Merge branch 'main' into fix/improve-admin-org-page

.env.example

@@ -103,7 +103,7 @@ NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID="documenso"
 NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY="password"
 
 # [[SMTP]]
-# OPTIONAL: Defines the transport to use for sending emails. Available options: smtp-auth (default) | smtp-api | resend | mailchannels
+# OPTIONAL: Defines the transport to use for sending emails. Available options: smtp-auth (default) | smtp-api | mailchannels
 NEXT_PRIVATE_SMTP_TRANSPORT="smtp-auth"
 # OPTIONAL: Defines the host to use for sending emails.
 NEXT_PRIVATE_SMTP_HOST="127.0.0.1"

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -34,7 +34,7 @@ body:
       label: Browser [e.g., Chrome, Firefox]
   - type: input
     attributes:
-      label: Version [e.g., 2.13.0]
+      label: Version [e.g., 2.0.1]
   - type: checkboxes
     attributes:
       label: Please check the boxes that apply to this issue report.
@@ -44,3 +44,4 @@ body:
         - label: I have included relevant environment information.
         - label: I have included any relevant screenshots.
         - label: I understand that this is a voluntary contribution and that there is no guarantee of resolution.
+        - label: I want to work on creating a PR for this issue if approved

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Security vulnerability
-    url: https://github.com/documenso/documenso/security/advisories/new
-    about: Please report security vulnerabilities privately via GitHub Security Advisories. Do not open a public issue.
-  - name: Questions & Discussions
-    url: https://github.com/documenso/documenso/discussions
-    about: Ask questions, share ideas, and discuss Documenso with the community.
-  - name: Discord
-    url: https://documen.so/discord
-    about: Chat with the community and the team.

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -33,3 +33,4 @@ body:
         - label: I have explained the use case or scenario for this feature.
         - label: I have included any relevant technical details or design suggestions.
         - label: I understand that this is a suggestion and that there is no guarantee of implementation.
+        - label: I want to work on creating a PR for this issue if approved

.github/ISSUE_TEMPLATE/improvement.yml

@@ -15,6 +15,17 @@ body:
       description: 'Are there any additional context or information that might be relevant to the improvement suggestion.'
     validations:
       required: false
+  - type: dropdown
+    id: assignee
+    attributes:
+      label: 'Do you want to work on this improvement?'
+      multiple: false
+      options:
+        - 'No'
+        - 'Yes'
+      default: 0
+    validations:
+      required: true
   - type: checkboxes
     attributes:
       label: 'Please check the boxes that apply to this improvement suggestion.'

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,14 +1,3 @@
-<!--
-  We are no longer accepting external pull requests.
-
-  Aside from a small group of trusted contributors we reach out to directly,
-  new external PRs will usually be closed with a request to open an issue instead.
-  This is a security decision. See https://documenso.com/blog/why-we-re-pausing-external-pull-requests
-
-  If you're a trusted contributor or maintainer, continue below.
-  Otherwise, please open a detailed issue: https://github.com/documenso/documenso/issues/new/choose
--->
-
 ## Description
 
 <!--- Describe the changes introduced by this pull request. -->

.github/PULL_REQUEST_TEMPLATE/test-addition.md

@@ -0,0 +1,40 @@
+---
+name: Test Addition
+about: Submit a new test, either unit or end-to-end (E2E), for review and inclusion
+---
+
+## Description
+
+<!--- Provide a clear and concise description of the new test you are adding. -->
+<!--- Explain the purpose of the test and what it aims to validate. -->
+
+## Related Issue
+
+<!--- If this test addition is related to a specific issue, reference it here using #issue_number. -->
+<!--- For example, "Fixes #123" or "Addresses #456". -->
+
+## Test Details
+
+<!--- Describe the details of the test you're adding. -->
+<!--- Include information about inputs, expected outputs, and any specific scenarios. -->
+
+- Test Name: Name of the test
+- Type: [Unit / E2E]
+- Description: Brief description of what the test checks
+- Inputs: What inputs the test uses (if applicable)
+- Expected Output: What output or behavior the test expects
+
+## Checklist
+
+<!--- Please check the boxes that apply to this pull request. -->
+<!--- You can add or remove items as needed. -->
+
+- [ ] I have written the new test and ensured it works as intended.
+- [ ] I have added necessary documentation to explain the purpose of the test.
+- [ ] I have followed the project's testing guidelines and coding style.
+- [ ] I have addressed any review feedback from previous submissions, if applicable.
+
+## Additional Notes
+
+<!--- Provide any additional context or notes for the reviewers. -->
+<!--- This might include explanations about the testing approach or any potential concerns. -->

.github/workflows/first-interaction.yml

@@ -1,10 +1,13 @@
 name: 'Welcome New Contributors'
 
 on:
+  pull_request:
+    types: ['opened']
   issues:
     types: ['opened']
 
 permissions:
+  pull-requests: write
   issues: write
 
 jobs:
@@ -17,7 +20,10 @@ jobs:
       - uses: actions/first-interaction@v1
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-message: |
+            Thank you for creating your first Pull Request and for being a part of the open signing revolution! 💚🚀
+            <br /> Feel free to hop into our community in [Discord](https://documen.so/discord)
           issue-message: |
             Thank you for opening your first issue and for being a part of the open signing revolution!
-            <br /> One of our team members will review it and get back to you as soon as possible 💚
+            <br /> One of our team members will review it and get back to you as soon as it possible 💚
             <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

.github/workflows/issue-assignee-check.yml

@@ -0,0 +1,62 @@
+name: 'Issue Assignee Check'
+
+on:
+  issues:
+    types: ['assigned']
+
+permissions:
+  issues: write
+
+jobs:
+  countIssues:
+    if: ${{ github.event.issue.assignee }} && github.event.action == 'assigned' && github.event.sender.type == 'User'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+
+      - name: Install Octokit
+        run: npm install @octokit/rest@18
+
+      - name: Check Assigned User's Issue Count
+        id: parse-comment
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { Octokit } = require("@octokit/rest");
+            const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+
+            const username = context.payload.issue.assignee.login;
+            console.log(`Username Extracted: ${username}`);
+
+            const { data: issues } = await octokit.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              assignee: username,
+              state: 'open'
+            });
+
+            const issueCount = issues.length;
+            console.log(`Issue Count For ${username}: ${issueCount}`);
+
+            if (issueCount > 3) {
+              let issueCountMessage = `### 🚨 Documenso Police 🚨`;
+              issueCountMessage += `\n@${username} has ${issueCount} open issues assigned already. Consider whether this issue should be assigned to them or left open for another contributor.`;
+
+              await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: issueCountMessage,
+                headers: {
+                  'Authorization': `token ${{ secrets.GITHUB_TOKEN }}`,
+                }
+              });
+            }

.github/workflows/pr-review-reminder.yml

@@ -0,0 +1,63 @@
+name: 'PR Review Reminder'
+
+on:
+  pull_request:
+    types: ['opened', 'ready_for_review']
+
+permissions:
+  pull-requests: write
+
+jobs:
+  checkPRs:
+    if: ${{ github.event.pull_request.user.login }} && github.event.action == ('opened' || 'ready_for_review')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+
+      - name: Install Octokit
+        run: npm install @octokit/rest@18
+
+      - name: Check user's PRs awaiting review
+        id: parse-prs
+        uses: actions/github-script@v5
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { Octokit } = require("@octokit/rest");
+            const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+
+            const username = context.payload.pull_request.user.login;
+            console.log(`Username Extracted: ${username}`);
+
+            const { data: pullRequests } = await octokit.pulls.list({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              sort: 'created',
+              direction: 'asc',
+            });
+
+            const userPullRequests = pullRequests.filter(pr => pr.user.login === username && (pr.state === 'open' || pr.state === 'ready_for_review'));
+            const prCount = userPullRequests.length;
+            console.log(`PR Count for ${username}: ${prCount}`);
+
+            if (prCount > 3) {
+              let prReminderMessage = `🚨 @${username} has ${prCount} pull requests awaiting review. Please consider reviewing them when possible. 🚨`;
+
+              await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: prReminderMessage,
+                headers: {
+                  'Authorization': `token ${{ secrets.GITHUB_TOKEN }}`,
+                }
+              });
+            }

.github/workflows/semantic-pull-requests.yml

@@ -16,6 +16,24 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
+      - name: Check PR creator's previous activity
+        id: check_activity
+        run: |
+          CREATOR=$(curl -s "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}" | jq -r '.user.login')
+          ACTIVITY=$(curl -s "https://api.github.com/search/commits?q=author:${CREATOR}+repo:${{ github.repository }}" | jq -r '.total_count')
+          if [ "$ACTIVITY" -eq 0 ]; then
+            echo "::set-output name=is_new::true"
+          else
+            echo "::set-output name=is_new::false"
+          fi
+
+      - name: Count PRs created by user
+        id: count_prs
+        run: |
+          CREATOR=$(curl -s "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}" | jq -r '.user.login')
+          PR_COUNT=$(curl -s "https://api.github.com/search/issues?q=type:pr+is:open+author:${CREATOR}+repo:${{ github.repository }}" | jq -r '.total_count')
+          echo "::set-output name=pr_count::$PR_COUNT"
+
       - uses: amannn/action-semantic-pull-request@v5
         id: lint_pr_title
         env:
@@ -26,6 +44,8 @@ jobs:
         with:
           header: pr-title-lint-error
           message: |
+            Hey There! and thank you for opening this pull request! 📝👋🏼
+
             We require pull request titles to follow the [Conventional Commits Spec](https://www.conventionalcommits.org/en/v1.0.0/) and it looks like your proposed title needs to be adjusted.
 
             Details:
@@ -33,3 +53,10 @@ jobs:
             ```
             ${{ steps.lint_pr_title.outputs.error_message }}
             ```
+
+      - if: ${{ steps.lint_pr_title.outputs.error_message == null && steps.check_activity.outputs.is_new == 'false' && steps.count_prs.outputs.pr_count < 2}}
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          header: pr-title-lint-error
+          message: |
+            Thank you for following the naming conventions for pull request titles! 💚🚀

.github/workflows/stale.yml

@@ -21,4 +21,4 @@ jobs:
           stale-pr-message: 'This PR has not seen activitiy for a while. It will be closed in 30 days unless further activity is detected.'
           close-pr-message: 'This PR has been closed because of inactivity.'
           exempt-pr-labels: 'WIP,on-hold,needs review'
-          exempt-issue-labels: 'WIP,on-hold,needs review,roadmap,status: assigned,status: triage'
+          exempt-issue-labels: 'WIP,on-hold,needs review,roadmap,assigned,needs triage'

.gitpod.yml

@@ -31,7 +31,8 @@ vscode:
   extensions:
     - aaron-bond.better-comments
     - bradlc.vscode-tailwindcss
-    - biomejs.biome
+    - dbaeumer.vscode-eslint
+    - esbenp.prettier-vscode
     - mikestead.dotenv
     - unifiedjs.vscode-mdx
     - GitHub.vscode-pull-request-github

.well-known/security.txt

@@ -1,14 +1,7 @@
-# Report security vulnerabilities privately via GitHub Security Advisories (preferred).
-Contact: https://github.com/documenso/documenso/security/advisories/new
-
-# Alternatively, report critical issues privately by email.
-Contact: mailto:security@documenso.com
-
-# Security policy
-Policy: https://github.com/documenso/documenso/security/policy
-
-# General (non-security) issues
+# General Issues
 Contact: https://github.com/documenso/documenso/issues/new?assignees=&labels=bug&projects=&template=bug-report.yml
 
+# Report critical issues privately to let us take appropriate action before publishing.
+Contact: mailto:security@documenso.com
 Preferred-Languages: en
-Canonical: https://documenso.com/.well-known/security.txt
+Canonical: https://documenso.com/.well-known/security.txt

CONTRIBUTING.md

@@ -1,27 +1,13 @@
 # Contributing to Documenso
 
-> **We are no longer accepting external pull requests.**
->
-> Aside from a small group of trusted contributors we reach out to directly, we no longer merge external PRs. New pull requests will usually be closed with a request to open an issue instead. This is a security decision, not a judgement on your work. Read [Why We're Pausing External Pull Requests](https://documenso.com/blog/why-we-re-pausing-external-pull-requests) for the full reasoning.
->
-> Documenso stays open source. You can still read, audit, run, and fork the code. The best way to contribute is through detailed issues.
+If you plan to contribute to Documenso, please take a moment to feel awesome ✨ People like you are what open source is about ♥. Any contributions, no matter how big or small, are highly appreciated.
 
-## How to contribute now
+## Before getting started
 
-The most useful contribution is a detailed issue. Treat it like a spec. The more detail, the better:
-
-- The problem you're trying to solve, and who it affects
-- How you expect the feature or change to behave
-- Edge cases, constraints, and anything you've already considered
-- Examples, mockups, or references where they help
-
-Before opening an issue, search [existing issues](https://github.com/documenso/documenso/issues) and [discussions](https://github.com/documenso/documenso/discussions) for related items. If a proposal is detailed and fits where Documenso is heading, we'll pick it up and build against it.
-
-For security vulnerabilities, do not open a public issue. Follow our [Security Policy](./SECURITY.md) instead.
-
----
-
-The sections below are for trusted contributors working with us directly, and for anyone running Documenso locally or maintaining a fork.
+- Before jumping into a PR be sure to search [existing PRs](https://github.com/documenso/documenso/pulls) or [issues](https://github.com/documenso/documenso/issues) for an open or closed item that relates to your submission.
+- Select an issue from [here](https://github.com/documenso/documenso/issues) or create a new one
+- Consider the results from the discussion on the issue
+- Accept the [Contributor License Agreement](https://documen.so/cla) to ensure we can accept your contributions.
 
 ## English only PRs and Issues
 

README.md

@@ -51,18 +51,16 @@ Join us in creating the next generation of open trust infrastructure.
 
 ## Community and Next Steps 🎯
 
-- Try Documenso by self-hosting it or signing up at [documenso.com](https://documenso.com).
+- Check out the first source code release in this repository and test it.
 - Tell us what you think in the [Discussions](https://github.com/documenso/documenso/discussions).
-- Join the [Discord server](https://documen.so/discord) for any questions and getting to know other community members.
+- Join the [Discord server](https://documen.so/discord) for any questions and getting to know to other community members.
 - ⭐ the repository to help us raise awareness.
-- Open detailed [issues](https://github.com/documenso/documenso/issues) to report bugs or propose features.
+- Spread the word on Twitter that Documenso is working towards a more open signing tool.
+- Fix or create [issues](https://github.com/documenso/documenso/issues), that are needed for the first production release.
 
 ## Contributing
 
-> **Note**: We no longer accept external pull requests, aside from a small group of trusted contributors we reach out to directly. The best way to contribute is through detailed issues. Read [Why We're Pausing External Pull Requests](https://documenso.com/blog/why-we-re-pausing-external-pull-requests) for the reasoning.
-
-- Documenso stays open source. You can read, audit, run, and fork the code.
-- To report issues or propose changes, see our [contribution guide](https://github.com/documenso/documenso/blob/main/CONTRIBUTING.md).
+- To contribute, please see our [contribution guide](https://github.com/documenso/documenso/blob/main/CONTRIBUTING.md).
 
 ## Contact us
 
@@ -83,21 +81,17 @@ Contact us if you are interested in our Enterprise plan for large organizations
   <a href=""><img src="" alt=""></a>
 </p>
 
-- [TypeScript](https://www.typescriptlang.org/) - Language
-- [React Router v7](https://reactrouter.com/) - Framework
-- [Hono](https://hono.dev/) - Server
+- [Typescript](https://www.typescriptlang.org/) - Language
+- [ReactRouter](https://reactrouter.com/) - Framework
 - [Prisma](https://www.prisma.io/) - ORM
-- [Tailwind CSS](https://tailwindcss.com/) - CSS
-- [shadcn/ui](https://ui.shadcn.com/) + [Radix UI](https://www.radix-ui.com/) - Component Library
+- [Tailwind](https://tailwindcss.com/) - CSS
+- [shadcn/ui](https://ui.shadcn.com/) - Component Library
 - [react-email](https://react.email/) - Email Templates
-- [Lingui](https://lingui.dev/) - Internationalization
 - [tRPC](https://trpc.io/) - API
-- [@libpdf/core](https://www.npmjs.com/package/@libpdf/core) - PDF Signatures
-- [pdf.js](https://mozilla.github.io/pdf.js/) - Viewing PDFs
-- [@cantoo/pdf-lib](https://github.com/cantoo-scribe/pdf-lib) - PDF manipulation
+- [@documenso/pdf-sign](https://www.npmjs.com/package/@documenso/pdf-sign) - PDF Signatures (launching soon)
+- [React-PDF](https://github.com/wojtekmaj/react-pdf) - Viewing PDFs
+- [PDF-Lib](https://github.com/Hopding/pdf-lib) - PDF manipulation
 - [Stripe](https://stripe.com/) - Payments
-- [Biome](https://biomejs.dev/) - Linting & Formatting
-- [Playwright](https://playwright.dev/) - E2E Testing
 
 <!-- - Support for [opensignpdf (requires Java on server)](https://github.com/open-pdf-sign) is currently planned. -->
 
@@ -202,10 +196,6 @@ For full instructions, requirements, and configuration details, see the [Self Ho
 
 [![Deploy on Elestio](https://elest.io/images/logos/deploy-to-elestio-btn.png)](https://elest.io/open-source/documenso)
 
-## Security
-
-If you believe you have found a security vulnerability in Documenso, please report it through our [Security Policy](https://github.com/documenso/documenso/security/policy). We prioritize private reports via [GitHub Security Advisories](https://github.com/documenso/documenso/security/advisories/new). See [SECURITY.md](./SECURITY.md) for scope and details.
-
 ## Troubleshooting
 
 For troubleshooting self-hosted deployments, see the [Troubleshooting guide](https://docs.documenso.com/docs/self-hosting/maintenance/troubleshooting) and [Tips & Common Pitfalls](https://docs.documenso.com/docs/self-hosting/getting-started/tips).

SECURITY.md

@@ -1,38 +0,0 @@
-# Security Policy
-
-We take the security of Documenso seriously. As a platform trusted with legally binding documents, the safety of the project and the people who rely on it is a priority for us. We're grateful to the security researchers who help keep it that way. If you've found an issue, we'd genuinely like to hear about it.
-
-## Reporting a Vulnerability
-
-Report security vulnerabilities privately. Do not open a public issue, discussion, or pull request for security reports.
-
-We accept reports through two channels, in order of preference:
-
-1. **GitHub Security Advisories (preferred)**. Use the [private vulnerability reporting form](https://github.com/documenso/documenso/security/advisories/new). This is our primary channel and lets us triage and work with you on a fix.
-2. **Email**. If you cannot use GitHub Security Advisories, email [security@documenso.com](mailto:security@documenso.com).
-
-Include the affected version, a clear description, steps to reproduce, and the potential impact.
-
-## Triage and Response
-
-We triage reports as we have availability. We read every report we receive, and we appreciate the time and effort it takes to put one together.
-
-We also run [Codex](https://openai.com/codex/) security analysis across the codebase. If Codex has already reported the issue you're sending us, we may close your report as a duplicate. Please don't take this as a reflection on your work; it just means our automated tooling happened to surface the same thing first.
-
-## Scope
-
-This policy covers vulnerabilities in the Documenso application code in this repository.
-
-The items below are out of scope and will not be accepted. They are deployment, infrastructure, and configuration concerns that belong with the operator's firewall, network, and environment setup, not the application:
-
-- Server-Side Request Forgery (SSRF) and related network-egress concerns
-- DNS rebinding and other DNS-level issues
-- Rate limiting, denial of service, and volumetric attacks
-- TLS and certificate configuration, HTTP security headers, and other reverse-proxy or web-server configuration
-- Findings that depend on insecure self-hosted infrastructure or misconfiguration
-
-If you're unsure whether something is in scope, report it privately anyway and we'll happily take a look.
-
-## Supported Versions
-
-Security fixes are applied to the latest release. Run the most recent version of Documenso.

