Merge branch 'main' into feat/reset-branding-to-default

apps/remix/app/components/dialogs/branding-preferences-reset-dialog.tsx

@@ -0,0 +1,118 @@
+import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
+import { Button } from '@documenso/ui/primitives/button';
+import {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from '@documenso/ui/primitives/dialog';
+import { Trans } from '@lingui/react/macro';
+import { useState } from 'react';
+
+export type BrandingPreferencesResetDialogProps = {
+  disabled?: boolean;
+  hasAdvancedBranding: boolean;
+  isSubmitting: boolean;
+  onReset: () => Promise<void>;
+  trigger?: React.ReactNode;
+};
+
+export const BrandingPreferencesResetDialog = ({
+  disabled = false,
+  hasAdvancedBranding,
+  isSubmitting,
+  onReset,
+  trigger,
+}: BrandingPreferencesResetDialogProps) => {
+  const [open, setOpen] = useState(false);
+  const [isResetting, setIsResetting] = useState(false);
+
+  const isLoading = isSubmitting || isResetting;
+
+  const handleResetToDefaults = async () => {
+    setIsResetting(true);
+
+    try {
+      await onReset();
+      setOpen(false);
+    } finally {
+      setIsResetting(false);
+    }
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={(value) => !isLoading && !disabled && setOpen(value)}>
+      <DialogTrigger asChild>
+        {trigger ?? (
+          <Button variant="destructive" type="button" disabled={disabled || isLoading}>
+            <Trans>Reset</Trans>
+          </Button>
+        )}
+      </DialogTrigger>
+
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>
+            <Trans>Reset branding preferences</Trans>
+          </DialogTitle>
+
+          <DialogDescription>
+            <Trans>
+              This will reset all branding preferences to their default values and save the changes immediately.
+            </Trans>
+          </DialogDescription>
+        </DialogHeader>
+
+        <Alert variant="warning">
+          <AlertDescription>
+            <p>
+              <Trans>Once confirmed, the following will be reset:</Trans>
+            </p>
+
+            <ul className="mt-0.5 list-inside list-disc">
+              <li>
+                <Trans>Custom branding enabled setting</Trans>
+              </li>
+              <li>
+                <Trans>Branding logo</Trans>
+              </li>
+              <li>
+                <Trans>Brand website and brand details</Trans>
+              </li>
+              <li>
+                <Trans>Brand colours, including background, foreground, primary, and border colours</Trans>
+              </li>
+
+              {hasAdvancedBranding && (
+                <>
+                  <li>
+                    <Trans>Border radius</Trans>
+                  </li>
+                  <li>
+                    <Trans>Custom CSS</Trans>
+                  </li>
+                </>
+              )}
+            </ul>
+          </AlertDescription>
+        </Alert>
+
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button type="button" variant="secondary" disabled={isLoading}>
+              <Trans>Cancel</Trans>
+            </Button>
+          </DialogClose>
+
+          <Button type="button" variant="destructive" loading={isLoading} onClick={() => void handleResetToDefaults()}>
+            <Trans>Reset to defaults</Trans>
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};

apps/remix/app/components/forms/branding-preferences-form.tsx

@@ -2,6 +2,7 @@ import { useCurrentOrganisation } from '@documenso/lib/client-only/providers/org
 import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
 import { DEFAULT_BRAND_COLORS, DEFAULT_BRAND_RADIUS } from '@documenso/lib/constants/theme';
 import { ZCssVarsSchema } from '@documenso/lib/types/css-vars';
+import { normalizeBrandingColors } from '@documenso/lib/utils/normalize-branding-colors';
 import { cn } from '@documenso/ui/lib/utils';
 import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from '@documenso/ui/primitives/accordion';
 import { Button } from '@documenso/ui/primitives/button';
@@ -18,6 +19,7 @@ import { useEffect, useState } from 'react';
 import { useForm } from 'react-hook-form';
 import { z } from 'zod';
 
+import { BrandingPreferencesResetDialog } from '~/components/dialogs/branding-preferences-reset-dialog';
 import { useOptionalCurrentTeam } from '~/providers/team';
 import { useCspNonce } from '~/utils/nonce';
 
@@ -67,6 +69,7 @@ export function BrandingPreferencesForm({
 
   const [previewUrl, setPreviewUrl] = useState<string>('');
   const [hasLoadedPreview, setHasLoadedPreview] = useState(false);
+  const [colorPickerKey, setColorPickerKey] = useState(0);
 
   const parsedColors = ZCssVarsSchema.safeParse(settings.brandingColors);
   const initialColors = parsedColors.success ? parsedColors.data : {};
@@ -85,6 +88,41 @@ export function BrandingPreferencesForm({
 
   const isBrandingEnabled = form.watch('brandingEnabled');
 
