Merge branch 'main' into fix/branding-preferences-form-validation-messages

Strip encryption from PDFs that open with an empty user password via
libpdf's ignorePermissions, still rejecting user-password PDFs.

Upgrade @libpdf/core to 0.5.1, which also keeps overlapping and layered
text intact during text extraction.

Resolves #3303

apps/remix/app/components/dialogs/envelope-item-edit-dialog.tsx

@@ -122,7 +122,7 @@ export const EnvelopeItemEditDialog = ({
 
       toast({
         title: t`Failed to read file`,
-        description: t`The file is not a valid PDF.`,
+        description: t`The file is not a valid PDF or is password protected.`,
         variant: 'destructive',
       });
     }

apps/remix/app/components/forms/branding-preferences-form.tsx

@@ -12,11 +12,20 @@ import { cn } from '@documenso/ui/lib/utils';
 import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from '@documenso/ui/primitives/accordion';
 import { Button } from '@documenso/ui/primitives/button';
 import { ColorPicker } from '@documenso/ui/primitives/color-picker';
-import { Form, FormControl, FormDescription, FormField, FormItem, FormLabel } from '@documenso/ui/primitives/form/form';
+import {
+  Form,
+  FormControl,
+  FormDescription,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from '@documenso/ui/primitives/form/form';
 import { Input } from '@documenso/ui/primitives/input';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@documenso/ui/primitives/select';
 import { Textarea } from '@documenso/ui/primitives/textarea';
 import { zodResolver } from '@hookform/resolvers/zod';
+import { msg } from '@lingui/core/macro';
 import { Trans, useLingui } from '@lingui/react/macro';
 import type { TeamGlobalSettings } from '@prisma/client';
 import { Loader } from 'lucide-react';
@@ -37,14 +46,17 @@ const ZBrandingPreferencesFormSchema = z.object({
     .instanceof(File)
     .refine(
       (file) => file.size <= BRANDING_LOGO_MAX_SIZE_BYTES,
-      `File size must be less than ${BRANDING_LOGO_MAX_SIZE_MB}MB`,
+      msg`File size must be less than ${BRANDING_LOGO_MAX_SIZE_MB}MB`,
+    )
+    .refine(
+      (file) => BRANDING_LOGO_ALLOWED_TYPES.includes(file.type),
+      msg`Only .jpg, .png, and .webp files are accepted`,
     )
-    .refine((file) => BRANDING_LOGO_ALLOWED_TYPES.includes(file.type), 'Only .jpg, .png, and .webp files are accepted')
     .nullish(),
-  brandingUrl: z.string().url().optional().or(z.literal('')),
-  brandingCompanyDetails: z.string().max(500).optional(),
+  brandingUrl: z.string().url(msg`Please enter a valid URL`).optional().or(z.literal('')),
+  brandingCompanyDetails: z.string().max(500, msg`Brand details must be less than 500 characters`).optional(),
   brandingColors: ZCssVarsSchema.default({}),
-  brandingCss: z.string().max(10_000).default(''),
+  brandingCss: z.string().max(10_000, msg`Custom CSS must be less than 10,000 characters`).default(''),
 });
 
 export type TBrandingPreferencesFormSchema = z.infer<typeof ZBrandingPreferencesFormSchema>;
@@ -349,6 +361,8 @@ export function BrandingPreferencesForm({
                         </span>
                       )}
                     </FormDescription>
+
+                    <FormMessage />
                   </div>
                 </InheritableField>
               )}
@@ -379,6 +393,8 @@ export function BrandingPreferencesForm({
                       </span>
                     )}
                   </FormDescription>
+
+                  <FormMessage />
                 </InheritableField>
               )}
             />
@@ -413,6 +429,8 @@ export function BrandingPreferencesForm({
                       </span>
                     )}
                   </FormDescription>
+
+                  <FormMessage />
                 </InheritableField>
               )}
             />
@@ -597,6 +615,8 @@ export function BrandingPreferencesForm({
                         <FormDescription>
                           <Trans>Border radius size in REM units (e.g. 0.5rem).</Trans>
                         </FormDescription>
+
+                        <FormMessage />
                       </FormItem>
                     )}
                   />
@@ -634,6 +654,8 @@ export function BrandingPreferencesForm({
                               shown after you save.
                             </Trans>
                           </FormDescription>
+
+                          <FormMessage />
                         </FormItem>
                       )}
                     />