SIGNING.md

@@ -1,9 +1,67 @@
-# Signing Certificate
+# Creating your own signing certificate
 
-Documenso needs a signing certificate to digitally sign documents. For full, up-to-date instructions on generating, converting, and configuring a certificate, see the official documentation:
+For the digital signature of your documents you need a signing certificate in .p12 format (public and private key). You can buy one (not recommended for dev) or use the steps to create a self-signed one:
 
-- [Signing Certificate](https://docs.documenso.com/docs/self-hosting/configuration/signing-certificate): Overview and all certificate options
-- [Local Certificate](https://docs.documenso.com/docs/self-hosting/configuration/signing-certificate/local): Generate a self-signed `.p12` certificate with OpenSSL
-- [Google Cloud HSM](https://docs.documenso.com/docs/self-hosting/configuration/signing-certificate/google-cloud-hsm): Sign using Google Cloud KMS
+1. Generate a private key using the OpenSSL command. You can run the following command to generate a 2048-bit RSA key:
 
-For deploying Documenso with Docker, see the [Docker Deployment](https://docs.documenso.com/docs/self-hosting/deployment/docker) and [Docker Compose](https://docs.documenso.com/docs/self-hosting/deployment/docker-compose) guides.
+   `openssl genrsa -out private.key 2048`
+
+2. Generate a self-signed certificate using the private key. You can run the following command to generate a self-signed certificate:
+
+   `openssl req -new -x509 -key private.key -out certificate.crt -days 365`
+
+   This will prompt you to enter some information, such as the Common Name (CN) for the certificate. Make sure you enter the correct information. The `-days` parameter sets the number of days for which the certificate is valid.
+
+3. Combine the private key and the self-signed certificate to create the p12 certificate. You can run the following commands to do this:
+
+   ```bash
+   # Set certificate password securely (won't appear in command history)
+   read -s -p "Enter certificate password: " CERT_PASS
+   echo
+   
+   # Create the p12 certificate using the environment variable
+   openssl pkcs12 -export -out certificate.p12 -inkey private.key -in certificate.crt \
+       -password env:CERT_PASS \
+       -keypbe PBE-SHA1-3DES \
+       -certpbe PBE-SHA1-3DES \
+       -macalg sha1
+   ```
+
+4. **IMPORTANT**: A certificate password is required to prevent signing failures. Make sure to use a strong password (minimum 4 characters) when prompted. Certificates without passwords will cause "Failed to get private key bags" errors during document signing.
+
+5. Place the certificate `/apps/remix/resources/certificate.p12` (If the path does not exist, it needs to be created)
+
+## Docker
+
+> We are still working on the publishing of docker images, in the meantime you can follow the steps below to create a production ready docker image.
+
+Want to create a production ready docker image? Follow these steps:
+
+- cd into `docker` directory
+- Make `build.sh` executable by running `chmod +x build.sh`
+- Run `./build.sh` to start building the docker image.
+- Publish the image to your docker registry of choice (or) If you prefer running the image from local, run the below command
+
+```
+docker run -d --restart=unless-stopped -p 3000:3000 -v documenso:/app/data --name documenso documenso:latest
+```
+
+Command Breakdown:
+
+- `-d` - Let's you run the container in background
+- `-p` - Passes down which ports to use. First half is the host port, Second half is the app port. You can change the first half anything you want and reverse proxy to that port.
+- `-v` - Volume let's you persist the data
+- `--name` - Name of the container
+- `documenso:latest` - Image you have built
+
+## Deployment
+
+We support a variety of deployment methods, and are actively working on adding more. Stay tuned for updates!
+
+## Railway
+
+[![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/deploy/DjrRRX?referralCode=EZR3s0&utm_medium=integration&utm_source=template&utm_campaign=generic)
+
+## Render
+
+[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/documenso/documenso)

apps/docs/README.md

@@ -1,16 +1,45 @@
-# @documenso/docs
+# docs
 
-The Documenso documentation site, built with [Next.js](https://nextjs.org/) and [Fumadocs](https://fumadocs.dev/). Published at [docs.documenso.com](https://docs.documenso.com).
+This is a Next.js application generated with
+[Create Fumadocs](https://github.com/fuma-nama/fumadocs).
 
-Content lives under `content/docs/` as MDX. See [WRITING_STYLE.md](../../WRITING_STYLE.md) for the documentation writing conventions.
+Run development server:
 
 ```bash
-# From the monorepo root
-npm run dev --filter=@documenso/docs
+npm run dev
+# or
+pnpm dev
+# or
+yarn dev
 ```
 
-## Structure
+Open http://localhost:3000 with your browser to see the result.
 
-- `content/docs/`: Documentation pages (MDX).
-- `lib/source.ts`: Content source adapter.
-- `lib/layout.shared.tsx`: Shared layout options.
+## Explore
+
+In the project, you can see:
+
+- `lib/source.ts`: Code for content source adapter, [`loader()`](https://fumadocs.dev/docs/headless/source-api) provides the interface to access your content.
+- `lib/layout.shared.tsx`: Shared options for layouts, optional but preferred to keep.
+
+| Route                     | Description                                            |
+| ------------------------- | ------------------------------------------------------ |
+| `app/(home)`              | The route group for your landing page and other pages. |
+| `app/docs`                | The documentation layout and pages.                    |
+| `app/api/search/route.ts` | The Route Handler for search.                          |
+
+### Fumadocs MDX
+
+A `source.config.ts` config file has been included, you can customise different options like frontmatter schema.
+
+Read the [Introduction](https://fumadocs.dev/docs/mdx) for further details.
+
+## Learn More
+
+To learn more about Next.js and Fumadocs, take a look at the following
+resources:
+
+- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js
+  features and API.
+- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.
+- [Fumadocs](https://fumadocs.dev) - learn about Fumadocs

apps/docs/content/docs/developers/local-development/index.mdx

@@ -15,17 +15,16 @@ Pick the one that fits your needs the best.
 
 ## Tech Stack
 
-- [TypeScript](https://www.typescriptlang.org/) - Language
-- [React Router v7](https://reactrouter.com/) - Framework
-- [Hono](https://hono.dev/) - Server
+- [Typescript](https://www.typescriptlang.org/) - Language
+- [React Router](https://reactrouter.com/) - Framework
 - [Prisma](https://www.prisma.io/) - ORM
-- [Tailwind CSS](https://tailwindcss.com/) - CSS
-- [shadcn/ui](https://ui.shadcn.com/) + [Radix UI](https://www.radix-ui.com/) - Component Library
+- [Tailwind](https://tailwindcss.com/) - CSS
+- [shadcn/ui](https://ui.shadcn.com/) - Component Library
 - [react-email](https://react.email/) - Email Templates
-- [Lingui](https://lingui.dev/) - Internationalization
 - [tRPC](https://trpc.io/) - API
-- [@libpdf/core](https://www.npmjs.com/package/@libpdf/core) - PDF Signing and Manipulation
-- [pdf.js](https://mozilla.github.io/pdf.js/) - Viewing PDFs
+- [@documenso/pdf-sign](https://www.npmjs.com/package/@documenso/pdf-sign) - PDF Signatures
+- [React-PDF](https://github.com/wojtekmaj/react-pdf) - Viewing PDFs
+- [PDF-Lib](https://github.com/Hopding/pdf-lib) - PDF manipulation
 - [Stripe](https://stripe.com/) - Payments
 
 <div className="mt-16 flex items-center justify-center gap-4">

apps/docs/content/docs/self-hosting/configuration/email.mdx

@@ -278,9 +278,7 @@ Test your email configuration by creating an account or resetting a password. Th
 
 ### Using a Test SMTP Server
 
-For development or testing, use a local SMTP server like [Inbucket](https://www.inbucket.org/), [Mailpit](https://github.com/axllent/mailpit), or [Mailhog](https://github.com/mailhog/MailHog). The default development setup (`docker/development/compose.yml`) already runs Inbucket, with its web UI on port 9000 and SMTP on port 2500.
-
-To run one standalone instead:
+For development or testing, use a local SMTP server like [Mailhog](https://github.com/mailhog/MailHog) or [Mailpit](https://github.com/axllent/mailpit):
 
 ```bash
 # Using Docker

apps/docs/content/docs/self-hosting/configuration/environment.mdx

@@ -86,21 +86,6 @@ Callback URL: `https://<your-domain>/api/auth/callback/microsoft`
 | `NEXT_PRIVATE_OIDC_SKIP_VERIFY`    | `false` | Skip email verification for OIDC accounts          |
 | `NEXT_PRIVATE_OIDC_PROMPT`         | `login` | OIDC prompt parameter. Set to empty string to omit |
 
-### Webhooks
-
-| Variable                                | Default | Description                                                              |
-| --------------------------------------- | ------- | ------------------------------------------------------------------------ |
-| `NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS` | -       | Comma-separated hostnames or IPs allowed to resolve to private addresses |
-
-Before delivering a webhook, Documenso checks whether the target resolves to a
-private or loopback address and blocks it if so. This check is best-effort and
-fails open. Use `NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS` to allow specific
-internal hosts, for example when delivering to a service on your own network:
-
-```bash
-NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS="hooks.internal.example,10.0.0.5"
-```
-
 ---
 
 ## Email Configuration

apps/docs/content/docs/self-hosting/deployment/kubernetes.mdx

@@ -235,7 +235,7 @@ spec:
 ```
 
 <Callout type="info">
-  Pin to a specific image tag (e.g., `documenso/documenso:<version>`) in production instead of `latest`
+  Pin to a specific image tag (e.g., `documenso/documenso:1.5.0`) in production instead of `latest`
   to ensure predictable deployments.
 </Callout>
 

apps/docs/content/docs/self-hosting/deployment/manual.mdx

@@ -14,8 +14,8 @@ import { Step, Steps } from 'fumadocs-ui/components/steps';
 
 ## Prerequisites
 
-- Node.js 22 or later
-- npm 11 or later
+- Node.js 20 or later
+- npm
 - PostgreSQL 14 or later
 - A Linux server (for systemd service setup)
 

apps/docs/content/docs/self-hosting/getting-started/quick-start.mdx

@@ -124,16 +124,12 @@ docker compose -f docker/development/compose.yml exec database \
 
 The quick start setup runs the following containers:
 
-| Container   | Purpose                              | Port                          |
-| ----------- | ------------------------------------ | ----------------------------- |
-| `documenso` | Main application                     | 3000                          |
-| `database`  | PostgreSQL database                  | 54320                         |
-| `inbucket`  | Local email testing server           | 9000 (web UI), 2500 (SMTP)    |
-| `redis`     | Cache and background job queue       | 63790                         |
-| `minio`     | S3-compatible storage                | 9002 (API), 9001 (console)    |
-| `gotenberg` | Document conversion (optional)       | 3005                          |
-
-The local email server is [Inbucket](https://www.inbucket.org/). Open its web UI at [http://localhost:9000](http://localhost:9000) to view emails Documenso sends during development. For your own deployment you can use any SMTP-compatible mailserver, such as Inbucket, [Mailpit](https://github.com/axllent/mailpit), or [Mailhog](https://github.com/mailhog/MailHog).
+| Container   | Purpose                          | Port  |
+| ----------- | -------------------------------- | ----- |
+| `documenso` | Main application                 | 3000  |
+| `database`  | PostgreSQL database              | 54320 |
+| `maildev`   | Local email testing server       | 2500  |
+| `minio`     | S3-compatible storage (optional) | 9000  |
 
 ## Useful Commands
 

apps/docs/content/docs/self-hosting/getting-started/requirements.mdx

@@ -141,8 +141,8 @@ If building from source (not using Docker images):
 
 | Requirement | Version |
 | ----------- | ------- |
-| Node.js     | 22+     |
-| npm         | 11+     |
+| Node.js     | 18+     |
+| npm         | 8+      |
 
 ---
 
@@ -169,7 +169,7 @@ Documenso runs on:
 | MySQL/MariaDB  | PostgreSQL-specific features required |
 | SQLite         | Not suitable for production workloads |
 | MongoDB        | Relational database required          |
-| Node.js < 22   | Modern JavaScript features required   |
+| Node.js < 18   | Modern JavaScript features required   |
 
 ---
 

apps/docs/content/docs/self-hosting/getting-started/tips.mdx

@@ -92,7 +92,7 @@ Use a specific version tag in production:
 
 ```bash
 # Good — predictable, reproducible
-docker pull documenso/documenso:<version>
+docker pull documenso/documenso:1.8.0
 
 # Risky — may pull breaking changes
 docker pull documenso/documenso:latest

apps/docs/content/docs/self-hosting/index.mdx

@@ -27,14 +27,6 @@ import { Callout } from 'fumadocs-ui/components/callout';
   Please see all the [requirements](/docs/self-hosting/getting-started/requirements) before proceeding.
 </Callout>
 
-<Callout type="warn">
-  **You are responsible for your own network security.** Documenso applies best-effort, non-exhaustive
-  checks to outbound requests such as webhooks, but these are not a complete SSRF mitigation and they
-  fail open. A self-hosted instance can reach internal addresses on your network. Restricting outbound
-  traffic, egress filtering, and blocking access to internal services and cloud metadata endpoints is
-  your responsibility through your firewall and network configuration.
-</Callout>
-
 ---
 
 ## Deployment Options

apps/docs/content/docs/self-hosting/maintenance/upgrades.mdx

@@ -165,10 +165,10 @@ See [Backups](/docs/self-hosting/maintenance/backups) for automated backup strat
 ### Pull the new image
 
 ```bash
-docker pull documenso/documenso:<version>
+docker pull documenso/documenso:1.6.0
 ```
 
-Replace `<version>` with your target version.
+Replace `1.6.0` with your target version.
 
 </Step>
 <Step>
@@ -189,7 +189,7 @@ docker run -d \
   -p 3000:3000 \
   --env-file .env \
   -v /path/to/cert.p12:/opt/documenso/cert.p12:ro \
-  documenso/documenso:<version>
+  documenso/documenso:1.6.0
 ```
 
 </Step>
@@ -223,14 +223,14 @@ Edit `compose.yml` or your `.env` file to specify the new version:
 ```yaml
 services:
   documenso:
-    image: documenso/documenso:<version>
+    image: documenso/documenso:1.6.0
 ```
 
 Or if using environment variable substitution:
 
 ```bash
 # In .env
-DOCUMENSO_VERSION=<version>
+DOCUMENSO_VERSION=1.6.0
 ```
 
 ```yaml
@@ -283,7 +283,7 @@ Edit the deployment directly:
 
 ```bash
 kubectl set image deployment/documenso \
-  documenso=documenso/documenso:<version> \
+  documenso=documenso/documenso:1.6.0 \
   -n documenso
 ```
 
@@ -295,7 +295,7 @@ spec:
     spec:
       containers:
         - name: documenso
-          image: documenso/documenso:<version>
+          image: documenso/documenso:1.6.0
 ```
 
 Then apply:
@@ -421,12 +421,12 @@ To run migrations manually before upgrading:
 
 ```bash
 # Pull the new image
-docker pull documenso/documenso:<version>
+docker pull documenso/documenso:1.6.0
 
 # Run migrations only
 docker run --rm \
   -e NEXT_PRIVATE_DATABASE_URL="postgresql://user:password@host:5432/documenso" \
-  documenso/documenso:<version> \
+  documenso/documenso:1.6.0 \
   npx prisma migrate deploy
 ```
 
@@ -516,7 +516,7 @@ docker run -d \
   -p 3000:3000 \
   --env-file .env \
   -v /path/to/cert.p12:/opt/documenso/cert.p12:ro \
-  documenso/documenso:<previous-version>
+  documenso/documenso:1.5.0
 ```
 
 </Tab>

apps/remix/Dockerfile

@@ -0,0 +1,22 @@
+FROM node:20-alpine AS development-dependencies-env
+COPY . /app
+WORKDIR /app
+RUN npm ci
+
+FROM node:20-alpine AS production-dependencies-env
+COPY ./package.json package-lock.json /app/
+WORKDIR /app
+RUN npm ci --omit=dev
+
+FROM node:20-alpine AS build-env
+COPY . /app/
+COPY --from=development-dependencies-env /app/node_modules /app/node_modules
+WORKDIR /app
+RUN npm run build
+
+FROM node:20-alpine
+COPY ./package.json package-lock.json /app/
+COPY --from=production-dependencies-env /app/node_modules /app/node_modules
+COPY --from=build-env /app/build /app/build
+WORKDIR /app
+CMD ["npm", "run", "start"]

apps/remix/README.md

@@ -1,14 +1,100 @@
-# @documenso/remix
+# Welcome to React Router!
 
-The main Documenso web application. Built with [React Router v7](https://reactrouter.com/) and served by a [Hono](https://hono.dev/) server.
+A modern, production-ready template for building full-stack React applications using React Router.
 
-This package is part of the Documenso monorepo and is not meant to be run standalone. Use the root scripts instead.
+[![Open in StackBlitz](https://developer.stackblitz.com/img/open_in_stackblitz.svg)](https://stackblitz.com/github/remix-run/react-router-templates/tree/main/default)
 
-- Local development: see the [root README](../../README.md) and the [Local Development docs](https://docs.documenso.com/docs/developers/local-development).
-- Self-hosting and deployment: see the [Self-Hosting docs](https://docs.documenso.com/docs/self-hosting).
-- Architecture overview: see [ARCHITECTURE.md](../../ARCHITECTURE.md).
+## Features
+
+- 🚀 Server-side rendering
+- ⚡️ Hot Module Replacement (HMR)
+- 📦 Asset bundling and optimization
+- 🔄 Data loading and mutations
+- 🔒 TypeScript by default
+- 🎉 TailwindCSS for styling
+- 📖 [React Router docs](https://reactrouter.com/)
+
+## Getting Started
+
+### Installation
+
+Install the dependencies:
+
+```bash
+npm install
+```
+
+### Development
+
+Start the development server with HMR:
 