+  const hasResetBrandingColors =
+    settings.brandingColors === null ||
+    settings.brandingColors === undefined ||
+    (parsedColors.success && normalizeBrandingColors(parsedColors.data) === null);
+
+  const isResetDisabled =
+    !form.formState.isDirty &&
+    settings.brandingEnabled === (canInherit ? null : false) &&
+    !settings.brandingLogo &&
+    !settings.brandingUrl &&
+    !settings.brandingCompanyDetails &&
+    !settings.brandingCss &&
+    hasResetBrandingColors;
+
+  const handleResetToDefaults = async () => {
+    const data: TBrandingPreferencesFormSchema = {
+      brandingEnabled: canInherit ? null : false,
+      brandingLogo: null,
+      brandingUrl: '',
+      brandingCompanyDetails: '',
+      brandingColors: {},
+      brandingCss: '',
+    };
+
+    await onFormSubmit(data);
+
+    if (previewUrl.startsWith('blob:')) {
+      URL.revokeObjectURL(previewUrl);
+    }
+
+    setPreviewUrl('');
+    setColorPickerKey((key) => key + 1);
+    form.reset(data);
+  };
+
   useEffect(() => {
     if (settings.brandingLogo) {
       const file = JSON.parse(settings.brandingLogo);
@@ -346,6 +384,7 @@ export function BrandingPreferencesForm({
                         </FormDescription>
                         <FormControl>
                           <ColorPicker
+                            key={`background-${colorPickerKey}`}
                             nonce={nonce}
                             value={field.value ?? ''}
                             defaultValue={DEFAULT_BRAND_COLORS.background}
@@ -369,6 +408,7 @@ export function BrandingPreferencesForm({
                         </FormDescription>
                         <FormControl>
                           <ColorPicker
+                            key={`foreground-${colorPickerKey}`}
                             nonce={nonce}
                             value={field.value ?? ''}
                             defaultValue={DEFAULT_BRAND_COLORS.foreground}
@@ -392,6 +432,7 @@ export function BrandingPreferencesForm({
                         </FormDescription>
                         <FormControl>
                           <ColorPicker
+                            key={`primary-${colorPickerKey}`}
                             nonce={nonce}
                             value={field.value ?? ''}
                             defaultValue={DEFAULT_BRAND_COLORS.primary}
@@ -415,6 +456,7 @@ export function BrandingPreferencesForm({
                         </FormDescription>
                         <FormControl>
                           <ColorPicker
+                            key={`primary-foreground-${colorPickerKey}`}
                             nonce={nonce}
                             value={field.value ?? ''}
                             defaultValue={DEFAULT_BRAND_COLORS.primaryForeground}
@@ -438,6 +480,7 @@ export function BrandingPreferencesForm({
                         </FormDescription>
                         <FormControl>
                           <ColorPicker
+                            key={`border-${colorPickerKey}`}
                             nonce={nonce}
                             value={field.value ?? ''}
                             defaultValue={DEFAULT_BRAND_COLORS.border}
@@ -461,6 +504,7 @@ export function BrandingPreferencesForm({
                         </FormDescription>
                         <FormControl>
                           <ColorPicker
+                            key={`ring-${colorPickerKey}`}
                             nonce={nonce}
                             value={field.value ?? ''}
                             defaultValue={DEFAULT_BRAND_COLORS.ring}
@@ -542,6 +586,12 @@ export function BrandingPreferencesForm({
             <Button type="submit" loading={form.formState.isSubmitting}>
               <Trans>Update</Trans>
             </Button>
+            <BrandingPreferencesResetDialog
+              disabled={isResetDisabled}
+              hasAdvancedBranding={hasAdvancedBranding}
+              isSubmitting={form.formState.isSubmitting}
+              onReset={handleResetToDefaults}
+            />
           </div>
         </fieldset>
       </form>

apps/remix/app/components/general/envelope-editor/envelope-editor-fields-page-renderer.tsx

@@ -49,13 +49,6 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
   const [isFieldChanging, setIsFieldChanging] = useState(false);
   const [pendingFieldCreation, setPendingFieldCreation] = useState<Konva.Rect | null>(null);
 
-  /**
-   * Whether the field was automatically selected on creation (drag-drop or marquee).
-   *
-   * We purposefully supress the floating toolbar for newly created fields.
-   */
-  const [isAutoSelectedField, setIsAutoSelectedField] = useState(false);
-
   const { stage, pageLayer, konvaContainer, scaledViewport, unscaledViewport } = usePageRenderer(
     ({ stage, pageLayer }) => createPageCanvas(stage, pageLayer),
     pageData,
@@ -244,26 +237,10 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
     fieldGroup.off('transformend');
     fieldGroup.off('dragend');
 
-    // Set up field selection. Shift + click toggles this field in/out of the current
-    // multi-selection, so fields can be added to a group by clicking them --
-    // complementing marquee drag-selection. A plain click (no modifier) selects just
-    // this field.
-    fieldGroup.on('click', (event) => {
+    // Set up field selection.
+    fieldGroup.on('click', () => {
       removePendingField();
-
-      const isMultiSelectModifier = event.evt.shiftKey;
-
-      if (isMultiSelectModifier) {
-        const currentNodes = interactiveTransformer.current?.nodes() ?? [];
-        const isAlreadySelected = currentNodes.includes(fieldGroup);
-
-        setSelectedFields(
-          isAlreadySelected ? currentNodes.filter((node) => node !== fieldGroup) : [...currentNodes, fieldGroup],
-        );
-      } else {
-        setSelectedFields([fieldGroup]);
-      }
-
+      setSelectedFields([fieldGroup]);
       pageLayer.current?.batchDraw();
     });
 
@@ -468,18 +445,43 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
       }
     });
 
-    // Clicking empty stage area clears the selection. Field clicks -- including
-    // Shift+click multi-select -- are handled by each field group's own click
-    // handler in `unsafeRenderFieldOnLayer`.
+    // Clicks should select/deselect shapes
     currentStage.on('click tap', (e) => {
-      // If we are selecting with the marquee rectangle, do nothing.
+      // if we are selecting with rect, do nothing
       if (selectionRectangle.visible() && selectionRectangle.width() > 0 && selectionRectangle.height() > 0) {
         return;
       }
 
