fix: merge conflicts

apps/remix/app/components/embed/embed-direct-template-client-page.tsx

@@ -332,7 +332,7 @@ export const EmbedDirectTemplateClientPage = ({
         {/* Widget */}
         <div
           key={isExpanded ? 'expanded' : 'collapsed'}
-          className="group/document-widget fixed bottom-8 left-0 z-50 h-fit max-h-[calc(100dvh-2rem)] w-full flex-shrink-0 px-6 md:sticky md:bottom-[unset] md:top-4 md:z-auto md:w-[350px] md:px-0"
+          className="group/document-widget fixed bottom-8 left-0 z-50 h-fit max-h-[calc(100dvh-2rem)] w-full flex-shrink-0 px-6 md:sticky md:top-4 md:z-auto md:w-[350px] md:px-0"
           data-expanded={isExpanded || undefined}
         >
           <div className="border-border bg-widget flex h-fit w-full flex-col rounded-xl border px-4 py-4 md:min-h-[min(calc(100dvh-2rem),48rem)] md:py-6">

apps/remix/app/components/embed/embed-document-signing-page.tsx

@@ -290,7 +290,7 @@ export const EmbedSignDocumentClientPage = ({
           {/* Widget */}
           <div
             key={isExpanded ? 'expanded' : 'collapsed'}
-            className="embed--DocumentWidgetContainer group/document-widget fixed bottom-8 left-0 z-50 h-fit max-h-[calc(100dvh-2rem)] w-full flex-shrink-0 px-6 md:sticky md:bottom-[unset] md:top-4 md:z-auto md:w-[350px] md:px-0"
+            className="embed--DocumentWidgetContainer group/document-widget fixed bottom-8 left-0 z-50 h-fit max-h-[calc(100dvh-2rem)] w-full flex-shrink-0 px-6 md:sticky md:top-4 md:z-auto md:w-[350px] md:px-0"
             data-expanded={isExpanded || undefined}
           >
             <div className="embed--DocumentWidget border-border bg-widget flex w-full flex-col rounded-xl border px-4 py-4 md:py-6">

apps/remix/app/components/embed/multisign/multi-sign-document-list.tsx

@@ -1,182 +0,0 @@
-import { Trans } from '@lingui/react/macro';
-import { ReadStatus, RecipientRole, SigningStatus } from '@prisma/client';
-import { ArrowRight, EyeIcon, XCircle } from 'lucide-react';
-import { match } from 'ts-pattern';
-
-import type { DocumentAndSender } from '@documenso/lib/server-only/document/get-document-by-token';
-import type { getRecipientByToken } from '@documenso/lib/server-only/recipient/get-recipient-by-token';
-import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
-import { Badge } from '@documenso/ui/primitives/badge';
-import { Button } from '@documenso/ui/primitives/button';
-import { Progress } from '@documenso/ui/primitives/progress';
-
-// Get the return type from getRecipientByToken
-type RecipientWithFields = Awaited<ReturnType<typeof getRecipientByToken>>;
-
-interface DocumentEnvelope {
-  document: DocumentAndSender;
-  recipient: RecipientWithFields;
-}
-
-interface MultiSignDocumentListProps {
-  envelopes: DocumentEnvelope[];
-  onDocumentSelect: (document: DocumentEnvelope['document']) => void;
-}
-
-export function MultiSignDocumentList({ envelopes, onDocumentSelect }: MultiSignDocumentListProps) {
-  // Calculate progress
-  const completedDocuments = envelopes.filter(
-    (envelope) => envelope.recipient.signingStatus === SigningStatus.SIGNED,
-  );
-  const totalDocuments = envelopes.length;
-  const progressPercentage = (completedDocuments.length / totalDocuments) * 100;
-
-  // Find next document to sign (first one that's not signed and not rejected)
-  const nextDocumentToSign = envelopes.find(
-    (envelope) =>
-      envelope.recipient.signingStatus !== SigningStatus.SIGNED &&
-      envelope.recipient.signingStatus !== SigningStatus.REJECTED,
-  );
-
-  const allDocumentsCompleted = completedDocuments.length === totalDocuments;
-
-  const hasAssistantOrCcRecipient = envelopes.some(
-    (envelope) =>
-      envelope.recipient.role === RecipientRole.ASSISTANT ||
-      envelope.recipient.role === RecipientRole.CC,
-  );
-
-  function handleView(doc: DocumentEnvelope['document']) {
-    onDocumentSelect(doc);
-  }
-
-  function handleNextDocument() {
-    if (nextDocumentToSign) {
-      onDocumentSelect(nextDocumentToSign.document);
-    }
-  }
-
-  if (hasAssistantOrCcRecipient) {
-    return (
-      <div className="mx-auto mt-16 flex w-full max-w-lg flex-col md:mt-16 md:rounded-2xl md:border md:px-8 md:py-16 md:shadow-lg">