 ```bash
-# From the monorepo root
 npm run dev
 ```
+
+Your application will be available at `http://localhost:5173`.
+
+## Building for Production
+
+Create a production build:
+
+```bash
+npm run build
+```
+
+## Deployment
+
+### Docker Deployment
+
+This template includes three Dockerfiles optimized for different package managers:
+
+- `Dockerfile` - for npm
+- `Dockerfile.pnpm` - for pnpm
+- `Dockerfile.bun` - for bun
+
+To build and run using Docker:
+
+```bash
+# For npm
+docker build -t my-app .
+
+# For pnpm
+docker build -f Dockerfile.pnpm -t my-app .
+
+# For bun
+docker build -f Dockerfile.bun -t my-app .
+
+# Run the container
+docker run -p 3000:3000 my-app
+```
+
+The containerized application can be deployed to any platform that supports Docker, including:
+
+- AWS ECS
+- Google Cloud Run
+- Azure Container Apps
+- Digital Ocean App Platform
+- Fly.io
+- Railway
+
+### DIY Deployment
+
+If you're familiar with deploying Node applications, the built-in app server is production-ready.
+
+Make sure to deploy the output of `npm run build`
+
+```
+├── package.json
+├── package-lock.json (or pnpm-lock.yaml, or bun.lockb)
+├── build/
+│   ├── client/    # Static assets
+│   └── server/    # Server-side code
+```
+
+## Styling
+
+This template comes with [Tailwind CSS](https://tailwindcss.com/) already configured for a simple default starting experience. You can use whatever CSS framework you prefer.
+
+---
+
+Built with ❤️ using React Router.

apps/remix/app/components/dialogs/document-preferences-reset-dialog.tsx

@@ -1,144 +0,0 @@
-import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
-import { Button } from '@documenso/ui/primitives/button';
-import {
-  Dialog,
-  DialogClose,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-  DialogTrigger,
-} from '@documenso/ui/primitives/dialog';
-import { Trans } from '@lingui/react/macro';
-import { useState } from 'react';
-
-export type DocumentPreferencesResetDialogProps = {
-  disabled?: boolean;
-  isSubmitting: boolean;
-  onReset: () => Promise<void>;
-  showAiFeatures?: boolean;
-  showDocumentVisibility?: boolean;
-  showIncludeSenderDetails?: boolean;
-  trigger?: React.ReactNode;
-};
-
-export const DocumentPreferencesResetDialog = ({
-  disabled = false,
-  isSubmitting,
-  onReset,
-  showAiFeatures = false,
-  showDocumentVisibility = false,
-  showIncludeSenderDetails = false,
-  trigger,
-}: DocumentPreferencesResetDialogProps) => {
-  const [open, setOpen] = useState(false);
-  const [isResetting, setIsResetting] = useState(false);
-
-  const isLoading = isSubmitting || isResetting;
-
-  const handleResetToDefaults = async () => {
-    setIsResetting(true);
-
-    try {
-      await onReset();
-      setOpen(false);
-    } finally {
-      setIsResetting(false);
-    }
-  };
-
-  return (
-    <Dialog open={open} onOpenChange={(value) => !isLoading && setOpen(value)}>
-      <DialogTrigger asChild>
-        {trigger ?? (
-          <Button variant="destructive" type="button" disabled={disabled || isLoading}>
-            <Trans>Reset</Trans>
-          </Button>
-        )}
-      </DialogTrigger>
-
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>
-            <Trans>Reset document preferences</Trans>
-          </DialogTitle>
-
-          <DialogDescription>
-            <Trans>
-              This will reset all document preferences to their default values and save the changes immediately.
-            </Trans>
-          </DialogDescription>
-        </DialogHeader>
-
-        <Alert variant="warning">
-          <AlertDescription>
-            <p>
-              <Trans>Once confirmed, the following will be reset:</Trans>
-            </p>
-
-            <ul className="mt-0.5 list-inside list-disc">
-              {showDocumentVisibility && (
-                <li>
-                  <Trans>Default document visibility</Trans>
-                </li>
-              )}
-              <li>
-                <Trans>Default document language</Trans>
-              </li>
-              <li>
-                <Trans>Default date format</Trans>
-              </li>
-              <li>
-                <Trans>Default time zone</Trans>
-              </li>
-              <li>
-                <Trans>Default signature settings</Trans>
-              </li>
-              {showIncludeSenderDetails && (
-                <li>
-                  <Trans>Send on behalf of team</Trans>
-                </li>
-              )}
-              <li>
-                <Trans>Include the signing certificate in the document</Trans>
-              </li>
-              <li>
-                <Trans>Include the audit logs in the document</Trans>
-              </li>
-              <li>
-                <Trans>Default recipients</Trans>
-              </li>
-              <li>
-                <Trans>Delegate document ownership</Trans>
-              </li>
-              <li>
-                <Trans>Default envelope expiration</Trans>
-              </li>
-              <li>
-                <Trans>Default signing reminders</Trans>
-              </li>
-              {showAiFeatures && (
-                <li>
-                  <Trans>AI features</Trans>
-                </li>
-              )}
-            </ul>
-          </AlertDescription>
-        </Alert>
-
-        <DialogFooter>
-          <DialogClose asChild>
-            <Button type="button" variant="secondary" disabled={isLoading}>
-              <Trans>Cancel</Trans>
-            </Button>
-          </DialogClose>
-
-          <Button type="button" variant="destructive" loading={isLoading} onClick={() => void handleResetToDefaults()}>
-            <Trans>Reset to defaults</Trans>
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  );
-};

apps/remix/app/components/forms/document-preferences-form.tsx

@@ -11,10 +11,10 @@ import { isValidLanguageCode, SUPPORTED_LANGUAGE_CODES, SUPPORTED_LANGUAGES } fr
 import { TIME_ZONES } from '@documenso/lib/constants/time-zones';
 import type { TDefaultRecipients } from '@documenso/lib/types/default-recipients';
 import { ZDefaultRecipientsSchema } from '@documenso/lib/types/default-recipients';
-import { type TDocumentMetaDateFormat, ZDocumentMetaDateFormatSchema } from '@documenso/lib/types/document-meta';
-import { generateDefaultOrganisationSettings, isPersonalLayout } from '@documenso/lib/utils/organisations';
+import { type TDocumentMetaDateFormat, ZDocumentMetaTimezoneSchema } from '@documenso/lib/types/document-meta';
+import { isPersonalLayout } from '@documenso/lib/utils/organisations';
 import { recipientAbbreviation } from '@documenso/lib/utils/recipient-formatter';
-import { extractTeamSignatureSettings, generateDefaultTeamSettings } from '@documenso/lib/utils/teams';
+import { extractTeamSignatureSettings } from '@documenso/lib/utils/teams';
 import { DocumentSignatureSettingsTooltip } from '@documenso/ui/components/document/document-signature-settings-tooltip';
 import { ExpirationPeriodPicker } from '@documenso/ui/components/document/expiration-period-picker';
 import { ReminderSettingsPicker } from '@documenso/ui/components/document/reminder-settings-picker';
@@ -38,11 +38,11 @@ import { zodResolver } from '@hookform/resolvers/zod';
 import { msg, t } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
-import { DocumentVisibility, OrganisationType, type RecipientRole, type TeamGlobalSettings } from '@prisma/client';
+import type { TeamGlobalSettings } from '@prisma/client';
+import { DocumentVisibility, OrganisationType, type RecipientRole } from '@prisma/client';
 import { useForm } from 'react-hook-form';
 import { z } from 'zod';
 
-import { DocumentPreferencesResetDialog } from '~/components/dialogs/document-preferences-reset-dialog';
 import { useOptionalCurrentTeam } from '~/providers/team';
 
 import { DefaultRecipientsMultiSelectCombobox } from '../general/default-recipients-multiselect-combobox';
@@ -93,26 +93,6 @@ export type DocumentPreferencesFormProps = {
   onFormSubmit: (data: TDocumentPreferencesFormSchema) => Promise<void>;
 };
 
-const getDocumentPreferencesFormValues = (settings: SettingsSubset): TDocumentPreferencesFormSchema => {
-  const parsedDocumentDateFormat = ZDocumentMetaDateFormatSchema.safeParse(settings.documentDateFormat);
-
-  return {
-    documentVisibility: settings.documentVisibility,
-    documentLanguage: isValidLanguageCode(settings.documentLanguage) ? settings.documentLanguage : null,
-    documentTimezone: settings.documentTimezone,
-    documentDateFormat: parsedDocumentDateFormat.success ? parsedDocumentDateFormat.data : null,
-    includeSenderDetails: settings.includeSenderDetails,
-    includeSigningCertificate: settings.includeSigningCertificate,
-    includeAuditLog: settings.includeAuditLog,
-    signatureTypes: extractTeamSignatureSettings({ ...settings }),
-    defaultRecipients: settings.defaultRecipients ? ZDefaultRecipientsSchema.parse(settings.defaultRecipients) : null,
-    delegateDocumentOwnership: settings.delegateDocumentOwnership,
-    aiFeaturesEnabled: settings.aiFeaturesEnabled,
-    envelopeExpirationPeriod: settings.envelopeExpirationPeriod ?? null,
-    reminderSettings: settings.reminderSettings ?? null,
-  };
-};
-
 export const DocumentPreferencesForm = ({
   settings,
   onFormSubmit,
@@ -133,7 +113,7 @@ export const DocumentPreferencesForm = ({
     documentVisibility: z.nativeEnum(DocumentVisibility).nullable(),
     documentLanguage: z.enum(SUPPORTED_LANGUAGE_CODES).nullable(),
     documentTimezone: z.string().nullable(),
-    documentDateFormat: ZDocumentMetaDateFormatSchema.nullable(),
+    documentDateFormat: ZDocumentMetaTimezoneSchema.nullable(),
     includeSenderDetails: z.boolean().nullable(),
     includeSigningCertificate: z.boolean().nullable(),
     includeAuditLog: z.boolean().nullable(),
@@ -147,27 +127,26 @@ export const DocumentPreferencesForm = ({
     reminderSettings: ZEnvelopeReminderSettings.nullable(),
   });
 
-  const defaultValues = getDocumentPreferencesFormValues(settings);
-  const defaultSettings = canInherit ? generateDefaultTeamSettings() : generateDefaultOrganisationSettings();
-  const baseResetValues = getDocumentPreferencesFormValues(defaultSettings);
-  const resetValues = {
-    ...baseResetValues,
-    aiFeaturesEnabled: isAiFeaturesConfigured ? baseResetValues.aiFeaturesEnabled : defaultValues.aiFeaturesEnabled,
-  };
-
   const form = useForm<TDocumentPreferencesFormSchema>({
-    defaultValues,
+    defaultValues: {
+      documentVisibility: settings.documentVisibility,
+      documentLanguage: isValidLanguageCode(settings.documentLanguage) ? settings.documentLanguage : null,
+      documentTimezone: settings.documentTimezone,
+      // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+      documentDateFormat: settings.documentDateFormat as TDocumentMetaDateFormat | null,
+      includeSenderDetails: settings.includeSenderDetails,
+      includeSigningCertificate: settings.includeSigningCertificate,
+      includeAuditLog: settings.includeAuditLog,
+      signatureTypes: extractTeamSignatureSettings({ ...settings }),
+      defaultRecipients: settings.defaultRecipients ? ZDefaultRecipientsSchema.parse(settings.defaultRecipients) : null,
+      delegateDocumentOwnership: settings.delegateDocumentOwnership,
+      aiFeaturesEnabled: settings.aiFeaturesEnabled,
+      envelopeExpirationPeriod: settings.envelopeExpirationPeriod ?? null,
+      reminderSettings: settings.reminderSettings ?? null,
+    },
     resolver: zodResolver(ZDocumentPreferencesFormSchema),
   });
 
-  const currentValues = form.watch();
-  const isResetDisabled = !form.formState.isDirty && JSON.stringify(currentValues) === JSON.stringify(resetValues);
-
-  const handleResetToDefaults = async () => {
-    await onFormSubmit(resetValues);
-    form.reset(resetValues);
-  };
-
   return (
     <Form {...form}>
       <form onSubmit={form.handleSubmit(onFormSubmit)}>
@@ -781,14 +760,6 @@ export const DocumentPreferencesForm = ({
             <Button type="submit" loading={form.formState.isSubmitting}>
               <Trans>Update</Trans>
             </Button>
-            <DocumentPreferencesResetDialog
-              disabled={isResetDisabled}
-              isSubmitting={form.formState.isSubmitting}
-              onReset={handleResetToDefaults}
-              showAiFeatures={isAiFeaturesConfigured}
-              showDocumentVisibility={!isPersonalLayoutMode}
-              showIncludeSenderDetails={!isPersonalLayoutMode && !isPersonalOrganisation}
-            />
           </div>
         </fieldset>
       </form>

apps/remix/app/components/general/admin-global-settings-section.tsx

@@ -5,6 +5,7 @@ import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
 import type { OrganisationGlobalSettings, TeamGlobalSettings } from '@prisma/client';
+import type { ReactNode } from 'react';
 
 import { DetailsCard, DetailsValue } from '~/components/general/admin-details';
 
@@ -25,38 +26,72 @@ const emailSettingsKeys = Object.keys(EMAIL_SETTINGS_LABELS) as (keyof TDocument
 type AdminGlobalSettingsSectionProps = {
   settings: TeamGlobalSettings | OrganisationGlobalSettings | null;
   isTeam?: boolean;
+  /** When viewing a team, the parent organisation settings the team inherits from. */
+  inheritedSettings?: OrganisationGlobalSettings | null;
 };
 
-export const AdminGlobalSettingsSection = ({ settings, isTeam = false }: AdminGlobalSettingsSectionProps) => {
+export const AdminGlobalSettingsSection = ({
+  settings,
+  isTeam = false,
+  inheritedSettings,
+}: AdminGlobalSettingsSectionProps) => {
   const { _ } = useLingui();
-  const notSetLabel = isTeam ? <Trans>Inherited</Trans> : <Trans>Not set</Trans>;
 
   if (!settings) {
     return null;
   }
 
-  const textValue = (value: string | null | undefined) => {
-    if (value === null || value === undefined) {
-      return notSetLabel;
+  const notSet = <Trans>Not set</Trans>;
+
+  const inheritedValue = (value: ReactNode) => {
+    if (!isTeam || value === null) {
+      return notSet;
     }
 
-    return value;
+    return (
+      <span className="flex items-center gap-1.5">
+        <span className="text-muted-foreground">
+          <Trans>Inherited</Trans>:
+        </span>
+        <span>{value}</span>
+      </span>
+    );
   };
 
-  const brandingTextValue = (value: string | null | undefined) => {
-    if (value === null || value === undefined || value.trim() === '') {
-      return notSetLabel;
+  const textValue = (value: string | null | undefined, inherited?: string | null) => {
+    if (value && value.trim() !== '') {
+      return value;
     }
 
-    return value;
+    if (inherited && inherited.trim() !== '') {
+      return inheritedValue(inherited);
+    }
+
+    return notSet;
   };
 
-  const booleanValue = (value: boolean | null | undefined) => {
-    if (value === null || value === undefined) {
-      return notSetLabel;
+  const booleanLabel = (value: boolean) => (value ? <Trans>Enabled</Trans> : <Trans>Disabled</Trans>);
+
+  const booleanValue = (value: boolean | null | undefined, inherited?: boolean | null) => {
+    if (value !== null && value !== undefined) {
+      return booleanLabel(value);
     }
 
-    return value ? <Trans>Enabled</Trans> : <Trans>Disabled</Trans>;
+    return inherited !== null && inherited !== undefined ? inheritedValue(booleanLabel(inherited)) : notSet;
+  };
+
+  const visibilityLabel = (value: string | null | undefined) => {
+    return value && DOCUMENT_VISIBILITY[value] ? _(DOCUMENT_VISIBILITY[value].value) : null;
+  };
+
+  const visibilityValue = (value: string | null | undefined, inherited?: string | null) => {
+    const label = visibilityLabel(value);
+
+    if (label !== null) {
+      return label;
+    }
+
+    return inheritedValue(visibilityLabel(inherited));
   };
 
   const parsedEmailSettings = ZDocumentEmailSettingsSchema.safeParse(settings.emailDocumentSettings);
@@ -65,70 +100,82 @@ export const AdminGlobalSettingsSection = ({ settings, isTeam = false }: AdminGl
     <div className="grid grid-cols-1 gap-3 text-sm sm:grid-cols-2 lg:grid-cols-3">
       <DetailsCard label={<Trans>Document visibility</Trans>}>
         <DetailsValue>
-          {settings.documentVisibility != null
-            ? _(DOCUMENT_VISIBILITY[settings.documentVisibility].value)
-            : notSetLabel}
+          {visibilityValue(settings.documentVisibility, inheritedSettings?.documentVisibility)}
         </DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Document language</Trans>}>
-        <DetailsValue>{textValue(settings.documentLanguage)}</DetailsValue>
+        <DetailsValue>{textValue(settings.documentLanguage, inheritedSettings?.documentLanguage)}</DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Document timezone</Trans>}>
-        <DetailsValue>{textValue(settings.documentTimezone)}</DetailsValue>
+        <DetailsValue>{textValue(settings.documentTimezone, inheritedSettings?.documentTimezone)}</DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Date format</Trans>}>
-        <DetailsValue>{textValue(settings.documentDateFormat)}</DetailsValue>
+        <DetailsValue>{textValue(settings.documentDateFormat, inheritedSettings?.documentDateFormat)}</DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Include sender details</Trans>}>
-        <DetailsValue>{booleanValue(settings.includeSenderDetails)}</DetailsValue>
+        <DetailsValue>
+          {booleanValue(settings.includeSenderDetails, inheritedSettings?.includeSenderDetails)}
+        </DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Include signing certificate</Trans>}>
-        <DetailsValue>{booleanValue(settings.includeSigningCertificate)}</DetailsValue>
+        <DetailsValue>
+          {booleanValue(settings.includeSigningCertificate, inheritedSettings?.includeSigningCertificate)}
+        </DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Include audit log</Trans>}>
-        <DetailsValue>{booleanValue(settings.includeAuditLog)}</DetailsValue>
+        <DetailsValue>{booleanValue(settings.includeAuditLog, inheritedSettings?.includeAuditLog)}</DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Delegate document ownership</Trans>}>
-        <DetailsValue>{booleanValue(settings.delegateDocumentOwnership)}</DetailsValue>
+        <DetailsValue>
+          {booleanValue(settings.delegateDocumentOwnership, inheritedSettings?.delegateDocumentOwnership)}
+        </DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Typed signature</Trans>}>
-        <DetailsValue>{booleanValue(settings.typedSignatureEnabled)}</DetailsValue>
+        <DetailsValue>
+          {booleanValue(settings.typedSignatureEnabled, inheritedSettings?.typedSignatureEnabled)}
+        </DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Upload signature</Trans>}>
-        <DetailsValue>{booleanValue(settings.uploadSignatureEnabled)}</DetailsValue>
+        <DetailsValue>
+          {booleanValue(settings.uploadSignatureEnabled, inheritedSettings?.uploadSignatureEnabled)}
+        </DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Draw signature</Trans>}>
-        <DetailsValue>{booleanValue(settings.drawSignatureEnabled)}</DetailsValue>
+        <DetailsValue>
+          {booleanValue(settings.drawSignatureEnabled, inheritedSettings?.drawSignatureEnabled)}
+        </DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Branding</Trans>}>
-        <DetailsValue>{booleanValue(settings.brandingEnabled)}</DetailsValue>
+        <DetailsValue>{booleanValue(settings.brandingEnabled, inheritedSettings?.brandingEnabled)}</DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Branding logo</Trans>}>
