <55143799+ephraimduncan@users.noreply.github.com> Co-authored-by: Ephraim Duncan <55143799+ephraimduncan@users.noreply.github.com> --- .env.example | 14 + .../configuration/advanced/ai-features.mdx | 2 +- .../advanced/document-conversion.mdx | 408 ++++++++++++++++++ .../configuration/advanced/index.mdx | 7 +- .../configuration/advanced/meta.json | 2 +- .../configuration/environment.mdx | 19 +- .../content/docs/users/documents/upload.mdx | 91 +++- .../document-upload-button-legacy.tsx | 9 + .../envelope/envelope-drop-zone-wrapper.tsx | 16 +- .../envelope/envelope-upload-button.tsx | 9 + docker/development/Dockerfile.gotenberg | 36 ++ docker/development/compose.yml | 46 ++ packages/lib/constants/document-conversion.ts | 90 ++++ .../document-conversion/circuit-breaker.ts | 37 ++ .../document-conversion/docx-to-pdf.ts | 92 ++++ .../document-conversion/gotenberg.ts | 135 ++++++ .../server-only/document-conversion/index.ts | 43 ++ packages/lib/utils/env.ts | 10 +- .../server/document-router/create-document.ts | 3 +- .../create-embedding-envelope.ts | 1 + .../server/envelope-router/create-envelope.ts | 21 +- packages/ui/primitives/document-dropzone.tsx | 7 +- .../ui/primitives/document-upload-button.tsx | 5 +- 23 files changed, 1062 insertions(+), 41 deletions(-) create mode 100644 apps/docs/content/docs/self-hosting/configuration/advanced/document-conversion.mdx create mode 100644 docker/development/Dockerfile.gotenberg create mode 100644 packages/lib/constants/document-conversion.ts create mode 100644 packages/lib/server-only/document-conversion/circuit-breaker.ts create mode 100644 packages/lib/server-only/document-conversion/docx-to-pdf.ts create mode 100644 packages/lib/server-only/document-conversion/gotenberg.ts create mode 100644 packages/lib/server-only/document-conversion/index.ts diff --git a/.env.example b/.env.example index a8cab596e..f723e1c66 100644 --- a/.env.example +++ b/.env.example @@ -211,3 +211,17 @@ NEXT_PRIVATE_LOGGER_FILE_PATH= # [[PLAIN SUPPORT]] NEXT_PRIVATE_PLAIN_API_KEY= + +# [[DOCUMENT CONVERSION]] +# OPTIONAL: Base URL of a Gotenberg-compatible service used to convert uploaded +# DOCX files to PDF on the server. When unset, DOCX uploads are disabled and +# only PDF is accepted. The dev docker compose exposes Gotenberg on port 3005. +# NEXT_PRIVATE_DOCUMENT_CONVERSION_URL="http://localhost:3005" +# OPTIONAL: Per-request timeout in milliseconds for the conversion service. +# Defaults to 30000 (30s) if unset. +# NEXT_PRIVATE_DOCUMENT_CONVERSION_TIMEOUT_MS=30000 +# OPTIONAL: HTTP Basic auth credentials for the conversion service. Set both +# when the service is started with `--api-enable-basic-auth` (the dev compose +# does this; the matching values there are `documenso` / `password`). +# NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME=documenso +# NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD=password diff --git a/apps/docs/content/docs/self-hosting/configuration/advanced/ai-features.mdx b/apps/docs/content/docs/self-hosting/configuration/advanced/ai-features.mdx index d2979910b..b1dfa709e 100644 --- a/apps/docs/content/docs/self-hosting/configuration/advanced/ai-features.mdx +++ b/apps/docs/content/docs/self-hosting/configuration/advanced/ai-features.mdx @@ -1,5 +1,5 @@ --- -title: AI Recipient & Field Detection (Self-hosting) +title: AI Recipient & Field Detection description: Configure Google Vertex AI so Documenso can detect recipients and fields automatically. --- diff --git a/apps/docs/content/docs/self-hosting/configuration/advanced/document-conversion.mdx b/apps/docs/content/docs/self-hosting/configuration/advanced/document-conversion.mdx new file mode 100644 index 000000000..004025af0 --- /dev/null +++ b/apps/docs/content/docs/self-hosting/configuration/advanced/document-conversion.mdx @@ -0,0 +1,408 @@ +--- +title: Document Conversion +description: Enable DOCX uploads on a self-hosted Documenso instance by running a Gotenberg sidecar that converts Word documents to PDF. +--- + +import { Accordion, Accordions } from 'fumadocs-ui/components/accordion'; +import { Callout } from 'fumadocs-ui/components/callout'; +import { Step, Steps } from 'fumadocs-ui/components/steps'; +import { Tab, Tabs } from 'fumadocs-ui/components/tabs'; + +## Overview + +Documenso can accept `.docx` uploads in addition to PDFs. When a user uploads a Word document, the Documenso server sends it to a [Gotenberg](https://gotenberg.dev) service which uses LibreOffice to convert it to PDF. The converted PDF is what gets stored, signed, and downloaded. The original DOCX is discarded. + +This feature is **opt-in for self-hosted instances**. When the conversion service is not configured, DOCX uploads are rejected in the UI and only PDFs are accepted. + +| Property | Value | +| ----------------------- | -------------------------------------------------------------------- | +| Conversion engine | [Gotenberg](https://gotenberg.dev) + LibreOffice | +| Input format | `.docx` (Office Open XML Word documents) | +| Output format | PDF | +| Network requirement | Documenso must reach the Gotenberg HTTP API | +| Default request timeout | 30 seconds per file | +| Failure handling | An internal circuit breaker opens for 30 seconds after a failure | + + + Only `.docx` is accepted. Legacy `.doc`, `.odt`, `.rtf`, and other LibreOffice-supported formats + are rejected at the upload step even when Gotenberg is configured. + + +--- + +## Requirements + +- A running Gotenberg 8 instance with the LibreOffice module (`gotenberg/gotenberg:8-libreoffice` or newer). +- Network reachability from the Documenso container to the Gotenberg HTTP API. +- A version of Documenso that includes the document conversion feature. + +## Build the Gotenberg Image + +The upstream `gotenberg/gotenberg:8-libreoffice` image works out of the box, but it ships only **metric-compatible font substitutes** (Carlito for Calibri, Liberation for Arial/Times/Courier). Layout widths are preserved but documents will look noticeably different from Word. + +For better fidelity, especially for non-Latin scripts, build a derived image that adds Microsoft Core Fonts and additional language fonts. The Documenso repository ships a reference Dockerfile at [`docker/development/Dockerfile.gotenberg`](https://github.com/documenso/documenso/blob/main/docker/development/Dockerfile.gotenberg) that you can use as a starting point: + +```dockerfile +FROM gotenberg/gotenberg:8-libreoffice + +USER root + +RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \ + > /etc/apt/sources.list.d/contrib.list \ + && echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \ + | debconf-set-selections \ + && apt-get update -qq \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \ + ca-certificates \ + ttf-mscorefonts-installer \ + fonts-symbola \ + fonts-noto-extra \ + fonts-hosny-amiri \ + fonts-thai-tlwg \ + fonts-sil-padauk \ + fonts-sarai \ + fonts-samyak-taml \ + culmus \ + libfribidi0 \ + libharfbuzz0b \ + && fc-cache -f \ + && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* + +USER gotenberg +``` + + + `ttf-mscorefonts-installer` accepts the Microsoft Core Fonts EULA on your behalf via debconf. By + installing this image you are agreeing to those licence terms. Review them before publishing the + image. + + +Build and publish the image to a registry you control: + +```bash +docker build -t registry.example.com/documenso/gotenberg:8 \ + -f Dockerfile.gotenberg . +docker push registry.example.com/documenso/gotenberg:8 +``` + +If you do not need extra fonts, skip the build step entirely and reference `gotenberg/gotenberg:8-libreoffice` directly in the next