-        <div className="flex items-center justify-center">
-          <XCircle className="text-destructive h-16 w-16 md:h-24 md:w-24" strokeWidth={1.2} />
-        </div>
-
-        <h2 className="mt-12 text-xl font-bold md:text-2xl">
-          <Trans>It looks like we ran into an issue!</Trans>
-        </h2>
-
-        <p className="text-muted-foreground mt-6">
-          <Trans>
-            One of the documents in the current bundle has a signing role that is not compatible
-            with the current signing experience.
-          </Trans>
-        </p>
-
-        <p className="text-muted-foreground mt-2">
-          <Trans>
-            Assistants and Copy roles are currently not compatible with the multi-sign experience.
-          </Trans>
-        </p>
-
-        <p className="text-muted-foreground mt-2">
-          <Trans>Please contact the site owner for further assistance.</Trans>
-        </p>
-      </div>
-    );
-  }
-
-  return (
-    <div className="bg-background mx-auto w-full max-w-lg md:my-12 md:rounded-2xl md:border md:p-8 md:shadow-lg">
-      <h2 className="text-foreground mb-1 text-lg font-semibold">
-        <Trans>Sign Documents</Trans>
-      </h2>
-
-      <p className="text-muted-foreground text-sm">
-        <Trans>
-          You have been requested to sign the following documents. Review each document carefully
-          and complete the signing process.
-        </Trans>
-      </p>
-
-      {/* Progress Section */}
-      <div className="mt-6">
-        <div className="flex items-center justify-between text-sm">
-          <span className="text-muted-foreground font-medium">
-            <Trans>Progress</Trans>
-          </span>
-          <span className="text-muted-foreground">
-            {completedDocuments.length} of {totalDocuments} completed
-          </span>
-        </div>
-
-        <div className="mt-4">
-          <Progress value={progressPercentage} className="h-2" />
-        </div>
-      </div>
-
-      <div className="mt-6 flex flex-col gap-4">
-        {envelopes.map((envelope) => (
-          <div
-            key={envelope.document.id}
-            className="border-border flex items-center gap-4 rounded-lg border px-4 py-2"
-          >
-            <span className="text-foreground flex-1 truncate text-sm font-medium">
-              {envelope.document.title}
-            </span>
-
-            {match(envelope.recipient)
-              .with({ signingStatus: SigningStatus.SIGNED }, () => (
-                <Badge size="small" variant="default">
-                  <Trans>Completed</Trans>
-                </Badge>
-              ))
-              .with({ signingStatus: SigningStatus.REJECTED }, () => (
-                <Badge size="small" variant="destructive">
-                  <Trans>Rejected</Trans>
-                </Badge>
-              ))
-              .with({ readStatus: ReadStatus.OPENED }, () => (
-                <Badge size="small" variant="neutral">
-                  <Trans>Viewed</Trans>
-                </Badge>
-              ))
-              .otherwise(() => null)}
-
-            <Button
-              className="-mr-2"
-              variant="outline"
-              size="sm"
-              onClick={() => handleView(envelope.document)}
-            >
-              <EyeIcon className="mr-1 h-4 w-4" />
-              <Trans>View</Trans>
-            </Button>
-          </div>
-        ))}
-      </div>
-
-      {/* Next Document Button */}
-      {!allDocumentsCompleted && nextDocumentToSign && (
-        <div className="mt-6">
-          <Button onClick={handleNextDocument} className="w-full" size="lg">
-            <Trans>View next document</Trans>
-            <ArrowRight className="ml-2 h-4 w-4" />
-          </Button>
-        </div>
-      )}
-
-      {allDocumentsCompleted && (
-        <Alert className="mt-6 text-center">
-          <AlertTitle>
-            <Trans>All documents have been completed!</Trans>
-          </AlertTitle>
-          <AlertDescription>
-            <Trans>Thank you for completing the signing process.</Trans>
-          </AlertDescription>
-        </Alert>
-      )}
-    </div>
-  );
-}