-        <DetailsValue>{brandingTextValue(settings.brandingLogo)}</DetailsValue>
+        <DetailsValue>{textValue(settings.brandingLogo, inheritedSettings?.brandingLogo)}</DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Branding URL</Trans>}>
-        <DetailsValue>{brandingTextValue(settings.brandingUrl)}</DetailsValue>
+        <DetailsValue>{textValue(settings.brandingUrl, inheritedSettings?.brandingUrl)}</DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Branding company details</Trans>}>
-        <DetailsValue>{brandingTextValue(settings.brandingCompanyDetails)}</DetailsValue>
+        <DetailsValue>
+          {textValue(settings.brandingCompanyDetails, inheritedSettings?.brandingCompanyDetails)}
+        </DetailsValue>
       </DetailsCard>
 
       <DetailsCard label={<Trans>Email reply-to</Trans>}>
-        <DetailsValue>{textValue(settings.emailReplyTo)}</DetailsValue>
+        <DetailsValue>{textValue(settings.emailReplyTo, inheritedSettings?.emailReplyTo)}</DetailsValue>
       </DetailsCard>
 
       {isTeam && parsedEmailSettings.success && (
@@ -145,7 +192,7 @@ export const AdminGlobalSettingsSection = ({ settings, isTeam = false }: AdminGl
       )}
 
       <DetailsCard label={<Trans>AI features</Trans>}>
-        <DetailsValue>{booleanValue(settings.aiFeaturesEnabled)}</DetailsValue>
+        <DetailsValue>{booleanValue(settings.aiFeaturesEnabled, inheritedSettings?.aiFeaturesEnabled)}</DetailsValue>
       </DetailsCard>
     </div>
   );

apps/remix/app/components/general/claim-limit-fields.tsx

@@ -1,11 +1,4 @@
-import {
-  FormControl,
-  FormDescription,
-  FormField,
-  FormItem,
-  FormLabel,
-  FormMessage,
-} from '@documenso/ui/primitives/form/form';
+import { FormControl, FormField, FormItem, FormLabel, FormMessage } from '@documenso/ui/primitives/form/form';
 import { Input } from '@documenso/ui/primitives/input';
 import { Trans, useLingui } from '@lingui/react/macro';
 import type { ReactNode } from 'react';
@@ -13,6 +6,13 @@ import type { Control, FieldValues, Path } from 'react-hook-form';
 
 import { RateLimitArrayInput } from './rate-limit-array-input';
 
+/**
+ * The rate-limit editor renders its own per-row inline errors, but a submit
+ * attempt can still surface array-level Zod issues (e.g. a committed duplicate
+ * window). Rendering the field's message here guarantees the form never fails
+ * silently when those errors are not tied to a row the editor is showing.
+ */
+
 type ClaimLimitFieldsProps<T extends FieldValues> = {
   control: Control<T>;
   /** e.g. '' for the claim form, 'claims.' for the org admin form. */
@@ -20,6 +20,12 @@ type ClaimLimitFieldsProps<T extends FieldValues> = {
   disabled?: boolean;
 };
 
+type LimitGroup = {
+  title: ReactNode;
+  quotaKey: string;
+  rateLimitKey: string;
+};
+
 export const ClaimLimitFields = <T extends FieldValues>({
   control,
   prefix = '',
@@ -30,13 +36,33 @@ export const ClaimLimitFields = <T extends FieldValues>({
   // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
   const name = (key: string) => `${prefix}${key}` as Path<T>;
 
-  const renderQuotaField = (key: string, label: ReactNode, description: ReactNode) => (
+  const limitGroups: LimitGroup[] = [
+    {
+      title: <Trans>Documents</Trans>,
+      quotaKey: 'documentQuota',
+      rateLimitKey: 'documentRateLimits',
+    },
+    {
+      title: <Trans>Emails</Trans>,
+      quotaKey: 'emailQuota',
+      rateLimitKey: 'emailRateLimits',
+    },
+    {
+      title: <Trans>API</Trans>,
+      quotaKey: 'apiQuota',
+      rateLimitKey: 'apiRateLimits',
+    },
+  ];
+
+  const renderQuotaField = (group: LimitGroup) => (
     <FormField
       control={control}
-      name={name(key)}
+      name={name(group.quotaKey)}
       render={({ field }) => (
         <FormItem>
-          <FormLabel>{label}</FormLabel>
+          <FormLabel className="text-muted-foreground text-xs">
+            <Trans>Monthly quota</Trans>
+          </FormLabel>
           <FormControl>
             <Input
               type="number"
@@ -47,20 +73,18 @@ export const ClaimLimitFields = <T extends FieldValues>({
               onChange={(e) => field.onChange(e.target.value === '' ? null : parseInt(e.target.value, 10))}
             />
           </FormControl>
-          <FormDescription>{description}</FormDescription>
           <FormMessage />
         </FormItem>
       )}
     />
   );
 
-  const renderRateLimitField = (key: string, label: ReactNode) => (
+  const renderRateLimitField = (group: LimitGroup) => (
     <FormField
       control={control}
-      name={name(key)}
+      name={name(group.rateLimitKey)}
       render={({ field }) => (
         <FormItem>
-          <FormLabel>{label}</FormLabel>
           <FormControl>
             <RateLimitArrayInput value={field.value ?? []} onChange={field.onChange} disabled={disabled} />
           </FormControl>
@@ -71,27 +95,30 @@ export const ClaimLimitFields = <T extends FieldValues>({
   );
 
   return (
-    <div className="space-y-4 rounded-md border p-4">
-      <FormLabel>
-        <Trans>Limits</Trans>
-      </FormLabel>
+    <div className="space-y-3">
+      <div>
+        <h3 className="font-semibold text-base">
+          <Trans>Limits</Trans>
+        </h3>
+        <p className="mt-1 text-muted-foreground text-sm">
+          <Trans>
+            Empty quota means unlimited, 0 blocks the resource. Rate limit windows accept values like 5m, 1h or 24h.
+          </Trans>
+        </p>
+      </div>
 
-      {renderQuotaField(
-        'documentQuota',
-        <Trans>Monthly document quota</Trans>,
-        <Trans>Empty = Unlimited, 0 = Blocked</Trans>,
-      )}
-      {renderRateLimitField('documentRateLimits', <Trans>Document rate limits</Trans>)}
+      <div className="overflow-hidden rounded-lg border">
+        <div className="grid grid-cols-1 divide-y divide-border md:grid-cols-3 md:divide-x md:divide-y-0">
+          {limitGroups.map((group) => (
+            <div key={group.quotaKey} className="space-y-4 p-4">
+              <h4 className="font-semibold text-sm">{group.title}</h4>
 
-      {renderQuotaField(
-        'emailQuota',
-        <Trans>Monthly email quota</Trans>,
-        <Trans>Empty = Unlimited, 0 = Blocked</Trans>,
-      )}
-      {renderRateLimitField('emailRateLimits', <Trans>Email rate limits</Trans>)}
-
-      {renderQuotaField('apiQuota', <Trans>Monthly API quota</Trans>, <Trans>Empty = Unlimited, 0 = Blocked</Trans>)}
-      {renderRateLimitField('apiRateLimits', <Trans>API rate limits</Trans>)}
+              {renderQuotaField(group)}
+              {renderRateLimitField(group)}
+            </div>
+          ))}
+        </div>
+      </div>
     </div>
   );
 };

apps/remix/app/components/general/document/document-audit-log-download-button.tsx

@@ -11,10 +11,10 @@ import { DownloadIcon } from 'lucide-react';
 
 export type DocumentAuditLogDownloadButtonProps = {
   className?: string;
-  envelopeId: string;
+  documentId: number;
 };
 
-export const DocumentAuditLogDownloadButton = ({ className, envelopeId }: DocumentAuditLogDownloadButtonProps) => {
+export const DocumentAuditLogDownloadButton = ({ className, documentId }: DocumentAuditLogDownloadButtonProps) => {
   const { toast } = useToast();
   const { _ } = useLingui();
 
@@ -22,7 +22,7 @@ export const DocumentAuditLogDownloadButton = ({ className, envelopeId }: Docume
 
   const onDownloadAuditLogsClick = async () => {
     try {
-      const { data, envelopeTitle } = await downloadAuditLogs({ envelopeId });
+      const { data, envelopeTitle } = await downloadAuditLogs({ documentId });
 
       const buffer = new Uint8Array(base64.decode(data));
       const blob = new Blob([buffer], { type: 'application/pdf' });

apps/remix/app/components/general/document/document-certificate-download-button.tsx

@@ -13,13 +13,13 @@ import { DownloadIcon } from 'lucide-react';
 
 export type DocumentCertificateDownloadButtonProps = {
   className?: string;
-  envelopeId: string;
+  documentId: number;
   documentStatus: DocumentStatus;
 };
 
 export const DocumentCertificateDownloadButton = ({
   className,
-  envelopeId,
+  documentId,
   documentStatus,
 }: DocumentCertificateDownloadButtonProps) => {
   const { toast } = useToast();
@@ -29,7 +29,7 @@ export const DocumentCertificateDownloadButton = ({
 
   const onDownloadCertificatesClick = async () => {
     try {
-      const { data, envelopeTitle } = await downloadCertificate({ envelopeId });
+      const { data, envelopeTitle } = await downloadCertificate({ documentId });
 
       const buffer = new Uint8Array(base64.decode(data));
       const blob = new Blob([buffer], { type: 'application/pdf' });

apps/remix/app/components/general/organisation-usage-panel.tsx

@@ -1,13 +1,38 @@
 import { currentMonthlyPeriod } from '@documenso/lib/universal/monthly-period';
+import {
+  getQuotaUsagePercent,
+  isQuotaExceeded,
+  isQuotaNearing,
+  normalizeCapacityLimit,
+} from '@documenso/lib/universal/quota-usage';
+import { cn } from '@documenso/ui/lib/utils';
+import type { BadgeProps } from '@documenso/ui/primitives/badge';
+import { Badge } from '@documenso/ui/primitives/badge';
 import { Progress } from '@documenso/ui/primitives/progress';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@documenso/ui/primitives/select';
 
 import { Trans } from '@lingui/react/macro';
 import type { OrganisationClaim, OrganisationMonthlyStat } from '@prisma/client';
-import { useState } from 'react';
-import { match } from 'ts-pattern';
+import type { LucideIcon } from 'lucide-react';
+import { FileIcon, MailIcon, MailOpenIcon, PlugIcon, UsersIcon, UsersRoundIcon } from 'lucide-react';
+import type { ReactNode } from 'react';
+import { useId, useState } from 'react';
+
 import { OrganisationUsageResetButton } from './organisation-usage-reset-button';
 
+type CapacityUsage = {
+  members: number;
+  teams: number;
+};
+
+type UsageRow = {
+  counter: 'document' | 'email' | 'api';
+  label: ReactNode;
+  icon: LucideIcon;
+  used: number;
+  effectiveLimit: number | null;
+};
+
 type OrganisationUsagePanelProps = {
   organisationId: string;
   monthlyStats: Pick<
@@ -15,13 +40,151 @@ type OrganisationUsagePanelProps = {
     'period' | 'documentCount' | 'emailCount' | 'apiCount' | 'emailReports'
   >[];
   organisationClaim: OrganisationClaim;
+  capacityUsage?: CapacityUsage;
+};
+
+type UsageCardState = {
+  status: {
+    label: ReactNode;
+    variant: NonNullable<BadgeProps['variant']>;
+  };
+  percent: number;
+  hasFiniteLimit: boolean;
+  progressClassName: string;
+  subtext: ReactNode;
+};
+
+type UsageCardStateOptions = {
+  used: number;
+  limit: number | null | undefined;
+  footnote?: ReactNode;
+};
+
+const getUsageCardState = ({ used, limit, footnote }: UsageCardStateOptions): UsageCardState => {
+  const percent = getQuotaUsagePercent(used, limit ?? null);
+  const hasFiniteLimit = Boolean(limit && limit > 0);
+
+  if (limit === null || limit === undefined) {
+    return {
+      status: { label: <Trans>Unlimited</Trans>, variant: 'neutral' },
+      percent,
+      hasFiniteLimit,
+      progressClassName: '',
+      subtext: footnote ?? null,
+    };
+  }
+
+  if (limit === 0) {
+    return {
+      status: { label: <Trans>Blocked</Trans>, variant: 'destructive' },
+      percent,
+      hasFiniteLimit,
+      progressClassName: '',
+      subtext: footnote ?? <Trans>Resource blocked</Trans>,
+    };
+  }
+
+  if (used > limit) {
+    return {
+      status: { label: <Trans>Exceeded</Trans>, variant: 'destructive' },
+      percent,
+      hasFiniteLimit,
+      progressClassName: '[&>div]:bg-destructive',
+      subtext: footnote ?? null,
+    };
+  }
+
+  if (isQuotaExceeded(limit, used)) {
+    return {
+      status: { label: <Trans>Limit reached</Trans>, variant: 'orange' },
+      percent,
+      hasFiniteLimit,
+      progressClassName: '[&>div]:bg-orange-500 dark:[&>div]:bg-orange-400',
+      subtext: footnote ?? null,
+    };
+  }
+
+  if (isQuotaNearing(limit, used)) {
+    return {
+      status: { label: <Trans>Near limit</Trans>, variant: 'warning' },
+      percent,
+      hasFiniteLimit,
+      progressClassName: '[&>div]:bg-yellow-500 dark:[&>div]:bg-yellow-400',
+      subtext: footnote ?? null,
+    };
+  }
+
+  return {
+    status: { label: <Trans>Within limit</Trans>, variant: 'default' },
+    percent,
+    hasFiniteLimit,
+    progressClassName: '',
+    subtext: footnote ?? null,
+  };
+};
+
+type UsageStatCardProps = {
+  label: ReactNode;
+  icon: LucideIcon;
+  used: number;
+  limit: number | null | undefined;
+  /** When true the card is a plain counter with no limit, status or progress. */
+  countOnly?: boolean;
+  footnote?: ReactNode;
+  action?: ReactNode;
+};
+
+const UsageStatCard = ({ label, icon: Icon, used, limit, countOnly = false, footnote, action }: UsageStatCardProps) => {
+  const { status, percent, hasFiniteLimit, progressClassName, subtext } = getUsageCardState({ used, limit, footnote });
+
+  return (
+    <div className="flex flex-col rounded-lg border bg-background p-5">
+      <div className="flex items-center justify-between gap-3">
+        <div className="flex items-center gap-2 font-medium text-foreground text-sm">
+          <Icon className="h-4 w-4 text-muted-foreground" />
+          <span>{label}</span>
+        </div>
+
+        {!countOnly && (
+          <Badge variant={status.variant} size="small">
+            {status.label}
+          </Badge>
+        )}
+      </div>
+
+      <div className="mt-4 flex flex-1 flex-col">
+        <div className="flex items-baseline justify-between gap-2">
+          <div className="flex items-baseline gap-1.5">
+            <span className="font-semibold text-3xl text-foreground tabular-nums tracking-tight">
+              {used.toLocaleString()}
+            </span>
+            {hasFiniteLimit ? (
+              <span className="text-base text-muted-foreground tabular-nums">/ {limit?.toLocaleString()}</span>
+            ) : null}
+          </div>
+
+          {hasFiniteLimit ? (
+            <span className="font-medium text-muted-foreground text-sm tabular-nums">{percent}%</span>
+          ) : null}
+        </div>
+
+        {hasFiniteLimit ? <Progress className={cn('mt-3 h-2', progressClassName)} value={percent} /> : null}
+
+        {subtext ? <p className="mt-2 text-muted-foreground text-xs">{subtext}</p> : null}
+      </div>
+
+      {action ? <div className="mt-4 flex justify-end border-t pt-4">{action}</div> : null}
+    </div>
+  );
 };
 
 export const OrganisationUsagePanel = ({
   organisationId,
   monthlyStats,
   organisationClaim,
+  capacityUsage,
 }: OrganisationUsagePanelProps) => {
+  const monthlyUsagePeriodId = useId();
   const [selectedPeriod, setSelectedPeriod] = useState<string | undefined>(() => monthlyStats[0]?.period);
 
   const selectedStat = monthlyStats.find((stat) => stat.period === selectedPeriod) ?? monthlyStats[0];
@@ -30,86 +193,105 @@ export const OrganisationUsagePanel = ({
   // current period), so only offer the reset action when viewing the current month.
   const isCurrentPeriod = selectedStat?.period === currentMonthlyPeriod();
 
-  const rows = [
+  const capacityRows = capacityUsage
+    ? [
+        {
+          key: 'members',
+          label: <Trans>Members</Trans>,
+          icon: UsersIcon,
+          used: capacityUsage.members,
+          limit: normalizeCapacityLimit(organisationClaim.memberCount),
+        },
+        {
+          key: 'teams',
+          label: <Trans>Teams</Trans>,
+          icon: UsersRoundIcon,
+          used: capacityUsage.teams,
+          limit: normalizeCapacityLimit(organisationClaim.teamCount),
+        },
+      ]
+    : [];
+
+  const monthlyRows: UsageRow[] = [
     {
-      counter: 'document' as const,
+      counter: 'document',
       label: <Trans>Documents</Trans>,
+      icon: FileIcon,
       used: selectedStat?.documentCount ?? 0,
       effectiveLimit: organisationClaim.documentQuota,
     },
     {
-      counter: 'email' as const,
+      counter: 'email',
       label: <Trans>Emails</Trans>,
+      icon: MailIcon,
       used: selectedStat?.emailCount ?? 0,
       effectiveLimit: organisationClaim.emailQuota,
     },
     {
-      counter: 'api' as const,
+      counter: 'api',
       label: <Trans>API requests</Trans>,
+      icon: PlugIcon,
       used: selectedStat?.apiCount ?? 0,
       effectiveLimit: organisationClaim.apiQuota,
     },
   ];
 
   return (
-    <div className="space-y-4 rounded-md border p-4">
-      <div className="flex items-center justify-between gap-2">
-        <h3 className="font-medium text-sm">
-          <Trans>Usage for period: {selectedStat?.period || 'N/A'}</Trans>
-        </h3>
+    <div className="mt-4 space-y-6">
+      {capacityRows.length > 0 ? (
+        <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 xl:grid-cols-3">
+          {capacityRows.map((row) => (
+            <UsageStatCard key={row.key} label={row.label} icon={row.icon} used={row.used} limit={row.limit} />
+          ))}
+        </div>
+      ) : null}
 
-        {monthlyStats.length > 0 && (
-          <Select value={selectedStat?.period} onValueChange={setSelectedPeriod}>
-            <SelectTrigger className="w-40">
-              <SelectValue />
-            </SelectTrigger>
-            <SelectContent>
-              {monthlyStats.map((stat) => (
-                <SelectItem key={stat.period} value={stat.period}>
-                  {stat.period}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
-        )}
-      </div>
+      <div className="space-y-3">
+        <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+          <h3 id={monthlyUsagePeriodId} className="font-semibold text-base">
+            <Trans>Monthly usage</Trans>
+          </h3>
 
-      {rows.map((row) => {
-        const percent =
-          row.effectiveLimit && row.effectiveLimit > 0
-            ? Math.min(100, Math.round((row.used / row.effectiveLimit) * 100))
-            : 0;
+          {monthlyStats.length > 0 ? (
+            <Select value={selectedStat?.period} onValueChange={setSelectedPeriod}>
+              <SelectTrigger className="h-9 w-full sm:w-44" aria-labelledby={monthlyUsagePeriodId}>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {monthlyStats.map((stat) => (
+                  <SelectItem key={stat.period} value={stat.period}>
+                    {stat.period}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          ) : null}
+        </div>
 
-        return (
-          <div key={row.counter} className="space-y-1">
-            <div className="flex items-center justify-between text-sm">
-              <span>{row.label}</span>
-              <span className="text-muted-foreground">
-                {row.used} /{' '}
-                {match(row.effectiveLimit)
-                  .with(null, () => <Trans>Unlimited</Trans>)
-                  .with(0, () => <Trans>Blocked</Trans>)
-                  .otherwise(String)}
-              </span>
-            </div>
+        <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 xl:grid-cols-3">
+          {monthlyRows.map((row) => (
+            <UsageStatCard
+              key={row.counter}
+              label={row.label}
+              icon={row.icon}
+              used={row.used}
+              limit={row.effectiveLimit}
+              action={
+                selectedStat && isCurrentPeriod ? (
+                  <OrganisationUsageResetButton organisationId={organisationId} counter={row.counter} />
+                ) : undefined