section. + +## Deploy the Service + +The Gotenberg service should run **alongside** your Documenso container, not exposed to the public internet. The conversion service has no built-in authorisation beyond HTTP Basic auth, so it should sit on a private network or behind your existing reverse proxy. + + + + +Add a `gotenberg` service to the `compose.yml` you use for Documenso: + +```yaml +services: + gotenberg: + image: registry.example.com/documenso/gotenberg:8 + # Or use upstream directly: + # image: gotenberg/gotenberg:8-libreoffice + restart: unless-stopped + environment: + GOTENBERG_API_BASIC_AUTH_USERNAME: ${GOTENBERG_USERNAME} + GOTENBERG_API_BASIC_AUTH_PASSWORD: ${GOTENBERG_PASSWORD} + command: + - gotenberg + - --api-enable-basic-auth + - --libreoffice-deny-private-ips + - --api-timeout=500s + - --libreoffice-auto-start + - --libreoffice-start-timeout=300s + - --pdfengines-disable-routes + - --webhook-disable + healthcheck: + test: ['CMD', 'curl', '-fsS', 'http://localhost:3000/health'] + interval: 10s + timeout: 5s + retries: 5 + start_period: 20s + + documenso: + # existing config + environment: + NEXT_PRIVATE_DOCUMENT_CONVERSION_URL: http://gotenberg:3000 + NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME: ${GOTENBERG_USERNAME} + NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD: ${GOTENBERG_PASSWORD} + depends_on: + gotenberg: + condition: service_healthy +``` + +Do **not** publish Gotenberg's port (`3000`) to the host. Documenso reaches it over the internal Docker network using the service name (`http://gotenberg:3000`). + + + + +Create a Deployment, Service, and Secret. Example manifests: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: gotenberg-auth + namespace: documenso +stringData: + username: documenso + password: replace-me-with-a-strong-password +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: gotenberg + namespace: documenso +spec: + replicas: 1 + selector: + matchLabels: { app: gotenberg } + template: + metadata: + labels: { app: gotenberg } + spec: + containers: + - name: gotenberg + image: registry.example.com/documenso/gotenberg:8 + args: + - gotenberg + - --api-enable-basic-auth + - --libreoffice-deny-private-ips + - --api-timeout=500s + - --libreoffice-auto-start + - --libreoffice-start-timeout=300s + - --pdfengines-disable-routes + - --webhook-disable + env: + - name: GOTENBERG_API_BASIC_AUTH_USERNAME + valueFrom: { secretKeyRef: { name: gotenberg-auth, key: username } } + - name: GOTENBERG_API_BASIC_AUTH_PASSWORD + valueFrom: { secretKeyRef: { name: gotenberg-auth, key: password } } + ports: + - containerPort: 3000 + readinessProbe: + httpGet: { path: /health, port: 3000 } + livenessProbe: + httpGet: { path: /health, port: 3000 } + initialDelaySeconds: 30 +--- +apiVersion: v1 +kind: Service +metadata: + name: gotenberg + namespace: documenso +spec: + selector: { app: gotenberg } + ports: + - port: 3000 + targetPort: 3000 +``` + +Then reference the in-cluster URL from Documenso's environment: + +``` +NEXT_PRIVATE_DOCUMENT_CONVERSION_URL=http://gotenberg.documenso.svc.cluster.local:3000 +NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME=documenso +NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD=replace-me-with-a-strong-password +``` + + + + +Documenso does not have to colocate with Gotenberg. You can point it at any reachable Gotenberg deployment: a managed instance, a shared internal service, or a Gotenberg-compatible API. + +```bash +NEXT_PRIVATE_DOCUMENT_CONVERSION_URL=https://gotenberg.internal.example.com +NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME=documenso +NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD=replace-me-with-a-strong-password +``` + +The remote instance must: + +- Expose the LibreOffice route `/forms/libreoffice/convert`. +- Be reachable from the Documenso container with low enough latency that the 30 second per-request timeout is comfortable. +- Be on a private network or require authentication. Uploaded documents are sent to it as multipart form data and may contain sensitive content. + + + + +## Recommended Gotenberg Flags + +The flags in the examples above are not arbitrary. Each one matters for a production deployment. + +| Flag | Why it matters | +| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `--api-enable-basic-auth` | Requires HTTP Basic credentials on every API route. Without this, anyone with network access to the container can convert arbitrary documents. | +| `--libreoffice-deny-private-ips` | Rejects any outbound fetch LibreOffice tries to make to private, loopback, link-local, or cloud-metadata addresses while processing a document. Mitigates SSRF via malicious `.docx` files that embed `TargetMode="External"` references. Requires Gotenberg 8.32.0. | +| `--api-timeout=500s` | Server-side request ceiling. Documenso aborts at 30 s by default, so this is a safety net for very large documents. | +| `--libreoffice-auto-start` | Starts LibreOffice at container boot so the first request is not slow. | +| `--libreoffice-start-timeout=300s`| Allows LibreOffice up to 5 minutes to come up under load. | +| `--pdfengines-disable-routes` | Disables the PDF engines routes Documenso does not use. Shrinks the attack surface. | +| `--webhook-disable` | Disables webhook callbacks. Documenso uses synchronous requests only. | + +## Configure Documenso + +Set the following environment variables on the Documenso container and restart it. + +### Required + +| Variable | Description | +| ------------------------------------- | ---------------------------------------------------------------------- | +| `NEXT_PRIVATE_DOCUMENT_CONVERSION_URL`| Base URL of the Gotenberg service (e.g., `http://gotenberg:3000`). Leave unset to disable the feature. | + +### Optional + +| Variable | Default | Description | +| ------------------------------------------- | ------- | -------------------------------------------------------------------------------------------- | +| `NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME` | | HTTP Basic auth username. Set when Gotenberg runs with `--api-enable-basic-auth`. | +| `NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD` | | HTTP Basic auth password. Set together with the username. | +| `NEXT_PRIVATE_DOCUMENT_CONVERSION_TIMEOUT_MS`| `30000` | Per-request timeout in milliseconds. Increase for very large documents. | + + + When `NEXT_PRIVATE_DOCUMENT_CONVERSION_URL` is set, the public flag + `NEXT_PUBLIC_DOCUMENT_CONVERSION_ENABLED` is derived automatically on server start. You do not + need to set it yourself, and setting it manually has no effect. + + +### Example `.env` Snippet + +```bash +# Document conversion (DOCX -> PDF) +NEXT_PRIVATE_DOCUMENT_CONVERSION_URL=http://gotenberg:3000 +NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME=documenso +NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD=replace-me-with-a-strong-password +# NEXT_PRIVATE_DOCUMENT_CONVERSION_TIMEOUT_MS=60000 +``` + +## Verify the Setup + +{/* prettier-ignore */} + + +### Restart the Documenso container + +Restart so the new environment variables are picked up. + + + +### Confirm Gotenberg is healthy + +From a shell inside the Documenso container or another container on the same network: + +```bash +curl -fsS http://gotenberg:3000/health +``` + +The endpoint is exempt from basic auth and should return `200 OK`. + + + +### Upload a test DOCX + +In the Documenso web UI, open **Documents** and try uploading a small `.docx` file. The upload dropzone should accept it, and after a few seconds the editor should open with the converted PDF. + + + +### Check the server logs + +Successful conversions log a `document_conversion_attempt` event with `result: "success"`, the duration, and the file size. Failures log the same event with `result: "error"` and an error code (`CONVERSION_SERVICE_UNAVAILABLE`, `CONVERSION_FAILED`, or `UNSUPPORTED_FILE_TYPE`). + + + + +## Security Considerations + +- **Treat the conversion service as untrusted internal infrastructure.