apps/remix/app/components/embed/multisign/multi-sign-document-signing-view.tsx

@@ -1,396 +0,0 @@
-import { useState } from 'react';
-
-import { msg } from '@lingui/core/macro';
-import { useLingui } from '@lingui/react';
-import { Trans } from '@lingui/react/macro';
-import { DocumentStatus, FieldType, SigningStatus } from '@prisma/client';
-import { Loader, LucideChevronDown, LucideChevronUp, X } from 'lucide-react';
-import { P, match } from 'ts-pattern';
-
-import { PDF_VIEWER_PAGE_SELECTOR } from '@documenso/lib/constants/pdf-viewer';
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { trpc } from '@documenso/trpc/react';
-import type {
-  TRemovedSignedFieldWithTokenMutationSchema,
-  TSignFieldWithTokenMutationSchema,
-} from '@documenso/trpc/server/field-router/schema';
-import { DocumentReadOnlyFields } from '@documenso/ui/components/document/document-read-only-fields';
-import { FieldToolTip } from '@documenso/ui/components/field/field-tooltip';
-import { cn } from '@documenso/ui/lib/utils';
-import { Button } from '@documenso/ui/primitives/button';
-import { ElementVisible } from '@documenso/ui/primitives/element-visible';
-import { Input } from '@documenso/ui/primitives/input';
-import { Label } from '@documenso/ui/primitives/label';
-import PDFViewer from '@documenso/ui/primitives/pdf-viewer';
-import { SignaturePadDialog } from '@documenso/ui/primitives/signature-pad/signature-pad-dialog';
-import { useToast } from '@documenso/ui/primitives/use-toast';
-
-import { useRequiredDocumentSigningContext } from '../../general/document-signing/document-signing-provider';
-import { DocumentSigningRejectDialog } from '../../general/document-signing/document-signing-reject-dialog';
-import { EmbedDocumentFields } from '../embed-document-fields';
-
-interface MultiSignDocumentSigningViewProps {
-  token: string;
-  recipientId: number;
-  onBack: () => void;
-  onDocumentCompleted?: (data: { token: string; documentId: number; recipientId: number }) => void;
-  onDocumentRejected?: (data: {
-    token: string;
-    documentId: number;
-    recipientId: number;
-    reason: string;
-  }) => void;
-  onDocumentError?: () => void;
-  onDocumentReady?: () => void;
-  isNameLocked?: boolean;
-  allowDocumentRejection?: boolean;
-}
-
-export const MultiSignDocumentSigningView = ({
-  token,
-  recipientId,
-  onBack,
-  onDocumentCompleted,
-  onDocumentRejected,
-  onDocumentError,
-  onDocumentReady,
-  isNameLocked = false,
-  allowDocumentRejection = false,
-}: MultiSignDocumentSigningViewProps) => {
-  const { _ } = useLingui();
-  const { toast } = useToast();
-
-  const { fullName, email, signature, setFullName, setSignature } =
-    useRequiredDocumentSigningContext();
-
-  const [hasDocumentLoaded, setHasDocumentLoaded] = useState(false);
-
-  const [isExpanded, setIsExpanded] = useState(false);
-  const [isSubmitting, setIsSubmitting] = useState(false);
-  const [showPendingFieldTooltip, setShowPendingFieldTooltip] = useState(false);
-
-  const { data: document, isLoading } = trpc.embeddingPresign.getMultiSignDocument.useQuery(
-    { token },
-    {
-      staleTime: 0,
-    },
-  );
-
-  const { mutateAsync: signFieldWithToken } = trpc.field.signFieldWithToken.useMutation();
-  const { mutateAsync: removeSignedFieldWithToken } =
-    trpc.field.removeSignedFieldWithToken.useMutation();
-
-  const { mutateAsync: completeDocumentWithToken } =
-    trpc.recipient.completeDocumentWithToken.useMutation();
-
-  const hasSignatureField = document?.fields.some((field) => field.type === FieldType.SIGNATURE);
-
-  const [pendingFields, completedFields] = [
-    document?.fields.filter((field) => field.recipient.signingStatus !== SigningStatus.SIGNED) ??
-      [],
-    document?.fields.filter((field) => field.recipient.signingStatus === SigningStatus.SIGNED) ??
-      [],
-  ];
-
-  const uninsertedFields = document?.fields.filter((field) => !field.inserted);
-
-  const onSignField = async (payload: TSignFieldWithTokenMutationSchema) => {
-    try {
-      await signFieldWithToken(payload);
-    } catch (err) {
-      const error = AppError.parseError(err);
-
-      if (error.code === AppErrorCode.UNAUTHORIZED) {
-        throw error;
-      }
-
-      console.error(err);
-
-      toast({
-        title: _(msg`Error`),
-        description: _(msg`An error occurred while signing the document.`),
-        variant: 'destructive',
-      });
-    }
-  };
-
-  const onUnsignField = async (payload: TRemovedSignedFieldWithTokenMutationSchema) => {
-    try {
-      await removeSignedFieldWithToken(payload);
-    } catch (err) {
-      const error = AppError.parseError(err);
-
-      if (error.code === AppErrorCode.UNAUTHORIZED) {
-        throw error;
-      }
-
-      console.error(err);
-    }
-  };
-
-  const onDocumentComplete = async () => {
-    try {
-      setIsSubmitting(true);
-
-      await completeDocumentWithToken({
-        documentId: document!.id,
-        token,
-      });
-
-      onBack();
-
-      onDocumentCompleted?.({
-        token,
-        documentId: document!.id,
-        recipientId,
-      });
-    } catch (err) {
-      onDocumentError?.();
-
-      toast({
-        title: 'Error',
-        description: 'Failed to complete the document. Please try again.',
-        variant: 'destructive',
-      });
-    } finally {
-      setIsSubmitting(false);
-    }
-  };
-
-  const onNextFieldClick = () => {
-    setShowPendingFieldTooltip(true);
-
-    setIsExpanded(false);
-  };
-
-  const onRejected = (reason: string) => {
-    if (onDocumentRejected && document) {
-      onDocumentRejected({
-        token,
-        documentId: document.id,
-        recipientId,
-        reason,
-      });
-    }
-  };
-
-  return (
-    <div className="bg-background min-h-screen overflow-hidden">
-      <div id="document-field-portal-root" className="relative h-full w-full overflow-y-auto p-8">
-        {match({ isLoading, document })
-          .with({ isLoading: true }, () => (
-            <div className="flex min-h-[400px] w-full items-center justify-center">
-              <div className="flex flex-col items-center gap-4">
-                <Loader className="text-primary h-8 w-8 animate-spin" />
-                <p className="text-muted-foreground text-sm">
-                  <Trans>Loading document...</Trans>
-                </p>
-              </div>
-            </div>
-          ))
-          .with({ isLoading: false, document: undefined }, () => (
-            <div className="flex min-h-[400px] w-full items-center justify-center">
-              <p className="text-muted-foreground text-sm">
-                <Trans>Failed to load document</Trans>
-              </p>
-            </div>
-          ))
-          .with({ document: P.nonNullable }, ({ document }) => (
-            <>
-              <div className="mx-auto flex w-full max-w-screen-xl items-baseline justify-between">
-                <div className="flex items-center gap-4">
-                  <h1 className="text-2xl font-semibold">{document.title}</h1>
-                </div>
-
-                <Button variant="ghost" size="sm" onClick={onBack} className="p-2">
-                  <X className="h-5 w-5" />
-                </Button>
-              </div>
-
-              {allowDocumentRejection && (
-                <div className="embed--Actions mb-4 mt-8 flex w-full flex-row-reverse items-baseline justify-between">
-                  <DocumentSigningRejectDialog
-                    document={document}
-                    token={token}
-                    onRejected={onRejected}
-                  />
-                </div>
-              )}
-
-              <div className="embed--DocumentContainer relative mx-auto mt-8 flex w-full max-w-screen-xl flex-col gap-x-6 gap-y-12 md:flex-row">
-                <div
-                  className={cn('embed--DocumentViewer flex-1', {