-      // If empty area clicked, remove all selections.
+      // If empty area clicked, remove all selections
       if (e.target === stage.current) {
         setSelectedFields([]);
+        return;
+      }
+
+      // Do nothing if field not clicked, or if field is not editable
+      if (!e.target.hasName('field-group') || e.target.draggable() === false) {
+        return;
+      }
+
+      // do we pressed shift or ctrl?
+      const metaPressed = e.evt.shiftKey || e.evt.ctrlKey || e.evt.metaKey;
+      const isSelected = transformer.nodes().indexOf(e.target) >= 0;
+
+      if (!metaPressed && !isSelected) {
+        // if no key pressed and the node is not selected
+        // select just one
+        setSelectedFields([e.target]);
+      } else if (metaPressed && isSelected) {
+        // if we pressed keys and node was selected
+        // we need to remove it from selection:
+        const nodes = transformer.nodes().slice(); // use slice to have new copy of array
+        // remove node from array
+        nodes.splice(nodes.indexOf(e.target), 1);
+        setSelectedFields(nodes);
+      } else if (metaPressed && !isSelected) {
+        // add the node into selection
+        const nodes = transformer.nodes().concat([e.target]);
+        setSelectedFields(nodes);
       }
     });
 
@@ -519,48 +521,13 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
       setSelectedFields(liveSelectedFieldGroups);
     }
 
-    // Mirror the editor's single selected field onto the canvas (Konva) selection.
-    //
-    // `addField` already marks a newly created field as the selected field, so this
-    // makes a field placed via the palette (drag-drop) or marquee creation show its
-    // resize handles immediately -- no second click needed. It also clears the canvas
-    // selection when the selected field is cleared (e.g. when the author starts
-    // placing another field), so the floating action toolbar can't intercept the next
-    // placement click. Runs after the render loop above so the field's group exists.
-    const selectedFormId = editorFields.selectedField?.formId ?? null;
-    const isSingleCanvasSelection = selectedKonvaFieldGroups.length === 1;
-
-    if (selectedFormId && localPageFields.some((field) => field.formId === selectedFormId)) {
-      const isAlreadySelected = isSingleCanvasSelection && selectedKonvaFieldGroups[0].id() === selectedFormId;
-
-      if (!isAlreadySelected) {
-        const fieldGroupToSelect = pageLayer.current.findOne(`#${selectedFormId}`);
-
-        if (fieldGroupToSelect instanceof Konva.Group) {
-          setSelectedFields([fieldGroupToSelect], { isAutoSelect: true });
-        }
-      }
-    } else if (selectedFormId === null && isSingleCanvasSelection) {
-      setSelectedFields([]);
-    }
-
     // Rerender the transformer
     interactiveTransformer.current?.forceUpdate();
 
     pageLayer.current.batchDraw();
-  }, [
-    localPageFields,
-    selectedKonvaFieldGroups,
-    overlappingFieldFormIds,
-    isFieldChanging,
-    editorFields.selectedField?.formId,
-  ]);
-
-  const setSelectedFields = (nodes: Konva.Node[], options?: { isAutoSelect?: boolean }) => {
-    // Any explicit (user-driven) selection shows the action toolbar; only auto-selection
-    // on field creation suppresses it.
-    setIsAutoSelectedField(Boolean(options?.isAutoSelect));
+  }, [localPageFields, selectedKonvaFieldGroups, overlappingFieldFormIds, isFieldChanging]);
 
+  const setSelectedFields = (nodes: Konva.Node[]) => {
     // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
     const fieldGroups = nodes.filter(
       (node) => node.hasName('field-group') && Boolean(node.getStage()) && Boolean(node.getParent()),
@@ -696,30 +663,25 @@ export const EnvelopeEditorFieldsPageRenderer = ({ pageData }: { pageData: PageR
 
   return (
     <>
-      {selectedKonvaFieldGroups.length > 0 &&
-        interactiveTransformer.current &&
-        !isFieldChanging &&
-        !isAutoSelectedField && (
-          <FieldActionButtons
-            handleDuplicateSelectedFields={duplicatedSelectedFields}
-            handleDuplicateSelectedFieldsOnAllPages={duplicatedSelectedFieldsOnAllPages}
-            handleDeleteSelectedFields={deletedSelectedFields}
-            handleChangeRecipient={changeSelectedFieldsRecipients}
-            handleChangeFieldType={changeSelectedFieldsType}
-            selectedFieldFormId={selectedKonvaFieldGroups.map((field) => field.id())}
-            style={{
-              position: 'absolute',
-              top:
-                interactiveTransformer.current.y() + interactiveTransformer.current.getClientRect().height + 5 + 'px',
-              left:
-                interactiveTransformer.current.x() + interactiveTransformer.current.getClientRect().width / 2 + 'px',
-              transform: 'translateX(-50%)',
-              gap: '8px',
-              pointerEvents: 'auto',
-              zIndex: 50,
-            }}
-          />
-        )}
+      {selectedKonvaFieldGroups.length > 0 && interactiveTransformer.current && !isFieldChanging && (
+        <FieldActionButtons
+          handleDuplicateSelectedFields={duplicatedSelectedFields}
+          handleDuplicateSelectedFieldsOnAllPages={duplicatedSelectedFieldsOnAllPages}
+          handleDeleteSelectedFields={deletedSelectedFields}
+          handleChangeRecipient={changeSelectedFieldsRecipients}
+          handleChangeFieldType={changeSelectedFieldsType}
+          selectedFieldFormId={selectedKonvaFieldGroups.map((field) => field.id())}
+          style={{
+            position: 'absolute',
+            top: interactiveTransformer.current.y() + interactiveTransformer.current.getClientRect().height + 5 + 'px',
+            left: interactiveTransformer.current.x() + interactiveTransformer.current.getClientRect().width / 2 + 'px',
+            transform: 'translateX(-50%)',
+            gap: '8px',
+            pointerEvents: 'auto',
+            zIndex: 50,
+          }}
+        />
+      )}
 