+              }
+            />
+          ))}
 
-            {row.effectiveLimit && row.effectiveLimit > 0 ? <Progress className="h-2 w-full" value={percent} /> : null}
-
-            {selectedStat && isCurrentPeriod && (
-              <div className="flex w-full justify-end pt-1">
-                <OrganisationUsageResetButton organisationId={organisationId} counter={row.counter} />
-              </div>
-            )}
-          </div>
-        );
-      })}
-
-      <div className="space-y-1">
-        <div className="flex items-center justify-between text-sm">
-          <span>
-            <Trans>Reports</Trans>
-          </span>
-          <span className="text-muted-foreground">{selectedStat?.emailReports ?? 0}</span>
+          <UsageStatCard
+            label={<Trans>Reports</Trans>}
+            icon={MailOpenIcon}
+            used={selectedStat?.emailReports ?? 0}
+            limit={null}
+            countOnly
+            footnote={<Trans>Sent this period</Trans>}
+          />
         </div>
       </div>
     </div>

apps/remix/app/components/general/organisation-usage-reset-button.tsx

@@ -2,6 +2,7 @@ import { trpc } from '@documenso/trpc/react';
 import { Button } from '@documenso/ui/primitives/button';
 import { useToast } from '@documenso/ui/primitives/use-toast';
 import { Trans, useLingui } from '@lingui/react/macro';
+import { RotateCcwIcon } from 'lucide-react';
 import { useRevalidator } from 'react-router';
 
 type OrganisationUsageResetButtonProps = {
@@ -32,6 +33,7 @@ export const OrganisationUsageResetButton = ({ organisationId, counter }: Organi
       loading={isPending}
       onClick={() => reset({ organisationId, counter })}
     >
+      <RotateCcwIcon className="mr-2 h-3.5 w-3.5" />
       <Trans>Reset</Trans>
     </Button>
   );

apps/remix/app/components/general/rate-limit-array-input.tsx

@@ -1,7 +1,9 @@
+import { RATE_LIMIT_WINDOW_REGEX } from '@documenso/lib/types/subscription';
 import { Button } from '@documenso/ui/primitives/button';
 import { Input } from '@documenso/ui/primitives/input';
-import { Trans } from '@lingui/react/macro';
+import { Trans, useLingui } from '@lingui/react/macro';
 import { PlusIcon, Trash2Icon } from 'lucide-react';
+import { useState } from 'react';
 
 type RateLimitEntryValue = { window: string; max: number };
 
@@ -11,50 +13,153 @@ type RateLimitArrayInputProps = {
   disabled?: boolean;
 };
 
+const EMPTY_ENTRY: RateLimitEntryValue = { window: '', max: 0 };
+
+/** A row counts as "started" once either field has input; fully-empty rows are dropped on commit. */
+const hasEntryInput = (entry: RateLimitEntryValue) => entry.window.trim() !== '' || entry.max > 0;
+
+/** Keep in-progress rows; drop rows that are completely empty. */
+const persistEntries = (entries: RateLimitEntryValue[]) => {
+  return entries.map((entry) => ({ ...entry, window: entry.window.trim() })).filter(hasEntryInput);
+};
+
 export const RateLimitArrayInput = ({ value, onChange, disabled }: RateLimitArrayInputProps) => {
-  const entries = value ?? [];
+  const { t } = useLingui();
+  const [draftEntry, setDraftEntry] = useState<RateLimitEntryValue | null>(null);
+
+  const entries = draftEntry ? [...value, draftEntry] : value.length ? value : [EMPTY_ENTRY];
+
+  const getWindowError = (entry: RateLimitEntryValue, index: number) => {
+    const window = entry.window.trim();
+
+    if (!hasEntryInput(entry)) {
+      return null;
+    }
+
+    if (window === '') {
+      return t`Enter a window, e.g. 5m`;
+    }
+
+    if (!RATE_LIMIT_WINDOW_REGEX.test(window)) {
+      return t`Use a duration with a unit, e.g. 5m, 1h, or 24h`;
+    }
+
+    const isDuplicateWindow = entries.some((otherEntry, otherIndex) => {
+      return otherIndex !== index && otherEntry.window.trim() === window;
+    });
+
+    return isDuplicateWindow ? t`Use a unique window for each rate limit` : null;
+  };
+
+  const getMaxError = (entry: RateLimitEntryValue) => {
+    if (!hasEntryInput(entry)) {
+      return null;
+    }
+
+    return entry.max > 0 ? null : t`Enter a max request count greater than 0`;
+  };
 
   const updateEntry = (index: number, patch: Partial<RateLimitEntryValue>) => {
-    const next = entries.map((entry, i) => (i === index ? { ...entry, ...patch } : entry));
-    onChange(next);
+    if (index >= value.length) {
+      const nextDraftEntry = { ...(draftEntry ?? EMPTY_ENTRY), ...patch };
+
+      if (hasEntryInput(nextDraftEntry)) {
+        onChange(persistEntries([...value, nextDraftEntry]));
+        setDraftEntry(null);
+        return;
+      }
+
+      setDraftEntry(nextDraftEntry);
+      return;
+    }
+
+    const next = value.map((entry, i) => (i === index ? { ...entry, ...patch } : entry));
+    onChange(persistEntries(next));
   };
 
   const removeEntry = (index: number) => {
-    onChange(entries.filter((_, i) => i !== index));
+    if (index >= value.length) {
+      setDraftEntry(null);
+      return;
+    }
+
+    const next = value.filter((_, i) => i !== index);
+    onChange(persistEntries(next));
   };
 
   const addEntry = () => {
-    onChange([...entries, { window: '5m', max: 100 }]);
+    setDraftEntry(EMPTY_ENTRY);
   };
 
+  const hasErrors = entries.some((entry, index) => getWindowError(entry, index) || getMaxError(entry));
+  const isAddDisabled = disabled || value.length === 0 || Boolean(draftEntry) || hasErrors;
+
   return (
     <div className="space-y-2">
-      {entries.map((entry, index) => (
-        <div key={index} className="flex items-center gap-2">
-          <Input
-            className="w-24"
-            placeholder="5m"
-            value={entry.window}
-            disabled={disabled}
-            onChange={(e) => updateEntry(index, { window: e.target.value })}
-          />
-          <Input
-            className="w-32"
-            type="number"
-            min={1}
-            value={entry.max}
-            disabled={disabled}
-            onChange={(e) => updateEntry(index, { max: parseInt(e.target.value, 10) || 0 })}
-          />
-          <Button type="button" variant="ghost" size="sm" disabled={disabled} onClick={() => removeEntry(index)}>
-            <Trash2Icon className="h-4 w-4" />
-          </Button>
-        </div>
-      ))}
+      <div className="flex items-center gap-2 text-muted-foreground text-xs">
+        <span className="w-20 shrink-0">
+          <Trans>Window</Trans>
+        </span>
+        <span className="flex-1">
+          <Trans>Max requests</Trans>
+        </span>
+        <span className="w-9 shrink-0" aria-hidden="true" />
+      </div>
 
-      <Button type="button" variant="secondary" size="sm" disabled={disabled} onClick={addEntry}>
+      {entries.map((entry, index) => {
+        const windowError = getWindowError(entry, index);
+        const maxError = getMaxError(entry);
+
+        return (
+          <div key={index} className="space-y-1">
+            <div className="flex items-center gap-2">
+              <Input
+                className="w-20 shrink-0"
+                placeholder="5m"
+                value={entry.window}
+                disabled={disabled}
+                aria-invalid={Boolean(windowError)}
+                onChange={(e) => updateEntry(index, { window: e.target.value })}
+              />
+              <Input
+                className="flex-1"
+                type="number"
+                min={1}
+                placeholder="100"
+                value={entry.max || ''}
+                disabled={disabled}
+                aria-invalid={Boolean(maxError)}
+                onChange={(e) => updateEntry(index, { max: parseInt(e.target.value, 10) || 0 })}
+              />
+              <Button
+                type="button"
+                variant="ghost"
+                size="sm"
+                className="h-9 w-9 shrink-0 p-0 text-muted-foreground hover:text-foreground"
+                disabled={disabled}
+                aria-label={t`Remove rate limit`}
+                onClick={() => removeEntry(index)}
+              >
+                <Trash2Icon className="h-4 w-4" />
+              </Button>
+            </div>
+
+            {windowError ? <p className="text-destructive text-xs">{windowError}</p> : null}
+            {maxError ? <p className="text-destructive text-xs">{maxError}</p> : null}
+          </div>
+        );
+      })}
+
+      <Button
+        type="button"
+        variant="outline"
+        size="sm"
+        className="w-full border-dashed"
+        disabled={isAddDisabled}
+        onClick={addEntry}
+      >
         <PlusIcon className="mr-2 h-4 w-4" />
-        <Trans>Add rate limit</Trans>
+        <Trans>Add rate limit window</Trans>
       </Button>
     </div>
   );

apps/remix/app/routes/_authenticated+/admin+/organisations.$id.tsx

@@ -8,6 +8,7 @@ import { getHighestOrganisationRoleInGroup } from '@documenso/lib/utils/organisa
 import { trpc } from '@documenso/trpc/react';
 import type { TGetAdminOrganisationResponse } from '@documenso/trpc/server/admin-router/get-admin-organisation.types';
 import { ZUpdateAdminOrganisationRequestSchema } from '@documenso/trpc/server/admin-router/update-admin-organisation.types';
+import { cn } from '@documenso/ui/lib/utils';
 import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from '@documenso/ui/primitives/accordion';
 import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
 import { Badge } from '@documenso/ui/primitives/badge';
@@ -30,7 +31,7 @@ import { useToast } from '@documenso/ui/primitives/use-toast';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { msg } from '@lingui/core/macro';
 import { Trans, useLingui } from '@lingui/react/macro';
-import { OrganisationMemberRole } from '@prisma/client';
+import { OrganisationMemberRole, SubscriptionStatus } from '@prisma/client';
 import { ExternalLinkIcon, InfoIcon, Loader } from 'lucide-react';
 import { useMemo } from 'react';
 import { useForm } from 'react-hook-form';
@@ -42,7 +43,6 @@ import { AdminOrganisationDeleteDialog } from '~/components/dialogs/admin-organi
 import { AdminOrganisationMemberDeleteDialog } from '~/components/dialogs/admin-organisation-member-delete-dialog';
 import { AdminOrganisationMemberUpdateDialog } from '~/components/dialogs/admin-organisation-member-update-dialog';
 import { AdminOrganisationSyncSubscriptionDialog } from '~/components/dialogs/admin-organisation-sync-subscription-dialog';
-import { DetailsCard, DetailsValue } from '~/components/general/admin-details';
 import { AdminGlobalSettingsSection } from '~/components/general/admin-global-settings-section';
 import { ClaimLimitFields } from '~/components/general/claim-limit-fields';
 import { GenericErrorLayout } from '~/components/general/generic-error-layout';
@@ -268,54 +268,32 @@ export default function OrganisationGroupSettingsPage({ params, loaderData }: Ro
 
       <GenericOrganisationAdminForm organisation={organisation} />
 
-      <div className="mt-6 rounded-lg border p-4">
-        <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-          <div>
-            <p className="font-medium text-sm">
-              <Trans>Organisation usage</Trans>
-            </p>
-            <p className="mt-1 text-muted-foreground text-sm">
-              <Trans>Current usage against organisation limits.</Trans>
-            </p>
-          </div>
-        </div>
+      <SettingsHeader
+        title={t`Organisation usage`}
+        subtitle={t`Current usage against organisation limits.`}
+        className="mt-6"
+        hideDivider
+      />
 
-        <div className="mt-4 grid grid-cols-1 gap-3 text-sm sm:grid-cols-2">
-          <DetailsCard label={<Trans>Members</Trans>}>
-            <DetailsValue>
-              {organisation.members.length} /{' '}
-              {organisation.organisationClaim.memberCount === 0
-                ? t`Unlimited`
-                : organisation.organisationClaim.memberCount}
-            </DetailsValue>
-          </DetailsCard>
-
-          <DetailsCard label={<Trans>Teams</Trans>}>
-            <DetailsValue>
-              {organisation.teams.length} /{' '}
-              {organisation.organisationClaim.teamCount === 0 ? t`Unlimited` : organisation.organisationClaim.teamCount}
-            </DetailsValue>
-          </DetailsCard>
-        </div>
-
-        <div className="mt-4">
-          <OrganisationUsagePanel
-            organisationId={organisation.id}
-            monthlyStats={organisation.monthlyStats}
-            organisationClaim={organisation.organisationClaim}
-          />
-        </div>
-      </div>
+      <OrganisationUsagePanel
+        organisationId={organisation.id}
+        monthlyStats={organisation.monthlyStats}
+        organisationClaim={organisation.organisationClaim}
+        capacityUsage={{
+          members: organisation.members.length,
+          teams: organisation.teams.length,
+        }}
+      />
 
       <div className="mt-6 rounded-lg border p-4">
         <Accordion type="single" collapsible>
           <AccordionItem value="global-settings" className="border-b-0">
             <AccordionTrigger className="py-0">
               <div className="text-left">
-                <p className="font-medium text-sm">
+                <p className="font-semibold text-base">
                   <Trans>Global Settings</Trans>
                 </p>
-                <p className="mt-1 font-normal text-muted-foreground text-sm">
+                <p className="mt-1 text-muted-foreground text-sm">
                   <Trans>Default settings applied to this organisation.</Trans>
                 </p>
               </div>
@@ -335,7 +313,15 @@ export default function OrganisationGroupSettingsPage({ params, loaderData }: Ro
         className="mt-16"
       />
 
-      <Alert className="my-6 flex flex-col justify-between p-6 sm:flex-row sm:items-center" variant="neutral">
+      <Alert
+        className={cn(
+          'my-6 flex flex-col justify-between p-6 sm:flex-row sm:items-center',
+          organisation.subscription?.status === SubscriptionStatus.ACTIVE &&
+            'border border-green-600/20 bg-green-50 dark:border-green-500/20 dark:bg-green-500/10',
+          organisation.subscription?.status === SubscriptionStatus.INACTIVE && 'opacity-60',
+        )}
+        variant="neutral"
+      >
         <div className="mb-4 sm:mb-0">
           <AlertTitle>
             <Trans>Subscription</Trans>
@@ -343,7 +329,12 @@ export default function OrganisationGroupSettingsPage({ params, loaderData }: Ro
 
           <AlertDescription className="mr-2">
             {organisation.subscription ? (
-              <span>{i18n._(SUBSCRIPTION_STATUS_MAP[organisation.subscription.status])} subscription found</span>
+              <span className="flex items-center gap-2">
+                {organisation.subscription.status === SubscriptionStatus.ACTIVE && (
+                  <span className="h-2 w-2 shrink-0 rounded-full bg-green-600 dark:bg-green-400" aria-hidden="true" />
+                )}
+                <span>{i18n._(SUBSCRIPTION_STATUS_MAP[organisation.subscription.status])} subscription found</span>
+              </span>
             ) : (
               <span>
                 <Trans>No subscription found</Trans>
@@ -356,6 +347,7 @@ export default function OrganisationGroupSettingsPage({ params, loaderData }: Ro
           <div>
             <Button
               variant="outline"
+              className="bg-background"
               loading={isCreatingStripeCustomer}
               onClick={async () => createStripeCustomer({ organisationId })}
             >
@@ -366,7 +358,7 @@ export default function OrganisationGroupSettingsPage({ params, loaderData }: Ro
 
         {organisation.customerId && !organisation.subscription && (
           <div>
-            <Button variant="outline" asChild>
+            <Button variant="outline" className="bg-background" asChild>
               <Link
                 target="_blank"
                 to={`https://dashboard.stripe.com/customers/${organisation.customerId}?create=subscription&subscription_default_customer=${organisation.customerId}`}
@@ -383,13 +375,13 @@ export default function OrganisationGroupSettingsPage({ params, loaderData }: Ro
             <AdminOrganisationSyncSubscriptionDialog
               organisationId={organisationId}
               trigger={
-                <Button variant="outline">
+                <Button variant="outline" className="bg-background">
                   <Trans>Sync Stripe subscription</Trans>
                 </Button>
               }
             />
 
-            <Button variant="outline" asChild>
+            <Button variant="outline" className="bg-background" asChild>
               <Link
                 target="_blank"
                 to={`https://dashboard.stripe.com/subscriptions/${organisation.subscription.planId}`}
@@ -406,21 +398,27 @@ export default function OrganisationGroupSettingsPage({ params, loaderData }: Ro
 
       <div className="mt-16 space-y-10">
         <div>
-          <label className="font-medium text-sm leading-none">
+          <h3 className="font-semibold text-base">
             <Trans>Organisation Members</Trans>
-          </label>
+          </h3>
+          <p className="mt-1 text-muted-foreground text-sm">
+            <Trans>People with access to this organisation.</Trans>
+          </p>
 
-          <div className="my-2">
+          <div className="mt-3">
             <DataTable columns={organisationMembersColumns} data={organisation.members} />
           </div>
         </div>
 
         <div>
-          <label className="font-medium text-sm leading-none">
+          <h3 className="font-semibold text-base">
             <Trans>Organisation Teams</Trans>
-          </label>
+          </h3>
+          <p className="mt-1 text-muted-foreground text-sm">
+            <Trans>Teams that belong to this organisation.</Trans>
+          </p>
 
-          <div className="my-2">
+          <div className="mt-3">
             <DataTable columns={teamsColumns} data={organisation.teams} />
           </div>
         </div>
@@ -648,7 +646,7 @@ const OrganisationAdminForm = ({ organisation, licenseFlags }: OrganisationAdmin
               <FormLabel className="flex items-center">
                 <Trans>Inherited subscription claim</Trans>
                 <Tooltip>
-                  <TooltipTrigger>
+                  <TooltipTrigger type="button">
                     <InfoIcon className="mx-2 h-4 w-4" />
                   </TooltipTrigger>
 
@@ -681,10 +679,15 @@ const OrganisationAdminForm = ({ organisation, licenseFlags }: OrganisationAdmin
                   </TooltipContent>
                 </Tooltip>
               </FormLabel>
-              <FormControl>
-                <Input disabled {...field} />
-              </FormControl>
-              <FormMessage />
+              <div className="rounded-lg border bg-muted/40 px-3 py-2.5 text-sm">
+                {field.value ? (
+                  <span className="font-mono text-foreground">{field.value}</span>
+                ) : (
+                  <span className="text-muted-foreground">
+                    <Trans>No inherited claim</Trans>
+                  </span>
+                )}
+              </div>
             </FormItem>
           )}
         />
@@ -715,108 +718,113 @@ const OrganisationAdminForm = ({ organisation, licenseFlags }: OrganisationAdmin
           )}
         />
 
-        <FormField
-          control={form.control}
-          name="claims.teamCount"
-          render={({ field }) => (
-            <FormItem>