** Documents pass through Gotenberg in plain form. Run it on a private network and require HTTP Basic auth. +- **Run with `--libreoffice-deny-private-ips`.** Without this flag, a malicious `.docx` can trigger LibreOffice to fetch URLs from your internal network (SSRF). +- **Disable unused routes.** `--pdfengines-disable-routes` and `--webhook-disable` reduce attack surface. Documenso only uses the LibreOffice convert route. +- **Do not expose Gotenberg to the public internet.** Even with basic auth, this is a document-processing service with a non-trivial CPU and memory footprint; exposing it invites abuse. +- **Rotate credentials.** Rotating the basic auth secret is a config change in both Gotenberg and Documenso, followed by a restart of each. + +## Resource Sizing + +Conversion is CPU- and memory-bound on LibreOffice. As a starting point: + +| Workload | Suggested resources | +| ----------------------------- | ------------------------------------ | +| Light (a few DOCX per minute) | 1 vCPU, 1 GB RAM | +| Moderate (sustained uploads) | 2 vCPU, 2 GB RAM | +| Heavy / multi-tenant | Horizontally scale Gotenberg replicas behind a load balancer | + +Gotenberg is stateless. Each container handles one or more concurrent requests independently. Scale horizontally rather than vertically once a single replica is saturated. + +## Troubleshooting + + + + The Documenso server does not see `NEXT_PRIVATE_DOCUMENT_CONVERSION_URL`. Check the value is set + on the running container (`docker exec documenso printenv | grep DOCUMENT_CONVERSION`) and + restart after changing it. + + + + Documenso could not reach Gotenberg. Verify: + + - The URL in `NEXT_PRIVATE_DOCUMENT_CONVERSION_URL` is resolvable from the Documenso container + (use the Docker service name or in-cluster DNS, not `localhost`). + - Gotenberg's `/health` endpoint returns `200`. + - Basic auth credentials match between the two services. + + After repeated failures, an internal circuit breaker opens for 30 seconds. Subsequent uploads + will fail fast during that window; this is intentional and self-recovers. + + + + + Gotenberg was reachable but returned a non-2xx response. Check the Gotenberg container logs: + + ```bash + docker compose logs -f gotenberg + ``` + + Common causes: corrupted `.docx` file, exotic embedded objects LibreOffice cannot render, or a + file that genuinely exceeded the conversion timeout. Increase + `NEXT_PRIVATE_DOCUMENT_CONVERSION_TIMEOUT_MS` for very large documents. + + + + + LibreOffice is not byte-identical to Microsoft Word. Layout, font metrics, and complex elements + (Charts, SmartArt, ActiveX controls) may differ. To improve fidelity: + + - Use the custom Dockerfile in this guide to install Microsoft Core Fonts and additional + language fonts. + - Make sure any custom fonts referenced by your documents are installed in the Gotenberg image. + - For pixel-perfect output, ask users to export to PDF from Word before uploading. + + + + + Documenso disables Gotenberg's `exportFormFields` flag during conversion. Word content controls + (``) become static graphics in the output PDF, which prevents Documenso's later + flattening step from making them invisible. This is intentional. Use Documenso fields + (signature, text, date, etc.) for anything that needs to be filled in by signers. + + + + LibreOffice starts lazily by default. Pass `--libreoffice-auto-start` to Gotenberg so it warms + up at container boot. Allow up to a minute on first start before considering the service + unhealthy. + + + + Repeated failures open an in-process circuit breaker for 30 seconds. If you see this in + production, the underlying problem is the Gotenberg service. Check its logs, resource usage, + and connectivity. The breaker is per-process and resets on restart. + + + +--- + +## See Also + +- [Upload Documents (User Guide)](/docs/users/documents/upload) - End-user view of DOCX uploads +- [Environment Variables](/docs/self-hosting/configuration/environment) - Full configuration reference +- [Docker Compose Deployment](/docs/self-hosting/deployment/docker-compose) - Compose-based deployment patterns +- [Gotenberg Documentation](https://gotenberg.dev/docs/getting-started/introduction) - Upstream Gotenberg docs diff --git a/apps/docs/content/docs/self-hosting/configuration/advanced/index.mdx b/apps/docs/content/docs/self-hosting/configuration/advanced/index.mdx index e00698d9d..0abf9d293 100644 --- a/apps/docs/content/docs/self-hosting/configuration/advanced/index.mdx +++ b/apps/docs/content/docs/self-hosting/configuration/advanced/index.mdx @@ -1,6 +1,6 @@ --- title: Advanced -description: Optional configuration for OAuth providers, AI features, and other advanced settings. +description: Optional configuration for OAuth providers, AI features, document conversion, and other advanced settings. --- @@ -14,4 +14,9 @@ description: Optional configuration for OAuth providers, AI features, and other description="Enable AI-powered recipient and field detection." href="/docs/self-hosting/configuration/advanced/ai-features" /> + diff --git a/apps/docs/content/docs/self-hosting/configuration/advanced/meta.json b/apps/docs/content/docs/self-hosting/configuration/advanced/meta.json index 5278c14a3..8b61e1758 100644 --- a/apps/docs/content/docs/self-hosting/configuration/advanced/meta.json +++ b/apps/docs/content/docs/self-hosting/configuration/advanced/meta.json @@ -1,4 +1,4 @@ { "title": "Advanced", - "pages": ["oauth-providers", "ai-features"] + "pages": ["oauth-providers", "document-conversion", "ai-features"] } diff --git a/apps/docs/content/docs/self-hosting/configuration/environment.mdx b/apps/docs/content/docs/self-hosting/configuration/environment.mdx index 699e54ede..74ca8ccc9 100644 --- a/apps/docs/content/docs/self-hosting/configuration/environment.mdx +++ b/apps/docs/content/docs/self-hosting/configuration/environment.mdx @@ -244,7 +244,7 @@ You can control who is allowed to create accounts on your instance with the foll - **`NEXT_PUBLIC_DISABLE_GOOGLE_SIGNUP`**, **`NEXT_PUBLIC_DISABLE_MICROSOFT_SIGNUP`**, **`NEXT_PUBLIC_DISABLE_OIDC_SIGNUP`**: Set to `true` to block brand-new account creation through the matching SSO provider. Existing users with the provider already linked can still sign in, and existing users can still link the provider to their account. `NEXT_PUBLIC_DISABLE_OIDC_SIGNUP` also blocks new-account creation through the organisation authentication portal. - **`NEXT_PRIVATE_ALLOWED_SIGNUP_DOMAINS`**: Restrict signups to specific email domains. When set, only users whose email address matches one of the listed domains can create an account. Leave empty to allow all domains. -Sign-in for existing users is never affected — only the creation of brand-new accounts. +Sign-in for existing users is never affected, only the creation of brand-new accounts. Both the master switch and the domain allowlist apply to email/password registration and OAuth (Google, Microsoft, OIDC). If a user attempts to sign up via OAuth with a disallowed domain, they are redirected to the sign-in page with an error. @@ -279,6 +279,23 @@ AI features must also be enabled in organisation/team settings after configurati --- +## Document Conversion + +Documenso can accept `.docx` uploads by sending them to a [Gotenberg](https://gotenberg.dev) service that converts them to PDF. When `NEXT_PRIVATE_DOCUMENT_CONVERSION_URL` is unset, DOCX uploads are rejected and only PDFs are accepted. + +| Variable | Description | Default | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------- | ------- | +| `NEXT_PRIVATE_DOCUMENT_CONVERSION_URL` | Base URL of the Gotenberg service (e.g., `http://gotenberg:3000`). Unset disables the feature. | | +| `NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME` | HTTP Basic auth username. Required when Gotenberg runs with `--api-enable-basic-auth`. | | +| `NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD` | HTTP Basic auth password. Set together with the username. | | +| `NEXT_PRIVATE_DOCUMENT_CONVERSION_TIMEOUT_MS` | Per-request timeout in milliseconds. Increase for very large documents. | `30000` | + +The public flag `NEXT_PUBLIC_DOCUMENT_CONVERSION_ENABLED` is derived automatically from `NEXT_PRIVATE_DOCUMENT_CONVERSION_URL` on server start. Do not set it manually. + +For setup, image-build instructions, and security recommendations, see [Document Conversion](/docs/self-hosting/configuration/advanced/document-conversion). + +--- + ## Background Jobs Documenso supports multiple background job providers for processing emails, documents, webhooks, and scheduled tasks. diff --git a/apps/docs/content/docs/users/documents/upload.mdx b/apps/docs/content/docs/users/documents/upload.mdx index bf5f863dd..cd79b7904 100644 --- a/apps/docs/content/docs/users/documents/upload.mdx +++ b/apps/docs/content/docs/users/documents/upload.mdx @@ -11,16 +11,41 @@ import { Step, Steps } from 'fumadocs-ui/components/steps'; | Limitation | Value | | ----------------------- | ----------------------------------- | -| Supported format | PDF only | +| Supported formats | PDF, DOCX | | Maximum file size | 50MB (configurable for self-hosted) | | Encrypted PDFs | Not supported | | Password-protected PDFs | Not supported | +| Legacy `.doc` files | Not supported (convert to DOCX) | Documenso does not support password-protected or encrypted PDF files. Remove encryption before uploading. +## Supported Formats + +Documenso accepts two file formats: + +- **PDF** (`.pdf`): used as-is. **Recommended.** +- **Word** (`.docx`): converted to PDF on the server during upload. The converted PDF is what recipients sign. + +Other formats (`.doc`, `.odt`, `.rtf`, images) are not supported. Convert them to PDF or DOCX before uploading. + + + **Upload a PDF whenever you can.** DOCX files are converted to PDF using LibreOffice, which is not + byte-identical to Microsoft Word. Spacing, line breaks, fonts, and complex elements (tables, + charts, headers, footers) can shift in the converted PDF. For the final document to look exactly + the way you designed it, export to PDF from Word, Google Docs, or Pages and upload the PDF + directly. + + + + DOCX support requires the document conversion service. It is enabled on + [documenso.com](https://app.documenso.com). Self-hosted instances must + [configure it](/docs/self-hosting/configuration/advanced/document-conversion) before DOCX uploads + are accepted. + + ## Upload Methods ![Documents dashboard](/document-signing/documenso-documents-dashboard.webp) @@ -38,15 +63,15 @@ You can upload documents in two ways: - ### Drag and drop your PDF + ### Drag and drop your file - Drag a PDF file from your computer and drop it anywhere on the page. + Drag a PDF or DOCX file from your computer and drop it anywhere on the page. ### Wait for the upload to complete - The document will process and the editor will open when ready. + The document will process and the editor will open when ready. DOCX files take a few extra seconds while they are converted to PDF. @@ -70,7 +95,7 @@ You can upload documents in two ways: ### Select your file - Choose a PDF file from your computer. + Choose a PDF or DOCX file from your computer. @@ -81,16 +106,32 @@ You can upload documents in two ways: +## DOCX Conversion + +We always recommend uploading a PDF rather than a DOCX. If you have the original document open in Word, Google Docs, or Pages, export to PDF from there and upload the PDF. The result is guaranteed to match what you see on screen. + +If you do upload a `.docx` file, Documenso converts it to PDF before adding it to the envelope. The original `.docx` is discarded. Only the converted PDF is stored, signed, and downloaded. + +Things to keep in mind when uploading DOCX: + +- **The converted PDF will not be pixel-identical to your Word document.** Conversion uses LibreOffice, which renders most documents faithfully but differs from Microsoft Word in subtle ways. Spacing, font metrics, line breaks, and complex layout features can shift. +- **Always review the converted PDF before adding fields or sending.** Open the document in the editor and scroll through every page to confirm it looks the way you expect. +- **Form controls are flattened.** Word content controls (drop-downs, date pickers, checkboxes) become static text or graphics. Use Documenso fields for anything that needs to be filled in. +- **Fonts not installed on the server fall back to substitutes.** On documenso.com, common fonts (Calibri, Arial, Times New Roman, etc.) are installed. On self-hosted instances, font fidelity depends on the operator's setup. +- **Tracked changes and comments are preserved as they appear in Word.** Accept or reject changes and remove comments before uploading if you do not want them in the final document. + +If the converted PDF does not match what you expect, export the document to PDF from Word, Google Docs, or another tool and upload the PDF directly. + ## Uploading Multiple Documents -You can upload multiple PDF files at once to create a single envelope containing multiple documents. The number of files you can upload per envelope depends on your plan. +You can upload multiple files at once to create a single envelope containing multiple documents. The number of files you can upload per envelope depends on your plan. To upload multiple files: -- Select multiple PDF files when using the file picker, or -- Drag and drop multiple PDF files at once +- Select multiple PDF or DOCX files when using the file picker, or +- Drag and drop multiple files at once -All files in the same upload become part of the same envelope and share the same recipients and signing workflow. +You can mix PDF and DOCX files in the same upload. All files become part of the same envelope and share the same recipients and signing workflow. If you need separate signing workflows for each document, upload them individually. @@ -114,15 +155,37 @@ The document remains in `Draft` status until you send it. You can close the edit Reduce the file size before uploading: - - Compress images within the PDF + - Compress images within the document - Remove unnecessary pages - - Use a PDF compression tool + - Use a PDF compression tool (for PDFs) or save with images downsampled (for DOCX) - - Convert your document to PDF before uploading. Most applications (Word, Google Docs, etc.) can - export to PDF format. + + Documenso accepts PDF and DOCX. For other formats (`.doc`, `.odt`, `.rtf`, etc.), export to PDF + from your editor (Word, Google Docs, Pages) and upload the PDF. + +If you are self-hosted and DOCX is rejected, the [document conversion +service](/docs/self-hosting/configuration/advanced/document-conversion) is not configured on your +instance. + + + + + The document conversion service was reachable but could not convert the file. Common causes: + +- The `.docx` file is corrupted. Open it in Word, save a new copy, and try again. +- The file uses very unusual fonts or embedded objects that LibreOffice cannot render. +- The file is unusually large or complex and exceeded the conversion timeout. + +If the problem persists, export the document to PDF from Word and upload the PDF directly. + + + + + The document conversion service is down or temporarily unreachable. Try again in a minute. If you + self-host, check the [document conversion + service](/docs/self-hosting/configuration/advanced/document-conversion) logs. diff --git a/apps/remix/app/components/general/document/document-upload-button-legacy.tsx b/apps/remix/app/components/general/document/document-upload-button-legacy.tsx index 443e901be..225e13cd0 100644 --- a/apps/remix/app/components/general/document/document-upload-button-legacy.tsx +++ b/apps/remix/app/components/general/document/document-upload-button-legacy.tsx @@ -140,6 +140,15 @@ export const DocumentUploadButtonLegacy = ({ className, type }: DocumentUploadBu 'ENVELOPE_ITEM_LIMIT_EXCEEDED', () => msg`You have reached the limit of the number of files per envelope.