-                    'md:mx-auto md:max-w-2xl': document.status === DocumentStatus.COMPLETED,
-                  })}
-                >
-                  <PDFViewer
-                    documentData={document.documentData}
-                    onDocumentLoad={() => {
-                      setHasDocumentLoaded(true);
-                      onDocumentReady?.();
-                    }}
-                  />
-                </div>
-
-                {/* Widget */}
-                {document.status !== DocumentStatus.COMPLETED && (
-                  <div
-                    key={isExpanded ? 'expanded' : 'collapsed'}
-                    className="embed--DocumentWidgetContainer group/document-widget fixed bottom-8 left-0 z-50 h-fit max-h-[calc(100dvh-2rem)] w-full flex-shrink-0 px-6 md:sticky md:bottom-[unset] md:top-0 md:z-auto md:w-[350px] md:px-0"
-                    data-expanded={isExpanded || undefined}
-                  >
-                    <div className="embed--DocumentWidget border-border bg-widget flex w-full flex-col rounded-xl border px-4 py-4 md:py-6">
-                      {/* Header */}
-                      <div className="embed--DocumentWidgetHeader">
-                        <div className="flex items-center justify-between gap-x-2">
-                          <h3 className="text-foreground text-xl font-semibold md:text-2xl">
-                            <Trans>Sign document</Trans>
-                          </h3>
-
-                          <Button variant="outline" className="h-8 w-8 p-0 md:hidden">
-                            {isExpanded ? (
-                              <LucideChevronDown
-                                className="text-muted-foreground h-5 w-5"
-                                onClick={() => setIsExpanded(false)}
-                              />
-                            ) : (
-                              <LucideChevronUp
-                                className="text-muted-foreground h-5 w-5"
-                                onClick={() => setIsExpanded(true)}
-                              />
-                            )}
-                          </Button>
-                        </div>
-                      </div>
-
-                      <div className="embed--DocumentWidgetContent hidden group-data-[expanded]/document-widget:block md:block">
-                        <p className="text-muted-foreground mt-2 text-sm">
-                          <Trans>Sign the document to complete the process.</Trans>
-                        </p>
-
-                        <hr className="border-border mb-8 mt-4" />
-                      </div>
-
-                      {/* Form */}
-                      <div className="embed--DocumentWidgetForm -mx-2 hidden px-2 group-data-[expanded]/document-widget:block md:block">
-                        <div className="flex flex-1 flex-col gap-y-4">
-                          {
-                            <>
-                              <div>
-                                <Label htmlFor="full-name">
-                                  <Trans>Full Name</Trans>
-                                </Label>
-
-                                <Input
-                                  type="text"
-                                  id="full-name"
-                                  className="bg-background mt-2"
-                                  disabled={isNameLocked}
-                                  value={fullName}
-                                  onChange={(e) => !isNameLocked && setFullName(e.target.value)}
-                                />
-                              </div>
-
-                              <div>
-                                <Label htmlFor="email">
-                                  <Trans>Email</Trans>
-                                </Label>
-
-                                <Input
-                                  type="email"
-                                  id="email"
-                                  className="bg-background mt-2"
-                                  value={email}
-                                  disabled
-                                />
-                              </div>
-
-                              {hasSignatureField && (
-                                <div>
-                                  <Label htmlFor="Signature">
-                                    <Trans>Signature</Trans>
-                                  </Label>
-
-                                  <SignaturePadDialog
-                                    className="mt-2"
-                                    disabled={isSubmitting}
-                                    disableAnimation
-                                    value={signature ?? ''}
-                                    onChange={(v) => setSignature(v ?? '')}
-                                    typedSignatureEnabled={
-                                      document.documentMeta?.typedSignatureEnabled
-                                    }
-                                    uploadSignatureEnabled={
-                                      document.documentMeta?.uploadSignatureEnabled
-                                    }
-                                    drawSignatureEnabled={
-                                      document.documentMeta?.drawSignatureEnabled
-                                    }
-                                  />
-                                </div>
-                              )}
-                            </>
-                          }
-                        </div>
-                      </div>
-
-                      <div className="hidden flex-1 group-data-[expanded]/document-widget:block md:block" />
-
-                      <div className="embed--DocumentWidgetFooter mt-4 hidden w-full grid-cols-2 items-center group-data-[expanded]/document-widget:grid md:grid">
-                        {uninsertedFields.length > 0 ? (
-                          <Button className="col-start-2" onClick={onNextFieldClick}>
-                            <Trans>Next</Trans>
-                          </Button>
-                        ) : (
-                          <Button
-                            className="col-span-2"
-                            loading={isSubmitting}
-                            onClick={onDocumentComplete}
-                          >
-                            <Trans>Complete</Trans>
-                          </Button>
-                        )}
-                      </div>
-                    </div>
-                  </div>
-                )}
-              </div>
-
-              {hasDocumentLoaded && (
-                <ElementVisible target={PDF_VIEWER_PAGE_SELECTOR}>
-                  {showPendingFieldTooltip && pendingFields.length > 0 && (
-                    <FieldToolTip
-                      key={pendingFields[0].id}
-                      field={pendingFields[0]}
-                      color="warning"
-                    >
-                      <Trans>Click to insert field</Trans>
-                    </FieldToolTip>
-                  )}
-                </ElementVisible>
-              )}
-
-              {/* Fields */}
-              {hasDocumentLoaded && (
-                <EmbedDocumentFields
-                  fields={pendingFields}
-                  metadata={document.documentMeta}
-                  onSignField={onSignField}
-                  onUnsignField={onUnsignField}
-                />
-              )}
-
-              {/* Completed fields */}
-              {document.status !== DocumentStatus.COMPLETED && (
-                <DocumentReadOnlyFields
-                  documentMeta={document.documentMeta ?? undefined}
-                  fields={completedFields}
-                />
-              )}
-            </>
-          ))
-          .otherwise(() => null)}
-      </div>
-    </div>
-  );
-};