-              <FormLabel>
-                <Trans>Team Count</Trans>
-              </FormLabel>
-              <FormControl>
-                <Input
-                  type="number"
-                  min={0}
-                  {...field}
-                  onChange={(e) => field.onChange(parseInt(e.target.value, 10) || 0)}
-                />
-              </FormControl>
-              <FormDescription>
-                <Trans>Number of teams allowed. 0 = Unlimited</Trans>
-              </FormDescription>
-              <FormMessage />
-            </FormItem>
-          )}
-        />
+        <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
+          <FormField
+            control={form.control}
+            name="claims.teamCount"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>
+                  <Trans>Team Count</Trans>
+                </FormLabel>
+                <FormControl>
+                  <Input
+                    type="number"
+                    min={0}
+                    {...field}
+                    onChange={(e) => field.onChange(parseInt(e.target.value, 10) || 0)}
+                  />
+                </FormControl>
+                <FormDescription>
+                  <Trans>Number of teams allowed. 0 = Unlimited</Trans>
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
 
-        <FormField
-          control={form.control}
-          name="claims.memberCount"
-          render={({ field }) => (
-            <FormItem>
-              <FormLabel>
-                <Trans>Member Count</Trans>
-              </FormLabel>
-              <FormControl>
-                <Input
-                  type="number"
-                  min={0}
-                  {...field}
-                  onChange={(e) => field.onChange(parseInt(e.target.value, 10) || 0)}
-                />
-              </FormControl>
-              <FormDescription>
-                <Trans>Number of members allowed. 0 = Unlimited</Trans>
-              </FormDescription>
-              <FormMessage />
-            </FormItem>
-          )}
-        />
+          <FormField
+            control={form.control}
+            name="claims.memberCount"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>
+                  <Trans>Member Count</Trans>
+                </FormLabel>
+                <FormControl>
+                  <Input
+                    type="number"
+                    min={0}
+                    {...field}
+                    onChange={(e) => field.onChange(parseInt(e.target.value, 10) || 0)}
+                  />
+                </FormControl>
+                <FormDescription>
+                  <Trans>Number of members allowed. 0 = Unlimited</Trans>
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
 
-        <FormField
-          control={form.control}
-          name="claims.envelopeItemCount"
-          render={({ field }) => (
-            <FormItem>
-              <FormLabel>
-                <Trans>Envelope Item Count</Trans>
-              </FormLabel>
-              <FormControl>
-                <Input
-                  type="number"
-                  min={1}
-                  {...field}
-                  onChange={(e) => field.onChange(parseInt(e.target.value, 10) || 0)}
-                />
-              </FormControl>
-              <FormDescription>
-                <Trans>Maximum number of uploaded files per envelope allowed</Trans>
-              </FormDescription>
-              <FormMessage />
-            </FormItem>
-          )}
-        />
+          <FormField
+            control={form.control}
+            name="claims.envelopeItemCount"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>
+                  <Trans>Envelope Item Count</Trans>
+                </FormLabel>
+                <FormControl>
+                  <Input
+                    type="number"
+                    min={1}
+                    {...field}
+                    onChange={(e) => field.onChange(parseInt(e.target.value, 10) || 0)}
+                  />
+                </FormControl>
+                <FormDescription>
+                  <Trans>Maximum number of uploaded files per envelope allowed</Trans>
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
 
-        <FormField
-          control={form.control}
-          name="claims.recipientCount"
-          render={({ field }) => (
-            <FormItem>
-              <FormLabel>
-                <Trans>Recipient Count</Trans>
-              </FormLabel>
-              <FormControl>
-                <Input
-                  type="number"
-                  min={0}
-                  {...field}
-                  onChange={(e) => field.onChange(parseInt(e.target.value, 10) || 0)}
-                />
-              </FormControl>
-              <FormDescription>
-                <Trans>Maximum number of recipients per document allowed. 0 = Unlimited</Trans>
-              </FormDescription>
-              <FormMessage />
-            </FormItem>
-          )}
-        />
+          <FormField
+            control={form.control}
+            name="claims.recipientCount"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>
+                  <Trans>Recipient Count</Trans>
+                </FormLabel>
+                <FormControl>
+                  <Input
+                    type="number"
+                    min={0}
+                    {...field}
+                    onChange={(e) => field.onChange(parseInt(e.target.value, 10) || 0)}
+                  />
+                </FormControl>
+                <FormDescription>
+                  <Trans>Maximum number of recipients per document allowed. 0 = Unlimited</Trans>
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+        </div>
 
         <div>
-          <FormLabel>
+          <h3 className="font-semibold text-base">
             <Trans>Feature Flags</Trans>
-          </FormLabel>
+          </h3>
+          <p className="mt-1 text-muted-foreground text-sm">
+            <Trans>Capabilities enabled for this organisation.</Trans>
+          </p>
 
-          <div className="mt-2 space-y-2 rounded-md border p-4">
+          <div className="mt-3 space-y-2 rounded-md border p-4">
             {Object.values(SUBSCRIPTION_CLAIM_FEATURE_FLAGS).map(({ key, label, isEnterprise }) => {
               const isRestrictedFeature = isEnterprise && !licenseFlags?.[key as keyof TLicenseClaim]; // eslint-disable-line @typescript-eslint/consistent-type-assertions
 

apps/remix/app/routes/_authenticated+/admin+/teams.$id.tsx

@@ -287,7 +287,11 @@ export default function AdminTeamPage({ params }: Route.ComponentProps) {
               </AccordionTrigger>
               <AccordionContent>
                 <div className="mt-4">
-                  <AdminGlobalSettingsSection settings={team.teamGlobalSettings} isTeam />
+                  <AdminGlobalSettingsSection
+                    settings={team.teamGlobalSettings}
+                    inheritedSettings={team.organisation.organisationGlobalSettings}
+                    isTeam
+                  />
                 </div>
               </AccordionContent>
             </AccordionItem>

apps/remix/app/routes/_authenticated+/t.$teamUrl+/documents.$id.logs.tsx

@@ -153,11 +153,11 @@ export default function DocumentsLogsPage({ loaderData }: Route.ComponentProps)
           <div className="mt-4 flex w-full flex-row sm:mt-0 sm:w-auto sm:self-end">
             <DocumentCertificateDownloadButton
               className="mr-2"
-              envelopeId={document.envelopeId}
+              documentId={document.id}
               documentStatus={document.status}
             />
 
-            <DocumentAuditLogDownloadButton envelopeId={document.envelopeId} />
+            <DocumentAuditLogDownloadButton documentId={document.id} />
           </div>
         </div>
       </div>

apps/remix/public/.well-known/security.txt

@@ -1,14 +1,7 @@
-# Report security vulnerabilities privately via GitHub Security Advisories (preferred).
-Contact: https://github.com/documenso/documenso/security/advisories/new
-
-# Alternatively, report critical issues privately by email.
-Contact: mailto:security@documenso.com
-
-# Security policy
-Policy: https://github.com/documenso/documenso/security/policy
-
-# General (non-security) issues
+# General Issues
 Contact: https://github.com/documenso/documenso/issues/new?assignees=&labels=bug&projects=&template=bug-report.yml
 
+# Report critical issues privately to let us take appropriate action before publishing.
+Contact: mailto:security@documenso.com
 Preferred-Languages: en
-Canonical: https://documenso.com/.well-known/security.txt
+Canonical: https://documenso.com/.well-known/security.txt

apps/remix/server/api/download/download.ts

@@ -1,52 +1,20 @@
-import { PDF_SIZE_A4_72PPI } from '@documenso/lib/constants/pdf';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { getEnvelopeById, getEnvelopeWhereInput } from '@documenso/lib/server-only/envelope/get-envelope-by-id';
-import { generateAuditLogPdf } from '@documenso/lib/server-only/pdf/generate-audit-log-pdf';
-import { generateCertificatePdf } from '@documenso/lib/server-only/pdf/generate-certificate-pdf';
+import { getEnvelopeById } from '@documenso/lib/server-only/envelope/get-envelope-by-id';
 import { getApiTokenByToken } from '@documenso/lib/server-only/public-api/get-api-token-by-token';
-import { isDocumentCompleted } from '@documenso/lib/utils/document';
 import { buildTeamWhereQuery } from '@documenso/lib/utils/teams';
 import { prisma } from '@documenso/prisma';
 import { sValidator } from '@hono/standard-validator';
-import { DocumentStatus, EnvelopeType } from '@prisma/client';
-import contentDisposition from 'content-disposition';
+import { EnvelopeType } from '@prisma/client';
 import { Hono } from 'hono';
 
 import type { HonoEnv } from '../../router';
 import { handleEnvelopeItemFileRequest } from '../files/files.helpers';
 import {
   ZDownloadDocumentRequestParamsSchema,
-  ZDownloadEnvelopeAuditLogPdfRequestParamsSchema,
-  ZDownloadEnvelopeCertificatePdfRequestParamsSchema,
   ZDownloadEnvelopeItemRequestParamsSchema,
   ZDownloadEnvelopeItemRequestQuerySchema,
 } from './download.types';
 
-/**
- * Resolve and validate an API token from the Authorization header.
- *
- * Supports both "Authorization: Bearer api_xxx" and "Authorization: api_xxx".
- */
-const resolveApiToken = async (authorizationHeader: string | undefined) => {
-  const [token] = (authorizationHeader || '').split('Bearer ').filter((s) => s.length > 0);
-
-  if (!token) {
-    throw new AppError(AppErrorCode.UNAUTHORIZED, {
-      message: 'API token was not provided',
-    });
-  }
-
-  const apiToken = await getApiTokenByToken({ token });
-
-  if (apiToken.user.disabled) {
-    throw new AppError(AppErrorCode.UNAUTHORIZED, {
-      message: 'User is disabled',
-    });
-  }
-
-  return apiToken;
-};
-
 export const downloadRoute = new Hono<HonoEnv>()
   /**
    * Download an envelope item by its ID.
@@ -62,8 +30,24 @@ export const downloadRoute = new Hono<HonoEnv>()
       try {
         const { envelopeItemId } = c.req.valid('param');
         const { version } = c.req.valid('query');
+        const authorizationHeader = c.req.header('authorization');
 
-        const apiToken = await resolveApiToken(c.req.header('authorization'));
+        // Support for both "Authorization: Bearer api_xxx" and "Authorization: api_xxx"
+        const [token] = (authorizationHeader || '').split('Bearer ').filter((s) => s.length > 0);
+
+        if (!token) {
+          throw new AppError(AppErrorCode.UNAUTHORIZED, {
+            message: 'API token was not provided',
+          });
+        }
+
+        const apiToken = await getApiTokenByToken({ token });
+
+        if (apiToken.user.disabled) {
+          throw new AppError(AppErrorCode.UNAUTHORIZED, {
+            message: 'User is disabled',
+          });
+        }
 
         logger.info({
           auth: 'api',
@@ -141,180 +125,6 @@ export const downloadRoute = new Hono<HonoEnv>()
       }
     },
   )
-  /**
-   * Download the audit log for a document as a PDF.
-   * Requires API key authentication via Authorization header.
-   */
-  .get(
-    '/envelope/:envelopeId/audit-log/pdf',
-    sValidator('param', ZDownloadEnvelopeAuditLogPdfRequestParamsSchema),
-    async (c) => {
-      const logger = c.get('logger');
-
-      try {
-        const { envelopeId } = c.req.valid('param');
-
-        const apiToken = await resolveApiToken(c.req.header('authorization'));
-
-        logger.info({
-          auth: 'api',
-          source: 'apiV2',
-          path: c.req.path,
-          userId: apiToken.user.id,
-          apiTokenId: apiToken.id,
-          envelopeId,
-        });
-
-        const envelope = await getEnvelopeById({
-          id: {
-            type: 'envelopeId',
-            id: envelopeId,
-          },
-          type: EnvelopeType.DOCUMENT,
-          userId: apiToken.user.id,
-          teamId: apiToken.teamId,
-        }).catch(() => null);
-
-        if (!envelope) {
-          return c.json({ error: 'Document not found' }, 404);
-        }
-
-        const auditLogPdf = await generateAuditLogPdf({
-          envelope,
-          recipients: envelope.recipients,
-          fields: envelope.fields,
-          language: envelope.documentMeta.language,
-          envelopeOwner: {
-            email: envelope.user.email,
-            name: envelope.user.name || '',
-          },
-          envelopeItems: envelope.envelopeItems.map((item) => item.title),
-          pageWidth: PDF_SIZE_A4_72PPI.width,
-          pageHeight: PDF_SIZE_A4_72PPI.height,
-        });
-
-        const result = await auditLogPdf.save();
-
-        const baseTitle = envelope.title.replace(/\.pdf$/i, '');
-
-        c.header('Content-Type', 'application/pdf');
-        c.header('Content-Disposition', contentDisposition(`${baseTitle}_audit-log.pdf`));
-        c.header('Cache-Control', 'no-cache, no-store, must-revalidate');
-
-        return c.body(result);
-      } catch (error) {
-        logger.error(error);
-
-        if (error instanceof AppError) {
-          const { status, body } = AppError.toRestAPIError(error);
-
-          return c.json({ error: body.message, code: error.code }, status);
-        }
-
-        return c.json({ error: 'Internal server error' }, 500);
-      }
-    },
-  )
-  /**
-   * Download the signing certificate for a completed document as a PDF.
-   * Requires API key authentication via Authorization header.
-   */
-  .get(
-    '/envelope/:envelopeId/certificate/pdf',
-    sValidator('param', ZDownloadEnvelopeCertificatePdfRequestParamsSchema),
-    async (c) => {
-      const logger = c.get('logger');
-
-      try {
-        const { envelopeId } = c.req.valid('param');
-
-        const apiToken = await resolveApiToken(c.req.header('authorization'));
-
-        logger.info({
-          auth: 'api',
-          source: 'apiV2',
-          path: c.req.path,
-          userId: apiToken.user.id,
-          apiTokenId: apiToken.id,
-          envelopeId,
-        });
-
-        const { envelopeWhereInput } = await getEnvelopeWhereInput({
-          id: {
-            type: 'envelopeId',
-            id: envelopeId,
-          },
-          type: EnvelopeType.DOCUMENT,
-          userId: apiToken.user.id,
-          teamId: apiToken.teamId,
-        });
-
-        const envelope = await prisma.envelope.findFirst({
-          where: envelopeWhereInput,
-          include: {
-            recipients: true,
-            fields: {
-              include: {
-                signature: true,
-              },
-            },
-            documentMeta: true,
-            user: {
-              select: {
-                email: true,
-                name: true,
-              },
-            },
-          },
-        });
-
-        if (!envelope) {
-          return c.json({ error: 'Document not found' }, 404);
-        }
-
-        // A cancelled document was never sealed/completed, so a signing certificate
-        // must not be generated for it.
-        if (!isDocumentCompleted(envelope.status) || envelope.status === DocumentStatus.CANCELLED) {
-          throw new AppError('DOCUMENT_NOT_COMPLETE', {
-            message: 'Document is not complete',
-          });
-        }
-
-        const certificatePdf = await generateCertificatePdf({
-          envelope,
-          recipients: envelope.recipients,
-          fields: envelope.fields,
-          language: envelope.documentMeta.language,
-          envelopeOwner: {
-            email: envelope.user.email,
-            name: envelope.user.name || '',
-          },
-          pageWidth: PDF_SIZE_A4_72PPI.width,
-          pageHeight: PDF_SIZE_A4_72PPI.height,
-        });
-
-        const result = await certificatePdf.save();
-
-        const baseTitle = envelope.title.replace(/\.pdf$/i, '');
-
-        c.header('Content-Type', 'application/pdf');
-        c.header('Content-Disposition', contentDisposition(`${baseTitle}_certificate.pdf`));
-        c.header('Cache-Control', 'no-cache, no-store, must-revalidate');
-
-        return c.body(result);
-      } catch (error) {
-        logger.error(error);
-
-        if (error instanceof AppError) {
-          const { status, body } = AppError.toRestAPIError(error);
-
-          return c.json({ error: body.message, code: error.code }, status);
-        }
-
-        return c.json({ error: 'Internal server error' }, 500);
-      }
-    },
-  )
   /**
    * Download a document by its ID.
    * Requires API key authentication via Authorization header.
@@ -324,8 +134,24 @@ export const downloadRoute = new Hono<HonoEnv>()
 
     try {
       const { documentId, version } = c.req.valid('param');
+      const authorizationHeader = c.req.header('authorization');
 
-      const apiToken = await resolveApiToken(c.req.header('authorization'));
+      // Support for both "Authorization: Bearer api_xxx" and "Authorization: api_xxx"
+      const [token] = (authorizationHeader || '').split('Bearer ').filter((s) => s.length > 0);
+
+      if (!token) {
+        throw new AppError(AppErrorCode.UNAUTHORIZED, {
+          message: 'API token was not provided',
+        });
+      }
+
+      const apiToken = await getApiTokenByToken({ token });
+
+      if (apiToken.user.disabled) {
+        throw new AppError(AppErrorCode.UNAUTHORIZED, {
+          message: 'User is disabled',
+        });
+      }
 
       logger.info({
         auth: 'api',
@@ -374,9 +200,11 @@ export const downloadRoute = new Hono<HonoEnv>()
       logger.error(error);
 
       if (error instanceof AppError) {
-        const { status, body } = AppError.toRestAPIError(error);
+        if (error.code === AppErrorCode.UNAUTHORIZED) {
+          return c.json({ error: error.message }, 401);
+        }
 
-        return c.json({ error: body.message, code: error.code }, status);
+        return c.json({ error: error.message }, 400);
       }
 
       return c.json({ error: 'Internal server error' }, 500);

apps/remix/server/api/download/download.types.ts

@@ -30,17 +30,3 @@ export const ZDownloadDocumentRequestParamsSchema = z.object({
 });
 
 export type TDownloadDocumentRequestParams = z.infer<typeof ZDownloadDocumentRequestParamsSchema>;
-
-export const ZDownloadEnvelopeAuditLogPdfRequestParamsSchema = z.object({
-  envelopeId: z.string().describe('The ID of the envelope to download the audit log for.'),
-});
-
-export type TDownloadEnvelopeAuditLogPdfRequestParams = z.infer<typeof ZDownloadEnvelopeAuditLogPdfRequestParamsSchema>;
-