`, ) + .with('UNSUPPORTED_FILE_TYPE', () => msg`This file type isn't supported. Please upload a PDF or Word document.`) + .with( + 'CONVERSION_SERVICE_UNAVAILABLE', + () => msg`Document conversion is temporarily unavailable. Please try again shortly or upload a PDF.`, + ) + .with( + 'CONVERSION_FAILED', + () => msg`We couldn't convert this file. Please check it's a valid Word document or upload a PDF instead.`, + ) .otherwise(() => msg`An error occurred while uploading your document.`); toast({ diff --git a/apps/remix/app/components/general/envelope/envelope-drop-zone-wrapper.tsx b/apps/remix/app/components/general/envelope/envelope-drop-zone-wrapper.tsx index 01703dc3d..94056ba9c 100644 --- a/apps/remix/app/components/general/envelope/envelope-drop-zone-wrapper.tsx +++ b/apps/remix/app/components/general/envelope/envelope-drop-zone-wrapper.tsx @@ -3,6 +3,7 @@ import { useAnalytics } from '@documenso/lib/client-only/hooks/use-analytics'; import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation'; import { useSession } from '@documenso/lib/client-only/providers/session'; import { APP_DOCUMENT_UPLOAD_SIZE_LIMIT, IS_BILLING_ENABLED } from '@documenso/lib/constants/app'; +import { getAllowedUploadMimeTypes } from '@documenso/lib/constants/document-conversion'; import { DEFAULT_DOCUMENT_TIME_ZONE, TIME_ZONES } from '@documenso/lib/constants/time-zones'; import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error'; import { megabytesToBytes } from '@documenso/lib/universal/unit-convertions'; @@ -115,6 +116,15 @@ export const EnvelopeDropZoneWrapper = ({ children, type, className }: EnvelopeD () => t`You have reached your document limit for this month. Please upgrade your plan.`, ) .with('ENVELOPE_ITEM_LIMIT_EXCEEDED', () => t`You have reached the limit of the number of files per envelope.`) + .with('UNSUPPORTED_FILE_TYPE', () => t`This file type isn't supported. Please upload a PDF or Word document.`) + .with( + 'CONVERSION_SERVICE_UNAVAILABLE', + () => t`Document conversion is temporarily unavailable. Please try again shortly or upload a PDF.`, + ) + .with( + 'CONVERSION_FAILED', + () => t`We couldn't convert this file. Please check it's a valid Word document or upload a PDF instead.`, + ) .otherwise(() => t`An error occurred during upload.`); toast({ @@ -158,9 +168,7 @@ export const EnvelopeDropZoneWrapper = ({ children, type, className }: EnvelopeD }); }; const { getRootProps, getInputProps, isDragActive } = useDropzone({ - accept: { - 'application/pdf': ['.pdf'], - }, + accept: getAllowedUploadMimeTypes(), multiple: true, maxSize: megabytesToBytes(APP_DOCUMENT_UPLOAD_SIZE_LIMIT), maxFiles: maximumEnvelopeItemCount, @@ -183,7 +191,7 @@ export const EnvelopeDropZoneWrapper = ({ children, type, className }: EnvelopeD

- Drag and drop your PDF file here + Drag and drop your document here

{isUploadDisabled && IS_BILLING_ENABLED() && ( diff --git a/apps/remix/app/components/general/envelope/envelope-upload-button.tsx b/apps/remix/app/components/general/envelope/envelope-upload-button.tsx index 8837cdcf4..3135fb3d3 100644 --- a/apps/remix/app/components/general/envelope/envelope-upload-button.tsx +++ b/apps/remix/app/components/general/envelope/envelope-upload-button.tsx @@ -119,6 +119,15 @@ export const EnvelopeUploadButton = ({ className, type, folderId }: EnvelopeUplo () => t`You have reached your document limit for this month. Please upgrade your plan.`, ) .with('ENVELOPE_ITEM_LIMIT_EXCEEDED', () => t`You have reached the limit of the number of files per envelope.`) + .with('UNSUPPORTED_FILE_TYPE', () => t`This file type isn't supported. Please upload a PDF or Word document.`) + .with( + 'CONVERSION_SERVICE_UNAVAILABLE', + () => t`Document conversion is temporarily unavailable. Please try again shortly or upload a PDF.`, + ) + .with( + 'CONVERSION_FAILED', + () => t`We couldn't convert this file. Please check it's a valid Word document or upload a PDF instead.`, + ) .otherwise(() => t`An error occurred while uploading your document.`); toast({ diff --git a/docker/development/Dockerfile.gotenberg b/docker/development/Dockerfile.gotenberg new file mode 100644 index 000000000..5bdad4acc --- /dev/null +++ b/docker/development/Dockerfile.gotenberg @@ -0,0 +1,36 @@ +FROM gotenberg/gotenberg:8-libreoffice + +# Install Microsoft Core Fonts (Arial, Times New Roman, Courier New, Verdana, +# Georgia, Comic Sans MS, Trebuchet MS, Impact, Andale Mono, Webdings) so that +# LibreOffice can render typical Word documents faithfully. The default image +# only ships metric-compatible substitutes (Carlito for Calibri, Liberation for +# Arial/Times/Courier) which preserve layout widths but look noticeably wrong. +# +# `ttf-mscorefonts-installer` lives in the non-free repo and requires accepting +# the Microsoft EULA, which we do non-interactively via debconf-set-selections. +USER root + +RUN echo "deb http://deb.debian.org/debian trixie contrib non-free" \ + > /etc/apt/sources.list.d/contrib.list \ + && echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \ + | debconf-set-selections \ + && apt-get update -qq \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \ + ca-certificates \ + wget \ + unzip \ + culmus \ + ttf-mscorefonts-installer \ + fonts-symbola \ + fonts-noto-extra \ + fonts-hosny-amiri \ + fonts-thai-tlwg \ + fonts-sil-padauk \ + fonts-sarai \ + fonts-samyak-taml \ + libfribidi0 \ + libharfbuzz0b \ + && fc-cache -f \ + && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* + +USER gotenberg diff --git a/docker/development/compose.yml b/docker/development/compose.yml index 2b7626e5c..b694e0bf2 100644 --- a/docker/development/compose.yml +++ b/docker/development/compose.yml @@ -48,6 +48,52 @@ services: entrypoint: sh command: -c 'mkdir -p /data/documenso && minio server /data --console-address ":9001" --address ":9002"' + gotenberg: + build: + context: . + dockerfile: Dockerfile.gotenberg + image: documenso-dev-gotenberg:latest + container_name: gotenberg + restart: unless-stopped + ports: + - 3005:3000 + environment: + # Basic auth credentials Gotenberg checks when `--api-enable-basic-auth` + # is passed. Dev defaults are non-secret — match + # `NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME` / `_PASSWORD` in `.env`. + GOTENBERG_API_BASIC_AUTH_USERNAME: documenso + GOTENBERG_API_BASIC_AUTH_PASSWORD: password + command: + - gotenberg + # Require basic auth on every API route — prevents anyone with network + # access to the container from invoking conversions. + - --api-enable-basic-auth + # SSRF defence in depth: reject any outbound fetch LibreOffice tries to + # make to a