apps/remix/app/utils/toast-error-messages.ts

@@ -92,7 +92,7 @@ export const getUploadErrorMessage = (code: string): ToastMessageDescriptor => {
     .with(AppErrorCode.TOO_MANY_REQUESTS, () => FAIR_USE_LIMIT_EXCEEDED_ERROR_MESSAGE)
     .with('INVALID_DOCUMENT_FILE', () => ({
       title: msg`Error`,
-      description: msg`You cannot upload encrypted PDFs.`,
+      description: msg`The file is not a valid PDF or is password protected.`,
     }))
     .with(AppErrorCode.LIMIT_EXCEEDED, () => ({
       title: msg`Error`,

package-lock.json

@@ -15,7 +15,7 @@
       "dependencies": {
         "@ai-sdk/google-vertex": "5.0.48",
         "@documenso/prisma": "*",
-        "@libpdf/core": "^0.4.2",
+        "@libpdf/core": "^0.5.1",
         "@lingui/conf": "^5.6.0",
         "@lingui/core": "^5.6.0",
         "@marsidev/react-turnstile": "^1.5.0",
@@ -4480,9 +4480,9 @@
       "license": "MIT"
     },
     "node_modules/@libpdf/core": {
-      "version": "0.4.2",
-      "resolved": "https://registry.npmjs.org/@libpdf/core/-/core-0.4.2.tgz",
-      "integrity": "sha512-lbkIqLDZCCxjLpiC+8/Xvaru/ME7iVVoihl9tLqbp/CDUWZNF0q3u7s2tBJB9wRW/SzUWID6YPFvBWws770hrQ==",
+      "version": "0.5.1",
+      "resolved": "https://registry.npmjs.org/@libpdf/core/-/core-0.5.1.tgz",
+      "integrity": "sha512-q+y4AEk9ngqyC1pdX/hNScnfh0ROr4vSiqX4C9CmuBzhtuVukbfTesXCaGvHZ3pksi8AJYDPGQ/0HzSeHZfi3A==",
       "license": "MIT",
       "dependencies": {
         "@noble/ciphers": "^2.2.0",

package.json

@@ -106,7 +106,7 @@
   "dependencies": {
     "@ai-sdk/google-vertex": "5.0.48",
     "@documenso/prisma": "*",
-    "@libpdf/core": "^0.4.2",
+    "@libpdf/core": "^0.5.1",
     "@lingui/conf": "^5.6.0",
     "@lingui/core": "^5.6.0",
     "@prisma/extension-read-replicas": "^0.4.1",

packages/lib/server-only/pdf/normalize-pdf.ts

@@ -9,14 +9,18 @@ export const normalizePdf = async (pdf: Buffer, options: { flattenForm?: boolean
     console.error(`PDF normalization error: ${e.message}`);
 
     throw new AppError('INVALID_DOCUMENT_FILE', {
-      message: 'The document is not a valid PDF',
+      message: 'The document is not a valid PDF or is password protected',
     });
   });
 
   if (pdfDoc.isEncrypted) {
-    throw new AppError('INVALID_DOCUMENT_FILE', {
-      message: 'The document is encrypted',
-    });
+    if (!pdfDoc.isAuthenticated) {
+      throw new AppError('INVALID_DOCUMENT_FILE', {
+        message: 'The document is password protected',
+      });
+    }
+
+    pdfDoc.removeProtection({ ignorePermissions: true });
   }
 
   pdfDoc.flattenLayers();