       {pendingFieldCreation && (
         <div

apps/remix/package.json

@@ -106,5 +106,5 @@
     "vite-plugin-babel-macros": "^1.0.6",
     "vite-tsconfig-paths": "^5.1.4"
   },
-  "version": "2.14.0"
+  "version": "2.13.0"
 }

apps/remix/server/api/download/download.ts

@@ -146,7 +146,7 @@ export const downloadRoute = new Hono<HonoEnv>()
    * Requires API key authentication via Authorization header.
    */
   .get(
-    '/envelope/:envelopeId/audit-log/download',
+    '/envelope/:envelopeId/audit-log/pdf',
     sValidator('param', ZDownloadEnvelopeAuditLogPdfRequestParamsSchema),
     async (c) => {
       const logger = c.get('logger');
@@ -220,7 +220,7 @@ export const downloadRoute = new Hono<HonoEnv>()
    * Requires API key authentication via Authorization header.
    */
   .get(
-    '/envelope/:envelopeId/certificate/download',
+    '/envelope/:envelopeId/certificate/pdf',
     sValidator('param', ZDownloadEnvelopeCertificatePdfRequestParamsSchema),
     async (c) => {
       const logger = c.get('logger');

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@documenso/root",
-  "version": "2.14.0",
+  "version": "2.13.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@documenso/root",
-      "version": "2.14.0",
+      "version": "2.13.0",
       "hasInstallScript": true,
       "workspaces": [
         "apps/*",
@@ -406,7 +406,7 @@
     },
     "apps/remix": {
       "name": "@documenso/remix",
-      "version": "2.14.0",
+      "version": "2.13.0",
       "dependencies": {
         "@cantoo/pdf-lib": "^2.5.3",
         "@documenso/api": "*",

package.json

@@ -5,7 +5,7 @@
     "apps/*",
     "packages/*"
   ],
-  "version": "2.14.0",
+  "version": "2.13.0",
   "scripts": {
     "postinstall": "patch-package",
     "build": "turbo run build",

packages/app-tests/e2e/api/v2/unauthorized-api-access/api-access-envelope-cert-audit-log.spec.ts