apps/remix/app/components/general/direct-template/direct-template-configure-form.tsx

@@ -130,7 +130,7 @@ export const DirectTemplateConfigureForm = ({
                       {...field}
                       disabled={
                         field.disabled ||
-                        derivedRecipientAccessAuth.length > 0 ||
+                        derivedRecipientAccessAuth !== null ||
                         user?.email !== undefined
                       }
                       placeholder="recipient@documenso.com"

apps/remix/app/components/general/document-signing/document-signing-auth-2fa.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 
 import { zodResolver } from '@hookform/resolvers/zod';
 import { Trans } from '@lingui/react/macro';
@@ -6,9 +6,9 @@ import { RecipientRole } from '@prisma/client';
 import { useForm } from 'react-hook-form';
 import { z } from 'zod';
 
-import { AppError } from '@documenso/lib/errors/app-error';
 import { DocumentAuth, type TRecipientActionAuth } from '@documenso/lib/types/document-auth';
-import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
+import { trpc } from '@documenso/trpc/react';
+import { Alert, AlertDescription } from '@documenso/ui/primitives/alert';
 import { Button } from '@documenso/ui/primitives/button';
 import { DialogFooter } from '@documenso/ui/primitives/dialog';
 import {
@@ -20,6 +20,8 @@ import {
   FormMessage,
 } from '@documenso/ui/primitives/form/form';
 import { PinInput, PinInputGroup, PinInputSlot } from '@documenso/ui/primitives/pin-input';
+import { Tabs, TabsList, TabsTrigger } from '@documenso/ui/primitives/tabs';
+import { useToast } from '@documenso/ui/primitives/use-toast';
 
 import { EnableAuthenticatorAppDialog } from '~/components/forms/2fa/enable-authenticator-app-dialog';
 
@@ -51,6 +53,7 @@ export const DocumentSigningAuth2FA = ({
 }: DocumentSigningAuth2FAProps) => {
   const { recipient, user, isCurrentlyAuthenticating, setIsCurrentlyAuthenticating } =
     useRequiredDocumentSigningAuthContext();
+  const { toast } = useToast();
 
   const form = useForm<T2FAAuthFormSchema>({
     resolver: zodResolver(Z2FAAuthFormSchema),
@@ -60,27 +63,104 @@ export const DocumentSigningAuth2FA = ({
   });
 
   const [is2FASetupSuccessful, setIs2FASetupSuccessful] = useState(false);
-  const [formErrorCode, setFormErrorCode] = useState<string | null>(null);
+  const [isEmailCodeSent, setIsEmailCodeSent] = useState(false);
+  const [isEmailCodeSending, setIsEmailCodeSending] = useState(false);
+  const [canResendEmail, setCanResendEmail] = useState(true);
+  const [resendCountdown, setResendCountdown] = useState(0);
+  const countdownTimerRef = useRef<NodeJS.Timeout | null>(null);
+  const [verificationMethod, setVerificationMethod] = useState<'app' | 'email'>(
+    user?.twoFactorEnabled ? 'app' : 'email',
+  );
+  const emailSendInitiatedRef = useRef(false);
+
+  const sendVerificationMutation = trpc.auth.sendEmailVerification.useMutation({
+    onSuccess: () => {
+      setIsEmailCodeSent(true);
+      setCanResendEmail(false);
+      setResendCountdown(60);
+
+      countdownTimerRef.current = setInterval(() => {
+        setResendCountdown((prev) => {
+          if (prev <= 1) {
+            if (countdownTimerRef.current) {
+              clearInterval(countdownTimerRef.current);
+            }
+            setCanResendEmail(true);
+            return 0;
+          }
+          return prev - 1;
+        });
+      }, 1000);
+
+      toast({
+        title: 'Verification code sent',
+        description: `A verification code has been sent to ${recipient.email}`,
+      });
+    },
+    onError: (error) => {
+      console.error('Failed to send verification code', error);
+      toast({
+        title: 'Failed to send verification code',
+        description: 'Please try again or contact support',
+        variant: 'destructive',
+      });
+    },
+    onSettled: () => {
+      setIsEmailCodeSending(false);
+    },
+  });
+
+  const verifyCodeMutation = trpc.auth.verifyEmailCode.useMutation();
+
+  const sendEmailVerificationCode = async () => {
+    try {
+      setIsEmailCodeSending(true);
+      await sendVerificationMutation.mutateAsync({
+        recipientId: recipient.id,
+      });
+    } catch (error) {
+      toast({
+        title: 'Failed to send verification code',
+        description: 'Please try again.',
+        variant: 'destructive',
+      });
+    }
+  };
+
+  useEffect(() => {
+    return () => {
+      if (countdownTimerRef.current) {
+        clearInterval(countdownTimerRef.current);
+      }
+    };
+  }, []);
 
   const onFormSubmit = async ({ token }: T2FAAuthFormSchema) => {
     try {
       setIsCurrentlyAuthenticating(true);
 
+      if (verificationMethod === 'email') {
+        await verifyCodeMutation.mutateAsync({
+          code: token,
+          recipientId: recipient.id,
+        });
+      }
+
       await onReauthFormSubmit({
         type: DocumentAuth.TWO_FACTOR_AUTH,
         token,
       });
 
       setIsCurrentlyAuthenticating(false);
-
       onOpenChange(false);
     } catch (err) {
       setIsCurrentlyAuthenticating(false);
 
-      const error = AppError.parseError(err);
-      setFormErrorCode(error.code);
-
-      // Todo: Alert.
+      toast({
+        title: 'Unauthorized',
+        description: 'We were unable to verify your details.',
+        variant: 'destructive',
+      });
     }
   };
 
@@ -90,21 +170,47 @@ export const DocumentSigningAuth2FA = ({
     });
 
     setIs2FASetupSuccessful(false);
-    setFormErrorCode(null);
+    setIsEmailCodeSent(false);
 
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [open]);
+    if (open && !user?.twoFactorEnabled) {
+      setVerificationMethod('email');
+    }
+  }, [open, user?.twoFactorEnabled, form]);
 
-  if (!user?.twoFactorEnabled && !is2FASetupSuccessful) {
+  useEffect(() => {
+    if (!open || verificationMethod !== 'email') {
+      emailSendInitiatedRef.current = false;
+    }
+  }, [open, verificationMethod]);
+
+  useEffect(() => {
+    if (open && verificationMethod === 'email' && !isEmailCodeSent && !isEmailCodeSending) {
+      if (!emailSendInitiatedRef.current) {
+        emailSendInitiatedRef.current = true;
+        void sendEmailVerificationCode();
+      }
+    }
+  }, [open, verificationMethod, isEmailCodeSent, isEmailCodeSending]);
+
+  if (verificationMethod === 'app' && !user?.twoFactorEnabled && !is2FASetupSuccessful) {
     return (
       <div className="space-y-4">
+        <Tabs
+          value={verificationMethod}
+          onValueChange={(val) => setVerificationMethod(val as 'app' | 'email')}
+        >
+          <TabsList className="grid w-full grid-cols-2">
+            <TabsTrigger value="app">Authenticator App</TabsTrigger>
+            <TabsTrigger value="email">Email Verification</TabsTrigger>
+          </TabsList>
+        </Tabs>
+
         <Alert variant="warning">
           <AlertDescription>
             <p>
               {recipient.role === RecipientRole.VIEWER && actionTarget === 'DOCUMENT' ? (
                 <Trans>You need to setup 2FA to mark this document as viewed.</Trans>
               ) : (
-                // Todo: Translate
                 `You need to setup 2FA to ${actionVerb.toLowerCase()} this ${actionTarget.toLowerCase()}.`
               )}
             </p>
@@ -129,59 +235,106 @@ export const DocumentSigningAuth2FA = ({
   }
 
