From f4105e47eba56f5d8d7e70dd516a8fcc0c870d7c Mon Sep 17 00:00:00 2001 From: Catalin Pit Date: Wed, 30 Sep 2026 09:19:20 +0300 Subject: [PATCH] fix: prevent recipients who already signed from rejecting documents (#3411) --- .../lib/server-only/document/reject-document-with-token.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/packages/lib/server-only/document/reject-document-with-token.ts b/packages/lib/server-only/document/reject-document-with-token.ts index a8555b42b..24e6c2d9b 100644 --- a/packages/lib/server-only/document/reject-document-with-token.ts +++ b/packages/lib/server-only/document/reject-document-with-token.ts @@ -51,6 +51,12 @@ export async function rejectDocumentWithToken({ token, id, reason, requestMetada }); } + if (recipient.signingStatus !== SigningStatus.NOT_SIGNED) { + throw new AppError(AppErrorCode.INVALID_REQUEST, { + message: `Recipient ${recipient.id} has already actioned this document`, + }); + } + assertRecipientNotExpired(recipient); // Update the recipient status to rejected