-export const ZDownloadEnvelopeCertificatePdfRequestParamsSchema = z.object({
-  envelopeId: z.string().describe('The ID of the envelope to download the certificate for.'),
-});
-
-export type TDownloadEnvelopeCertificatePdfRequestParams = z.infer<
-  typeof ZDownloadEnvelopeCertificatePdfRequestParamsSchema
->;

package.json

@@ -35,6 +35,7 @@
     "with:env": "dotenv -e .env -e .env.local --",
     "reset:hard": "npm run clean && npm i && npm run prisma:generate",
     "precommit": "npm install && git add package.json package-lock.json",
+    "trigger:dev": "npm run with:env -- npx trigger-cli dev --handler-path=\"/api/jobs\"",
     "inngest:dev": "inngest dev -u http://localhost:3000/api/jobs",
     "make:version": "npm version --workspace @documenso/remix --include-workspace-root --no-git-tag-version -m \"v%s\"",
     "translate": "npm run translate:extract && npm run translate:compile",

packages/app-tests/e2e/organisations/organisation-permission-hierarchy.spec.ts

@@ -1,342 +0,0 @@
-import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
-import { generateDatabaseId, nanoid } from '@documenso/lib/universal/id';
-import { prisma } from '@documenso/prisma';
-import { seedOrganisationMembers } from '@documenso/prisma/seed/organisations';
-import { seedUser } from '@documenso/prisma/seed/users';
-import { expect, type Page, test } from '@playwright/test';
-import { OrganisationGroupType, type OrganisationMemberRole } from '@prisma/client';
-
-import { apiSignin } from '../fixtures/authentication';
-
-const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
-
-/**
- * Calls a tRPC mutation directly using the cookies of whoever is currently
- * signed in on the page context. This deliberately bypasses the UI: the
- * authorisation checks under test live on the server, and the UI may simply
- * hide a button rather than reject the request, which would mask a backend gap.
- */
-const trpcMutation = async (page: Page, procedure: string, input: Record<string, unknown>) => {
-  return await page.request.post(`${WEBAPP_BASE_URL}/api/trpc/${procedure}`, {
-    headers: { 'content-type': 'application/json' },
-    data: JSON.stringify({ json: input }),
-  });
-};
-
-const getOrganisationMember = async (userId: number, organisationId: string) => {
-  return await prisma.organisationMember.findFirstOrThrow({
-    where: {
-      userId,
-      organisationId,
-    },
-  });
-};
-
-const createCustomGroup = async (organisationId: string, organisationRole: OrganisationMemberRole) => {
-  return await prisma.organisationGroup.create({
-    data: {
-      id: generateDatabaseId('org_group'),
-      organisationId,
-      name: `custom-${organisationRole}-${nanoid()}`,
-      type: OrganisationGroupType.CUSTOM,
-      organisationRole,
-    },
-  });
-};
-
-const createPendingInvite = async (organisationId: string, organisationRole: OrganisationMemberRole) => {
-  return await prisma.organisationMemberInvite.create({
-    data: {
-      id: generateDatabaseId('member_invite'),
-      email: `invite-${nanoid()}@test.documenso.com`,
-      token: nanoid(32),
-      organisationId,
-      organisationRole,
-    },
-  });
-};
-
-test.describe('[ORGANISATION_PERMISSION_HIERARCHY]: member deletion', () => {
-  test('a manager cannot delete an admin via member.delete', async ({ page }) => {
-    const { organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [managerUser, adminUser] = await seedOrganisationMembers({
-      members: [
-        { name: 'Manager', organisationRole: 'MANAGER' },
-        { name: 'Admin', organisationRole: 'ADMIN' },
-      ],
-      organisationId: organisation.id,
-    });
-
-    const adminMember = await getOrganisationMember(adminUser.id, organisation.id);
-
-    await apiSignin({ page, email: managerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.member.delete', {
-      organisationId: organisation.id,
-      organisationMemberId: adminMember.id,
-    });
-
-    expect(res.ok()).toBeFalsy();
-
-    // The admin must still be a member of the organisation.
-    const stillExists = await prisma.organisationMember.findFirst({
-      where: { id: adminMember.id },
-    });
-
-    expect(stillExists).not.toBeNull();
-  });
-
-  test('a manager cannot delete an admin via member.deleteMany', async ({ page }) => {
-    const { organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [managerUser, adminUser] = await seedOrganisationMembers({
-      members: [
-        { name: 'Manager', organisationRole: 'MANAGER' },
-        { name: 'Admin', organisationRole: 'ADMIN' },
-      ],
-      organisationId: organisation.id,
-    });
-
-    const adminMember = await getOrganisationMember(adminUser.id, organisation.id);
-
-    await apiSignin({ page, email: managerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.member.deleteMany', {
-      organisationId: organisation.id,
-      organisationMemberIds: [adminMember.id],
-    });
-
-    expect(res.ok()).toBeFalsy();
-
-    const stillExists = await prisma.organisationMember.findFirst({
-      where: { id: adminMember.id },
-    });
-
-    expect(stillExists).not.toBeNull();
-  });
-
-  test('a manager cannot delete the organisation owner', async ({ page }) => {
-    const { user: ownerUser, organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [managerUser] = await seedOrganisationMembers({
-      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
-      organisationId: organisation.id,
-    });
-
-    const ownerMember = await getOrganisationMember(ownerUser.id, organisation.id);
-
-    await apiSignin({ page, email: managerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.member.deleteMany', {
-      organisationId: organisation.id,
-      organisationMemberIds: [ownerMember.id],
-    });
-
-    expect(res.ok()).toBeFalsy();
-
-    const stillExists = await prisma.organisationMember.findFirst({
-      where: { id: ownerMember.id },
-    });
-
-    expect(stillExists).not.toBeNull();
-  });
-
-  test('an admin cannot delete the organisation owner', async ({ page }) => {
-    const { user: ownerUser, organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [adminUser] = await seedOrganisationMembers({
-      members: [{ name: 'Admin', organisationRole: 'ADMIN' }],
-      organisationId: organisation.id,
-    });
-
-    const ownerMember = await getOrganisationMember(ownerUser.id, organisation.id);
-
-    await apiSignin({ page, email: adminUser.email });
-
-    const res = await trpcMutation(page, 'organisation.member.deleteMany', {
-      organisationId: organisation.id,
-      organisationMemberIds: [ownerMember.id],
-    });
-
-    expect(res.ok()).toBeFalsy();
-
-    const stillExists = await prisma.organisationMember.findFirst({
-      where: { id: ownerMember.id },
-    });
-
-    expect(stillExists).not.toBeNull();
-  });
-
-  test('a manager can still delete a regular member (positive control)', async ({ page }) => {
-    const { organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [managerUser, memberUser] = await seedOrganisationMembers({
-      members: [
-        { name: 'Manager', organisationRole: 'MANAGER' },
-        { name: 'Member', organisationRole: 'MEMBER' },
-      ],
-      organisationId: organisation.id,
-    });
-
-    const member = await getOrganisationMember(memberUser.id, organisation.id);
-
-    await apiSignin({ page, email: managerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.member.deleteMany', {
-      organisationId: organisation.id,
-      organisationMemberIds: [member.id],
-    });
-
-    expect(res.ok()).toBeTruthy();
-
-    const deleted = await prisma.organisationMember.findFirst({
-      where: { id: member.id },
-    });
-
-    expect(deleted).toBeNull();
-  });
-});
-
-test.describe('[ORGANISATION_PERMISSION_HIERARCHY]: group deletion', () => {
-  test('a manager cannot delete an admin-role group', async ({ page }) => {
-    const { organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [managerUser] = await seedOrganisationMembers({
-      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
-      organisationId: organisation.id,
-    });
-
-    const adminGroup = await createCustomGroup(organisation.id, 'ADMIN');
-
-    await apiSignin({ page, email: managerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.group.delete', {
-      organisationId: organisation.id,
-      groupId: adminGroup.id,
-    });
-
-    expect(res.ok()).toBeFalsy();
-
-    const stillExists = await prisma.organisationGroup.findFirst({
-      where: { id: adminGroup.id },
-    });
-
-    expect(stillExists).not.toBeNull();
-  });
-
-  test('a manager can delete a member-role group (positive control)', async ({ page }) => {
-    const { organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [managerUser] = await seedOrganisationMembers({
-      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
-      organisationId: organisation.id,
-    });
-
-    const memberGroup = await createCustomGroup(organisation.id, 'MEMBER');
-
-    await apiSignin({ page, email: managerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.group.delete', {
-      organisationId: organisation.id,
-      groupId: memberGroup.id,
-    });
-
-    expect(res.ok()).toBeTruthy();
-
-    const deleted = await prisma.organisationGroup.findFirst({
-      where: { id: memberGroup.id },
-    });
-
-    expect(deleted).toBeNull();
-  });
-});
-
-test.describe('[ORGANISATION_PERMISSION_HIERARCHY]: invite resend', () => {
-  test('a manager cannot resend an admin-role invite', async ({ page }) => {
-    const { organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [managerUser] = await seedOrganisationMembers({
-      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
-      organisationId: organisation.id,
-    });
-
-    const adminInvite = await createPendingInvite(organisation.id, 'ADMIN');
-
-    await apiSignin({ page, email: managerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.member.invite.resend', {
-      organisationId: organisation.id,
-      invitationId: adminInvite.id,
-    });
-
-    expect(res.ok()).toBeFalsy();
-  });
-
-  test('a manager can resend a member-role invite (positive control)', async ({ page }) => {
-    const { organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [managerUser] = await seedOrganisationMembers({
-      members: [{ name: 'Manager', organisationRole: 'MANAGER' }],
-      organisationId: organisation.id,
-    });
-
-    const memberInvite = await createPendingInvite(organisation.id, 'MEMBER');
-
-    await apiSignin({ page, email: managerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.member.invite.resend', {
-      organisationId: organisation.id,
-      invitationId: memberInvite.id,
-    });
-
-    expect(res.ok()).toBeTruthy();
-  });
-});
-
-test.describe('[ORGANISATION_PERMISSION_HIERARCHY]: leaving an organisation', () => {
-  test('the owner cannot leave without transferring ownership first', async ({ page }) => {
-    const { user: ownerUser, organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const ownerMember = await getOrganisationMember(ownerUser.id, organisation.id);
-
-    await apiSignin({ page, email: ownerUser.email });
-
-    const res = await trpcMutation(page, 'organisation.leave', {
-      organisationId: organisation.id,
-    });
-
-    expect(res.ok()).toBeFalsy();
-
-    const stillExists = await prisma.organisationMember.findFirst({
-      where: { id: ownerMember.id },
-    });
-
-    expect(stillExists).not.toBeNull();
-  });
-
-  test('a non-owner member can still leave (positive control)', async ({ page }) => {
-    const { organisation } = await seedUser({ isPersonalOrganisation: false });
-
-    const [memberUser] = await seedOrganisationMembers({
-      members: [{ name: 'Member', organisationRole: 'MEMBER' }],
-      organisationId: organisation.id,
-    });
-
-    const member = await getOrganisationMember(memberUser.id, organisation.id);
-
-    await apiSignin({ page, email: memberUser.email });
-
-    const res = await trpcMutation(page, 'organisation.leave', {
-      organisationId: organisation.id,
-    });
-
-    expect(res.ok()).toBeTruthy();
-
-    const deleted = await prisma.organisationMember.findFirst({
-      where: { id: member.id },
-    });
-
-    expect(deleted).toBeNull();
-  });
-});

packages/lib/server-only/rate-limit/compute-quota-flags.ts

@@ -1,4 +1,4 @@
-import { QUOTA_WARNING_THRESHOLD } from './get-quota-alert-kind';
+import { isQuotaExceeded, isQuotaNearing } from '../../universal/quota-usage';
 
 export type QuotaFlags = {
   isDocumentQuotaExceeded: boolean;
@@ -22,39 +22,6 @@ type ComputeQuotaFlagsOptions = {
   };
 };
 
-/**
- * A quota of `null` means unlimited (never exceeded). A quota of `0` means
- * blocked (always exceeded). Otherwise usage `>=` quota is exceeded.
- */
-const isQuotaExceeded = (quota: number | null, usage: number): boolean => {
-  if (quota === null) {
-    return false;
-  }
-
-  if (quota === 0) {
-    return true;
-  }
-
-  return usage >= quota;
-};
-
-/**
- * A counter is "nearing" its quota once usage reaches the warning threshold
- * (80% of the quota, rounded up) but has not yet been exceeded. Nearing and
- * exceeded are mutually exclusive per counter.
- */
-const isQuotaNearing = (quota: number | null, usage: number): boolean => {
-  if (quota === null || quota === 0) {
-    return false;
-  }
-
-  if (isQuotaExceeded(quota, usage)) {
-    return false;
-  }
-
-  return usage >= Math.ceil(quota * QUOTA_WARNING_THRESHOLD);
-};
-
 export const computeQuotaFlags = ({ quotas, usage }: ComputeQuotaFlagsOptions): QuotaFlags => {
   return {
     isDocumentQuotaExceeded: isQuotaExceeded(quotas.documentQuota, usage?.documentCount ?? 0),

packages/lib/server-only/rate-limit/get-quota-alert-kind.ts

@@ -1,4 +1,4 @@
-export const QUOTA_WARNING_THRESHOLD = 0.8;
+import { getQuotaWarningCount } from '../../universal/quota-usage';
 
 export type QuotaAlertKind = 'quota' | 'quotaNearing';
 
@@ -32,7 +32,7 @@ export const getQuotaAlertKind = (opts: GetQuotaAlertKindOptions): QuotaAlertKin
   // From here newCount < quota, so for tiny quotas (1-4) where the rounded-up
   // warning threshold equals the quota itself, the warning can never fire — the
   // exhausting request is handled by the quota branch above.
-  const warningCount = Math.ceil(quota * QUOTA_WARNING_THRESHOLD);
+  const warningCount = getQuotaWarningCount(quota);
 
   const didCrossWarning = newCount >= warningCount && previousCount < warningCount;
 

packages/lib/server-only/webhooks/assert-webhook-url.ts

@@ -71,17 +71,10 @@ const isBypassedHost = (url: string): boolean => {
 };
 
 /**
- * Assert that a webhook URL does not point at a private/loopback address,
- * checking both the literal host and its resolved DNS records. Throws an
- * AppError with WEBHOOK_INVALID_REQUEST if it does. Hosts listed in
- * NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS skip all checks.
+ * Asserts that a webhook URL does not resolve to a private or loopback
+ * address. Throws an AppError with WEBHOOK_INVALID_REQUEST if it does.
  *
- * This is best-effort, non-exhaustive SSRF defence, NOT a complete mitigation.
- * It does not cover DNS rebinding (the resolved address can change between this
- * check and the actual request), obscure IP encodings, or every IPv6 form, and
- * it fails open on lookup errors/timeouts (see the catch below). Network-level
- * SSRF protection (firewall/egress rules, blocking internal services and cloud
- * metadata endpoints) remains the responsibility of the deployment.
+ * Hosts listed in NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS skip all checks.
  */
 export const assertNotPrivateUrl = async (
   url: string,

packages/lib/server-only/webhooks/is-private-url.ts

@@ -3,11 +3,10 @@ import { z } from 'zod';
 const ZIpSchema = z.string().ip();
 
 /**
- * Synchronously check whether a URL's host is a known private/loopback address
- * (localhost, RFC 1918, link-local, loopback, etc.), regardless of protocol.
+ * Check whether a URL points to a known private/loopback address.
  *
- * Best-effort and non-exhaustive: unrecognised or unparseable hosts return
- * `false` (fail open). See `assertNotPrivateUrl` for the full SSRF caveats.
+ * Performs a synchronous check against known private hostnames and IP ranges.
+ * Works regardless of the URL protocol.
  */
 export const isPrivateUrl = (url: string): boolean => {
   try {

packages/lib/types/subscription.ts

@@ -6,14 +6,39 @@ import { z } from 'zod';
  *
  * Example: "5m", "1h", "1d"
  */
-export const ZRateLimitWindowSchema = z.string().regex(/^\d+[smhd]$/);
+export const RATE_LIMIT_WINDOW_REGEX = /^\d+[smhd]$/;
 
-export const ZRateLimitArraySchema = z.array(
-  z.object({
-    window: ZRateLimitWindowSchema,
-    max: z.number().int().positive(),
-  }),
-);
+const RATE_LIMIT_WINDOW_ERROR_MESSAGE = 'Use a duration with a unit, e.g. 5m, 1h, or 24h';
+const RATE_LIMIT_DUPLICATE_WINDOW_ERROR_MESSAGE = 'Use a unique window for each rate limit';
+
+export const ZRateLimitWindowSchema = z.string().trim().regex(RATE_LIMIT_WINDOW_REGEX, {
+  message: RATE_LIMIT_WINDOW_ERROR_MESSAGE,
+});
+
+export const ZRateLimitArraySchema = z
+  .array(
+    z.object({
+      window: ZRateLimitWindowSchema,
+      max: z.number().int().positive(),
+    }),
+  )
+  .superRefine((entries, ctx) => {
+    const windows = new Set<string>();
+
+    entries.forEach((entry, index) => {
+      const window = entry.window.trim();
+
+      if (windows.has(window)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: RATE_LIMIT_DUPLICATE_WINDOW_ERROR_MESSAGE,
+          path: [index, 'window'],
+        });
+      }
+
+      windows.add(window);
+    });
+  });
 
 export type TRateLimitArray = z.infer<typeof ZRateLimitArraySchema>;
 
@@ -52,7 +77,7 @@ export const ZClaimFlagsSchema = z.object({
   signingReminders: z.boolean().optional(),
 
   cscQesSigning: z.boolean().optional(),
-  
+
   /**
    * Controls whether an organisation is prevented from sending emails.
    *

packages/lib/universal/quota-usage.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  getQuotaUsagePercent,
+  getQuotaWarningCount,
+  isQuotaExceeded,
+  isQuotaNearing,
+  normalizeCapacityLimit,
+} from './quota-usage';
+
+describe('isQuotaExceeded', () => {
+  it('treats null quota as unlimited (never exceeded)', () => {
+    expect(isQuotaExceeded(null, 0)).toBe(false);
+    expect(isQuotaExceeded(null, 1_000_000)).toBe(false);
+  });
+
+  it('treats a zero quota as blocked (always exceeded)', () => {
+    expect(isQuotaExceeded(0, 0)).toBe(true);
+    expect(isQuotaExceeded(0, 5)).toBe(true);
+  });
+
+  it('is exceeded once usage reaches the quota (>= boundary)', () => {
+    expect(isQuotaExceeded(10, 9)).toBe(false);
+    expect(isQuotaExceeded(10, 10)).toBe(true);
+    expect(isQuotaExceeded(10, 11)).toBe(true);
+  });
+});
+
+describe('getQuotaWarningCount', () => {
+  it('rounds the 80% threshold up', () => {
+    expect(getQuotaWarningCount(10)).toBe(8);
+    expect(getQuotaWarningCount(100)).toBe(80);
+    // 5 * 0.8 = 4 exactly.
+    expect(getQuotaWarningCount(5)).toBe(4);
+    // 3 * 0.8 = 2.4 -> 3, so the warning count equals the quota itself.
+    expect(getQuotaWarningCount(3)).toBe(3);
+  });
+});
+
+describe('isQuotaNearing', () => {
+  it('is never nearing for unlimited or blocked quotas', () => {
+    expect(isQuotaNearing(null, 5)).toBe(false);
+    expect(isQuotaNearing(0, 5)).toBe(false);
+  });
+
+  it('is nearing from the warning threshold up to (but not including) the quota', () => {
+    expect(isQuotaNearing(10, 7)).toBe(false);
+    expect(isQuotaNearing(10, 8)).toBe(true);