   return (
-    <Form {...form}>
-      <form onSubmit={form.handleSubmit(onFormSubmit)}>
-        <fieldset disabled={isCurrentlyAuthenticating}>
-          <div className="space-y-4">
-            <FormField
-              control={form.control}
-              name="token"
-              render={({ field }) => (
-                <FormItem>
-                  <FormLabel required>2FA token</FormLabel>
+    <div className="space-y-4">
+      {user?.twoFactorEnabled && (
+        <Tabs
+          value={verificationMethod}
+          onValueChange={(val) => setVerificationMethod(val as 'app' | 'email')}
+        >
+          <TabsList className="grid w-full grid-cols-2">
+            <TabsTrigger value="app">Authenticator App</TabsTrigger>
+            <TabsTrigger value="email">Email Verification</TabsTrigger>
+          </TabsList>
+        </Tabs>
+      )}
 
-                  <FormControl>
-                    <PinInput {...field} value={field.value ?? ''} maxLength={6}>
-                      {Array(6)
-                        .fill(null)
-                        .map((_, i) => (
-                          <PinInputGroup key={i}>
-                            <PinInputSlot index={i} />
-                          </PinInputGroup>
-                        ))}
-                    </PinInput>
-                  </FormControl>
-
-                  <FormMessage />
-                </FormItem>
-              )}
-            />
-
-            {formErrorCode && (
-              <Alert variant="destructive">
-                <AlertTitle>
-                  <Trans>Unauthorized</Trans>
-                </AlertTitle>
-                <AlertDescription>
-                  <Trans>
-                    We were unable to verify your details. Please try again or contact support
-                  </Trans>
-                </AlertDescription>
-              </Alert>
+      {verificationMethod === 'email' && (
+        <Alert variant="secondary">
+          <AlertDescription>
+            {isEmailCodeSent ? (
+              <p>
+                <Trans>
+                  A verification code has been sent to {recipient.email}. Please enter it below to
+                  continue.
+                </Trans>
+              </p>
+            ) : (
+              <p>
+                <Trans>
+                  We'll send a verification code to {recipient.email} to verify your identity.
+                </Trans>
+              </p>
             )}
+          </AlertDescription>
+        </Alert>
+      )}
 
-            <DialogFooter>
-              <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
-                <Trans>Cancel</Trans>
-              </Button>
+      <Form {...form}>
+        <form onSubmit={form.handleSubmit(onFormSubmit)}>
+          <fieldset disabled={isCurrentlyAuthenticating}>
+            <div className="space-y-4">
+              <FormField
+                control={form.control}
+                name="token"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel required>
+                      {verificationMethod === 'app' ? (
+                        <Trans>2FA token</Trans>
+                      ) : (
+                        <Trans>Verification code</Trans>
+                      )}
+                    </FormLabel>
 
-              <Button type="submit" loading={isCurrentlyAuthenticating}>
-                <Trans>Sign</Trans>
-              </Button>
-            </DialogFooter>
-          </div>
-        </fieldset>
-      </form>
-    </Form>
+                    <FormControl>
+                      <PinInput {...field} value={field.value ?? ''} maxLength={6}>
+                        {Array(6)
+                          .fill(null)
+                          .map((_, i) => (
+                            <PinInputGroup key={i}>
+                              <PinInputSlot index={i} />
+                            </PinInputGroup>
+                          ))}
+                      </PinInput>
+                    </FormControl>
+
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              {verificationMethod === 'email' && (
+                <div className="flex justify-center">
+                  <Button
+                    type="button"
+                    variant="link"
+                    disabled={isEmailCodeSending || !canResendEmail}
+                    onClick={() => void sendEmailVerificationCode()}
+                  >
+                    {isEmailCodeSending ? (
+                      <Trans>Sending...</Trans>
+                    ) : !canResendEmail ? (
+                      <Trans>Resend code ({resendCountdown}s)</Trans>
+                    ) : (
+                      <Trans>Resend code</Trans>
+                    )}
+                  </Button>
+                </div>
+              )}
+
+              <DialogFooter>
+                <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
+                  <Trans>Cancel</Trans>
+                </Button>
+
+                <Button type="submit" loading={isCurrentlyAuthenticating}>
+                  <Trans>{actionTarget === 'DOCUMENT' ? 'Sign Document' : 'Sign Field'}</Trans>
+                </Button>
+              </DialogFooter>
+            </div>
+          </fieldset>
+        </form>
+      </Form>
+    </div>
   );
 };

apps/remix/app/components/general/document-signing/document-signing-auth-dialog.tsx

@@ -1,8 +1,5 @@
-import { useState } from 'react';
-
 import { Trans } from '@lingui/react/macro';
 import type { FieldType } from '@prisma/client';
-import { ChevronLeftIcon } from 'lucide-react';
 import { P, match } from 'ts-pattern';
 
 import {
@@ -10,7 +7,6 @@ import {
   type TRecipientActionAuth,
   type TRecipientActionAuthTypes,
 } from '@documenso/lib/types/document-auth';
-import { Button } from '@documenso/ui/primitives/button';
 import {
   Dialog,
   DialogContent,
@@ -22,17 +18,15 @@ import {
 import { DocumentSigningAuth2FA } from './document-signing-auth-2fa';
 import { DocumentSigningAuthAccount } from './document-signing-auth-account';
 import { DocumentSigningAuthPasskey } from './document-signing-auth-passkey';
-import { DocumentSigningAuthPassword } from './document-signing-auth-password';
 import { useRequiredDocumentSigningAuthContext } from './document-signing-auth-provider';
 