@@ -1,284 +0,0 @@
-import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
-import { hashString } from '@documenso/lib/server-only/auth/hash';
-import { createApiToken } from '@documenso/lib/server-only/public-api/create-api-token';
-import { alphaid } from '@documenso/lib/universal/id';
-import { prisma } from '@documenso/prisma';
-import { DocumentVisibility, TeamMemberRole } from '@documenso/prisma/client';
-import { seedCompletedDocument } from '@documenso/prisma/seed/documents';
-import { seedTeam, seedTeamMember } from '@documenso/prisma/seed/teams';
-import { seedUser } from '@documenso/prisma/seed/users';
-import { type APIRequestContext, expect, test } from '@playwright/test';
-import type { Team, User } from '@prisma/client';
-
-const WEBAPP_BASE_URL = NEXT_PUBLIC_WEBAPP_URL();
-const API_BASE_URL = `${WEBAPP_BASE_URL}/api/v2-beta`;
-
-/**
- * Create an API token directly, bypassing the role check in `createApiToken`.
- *
- * This simulates a token that was minted while the user had permission, and which
- * survives a later downgrade to a lower team role (e.g. MEMBER). Such a token must
- * still respect document visibility at request time.
- */
-const seedApiTokenForUser = async ({
-  userId,
-  teamId,
-  tokenName,
-}: {
-  userId: number;
-  teamId: number;
-  tokenName: string;
-}) => {
-  const token = `api_${alphaid(16)}`;
-
-  await prisma.apiToken.create({
-    data: {
-      name: tokenName,
-      token: hashString(token),
-      expires: null,
-      userId,
-      teamId,
-    },
-  });
-
-  return { token };
-};
-
-test.describe.configure({
-  mode: 'parallel',
-});
-
-const downloadAuditLogPdf = (request: APIRequestContext, envelopeId: string, authToken?: string) => {
-  return request.get(`${API_BASE_URL}/envelope/${envelopeId}/audit-log/download`, {
-    headers: authToken ? { Authorization: `Bearer ${authToken}` } : {},
-  });
-};
-
-const downloadCertificatePdf = (request: APIRequestContext, envelopeId: string, authToken?: string) => {
-  return request.get(`${API_BASE_URL}/envelope/${envelopeId}/certificate/download`, {
-    headers: authToken ? { Authorization: `Bearer ${authToken}` } : {},
-  });
-};
-
-test.describe('Envelope certificate / audit log PDF download API V2 - access control', () => {
-  let userA: User, teamA: Team, userB: User, teamB: Team, tokenA: string, tokenB: string;
-
-  test.beforeEach(async () => {
-    ({ user: userA, team: teamA } = await seedUser());
-    ({ token: tokenA } = await createApiToken({
-      userId: userA.id,
-      teamId: teamA.id,
-      tokenName: 'userA',
-      expiresIn: null,
-    }));
-
-    ({ user: userB, team: teamB } = await seedUser());
-    ({ token: tokenB } = await createApiToken({
-      userId: userB.id,
-      teamId: teamB.id,
-      tokenName: 'userB',
-      expiresIn: null,
-    }));
-  });
-
-  test('should reject audit log download without an API token', async ({ request }) => {
-    const document = await seedCompletedDocument(userA, teamA.id, ['recipient@test.documenso.com']);
-
-    const res = await downloadAuditLogPdf(request, document.id);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(401);
-  });
-
-  test('should reject certificate download without an API token', async ({ request }) => {
-    const document = await seedCompletedDocument(userA, teamA.id, ['recipient@test.documenso.com']);
-
-    const res = await downloadCertificatePdf(request, document.id);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(401);
-  });
-
-  test('should reject audit log download from a user in a different team', async ({ request }) => {
-    const document = await seedCompletedDocument(userA, teamA.id, ['recipient@test.documenso.com']);
-
-    const res = await downloadAuditLogPdf(request, document.id, tokenB);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(404);
-  });
-
-  test('should reject certificate download from a user in a different team', async ({ request }) => {
-    const document = await seedCompletedDocument(userA, teamA.id, ['recipient@test.documenso.com']);
-
-    const res = await downloadCertificatePdf(request, document.id, tokenB);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(404);
-  });
-
-  test('should reject a disabled user downloading the audit log', async ({ request }) => {
-    const document = await seedCompletedDocument(userA, teamA.id, ['recipient@test.documenso.com']);
-
-    await prisma.user.update({
-      where: { id: userA.id },
-      data: { disabled: true },
-    });
-
-    const res = await downloadAuditLogPdf(request, document.id, tokenA);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(401);
-  });
-
-  test('should reject a disabled user downloading the certificate', async ({ request }) => {
-    const document = await seedCompletedDocument(userA, teamA.id, ['recipient@test.documenso.com']);
-
-    await prisma.user.update({
-      where: { id: userA.id },
-      data: { disabled: true },
-    });
-
-    const res = await downloadCertificatePdf(request, document.id, tokenA);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(401);
-  });
-
-  test('should return 404 for a non-existent envelope id', async ({ request }) => {
-    const auditLogRes = await downloadAuditLogPdf(request, 'envelope_doesnotexist', tokenA);
-    expect(auditLogRes.status()).toBe(404);
-
-    const certificateRes = await downloadCertificatePdf(request, 'envelope_doesnotexist', tokenA);
-    expect(certificateRes.status()).toBe(404);
-  });
-});
-
-test.describe('Envelope certificate / audit log PDF download API V2 - document visibility', () => {
-  test.describe.configure({
-    mode: 'parallel',
-  });
-
-  test('should hide an ADMIN-only document from a downgraded member (audit log)', async ({ request }) => {
-    const { team, owner } = await seedTeam();
-    const member = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MEMBER });
-
-    const { token: memberToken } = await seedApiTokenForUser({
-      userId: member.id,
-      teamId: team.id,
-      tokenName: 'member-audit-log-token',
-    });
-
-    // ADMIN-visibility document owned by the team owner - a member must not see it.
-    const document = await seedCompletedDocument(owner, team.id, ['recipient@test.documenso.com'], {
-      createDocumentOptions: { visibility: DocumentVisibility.ADMIN },
-    });
-
-    const res = await downloadAuditLogPdf(request, document.id, memberToken);
-
-    // Visibility failure surfaces as not-found, matching the canonical access checks.
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(404);
-  });
-
-  test('should hide an ADMIN-only document from a downgraded member (certificate)', async ({ request }) => {
-    const { team, owner } = await seedTeam();
-    const member = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MEMBER });
-
-    const { token: memberToken } = await seedApiTokenForUser({
-      userId: member.id,
-      teamId: team.id,
-      tokenName: 'member-certificate-token',
-    });
-
-    const document = await seedCompletedDocument(owner, team.id, ['recipient@test.documenso.com'], {
-      createDocumentOptions: { visibility: DocumentVisibility.ADMIN },
-    });
-
-    const res = await downloadCertificatePdf(request, document.id, memberToken);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(404);
-  });
-
-  test('should hide a MANAGER_AND_ABOVE document from a downgraded member (audit log)', async ({ request }) => {
-    const { team, owner } = await seedTeam();
-    const member = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MEMBER });
-
-    const { token: memberToken } = await seedApiTokenForUser({
-      userId: member.id,
-      teamId: team.id,
-      tokenName: 'member-manager-vis-token',
-    });
-
-    const document = await seedCompletedDocument(owner, team.id, ['recipient@test.documenso.com'], {
-      createDocumentOptions: { visibility: DocumentVisibility.MANAGER_AND_ABOVE },
-    });
-
-    const res = await downloadAuditLogPdf(request, document.id, memberToken);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(404);
-  });
-
-  test('should hide a MANAGER_AND_ABOVE document from a downgraded member (certificate)', async ({ request }) => {
-    const { team, owner } = await seedTeam();
-    const member = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MEMBER });
-
-    const { token: memberToken } = await seedApiTokenForUser({
-      userId: member.id,
-      teamId: team.id,
-      tokenName: 'member-manager-vis-cert-token',
-    });
-
-    const document = await seedCompletedDocument(owner, team.id, ['recipient@test.documenso.com'], {
-      createDocumentOptions: { visibility: DocumentVisibility.MANAGER_AND_ABOVE },
-    });
-
-    const res = await downloadCertificatePdf(request, document.id, memberToken);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(404);
-  });
-
-  test('should hide an ADMIN-only document from a downgraded manager (certificate)', async ({ request }) => {
-    const { team, owner } = await seedTeam();
-    const manager = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MANAGER });
-
-    const { token: managerToken } = await seedApiTokenForUser({
-      userId: manager.id,
-      teamId: team.id,
-      tokenName: 'manager-admin-vis-cert-token',
-    });
-
-    const document = await seedCompletedDocument(owner, team.id, ['recipient@test.documenso.com'], {
-      createDocumentOptions: { visibility: DocumentVisibility.ADMIN },
-    });
-
-    const res = await downloadCertificatePdf(request, document.id, managerToken);
-
-    expect(res.ok()).toBeFalsy();
-    expect(res.status()).toBe(404);
-  });
-
-  test('should allow a member to download an EVERYONE-visibility document (audit log)', async ({ request }) => {
-    const { team, owner } = await seedTeam();
-    const member = await seedTeamMember({ teamId: team.id, role: TeamMemberRole.MEMBER });
-
-    const { token: memberToken } = await seedApiTokenForUser({
-      userId: member.id,
-      teamId: team.id,
-      tokenName: 'member-everyone-vis-token',
-    });
-
-    const document = await seedCompletedDocument(owner, team.id, ['recipient@test.documenso.com'], {
-      createDocumentOptions: { visibility: DocumentVisibility.EVERYONE },
-    });
-
-    const res = await downloadAuditLogPdf(request, document.id, memberToken);
-
-    expect(res.ok()).toBeTruthy();
-    expect(res.status()).toBe(200);
-    expect(res.headers()['content-type']).toContain('application/pdf');
-  });
-});