private/loopback/link-local/cloud-metadata address while + # processing an uploaded document. Mitigates CVE-2026-42591 (malicious + # docx files embedding `TargetMode="External"` references to internal + # services). Added in Gotenberg 8.32.0. + - --libreoffice-deny-private-ips + # Generous server-side timeout; the Node client aborts at 30 s by + # default, so this is just a safety net. + - --api-timeout=500s + # Pre-warm LibreOffice at boot so the first request isn't cold. + - --libreoffice-auto-start + - --libreoffice-start-timeout=300s + # Disable surfaces we don't use to shrink the attack surface. + - --pdfengines-disable-routes + - --webhook-disable + # Verbose logs for the dev compose only. + - --log-level=debug + healthcheck: + # `/health` is exempt from `--api-enable-basic-auth` so the check + # doesn't need to authenticate. + test: ['CMD', 'curl', '-fsS', 'http://localhost:3000/health'] + interval: 10s + timeout: 5s + retries: 5 + start_period: 20s + volumes: minio: redis: diff --git a/packages/lib/constants/document-conversion.ts b/packages/lib/constants/document-conversion.ts new file mode 100644 index 000000000..30b9a1894 --- /dev/null +++ b/packages/lib/constants/document-conversion.ts @@ -0,0 +1,90 @@ +import { env } from '@documenso/lib/utils/env'; + +export const DOCUMENT_CONVERSION_MIME_TYPE_DOCX = + 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'; + +const DEFAULT_DOCUMENT_CONVERSION_TIMEOUT_MS = 30_000; + +/** + * Returns whether the document conversion feature is enabled. + * + * Platform-aware: + * - On the server, checks the private URL is configured. + * - On the client, reads the derived public flag injected via `window.__ENV__`. + */ +export const IS_DOCUMENT_CONVERSION_ENABLED = (): boolean => { + if (typeof window === 'undefined') { + return !!env('NEXT_PRIVATE_DOCUMENT_CONVERSION_URL'); + } + + return env('NEXT_PUBLIC_DOCUMENT_CONVERSION_ENABLED') === 'true'; +}; + +/** + * Returns the configured conversion service base URL as supplied via env, or + * `undefined` if not configured. + * + * Server-side only. + */ +export const DOCUMENT_CONVERSION_URL = (): string | undefined => { + return env('NEXT_PRIVATE_DOCUMENT_CONVERSION_URL'); +}; + +/** + * Returns HTTP Basic auth credentials for the conversion service, or + * `undefined` if either env var is missing. When Gotenberg is started with + * `--api-enable-basic-auth`, every request must carry these credentials. + * + * Server-side only. + */ +export const DOCUMENT_CONVERSION_AUTH = (): { username: string; password: string } | undefined => { + const username = env('NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME'); + const password = env('NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD'); + + if (!username || !password) { + return undefined; + } + + return { username, password }; +}; + +/** + * Returns the per-request timeout for conversion calls in milliseconds. + * + * Falls back to a 30 second default when the env value is missing or + * unparseable. + */ +export const DOCUMENT_CONVERSION_TIMEOUT_MS = (): number => { + const raw = env('NEXT_PRIVATE_DOCUMENT_CONVERSION_TIMEOUT_MS'); + + if (!raw) { + return DEFAULT_DOCUMENT_CONVERSION_TIMEOUT_MS; + } + + const parsed = parseInt(raw, 10); + + if (Number.isNaN(parsed) || parsed <= 0) { + return DEFAULT_DOCUMENT_CONVERSION_TIMEOUT_MS; + } + + return parsed; +}; + +/** + * Returns the mime type -> extensions map that should be passed to the + * dropzone `accept` config and used for server-side validation. + * + * Always includes PDF; only includes DOCX when the conversion feature is + * enabled. + */ +export const getAllowedUploadMimeTypes = (): Record => { + const base: Record = { + 'application/pdf': ['.pdf'], + }; + + if (IS_DOCUMENT_CONVERSION_ENABLED()) { + base[DOCUMENT_CONVERSION_MIME_TYPE_DOCX] = ['.docx']; + } + + return base; +}; diff --git a/packages/lib/server-only/document-conversion/circuit-breaker.ts b/packages/lib/server-only/document-conversion/circuit-breaker.ts new file mode 100644 index 000000000..2c7a75570 --- /dev/null +++ b/packages/lib/server-only/document-conversion/circuit-breaker.ts @@ -0,0 +1,37 @@ +/** + * In-process circuit breaker for the document conversion service. + * + * Behaviour: any failure opens the circuit for `COOLDOWN_MS`. While open, + * callers should fail fast without hitting the network. The first request + * after the cooldown is allowed through and either closes the circuit (on + * success) or re-opens it for another cooldown window (on failure). + * + * State is stored on `globalThis` so it survives Vite/Remix HMR in dev and + * is unambiguously process-wide. This module is intentionally pure and + * synchronous: no I/O, no logger import — callers handle observability. + */ + +const COOLDOWN_MS = 30_000; + +declare global { + // eslint-disable-next-line no-var + var __documensoConversionCircuitOpenedAt: number | null | undefined; +} + +export const isCircuitOpen = (): boolean => { + const openedAt = globalThis.__documensoConversionCircuitOpenedAt; + + if (!openedAt) { + return false; + } + + return Date.now() - openedAt < COOLDOWN_MS; +}; + +export const recordSuccess = (): void => { + globalThis.__documensoConversionCircuitOpenedAt = null; +}; + +export const recordFailure = (): void => { + globalThis.__documensoConversionCircuitOpenedAt = Date.now(); +}; diff --git a/packages/lib/server-only/document-conversion/docx-to-pdf.ts b/packages/lib/server-only/document-conversion/docx-to-pdf.ts new file mode 100644 index 000000000..7fc514d3c --- /dev/null +++ b/packages/lib/server-only/document-conversion/docx-to-pdf.ts @@ -0,0 +1,92 @@ +import { AppError } from '@documenso/lib/errors/app-error'; +import type { Logger } from 'pino'; + +import { + DOCUMENT_CONVERSION_MIME_TYPE_DOCX, + IS_DOCUMENT_CONVERSION_ENABLED, +} from '../../constants/document-conversion'; +import { isCircuitOpen, recordFailure, recordSuccess } from './circuit-breaker'; +import { convertDocxToPdfViaGotenberg } from './gotenberg'; + +type ConvertDocxToPdfOptions = { + buffer: Buffer; + filename: string; +}; + +const NOT_CONFIGURED_USER_MESSAGE = "Document conversion isn't enabled on this instance. Please upload a PDF."; + +const UNAVAILABLE_USER_MESSAGE = + 'Document conversion is temporarily unavailable. Please try again shortly or upload a PDF.'; + +/** + * Converts a DOCX buffer to a PDF buffer via the configured Gotenberg + * conversion service. Guards on feature-enabled and circuit-open state, + * and emits a structured log line for each attempt. + */ +export const convertDocxToPdf = async ( + { buffer, filename }: ConvertDocxToPdfOptions, + logger?: Logger, +): Promise => { + if (!IS_DOCUMENT_CONVERSION_ENABLED()) { + throw new AppError('CONVERSION_SERVICE_UNAVAILABLE', { + message: 'Conversion service not configured', + userMessage: NOT_CONFIGURED_USER_MESSAGE, + statusCode: 503, + }); + } + + if (isCircuitOpen()) { + throw new AppError('CONVERSION_SERVICE_UNAVAILABLE', { + message: 'Conversion circuit is open; failing fast', + userMessage: UNAVAILABLE_USER_MESSAGE, + statusCode: 503, + }); + } + + const startedAt = Date.now(); + + try { + const outputBuffer = await convertDocxToPdfViaGotenberg({ buffer, filename }); + + recordSuccess(); + + logger?.info({ + event: 'document_conversion_attempt', + filename, + sourceMimeType: DOCUMENT_CONVERSION_MIME_TYPE_DOCX, + durationMs: Date.now() - startedAt, + inputBytes: buffer.byteLength, + outputBytes: outputBuffer.byteLength, + }); + + return outputBuffer; + } catch (err) { + recordFailure(); + + const errMessage = err instanceof Error ? err.message : String(err); + const errCode = err instanceof AppError ? err.code : 'UNKNOWN'; + + const logData = { + event: 'document_conversion_attempt', + filename, + sourceMimeType: DOCUMENT_CONVERSION_MIME_TYPE_DOCX, + durationMs: Date.now() - startedAt, + inputBytes: buffer.byteLength, + failed: true, + errorCode: errCode, + error: errMessage, + }; + + // A non-2xx from the conversion service surfaces as CONVERSION_FAILED. + // We log those at `error` level (status + truncated body live in the + // AppError message). All other failures stay at `info` to avoid noisy + // logs from transient network blips that the breaker already handles. + if (errCode === 'CONVERSION_FAILED') { + logger?.error(logData); + } else { + logger?.info(logData); + } + + throw err; + } +}; diff --git a/packages/lib/server-only/document-conversion/gotenberg.ts b/packages/lib/server-only/document-conversion/gotenberg.ts new file mode 100644 index 000000000..9adc9b27a --- /dev/null +++ b/packages/lib/server-only/document-conversion/gotenberg.ts @@ -0,0 +1,135 @@ +import { AppError } from '@documenso/lib/errors/app-error'; + +import { + DOCUMENT_CONVERSION_AUTH, + DOCUMENT_CONVERSION_MIME_TYPE_DOCX, + DOCUMENT_CONVERSION_TIMEOUT_MS, + DOCUMENT_CONVERSION_URL, +} from '../../constants/document-conversion'; + +type ConvertDocxToPdfViaGotenbergOptions = { + buffer: Buffer; + filename: string; +}; + +const UNAVAILABLE_USER_MESSAGE = + 'Document conversion is temporarily unavailable. Please try again shortly or upload a PDF.'; + +const NOT_CONFIGURED_USER_MESSAGE = "Document conversion isn't enabled on this instance. Please upload a PDF."; + +const CONVERSION_FAILED_USER_MESSAGE = + "We couldn't convert this file. Please check it's a valid Word document or upload a PDF instead."; + +const MAX_ERROR_BODY_CHARS = 500; + +/** + * Posts a DOCX file to the configured Gotenberg-compatible conversion + * service and returns the resulting PDF bytes. + * + * Throws an `AppError` for all failure modes: + * - `CONVERSION_SERVICE_UNAVAILABLE` for missing config, timeout, or + * network errors. + * - `CONVERSION_FAILED` for non-2xx responses from the service. + */ +export const convertDocxToPdfViaGotenberg = async ({ + buffer, + filename, +}: ConvertDocxToPdfViaGotenbergOptions): Promise => { + const url = DOCUMENT_CONVERSION_URL(); + + if (!url) { + throw new AppError('CONVERSION_SERVICE_UNAVAILABLE', { + message: 'Conversion service URL is not configured', + userMessage: NOT_CONFIGURED_USER_MESSAGE, + statusCode: 503, + }); + } + + const formData = new FormData(); + const blob = new Blob([buffer], { type: DOCUMENT_CONVERSION_MIME_TYPE_DOCX }); + + formData.append('files', blob, filename); + + // Tell LibreOffice NOT to export Word content controls (``) as PDF + // AcroForm fields. By default Gotenberg renders the field values into form + // appearance streams that reference unembedded base fonts (Times-Roman, + // Times-Bold). Our downstream `normalizePdf` flattens the form, but the + // pdf-lib flattening drops those appearance streams, so every SDT-bound + // string (i.e. virtually all of the body text in Office resume / cover- + // letter templates) ends up invisible in the final PDF. Disabling form + // export makes LibreOffice render those strings as regular text in the + // page content stream, with all glyphs embedded. + formData.append('exportFormFields', 'false'); + + // When the service is launched with `--api-enable-basic-auth`, every + // route (including `/health` and `/forms/libreoffice/convert`) requires + // HTTP Basic credentials. When auth env vars are not configured we send + // no header and rely on the service running without auth enabled. + const auth = DOCUMENT_CONVERSION_AUTH(); + const headers: Record = {}; + + if (auth) { + const encoded = Buffer.from(`${auth.username}:${auth.password}`).toString('base64'); + headers.Authorization = `Basic ${encoded}`; + } + + const controller = new AbortController(); + const timeoutHandle = setTimeout(() => controller.abort(), DOCUMENT_CONVERSION_TIMEOUT_MS()); + + const convertEndpoint = new URL('/forms/libreoffice/convert', url).toString(); + + try { + const response = await fetch(convertEndpoint, { + method: 'POST', + body: formData, + headers, + signal: controller.signal, + }); + + if (!response.ok) { + let body = ''; + + try { + body = await response.text(); + } catch { + body = ''; + } + + const truncatedBody = body.length > MAX_ERROR_BODY_CHARS ? `${body.slice(0, MAX_ERROR_BODY_CHARS)}...` : body; + + throw new AppError('CONVERSION_FAILED', { + message: `Conversion service returned ${response.status}: ${truncatedBody}`, + userMessage: CONVERSION_FAILED_USER_MESSAGE, + statusCode: 400, + }); + } + + const arrayBuffer = await response.arrayBuffer(); + + return Buffer.from(arrayBuffer); + } catch (err) { + if (err instanceof AppError) { + throw err; + } + + const isAbortError = err instanceof Error && err.name === 'AbortError'; + + if (isAbortError) { + throw new AppError('CONVERSION_SERVICE_UNAVAILABLE', { + message: 'Conversion service timed out', + userMessage: UNAVAILABLE_USER_MESSAGE, + statusCode: 503, + }); + } + + const errMessage = err instanceof Error ? err.message : String(err); + + throw new AppError('CONVERSION_SERVICE_UNAVAILABLE', { + message: `Conversion service request failed: ${errMessage}`, + userMessage: UNAVAILABLE_USER_MESSAGE, + statusCode: 503, + }); + } finally { + clearTimeout(timeoutHandle); + } +}; diff --git a/packages/lib/server-only/document-conversion/index.ts b/packages/lib/server-only/document-conversion/index.ts new file mode 100644 index 000000000..b99100556 --- /dev/null +++ b/packages/lib/server-only/document-conversion/index.ts @@ -0,0 +1,43 @@ +import { AppError } from '@documenso/lib/errors/app-error'; +import type { Logger } from 'pino'; + +import { DOCUMENT_CONVERSION_MIME_TYPE_DOCX } from '../../constants/document-conversion'; +import { convertDocxToPdf } from './docx-to-pdf'; + +// We should work on unifying these later on. +type FileInput = { + name: string; + type: string; + arrayBuffer: () => Promise; +}; + +const UNSUPPORTED_USER_MESSAGE = "This file type isn't supported. Please upload a PDF or Word document."; + +/** + * Entry point for upload routes. Returns a PDF buffer for any supported + * input file: + * + * - PDF in → PDF out (no conversion, no network call). + * - DOCX in → converted PDF out via the configured conversion service. + * - Any other mime type → throws `UNSUPPORTED_FILE_TYPE`. + * + * To support new source formats (PowerPoint, HTML, ...), add a new + * `-to-pdf.ts` sibling and dispatch to it from here. + */ +export const convertToPdf = async (file: FileInput, logger?: Logger): Promise => { + if (file.type === 'application/pdf') { + return Buffer.from(await file.arrayBuffer()); + } + + if (file.type === DOCUMENT_CONVERSION_MIME_TYPE_DOCX) { + const buffer = Buffer.from(await file.arrayBuffer()); + + return convertDocxToPdf({ buffer, filename: file.name }, logger); + } + + throw new AppError('UNSUPPORTED_FILE_TYPE', { + message: `Unsupported file type: ${file.type}`, + userMessage: UNSUPPORTED_USER_MESSAGE, + statusCode: 400, + }); +}; diff --git a/packages/lib/utils/env.ts b/packages/lib/utils/env.ts index 8e1dd669e..9df0a4ee2 100644 --- a/packages/lib/utils/env.ts +++ b/packages/lib/utils/env.ts @@ -20,5 +20,11 @@ export const env = (variable: K): EnvValue => { return (typeof process !== 'undefined' ? process?.env?.[variable] : undefined) as EnvValue; }; -export const createPublicEnv = () => - Object.fromEntries(Object.entries(process.env).filter(([key]) => key.startsWith('NEXT_PUBLIC_'))); +export const createPublicEnv = () => ({ + ...Object.fromEntries(Object.entries(process.env).filter(([key]) => key.startsWith('NEXT_PUBLIC_'))), + // Derived from the private URL so the public flag cannot drift from the + // real server-side configuration. Placed last so it wins over any literal + // env var with the same name. + // The `? 