 export type DocumentSigningAuthDialogProps = {
   title?: string;
-  availableAuthTypes: TRecipientActionAuthTypes[];
+  documentAuthType: TRecipientActionAuthTypes;
   description?: string;
   actionTarget: FieldType | 'DOCUMENT';
   open: boolean;
   onOpenChange: (value: boolean) => void;
-
   /**
    * The callback to run when the reauth form is filled out.
    */
@@ -42,158 +36,68 @@ export type DocumentSigningAuthDialogProps = {
 export const DocumentSigningAuthDialog = ({
   title,
   description,
-  availableAuthTypes,
+  documentAuthType,
+  actionTarget,
   open,
   onOpenChange,
   onReauthFormSubmit,
 }: DocumentSigningAuthDialogProps) => {
   const { recipient, user, isCurrentlyAuthenticating } = useRequiredDocumentSigningAuthContext();
 
-  // Filter out EXPLICIT_NONE from available auth types for the chooser
-  const validAuthTypes = availableAuthTypes.filter(
-    (authType) => authType !== DocumentAuth.EXPLICIT_NONE,
-  );
-
-  const [selectedAuthType, setSelectedAuthType] = useState<TRecipientActionAuthTypes | null>(() => {
-    // Auto-select if there's only one valid option
-    if (validAuthTypes.length === 1) {
-      return validAuthTypes[0];
-    }
-    // Return null if multiple options - show chooser
-    return null;
-  });
-
   const handleOnOpenChange = (value: boolean) => {
     if (isCurrentlyAuthenticating) {
       return;
     }
 
-    // Reset selected auth type when dialog closes
-    if (!value) {
-      setSelectedAuthType(() => {
-        if (validAuthTypes.length === 1) {
-          return validAuthTypes[0];
-        }
-
-        return null;
-      });
-    }
-
     onOpenChange(value);
   };
 
-  const handleBackToChooser = () => {
-    setSelectedAuthType(null);
-  };
-
-  // If no valid auth types available, don't render anything
-  if (validAuthTypes.length === 0) {
-    return null;
-  }
-
   return (
     <Dialog open={open} onOpenChange={handleOnOpenChange}>
       <DialogContent>
         <DialogHeader>
           <DialogTitle>
-            {selectedAuthType && validAuthTypes.length > 1 && (
-              <div className="flex items-center gap-2">
-                <Button
-                  type="button"
-                  variant="ghost"
-                  size="sm"
-                  onClick={handleBackToChooser}
-                  className="h-6 w-6 p-0"
-                >
-                  <ChevronLeftIcon className="h-4 w-4" />
-                </Button>
-                <span>{title || <Trans>Sign field</Trans>}</span>
-              </div>
-            )}
-            {(!selectedAuthType || validAuthTypes.length === 1) &&
-              (title || <Trans>Sign field</Trans>)}
+            {title ||
+              (actionTarget === 'DOCUMENT' ? (
+                <Trans>Sign document</Trans>
+              ) : (
+                <Trans>Sign field</Trans>
+              ))}
           </DialogTitle>
 
           <DialogDescription>
-            {description || <Trans>Reauthentication is required to sign this field</Trans>}
+            {description || (
+              <Trans>
+                Reauthentication is required to sign this{' '}
+                {actionTarget === 'DOCUMENT' ? 'document' : 'field'}
+              </Trans>
+            )}
           </DialogDescription>
         </DialogHeader>
 
-        {/* Show chooser if no auth type is selected and there are multiple options */}
-        {!selectedAuthType && validAuthTypes.length > 1 && (
-          <div className="space-y-4">
-            <p className="text-muted-foreground text-sm">
-              <Trans>Choose your preferred authentication method:</Trans>
-            </p>
-            <div className="grid gap-2">
-              {validAuthTypes.map((authType) => (
-                <Button
-                  key={authType}
-                  type="button"
-                  variant="outline"
-                  className="h-auto justify-start p-4"
-                  onClick={() => setSelectedAuthType(authType)}
-                >
-                  <div className="text-left">
-                    <div className="font-medium">
-                      {match(authType)
-                        .with(DocumentAuth.ACCOUNT, () => <Trans>Account</Trans>)
-                        .with(DocumentAuth.PASSKEY, () => <Trans>Passkey</Trans>)
-                        .with(DocumentAuth.TWO_FACTOR_AUTH, () => <Trans>2FA</Trans>)
-                        .with(DocumentAuth.PASSWORD, () => <Trans>Password</Trans>)
-                        .exhaustive()}
-                    </div>
-
-                    <div className="text-muted-foreground text-sm">
-                      {match(authType)
-                        .with(DocumentAuth.ACCOUNT, () => <Trans>Sign in to your account</Trans>)
-                        .with(DocumentAuth.PASSKEY, () => (
-                          <Trans>Use your passkey for authentication</Trans>
-                        ))
-                        .with(DocumentAuth.TWO_FACTOR_AUTH, () => (
-                          <Trans>Enter your 2FA code</Trans>
-                        ))
-                        .with(DocumentAuth.PASSWORD, () => <Trans>Enter your password</Trans>)
-                        .exhaustive()}
-                    </div>
-                  </div>
-                </Button>
-              ))}
-            </div>
-          </div>
-        )}
-
-        {/* Show the selected auth component */}
-        {selectedAuthType &&
-          match({ documentAuthType: selectedAuthType, user })
-            .with(
-              { documentAuthType: DocumentAuth.ACCOUNT },
-              { user: P.when((user) => !user || user.email !== recipient.email) }, // Assume all current auth methods requires them to be logged in.
-              () => <DocumentSigningAuthAccount onOpenChange={onOpenChange} />,
-            )
-            .with({ documentAuthType: DocumentAuth.PASSKEY }, () => (
-              <DocumentSigningAuthPasskey
-                open={open}
-                onOpenChange={onOpenChange}
-                onReauthFormSubmit={onReauthFormSubmit}
-              />
-            ))
-            .with({ documentAuthType: DocumentAuth.TWO_FACTOR_AUTH }, () => (
-              <DocumentSigningAuth2FA
-                open={open}
-                onOpenChange={onOpenChange}
-                onReauthFormSubmit={onReauthFormSubmit}
-              />
-            ))
-            .with({ documentAuthType: DocumentAuth.PASSWORD }, () => (
-              <DocumentSigningAuthPassword
-                open={open}
-                onOpenChange={onOpenChange}
-                onReauthFormSubmit={onReauthFormSubmit}
-              />
-            ))
-            .with({ documentAuthType: DocumentAuth.EXPLICIT_NONE }, () => null)
-            .exhaustive()}
+        {match({ documentAuthType, user })
+          .with(
+            { documentAuthType: DocumentAuth.ACCOUNT },
+            { user: P.when((user) => !user || user.email !== recipient.email) }, // Assume all current auth methods requires them to be logged in.
+            () => <DocumentSigningAuthAccount onOpenChange={onOpenChange} />,
+          )
+          .with({ documentAuthType: DocumentAuth.PASSKEY }, () => (
+            <DocumentSigningAuthPasskey
+              open={open}
+              onOpenChange={onOpenChange}
+              onReauthFormSubmit={onReauthFormSubmit}
+            />
+          ))
+          .with({ documentAuthType: DocumentAuth.TWO_FACTOR_AUTH }, () => (
+            <DocumentSigningAuth2FA
+              actionTarget={actionTarget === 'DOCUMENT' ? 'DOCUMENT' : 'FIELD'}
+              open={open}
+              onOpenChange={onOpenChange}
+              onReauthFormSubmit={onReauthFormSubmit}
+            />
+          ))
+          .with({ documentAuthType: DocumentAuth.EXPLICIT_NONE }, () => null)
+          .exhaustive()}
       </DialogContent>
     </Dialog>
   );