+    expect(isQuotaNearing(10, 9)).toBe(true);
+  });
+
+  it('is not nearing once exceeded (nearing and exceeded are mutually exclusive)', () => {
+    expect(isQuotaNearing(10, 10)).toBe(false);
+    expect(isQuotaNearing(10, 11)).toBe(false);
+  });
+
+  it('can never fire for tiny quotas where the warning count equals the quota', () => {
+    // getQuotaWarningCount(3) === 3, so usage >= 3 is already exceeded.
+    expect(isQuotaNearing(3, 2)).toBe(false);
+    expect(isQuotaNearing(3, 3)).toBe(false);
+  });
+
+  it('agrees with the warning-count helper at the boundary', () => {
+    const quota = 250;
+    const warningCount = getQuotaWarningCount(quota);
+
+    expect(isQuotaNearing(quota, warningCount - 1)).toBe(false);
+    expect(isQuotaNearing(quota, warningCount)).toBe(true);
+  });
+});
+
+describe('getQuotaUsagePercent', () => {
+  it('returns 0 for unlimited or non-positive quotas', () => {
+    expect(getQuotaUsagePercent(5, null)).toBe(0);
+    expect(getQuotaUsagePercent(5, 0)).toBe(0);
+    expect(getQuotaUsagePercent(5, -10)).toBe(0);
+  });
+
+  it('rounds the percentage to the nearest integer', () => {
+    expect(getQuotaUsagePercent(1, 3)).toBe(33);
+    expect(getQuotaUsagePercent(2, 3)).toBe(67);
+    expect(getQuotaUsagePercent(50, 100)).toBe(50);
+  });
+
+  it('clamps the percentage to 100 when usage exceeds the quota', () => {
+    expect(getQuotaUsagePercent(150, 100)).toBe(100);
+  });
+});
+
+describe('normalizeCapacityLimit', () => {
+  it('maps 0 (unlimited for capacity limits) to null', () => {
+    expect(normalizeCapacityLimit(0)).toBeNull();
+  });
+
+  it('passes positive limits through unchanged', () => {
+    expect(normalizeCapacityLimit(1)).toBe(1);
+    expect(normalizeCapacityLimit(25)).toBe(25);
+  });
+});

packages/lib/universal/quota-usage.ts

@@ -0,0 +1,57 @@
+export const QUOTA_WARNING_THRESHOLD = 0.8;
+
+/**
+ * Monthly quotas: `null` = unlimited, `0` = blocked. Usage `>=` quota is exceeded.
+ */
+export const isQuotaExceeded = (quota: number | null, usage: number): boolean => {
+  if (quota === null) {
+    return false;
+  }
+
+  if (quota === 0) {
+    return true;
+  }
+
+  return usage >= quota;
+};
+
+/**
+ * The usage count at which a positive quota starts "nearing" (80% rounded up).
+ * The single source for the warning threshold math so the UI panel, quota flags,
+ * and the per-request alert path can't drift apart.
+ */
+export const getQuotaWarningCount = (quota: number): number => {
+  return Math.ceil(quota * QUOTA_WARNING_THRESHOLD);
+};
+
+/**
+ * Nearing once usage reaches the warning threshold (80% rounded up) but is not exceeded.
+ */
+export const isQuotaNearing = (quota: number | null, usage: number): boolean => {
+  if (quota === null || quota === 0) {
+    return false;
+  }
+
+  if (isQuotaExceeded(quota, usage)) {
+    return false;
+  }
+
+  return usage >= getQuotaWarningCount(quota);
+};
+
+export const getQuotaUsagePercent = (usage: number, quota: number | null): number => {
+  if (quota === null || quota <= 0) {
+    return 0;
+  }
+
+  return Math.min(100, Math.round((usage / quota) * 100));
+};
+
+/** Member/team capacity limits use `0` for unlimited. */
+export const normalizeCapacityLimit = (limit: number): number | null => {
+  if (limit === 0) {
+    return null;
+  }
+
+  return limit;
+};

packages/trpc/server/admin-router/get-admin-team.ts

@@ -30,6 +30,7 @@ export const getAdminTeamRoute = adminProcedure
             name: true,
             url: true,
             ownerUserId: true,
+            organisationGlobalSettings: true,
           },
         },
         teamEmail: true,

packages/trpc/server/admin-router/get-admin-team.types.ts

@@ -1,5 +1,6 @@
 import { OrganisationMemberRoleSchema } from '@documenso/prisma/generated/zod/inputTypeSchemas/OrganisationMemberRoleSchema';
 import { TeamMemberRoleSchema } from '@documenso/prisma/generated/zod/inputTypeSchemas/TeamMemberRoleSchema';
+import OrganisationGlobalSettingsSchema from '@documenso/prisma/generated/zod/modelSchema/OrganisationGlobalSettingsSchema';
 import OrganisationMemberInviteSchema from '@documenso/prisma/generated/zod/modelSchema/OrganisationMemberInviteSchema';
 import OrganisationMemberSchema from '@documenso/prisma/generated/zod/modelSchema/OrganisationMemberSchema';
 import OrganisationSchema from '@documenso/prisma/generated/zod/modelSchema/OrganisationSchema';
@@ -19,6 +20,8 @@ export const ZGetAdminTeamResponseSchema = TeamSchema.extend({
     name: true,
     url: true,
     ownerUserId: true,
+  }).extend({
+    organisationGlobalSettings: OrganisationGlobalSettingsSchema,
   }),
   teamEmail: TeamEmailSchema.nullable(),
   teamGlobalSettings: TeamGlobalSettingsSchema.nullable(),

packages/trpc/server/document-router/download-document-audit-logs.ts

@@ -15,18 +15,18 @@ export const downloadDocumentAuditLogsRoute = authenticatedProcedure
   .output(ZDownloadDocumentAuditLogsResponseSchema)
   .mutation(async ({ input, ctx }) => {
     const { teamId } = ctx;
-    const { envelopeId } = input;
+    const { documentId } = input;
 
     ctx.logger.info({
       input: {
-        envelopeId,
+        documentId,
       },
     });
 
     const envelope = await getEnvelopeById({
       id: {
-        type: 'envelopeId',
-        id: envelopeId,
+        type: 'documentId',
+        id: documentId,
       },
       type: EnvelopeType.DOCUMENT,
       userId: ctx.user.id,
@@ -55,8 +55,10 @@ export const downloadDocumentAuditLogsRoute = authenticatedProcedure
 
     const result = await certificatePdf.save();
 
+    const base64 = Buffer.from(result).toString('base64');
+
     return {
-      data: Buffer.from(result).toString('base64'),
+      data: base64,
       envelopeTitle: envelope.title,
     };
   });

packages/trpc/server/document-router/download-document-audit-logs.types.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 
 export const ZDownloadDocumentAuditLogsRequestSchema = z.object({
-  envelopeId: z.string(),
+  documentId: z.number(),
 });
 
 export const ZDownloadDocumentAuditLogsResponseSchema = z.object({

packages/trpc/server/document-router/download-document-certificate.ts

@@ -17,18 +17,18 @@ export const downloadDocumentCertificateRoute = authenticatedProcedure
   .output(ZDownloadDocumentCertificateResponseSchema)
   .mutation(async ({ input, ctx }) => {
     const { teamId } = ctx;
-    const { envelopeId } = input;
+    const { documentId } = input;
 
     ctx.logger.info({
       input: {
-        envelopeId,
+        documentId,
       },
     });
 
     const { envelopeWhereInput } = await getEnvelopeWhereInput({
       id: {
-        type: 'envelopeId',
-        id: envelopeId,
+        type: 'documentId',
+        id: documentId,
       },
       type: EnvelopeType.DOCUMENT,
       userId: ctx.user.id,
@@ -81,8 +81,10 @@ export const downloadDocumentCertificateRoute = authenticatedProcedure
 
     const result = await certificatePdf.save();
 
+    const base64 = Buffer.from(result).toString('base64');
+
     return {
-      data: Buffer.from(result).toString('base64'),
+      data: base64,
       envelopeTitle: envelope.title,
     };
   });

packages/trpc/server/document-router/download-document-certificate.types.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 
 export const ZDownloadDocumentCertificateRequestSchema = z.object({
-  envelopeId: z.string(),
+  documentId: z.number(),
 });
 
 export const ZDownloadDocumentCertificateResponseSchema = z.object({

packages/trpc/server/envelope-router/download-envelope-audit-log-pdf.ts

@@ -1,23 +0,0 @@
-import { authenticatedProcedure } from '../trpc';
-import {
-  downloadEnvelopeAuditLogPdfMeta,
-  ZDownloadEnvelopeAuditLogPdfRequestSchema,
-  ZDownloadEnvelopeAuditLogPdfResponseSchema,
-} from './download-envelope-audit-log-pdf.types';
-
-export const downloadEnvelopeAuditLogPdfRoute = authenticatedProcedure
-  .meta(downloadEnvelopeAuditLogPdfMeta)
-  .input(ZDownloadEnvelopeAuditLogPdfRequestSchema)
-  .output(ZDownloadEnvelopeAuditLogPdfResponseSchema)
-  .query(({ input, ctx }) => {
-    const { envelopeId } = input;
-
-    ctx.logger.info({
-      input: {
-        envelopeId,
-      },
-    });
-
-    // This endpoint is purely for V2 API, which is implemented in the Hono remix server.
-    throw new Error('NOT_IMPLEMENTED');
-  });

packages/trpc/server/envelope-router/download-envelope-audit-log-pdf.types.ts

@@ -1,25 +0,0 @@
-import { z } from 'zod';
-
-import type { TrpcRouteMeta } from '../trpc';
-
-export const downloadEnvelopeAuditLogPdfMeta: TrpcRouteMeta = {
-  openapi: {
-    method: 'GET',
-    path: '/envelope/{envelopeId}/audit-log/pdf',
-    summary: 'Download envelope audit log PDF',
-    description: 'Download the audit log for a document as a PDF.',
-    tags: ['Envelope'],
-    responseHeaders: z.object({
-      'Content-Type': z.literal('application/pdf'),
-    }),
-  },
-};
-
-export const ZDownloadEnvelopeAuditLogPdfRequestSchema = z.object({
-  envelopeId: z.string().describe('The ID of the envelope to download the audit log for.'),
-});
-
-export const ZDownloadEnvelopeAuditLogPdfResponseSchema = z.instanceof(Uint8Array);
-
-export type TDownloadEnvelopeAuditLogPdfRequest = z.infer<typeof ZDownloadEnvelopeAuditLogPdfRequestSchema>;
-export type TDownloadEnvelopeAuditLogPdfResponse = z.infer<typeof ZDownloadEnvelopeAuditLogPdfResponseSchema>;

packages/trpc/server/envelope-router/download-envelope-certificate-pdf.ts

@@ -1,23 +0,0 @@
-import { authenticatedProcedure } from '../trpc';
-import {
-  downloadEnvelopeCertificatePdfMeta,
-  ZDownloadEnvelopeCertificatePdfRequestSchema,
-  ZDownloadEnvelopeCertificatePdfResponseSchema,
-} from './download-envelope-certificate-pdf.types';
-
-export const downloadEnvelopeCertificatePdfRoute = authenticatedProcedure
-  .meta(downloadEnvelopeCertificatePdfMeta)
-  .input(ZDownloadEnvelopeCertificatePdfRequestSchema)
-  .output(ZDownloadEnvelopeCertificatePdfResponseSchema)
-  .query(({ input, ctx }) => {
-    const { envelopeId } = input;
-
-    ctx.logger.info({
-      input: {
-        envelopeId,
-      },
-    });
-
-    // This endpoint is purely for V2 API, which is implemented in the Hono remix server.
-    throw new Error('NOT_IMPLEMENTED');
-  });

packages/trpc/server/envelope-router/download-envelope-certificate-pdf.types.ts

@@ -1,25 +0,0 @@
-import { z } from 'zod';
-
-import type { TrpcRouteMeta } from '../trpc';
-
-export const downloadEnvelopeCertificatePdfMeta: TrpcRouteMeta = {
-  openapi: {
-    method: 'GET',
-    path: '/envelope/{envelopeId}/certificate/pdf',
-    summary: 'Download envelope certificate PDF',
-    description: 'Download the signing certificate for a completed document as a PDF.',
-    tags: ['Envelope'],
-    responseHeaders: z.object({
-      'Content-Type': z.literal('application/pdf'),
-    }),
-  },
-};
-
-export const ZDownloadEnvelopeCertificatePdfRequestSchema = z.object({
-  envelopeId: z.string().describe('The ID of the envelope to download the certificate for.'),
-});
-
-export const ZDownloadEnvelopeCertificatePdfResponseSchema = z.instanceof(Uint8Array);
-
-export type TDownloadEnvelopeCertificatePdfRequest = z.infer<typeof ZDownloadEnvelopeCertificatePdfRequestSchema>;
-export type TDownloadEnvelopeCertificatePdfResponse = z.infer<typeof ZDownloadEnvelopeCertificatePdfResponseSchema>;

packages/trpc/server/envelope-router/router.ts

@@ -12,8 +12,6 @@ import { createEnvelopeItemsRoute } from './create-envelope-items';
 import { deleteEnvelopeRoute } from './delete-envelope';
 import { deleteEnvelopeItemRoute } from './delete-envelope-item';
 import { distributeEnvelopeRoute } from './distribute-envelope';
-import { downloadEnvelopeAuditLogPdfRoute } from './download-envelope-audit-log-pdf';
-import { downloadEnvelopeCertificatePdfRoute } from './download-envelope-certificate-pdf';
 import { downloadEnvelopeItemRoute } from './download-envelope-item';
 import { duplicateEnvelopeRoute } from './duplicate-envelope';
 import { createEnvelopeFieldsRoute } from './envelope-fields/create-envelope-fields';
@@ -87,10 +85,6 @@ export const envelopeRouter = router({
   find: findEnvelopesRoute,
   auditLog: {
     find: findEnvelopeAuditLogsRoute,
-    downloadPdf: downloadEnvelopeAuditLogPdfRoute,
-  },
-  certificate: {
-    downloadPdf: downloadEnvelopeCertificatePdfRoute,
   },
   bulk: {
     move: bulkMoveEnvelopesRoute,

packages/trpc/server/organisation-router/delete-organisation-group.ts

@@ -1,7 +1,6 @@
 import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/organisations';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { getMemberOrganisationRole } from '@documenso/lib/server-only/team/get-member-roles';
-import { buildOrganisationWhereQuery, isOrganisationRoleWithinUserHierarchy } from '@documenso/lib/utils/organisations';
+import { buildOrganisationWhereQuery } from '@documenso/lib/utils/organisations';
 import { prisma } from '@documenso/prisma';
 import { OrganisationGroupType } from '@prisma/client';
 
@@ -60,22 +59,6 @@ export const deleteOrganisationGroupRoute = authenticatedProcedure
       });
     }
 
-    const currentUserOrganisationRole = await getMemberOrganisationRole({
-      organisationId,
-      reference: {
-        type: 'User',
-        id: user.id,
-      },
-    });
-
-    // A user cannot delete a group whose role is higher than their own
-    // (e.g. a manager deleting an admin-role group).
-    if (!isOrganisationRoleWithinUserHierarchy(currentUserOrganisationRole, group.organisationRole)) {
-      throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'You are not allowed to delete this organisation group',
-      });
-    }
-
     await prisma.organisationGroup.delete({
       where: {
         id: groupId,

packages/trpc/server/organisation-router/delete-organisation-members.ts

@@ -1,15 +1,8 @@
 import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
-import {
-  ORGANISATION_MEMBER_ROLE_HIERARCHY,
-  ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP,
-} from '@documenso/lib/constants/organisations';
+import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/organisations';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { jobs } from '@documenso/lib/jobs/client';
-import {
-  buildOrganisationWhereQuery,
-  getHighestOrganisationRoleInGroup,
-  isOrganisationRoleWithinUserHierarchy,
-} from '@documenso/lib/utils/organisations';
+import { buildOrganisationWhereQuery } from '@documenso/lib/utils/organisations';
 import { prisma } from '@documenso/prisma';
 import { OrganisationMemberInviteStatus } from '@documenso/prisma/client';
 
@@ -67,12 +60,9 @@ export const deleteOrganisationMembers = async ({
         },
       },
       members: {
-        include: {
-          organisationGroupMembers: {
-            include: {
-              group: true,
-            },
-          },
+        select: {
+          id: true,
+          userId: true,
         },
       },
       invites: {
@@ -94,41 +84,6 @@ export const deleteOrganisationMembers = async ({
 
   const membersToDelete = organisation.members.filter((member) => organisationMemberIds.includes(member.id));
 
-  const currentUserMember = organisation.members.find((member) => member.userId === userId);
-
-  if (!currentUserMember) {
-    throw new AppError(AppErrorCode.UNAUTHORIZED);
-  }
-
-  const currentUserOrganisationRole = getHighestOrganisationRoleInGroup(
-    currentUserMember.organisationGroupMembers.map(({ group }) => group),
-  );
-
-  // The roles the current user is allowed to act on (their own role and below).
-  const manageableOrganisationRoles = ORGANISATION_MEMBER_ROLE_HIERARCHY[currentUserOrganisationRole];
-
-  for (const member of membersToDelete) {
-    // The organisation owner can never be removed via this route. Ownership must
-    // be transferred first (mirrors the admin and update-member routes).
-    if (member.userId === organisation.ownerUserId) {
-      throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'Cannot remove the organisation owner',
-      });
-    }
-
-    const memberOrganisationRole = getHighestOrganisationRoleInGroup(
-      member.organisationGroupMembers.map(({ group }) => group),
-    );
-
-    // A user cannot remove a member whose role is higher than their own
-    // (e.g. a manager removing an admin).
-    if (!isOrganisationRoleWithinUserHierarchy(currentUserOrganisationRole, memberOrganisationRole)) {
-      throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'Cannot remove a member with a higher role',
-      });
-    }
-  }
-
   const inviteCount = organisation.invites.length;
   const newMemberCount = organisation.members.length + inviteCount - membersToDelete.length;
 
@@ -168,18 +123,6 @@ export const deleteOrganisationMembers = async ({
           in: organisationMemberIds,
         },
         organisationId,
-        userId: {
-          not: organisation.ownerUserId,
-        },
-        organisationGroupMembers: {
-          none: {
-            group: {
-              organisationRole: {
-                notIn: manageableOrganisationRoles,
-              },
-            },
-          },
-        },
       },
     });
   });

packages/trpc/server/organisation-router/leave-organisation.ts

@@ -51,14 +51,6 @@ export const leaveOrganisationRoute = authenticatedProcedure
       throw new AppError(AppErrorCode.NOT_FOUND);
     }
 
-    // The organisation owner cannot leave their own organisation. Ownership must
-    // be transferred to another member first.
-    if (organisation.ownerUserId === userId) {
-      throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'You cannot leave an organisation you own. Please transfer ownership first.',
-      });
-    }
-
     const { organisationClaim } = organisation;
 
     const inviteCount = organisation.invites.length;

packages/trpc/server/organisation-router/resend-organisation-member-invite.ts

@@ -1,8 +1,7 @@
 import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/organisations';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { sendOrganisationMemberInviteEmail } from '@documenso/lib/server-only/organisation/create-organisation-member-invites';
-import { getMemberOrganisationRole } from '@documenso/lib/server-only/team/get-member-roles';
-import { buildOrganisationWhereQuery, isOrganisationRoleWithinUserHierarchy } from '@documenso/lib/utils/organisations';
+import { buildOrganisationWhereQuery } from '@documenso/lib/utils/organisations';
 import { prisma } from '@documenso/prisma';
 
 import { authenticatedProcedure } from '../trpc';
@@ -98,21 +97,6 @@ export const resendOrganisationMemberInvitation = async ({
     });
   }
 
-  const currentUserOrganisationRole = await getMemberOrganisationRole({
-    organisationId: organisation.id,
-    reference: {
-      type: 'User',
-      id: userId,
-    },
-  });
-
-  // A user cannot interact with an invitation that is not within their own hierarchy.
-  if (!isOrganisationRoleWithinUserHierarchy(currentUserOrganisationRole, invitation.organisationRole)) {
-    throw new AppError(AppErrorCode.UNAUTHORIZED, {
-      message: 'You cannot resend an invite for a member with a higher role',
-    });
-  }
-
   await sendOrganisationMemberInviteEmail({
     email: invitation.email,
     token: invitation.token,

render.yaml

@@ -10,7 +10,7 @@ services:
     envVars:
       # Node Version
       - key: NODE_VERSION
-        value: 22.13.0
+        value: 18.17.0
 
       - key: PORT
         value: 10000

tsconfig.eslint.json

@@ -0,0 +1,4 @@
+{
+  "extends": "./packages/tsconfig/base.json",
+  "include": ["packages/**/*", "apps/**/*"]
+}