'true' : 'false'` might seem dumb but it's because we're expecting env var strings. + NEXT_PUBLIC_DOCUMENT_CONVERSION_ENABLED: process.env.NEXT_PRIVATE_DOCUMENT_CONVERSION_URL ? 'true' : 'false', +}); diff --git a/packages/trpc/server/document-router/create-document.ts b/packages/trpc/server/document-router/create-document.ts index 04dd9a22d..f2e84364e 100644 --- a/packages/trpc/server/document-router/create-document.ts +++ b/packages/trpc/server/document-router/create-document.ts @@ -1,5 +1,6 @@ import { getServerLimits } from '@documenso/ee/server-only/limits/server'; import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error'; +import { convertToPdf } from '@documenso/lib/server-only/document-conversion'; import { createEnvelope } from '@documenso/lib/server-only/envelope/create-envelope'; import { insertFormValuesInPdf } from '@documenso/lib/server-only/pdf/insert-form-values-in-pdf'; import { putNormalizedPdfFileServerSide } from '@documenso/lib/universal/upload/put-file.server'; @@ -35,7 +36,7 @@ export const createDocumentRoute = authenticatedProcedure attachments, } = payload; - let pdf = Buffer.from(await file.arrayBuffer()); + let pdf = await convertToPdf(file, ctx.logger); if (formValues) { // eslint-disable-next-line require-atomic-updates diff --git a/packages/trpc/server/embedding-router/create-embedding-envelope.ts b/packages/trpc/server/embedding-router/create-embedding-envelope.ts index b4ae1709f..5123f6f50 100644 --- a/packages/trpc/server/embedding-router/create-embedding-envelope.ts +++ b/packages/trpc/server/embedding-router/create-embedding-envelope.ts @@ -37,5 +37,6 @@ export const createEmbeddingEnvelopeRoute = procedure bypassDefaultRecipients: true, }, apiRequestMetadata: ctx.metadata, + logger: ctx.logger, }); }); diff --git a/packages/trpc/server/envelope-router/create-envelope.ts b/packages/trpc/server/envelope-router/create-envelope.ts index 87f5168e9..c721ad31e 100644 --- a/packages/trpc/server/envelope-router/create-envelope.ts +++ b/packages/trpc/server/envelope-router/create-envelope.ts @@ -1,11 +1,13 @@ import { getServerLimits } from '@documenso/ee/server-only/limits/server'; import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error'; +import { convertToPdf } from '@documenso/lib/server-only/document-conversion'; import { createEnvelope } from '@documenso/lib/server-only/envelope/create-envelope'; import { extractPdfPlaceholders } from '@documenso/lib/server-only/pdf/auto-place-fields'; import { normalizePdf } from '@documenso/lib/server-only/pdf/normalize-pdf'; import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata'; import { putPdfFileServerSide } from '@documenso/lib/universal/upload/put-file.server'; import { EnvelopeType } from '@prisma/client'; +import type { Logger } from 'pino'; import { insertFormValuesInPdf } from '../../../lib/server-only/pdf/insert-form-values-in-pdf'; import { authenticatedProcedure } from '../trpc'; @@ -32,6 +34,7 @@ export const createEnvelopeRoute = authenticatedProcedure teamId: ctx.teamId, input, apiRequestMetadata: ctx.metadata, + logger: ctx.logger, }); }); @@ -48,6 +51,12 @@ type CreateEnvelopeRouteOptions = { input: TCreateEnvelopeRequest; apiRequestMetadata: ApiRequestMetadata; + /** + * Optional pino logger threaded from the calling tRPC context. Passed to + * downstream helpers (e.g. `convertToPdf`) for structured logging. + */ + logger?: Logger; + options?: { bypassDefaultRecipients?: boolean; }; @@ -58,6 +67,7 @@ export const createEnvelopeRouteCaller = async ({ teamId, input, apiRequestMetadata, + logger, options = {}, }: CreateEnvelopeRouteOptions) => { const { payload, files } = input; @@ -96,17 +106,10 @@ export const createEnvelopeRouteCaller = async ({ }); } - if (files.some((file) => !file.type.startsWith('application/pdf'))) { - throw new AppError('INVALID_DOCUMENT_FILE', { - message: 'You cannot upload non-PDF files', - statusCode: 400, - }); - } - - // For each file: normalize, extract & clean placeholders, then upload. + // For each file: convert to PDF if needed, normalize, extract & clean placeholders, then upload. const envelopeItems = await Promise.all( files.map(async (file) => { - let pdf = Buffer.from(await file.arrayBuffer()); + let pdf = await convertToPdf(file, logger); if (formValues) { // eslint-disable-next-line require-atomic-updates diff --git a/packages/ui/primitives/document-dropzone.tsx b/packages/ui/primitives/document-dropzone.tsx index e9a111d0b..848751042 100644 --- a/packages/ui/primitives/document-dropzone.tsx +++ b/packages/ui/primitives/document-dropzone.tsx @@ -1,5 +1,6 @@ import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation'; import { APP_DOCUMENT_UPLOAD_SIZE_LIMIT, IS_BILLING_ENABLED } from '@documenso/lib/constants/app'; +import { getAllowedUploadMimeTypes } from '@documenso/lib/constants/document-conversion'; import { megabytesToBytes } from '@documenso/lib/universal/unit-convertions'; import type { MessageDescriptor } from '@lingui/core'; import { msg } from '@lingui/core/macro'; @@ -54,9 +55,7 @@ export const DocumentDropzone = ({ const organisation = useCurrentOrganisation(); const { getRootProps, getInputProps } = useDropzone({ - accept: { - 'application/pdf': ['.pdf'], - }, + accept: getAllowedUploadMimeTypes(), multiple: allowMultiple, disabled, onDrop: (acceptedFiles) => { @@ -151,7 +150,7 @@ export const DocumentDropzone = ({

{_(heading[type])}

- {_(disabled ? disabledMessage : msg`Drag & drop your PDF here.`)} + {_(disabled ? disabledMessage : msg`Drag & drop your document here.`)}

{disabled && IS_BILLING_ENABLED() && ( diff --git a/packages/ui/primitives/document-upload-button.tsx b/packages/ui/primitives/document-upload-button.tsx index ff8459c48..1d9d635c3 100644 --- a/packages/ui/primitives/document-upload-button.tsx +++ b/packages/ui/primitives/document-upload-button.tsx @@ -1,6 +1,7 @@ import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/organisation'; import { useSession } from '@documenso/lib/client-only/providers/session'; import { APP_DOCUMENT_UPLOAD_SIZE_LIMIT, IS_BILLING_ENABLED } from '@documenso/lib/constants/app'; +import { getAllowedUploadMimeTypes } from '@documenso/lib/constants/document-conversion'; import { megabytesToBytes } from '@documenso/lib/universal/unit-convertions'; import { isPersonalLayout } from '@documenso/lib/utils/organisations'; import type { MessageDescriptor } from '@lingui/core'; @@ -51,9 +52,7 @@ export const DocumentUploadButton = ({ const isPersonalLayoutMode = isPersonalLayout(organisations); const { getRootProps, getInputProps } = useDropzone({ - accept: { - 'application/pdf': ['.pdf'], - }, + accept: getAllowedUploadMimeTypes(), multiple: internalVersion === '2', disabled, maxFiles, From a8efb6f495295d5b9efc0778cb418b456b958423 Mon Sep 17 00:00:00 2001 From: Lucas Smith Date: Wed, 13 May 2026 15:17:34 +1000 Subject: [PATCH 05/15] fix: remove translation tag from css textarea placeholder (#2803) --- apps/remix/app/components/forms/branding-preferences-form.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/remix/app/components/forms/branding-preferences-form.tsx b/apps/remix/app/components/forms/branding-preferences-form.tsx index fa83eb20c..e420fdae7 100644 --- a/apps/remix/app/components/forms/branding-preferences-form.tsx +++ b/apps/remix/app/components/forms/branding-preferences-form.tsx @@ -512,7 +512,7 @@ export function BrandingPreferencesForm({