packages/app-tests/e2e/envelope-editor-v2/envelope-fields.spec.ts

@@ -20,7 +20,7 @@ import {
   type TEnvelopeEditorSurface,
 } from '../fixtures/envelope-editor';
 import { expectToastTextToBeVisible } from '../fixtures/generic';
-import { getKonvaElementCountForPage, getKonvaTransformerNodeCountForPage } from '../fixtures/konva';
+import { getKonvaElementCountForPage } from '../fixtures/konva';
 
 type TFieldFlowResult = {
   externalId: string;
@@ -46,7 +46,6 @@ const updateExternalId = async (surface: TEnvelopeEditorSurface, externalId: str
 
   if (!surface.isEmbedded) {
     await expectToastTextToBeVisible(surface.root, 'Envelope updated');
-    await surface.root.getByTestId('toast-close').click();
   }
 };
 
@@ -99,17 +98,6 @@ const selectFieldOnCanvas = async (root: Page, position: { x: number; y: number
   await canvas.click({ position, force: true });
 };
 
-/**
- * Shift+click a field on the canvas to toggle it in/out of the current multi-selection.
- */
-const shiftClickFieldOnCanvas = async (root: Page, position: { x: number; y: number }) => {
-  const canvas = root.locator('.konva-container canvas').first();
-  await expect(canvas).toBeVisible();
-  await root.waitForTimeout(300);
-  // Use force:true to bypass any floating action toolbar buttons that may intercept clicks.
-  await canvas.click({ position, modifiers: ['Shift'], force: true });
-};
-
 const runAddAndPersistSignatureTextFields = async (surface: TEnvelopeEditorSurface): Promise<TFieldFlowResult> => {
   const externalId = `e2e-fields-${nanoid()}`;
 
@@ -772,106 +760,9 @@ const assertChangeFieldTypePersistedInDatabase = async ({
   expect(actualMetaTypes).toEqual(['date', 'date']);
 };
 
-// --- Shift+click multi-select flow ---
-
-type TShiftClickFlowResult = {
-  externalId: string;
-};
-
-const SHIFT_CLICK_FIELD_POSITIONS = {
-  signature: { x: 150, y: 120 },
-  text: { x: 150, y: 260 },
-  name: { x: 150, y: 400 },
-};
-
-const runShiftClickMultiSelectFlow = async (surface: TEnvelopeEditorSurface): Promise<TShiftClickFlowResult> => {
-  const externalId = `e2e-shift-click-${nanoid()}`;
-  const root = surface.root;
-
-  if (surface.isEmbedded && !surface.envelopeId) {
-    await addEnvelopeItemPdf(root, 'embedded-fields.pdf');
-  }
-
-  await updateExternalId(surface, externalId);
-  await setupRecipientsForFieldPlacement(surface);
-
-  await clickEnvelopeEditorStep(root, 'addFields');
-  await expect(root.locator('.konva-container canvas').first()).toBeVisible();
-
-  // Place three fields, spaced far enough apart that their action toolbars don't
-  // overlap a neighbouring field's click target.
-  await placeFieldOnPdf(root, 'Signature', SHIFT_CLICK_FIELD_POSITIONS.signature);
-  await placeFieldOnPdf(root, 'Text', SHIFT_CLICK_FIELD_POSITIONS.text);
-  await placeFieldOnPdf(root, 'Name', SHIFT_CLICK_FIELD_POSITIONS.name);
-  expect(await getKonvaElementCountForPage(root, 1, '.field-group')).toBe(3);
-
-  // A plain click selects exactly one field.
-  await selectFieldOnCanvas(root, SHIFT_CLICK_FIELD_POSITIONS.signature);
-  await expect.poll(() => getKonvaTransformerNodeCountForPage(root, 1)).toBe(1);
-
-  // Shift+click a second field ADDS it to the selection (the new behaviour).
-  await shiftClickFieldOnCanvas(root, SHIFT_CLICK_FIELD_POSITIONS.text);
-  await expect.poll(() => getKonvaTransformerNodeCountForPage(root, 1)).toBe(2);
-
-  // Shift+click an already-selected field REMOVES it from the selection.
-  await shiftClickFieldOnCanvas(root, SHIFT_CLICK_FIELD_POSITIONS.signature);
-  await expect.poll(() => getKonvaTransformerNodeCountForPage(root, 1)).toBe(1);
-
-  // Shift+click it again RE-ADDS it, leaving Signature + Text selected and Name excluded.
-  await shiftClickFieldOnCanvas(root, SHIFT_CLICK_FIELD_POSITIONS.signature);
-  await expect.poll(() => getKonvaTransformerNodeCountForPage(root, 1)).toBe(2);
-
-  // Delete the two selected fields via the floating action toolbar. Only the
-  // un-selected Name field should remain -- proving the multi-selection contained
-  // exactly the two Shift-clicked fields.
-  await expect(root.locator('button[title="Remove"]')).toBeVisible();
-  await root.locator('button[title="Remove"]').click();
-  expect(await getKonvaElementCountForPage(root, 1, '.field-group')).toBe(1);
-
-  // Navigate away and back to verify persistence.
-  await clickEnvelopeEditorStep(root, 'upload');
-  await clickEnvelopeEditorStep(root, 'addFields');
-  expect(await getKonvaElementCountForPage(root, 1, '.field-group')).toBe(1);
-
-  return { externalId };
-};
-
-const assertShiftClickMultiSelectPersistedInDatabase = async ({
-  surface,
-  externalId,
-}: {
-  surface: TEnvelopeEditorSurface;
-  externalId: string;
-}) => {
-  const envelope = await prisma.envelope.findFirstOrThrow({
-    where: {
-      externalId,
-      userId: surface.userId,
-      teamId: surface.teamId,
-      type: surface.envelopeType,
-    },
-    orderBy: { createdAt: 'desc' },
-    include: { fields: true },
-  });
-
-  // Signature + Text were multi-selected via Shift+click and deleted; only Name remains.
-  expect(envelope.fields).toHaveLength(1);
-  expect(envelope.fields[0].type).toBe(FieldType.NAME);
-};
-
 // --- Test describe blocks ---
 
 test.describe('document editor', () => {
-  test('shift+click adds and removes fields from the selection', async ({ page }) => {
-    const surface = await openDocumentEnvelopeEditor(page);
-    const result = await runShiftClickMultiSelectFlow(surface);
-
-    await assertShiftClickMultiSelectPersistedInDatabase({
-      surface,
-      ...result,
-    });
-  });
-
   test('add and persist signature/text fields', async ({ page }) => {
     const surface = await openDocumentEnvelopeEditor(page);
     const result = await runAddAndPersistSignatureTextFields(surface);
@@ -924,16 +815,6 @@ test.describe('document editor', () => {
 });
 
 test.describe('template editor', () => {
-  test('shift+click adds and removes fields from the selection', async ({ page }) => {
-    const surface = await openTemplateEnvelopeEditor(page);
-    const result = await runShiftClickMultiSelectFlow(surface);
-
-    await assertShiftClickMultiSelectPersistedInDatabase({
-      surface,
-      ...result,
-    });
-  });
-
   test('add and persist signature/text fields', async ({ page }) => {
     const surface = await openTemplateEnvelopeEditor(page);
     const result = await runAddAndPersistSignatureTextFields(surface);
@@ -986,21 +867,6 @@ test.describe('template editor', () => {
 });
 
 test.describe('embedded create', () => {
-  test('shift+click adds and removes fields from the selection', async ({ page }) => {
-    const surface = await openEmbeddedEnvelopeEditor(page, {
-      envelopeType: 'DOCUMENT',
-      tokenNamePrefix: 'e2e-embed-shift-click',
-    });
-    const result = await runShiftClickMultiSelectFlow(surface);
-
-    await persistEmbeddedEnvelope(surface);
-
-    await assertShiftClickMultiSelectPersistedInDatabase({
-      surface,
-      ...result,
-    });
-  });
-
   test('add and persist signature/text fields', async ({ page }) => {
     const surface = await openEmbeddedEnvelopeEditor(page, {
       envelopeType: 'DOCUMENT',
@@ -1078,22 +944,6 @@ test.describe('embedded create', () => {
 });
 
 test.describe('embedded edit', () => {
-  test('shift+click adds and removes fields from the selection', async ({ page }) => {
-    const surface = await openEmbeddedEnvelopeEditor(page, {
-      envelopeType: 'TEMPLATE',
-      mode: 'edit',
-      tokenNamePrefix: 'e2e-embed-shift-click',
-    });
-    const result = await runShiftClickMultiSelectFlow(surface);
-
-    await persistEmbeddedEnvelope(surface);
-
-    await assertShiftClickMultiSelectPersistedInDatabase({
-      surface,
-      ...result,
-    });
-  });
-
   test('add and persist signature/text fields', async ({ page }) => {
     const surface = await openEmbeddedEnvelopeEditor(page, {
       envelopeType: 'TEMPLATE',

packages/app-tests/e2e/fixtures/konva.ts

@@ -16,35 +16,3 @@ export const getKonvaElementCountForPage = async (page: Page, pageNumber: number
     { pageNumber, elementSelector },
   );
 };
-
-/**
- * Returns how many field groups are currently attached to the page's Konva
- * transformer, i.e. the size of the active canvas selection. Used to assert
- * multi-select behaviour (marquee drag and Shift+click).
- */
-export const getKonvaTransformerNodeCountForPage = async (page: Page, pageNumber: number) => {
-  await page.locator('.konva-container canvas').first().waitFor({ state: 'visible' });
-
-  return await page.evaluate(
-    ({ pageNumber }) => {
-      // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-      const konva: typeof Konva = (window as unknown as { Konva: typeof Konva }).Konva;
-
-      const stage = konva.stages.find((stage) => stage.attrs.id === `page-${pageNumber}`);
-
-      if (!stage) {
-        return 0;
-      }
-
-      const transformer = stage.find('Transformer')[0];
-
-      if (!transformer) {
-        return 0;
-      }
-
-      // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-      return (transformer as Konva.Transformer).nodes().length;
-    },
-    { pageNumber },
-  );
-};

packages/email/template-components/template-document-completed.tsx

@@ -28,11 +28,7 @@ export const TemplateDocumentCompleted = ({
         <Section className="mb-4">
           <Column align="center">
             <Text className="font-semibold text-base text-foreground">
-              <Img
-                src={getAssetUrl('/static/completed.png')}
-                className="-mt-0.5 mr-2 inline h-7 w-7 align-middle"
-                alt=""
-              />
+              <Img src={getAssetUrl('/static/completed.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" />
               <Trans>Completed</Trans>
             </Text>
           </Column>
@@ -51,7 +47,7 @@ export const TemplateDocumentCompleted = ({
             className="rounded-lg border border-border border-solid px-4 py-2 text-center font-medium text-foreground text-sm no-underline"
             href={downloadLink}
           >
-            <Img src={getAssetUrl('/static/download.png')} className="mr-2 mb-0.5 inline h-5 w-5 align-middle" alt="" />
+            <Img src={getAssetUrl('/static/download.png')} className="mr-2 mb-0.5 inline h-5 w-5 align-middle" />
             <Trans>Download</Trans>
           </Button>
         </Section>

packages/email/template-components/template-document-pending.tsx

@@ -21,7 +21,7 @@ export const TemplateDocumentPending = ({ documentName, assetBaseUrl }: Template
         <Section className="mb-4">
           <Column align="center">
             <Text className="font-semibold text-base text-foreground">
-              <Img src={getAssetUrl('/static/clock.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" alt="" />
+              <Img src={getAssetUrl('/static/clock.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" />
               <Trans>Waiting for others</Trans>
             </Text>
           </Column>

packages/email/template-components/template-document-recipient-signed.tsx

@@ -30,11 +30,7 @@ export const TemplateDocumentRecipientSigned = ({
         <Section className="mb-4">
           <Column align="center">
             <Text className="font-semibold text-base text-foreground">
-              <Img
-                src={getAssetUrl('/static/completed.png')}
-                className="-mt-0.5 mr-2 inline h-7 w-7 align-middle"
-                alt=""
-              />
+              <Img src={getAssetUrl('/static/completed.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" />
               <Trans>Completed</Trans>
             </Text>
           </Column>

packages/email/template-components/template-document-self-signed.tsx

@@ -26,11 +26,7 @@ export const TemplateDocumentSelfSigned = ({ documentName, assetBaseUrl }: Templ
         <Section>
           <Column align="center">
             <Text className="font-semibold text-base text-foreground">
-              <Img
-                src={getAssetUrl('/static/completed.png')}
-                className="-mt-0.5 mr-2 inline h-7 w-7 align-middle"
-                alt=""
-              />
+              <Img src={getAssetUrl('/static/completed.png')} className="-mt-0.5 mr-2 inline h-7 w-7 align-middle" />
               <Trans>Completed</Trans>
             </Text>
           </Column>
@@ -55,11 +51,7 @@ export const TemplateDocumentSelfSigned = ({ documentName, assetBaseUrl }: Templ
             href={signUpUrl}
             className="mr-4 rounded-lg border border-border border-solid px-4 py-2 text-center font-medium text-foreground text-sm no-underline"
           >
-            <Img
-              src={getAssetUrl('/static/user-plus.png')}
-              className="mr-2 mb-0.5 inline h-5 w-5 align-middle"
-              alt=""
-            />
+            <Img src={getAssetUrl('/static/user-plus.png')} className="mr-2 mb-0.5 inline h-5 w-5 align-middle" />
             <Trans>Create account</Trans>
           </Button>
 
@@ -67,7 +59,7 @@ export const TemplateDocumentSelfSigned = ({ documentName, assetBaseUrl }: Templ
             className="rounded-lg border border-border border-solid px-4 py-2 text-center font-medium text-foreground text-sm no-underline"
             href="https://documenso.com/pricing"
           >
-            <Img src={getAssetUrl('/static/review.png')} className="mr-2 mb-0.5 inline h-5 w-5 align-middle" alt="" />
+            <Img src={getAssetUrl('/static/review.png')} className="mr-2 mb-0.5 inline h-5 w-5 align-middle" />
             <Trans>View plans</Trans>
           </Button>
         </Section>

packages/email/template-components/template-image.tsx

@@ -11,7 +11,7 @@ export const TemplateImage = ({ assetBaseUrl, className, staticAsset }: Template
     return new URL(path, assetBaseUrl).toString();
   };
 
-  return <Img className={className} src={getAssetUrl(`/static/${staticAsset}`)} alt="" />;
+  return <Img className={className} src={getAssetUrl(`/static/${staticAsset}`)} />;
 };
 
 export default TemplateImage;

packages/email/templates/document-invite.tsx

@@ -85,7 +85,7 @@ export const DocumentInviteEmailTemplate = ({
                 <Text className="my-4 font-semibold text-base">
                   <Trans>
                     {inviterName}{' '}
-                    <Link className="font-normal text-muted-foreground" href={`mailto:${inviterEmail}`}>
+                    <Link className="font-normal text-muted-foreground" href="mailto:{inviterEmail}">
                       ({inviterEmail})
                     </Link>
                   </Trans>

packages/trpc/server/envelope-router/download-envelope-audit-log-pdf.types.ts

@@ -5,7 +5,7 @@ import type { TrpcRouteMeta } from '../trpc';
 export const downloadEnvelopeAuditLogPdfMeta: TrpcRouteMeta = {
   openapi: {
     method: 'GET',
-    path: '/envelope/{envelopeId}/audit-log/download',
+    path: '/envelope/{envelopeId}/audit-log/pdf',
     summary: 'Download envelope audit log PDF',
     description: 'Download the audit log for a document as a PDF.',
     tags: ['Envelope'],

packages/trpc/server/envelope-router/download-envelope-certificate-pdf.types.ts

@@ -5,7 +5,7 @@ import type { TrpcRouteMeta } from '../trpc';
 export const downloadEnvelopeCertificatePdfMeta: TrpcRouteMeta = {
   openapi: {
     method: 'GET',
-    path: '/envelope/{envelopeId}/certificate/download',
+    path: '/envelope/{envelopeId}/certificate/pdf',
     summary: 'Download envelope certificate PDF',
     description: 'Download the signing certificate for a completed document as a PDF.',
     tags: ['Envelope'],