apps/remix/app/components/general/document-signing/document-signing-auth-password.tsx

@@ -1,148 +0,0 @@
-import { useEffect, useState } from 'react';
-
-import { zodResolver } from '@hookform/resolvers/zod';
-import { Trans } from '@lingui/react/macro';
-import { useForm } from 'react-hook-form';
-import { z } from 'zod';
-
-import { AppError } from '@documenso/lib/errors/app-error';
-import { DocumentAuth, type TRecipientActionAuth } from '@documenso/lib/types/document-auth';
-import { Alert, AlertDescription, AlertTitle } from '@documenso/ui/primitives/alert';
-import { Button } from '@documenso/ui/primitives/button';
-import { DialogFooter } from '@documenso/ui/primitives/dialog';
-import {
-  Form,
-  FormControl,
-  FormField,
-  FormItem,
-  FormLabel,
-  FormMessage,
-} from '@documenso/ui/primitives/form/form';
-import { Input } from '@documenso/ui/primitives/input';
-
-import { useRequiredDocumentSigningAuthContext } from './document-signing-auth-provider';
-
-export type DocumentSigningAuthPasswordProps = {
-  actionTarget?: 'FIELD' | 'DOCUMENT';
-  actionVerb?: string;
-  open: boolean;
-  onOpenChange: (value: boolean) => void;
-  onReauthFormSubmit: (values?: TRecipientActionAuth) => Promise<void> | void;
-};
-
-const ZPasswordAuthFormSchema = z.object({
-  password: z
-    .string()
-    .min(1, { message: 'Password is required' })
-    .max(72, { message: 'Password must be at most 72 characters long' }),
-});
-
-type TPasswordAuthFormSchema = z.infer<typeof ZPasswordAuthFormSchema>;
-
-export const DocumentSigningAuthPassword = ({
-  actionTarget = 'FIELD',
-  actionVerb = 'sign',
-  onReauthFormSubmit,
-  open,
-  onOpenChange,
-}: DocumentSigningAuthPasswordProps) => {
-  const { recipient, isCurrentlyAuthenticating, setIsCurrentlyAuthenticating } =
-    useRequiredDocumentSigningAuthContext();
-
-  const form = useForm<TPasswordAuthFormSchema>({
-    resolver: zodResolver(ZPasswordAuthFormSchema),
-    defaultValues: {
-      password: '',
-    },
-  });
-
-  const [formErrorCode, setFormErrorCode] = useState<string | null>(null);
-
-  const onFormSubmit = async ({ password }: TPasswordAuthFormSchema) => {
-    try {
-      setIsCurrentlyAuthenticating(true);
-
-      await onReauthFormSubmit({
-        type: DocumentAuth.PASSWORD,
-        password,
-      });
-
-      setIsCurrentlyAuthenticating(false);
-
-      onOpenChange(false);
-    } catch (err) {
-      setIsCurrentlyAuthenticating(false);
-
-      const error = AppError.parseError(err);
-      setFormErrorCode(error.code);
-
-      // Todo: Alert.
-    }
-  };
-
-  useEffect(() => {
-    form.reset({
-      password: '',
-    });
-
-    setFormErrorCode(null);
-
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [open]);
-
-  return (
-    <Form {...form}>
-      <form onSubmit={form.handleSubmit(onFormSubmit)}>
-        <fieldset disabled={isCurrentlyAuthenticating}>
-          <div className="space-y-4">
-            {formErrorCode && (
-              <Alert variant="destructive">
-                <AlertTitle>
-                  <Trans>Unauthorized</Trans>
-                </AlertTitle>
-                <AlertDescription>
-                  <Trans>
-                    We were unable to verify your details. Please try again or contact support
-                  </Trans>
-                </AlertDescription>
-              </Alert>
-            )}
-
-            <FormField
-              control={form.control}
-              name="password"
-              render={({ field }) => (
-                <FormItem>
-                  <FormLabel required>
-                    <Trans>Password</Trans>
-                  </FormLabel>
-
-                  <FormControl>
-                    <Input
-                      type="password"
-                      placeholder="Enter your password"
-                      {...field}
-                      autoComplete="current-password"
-                    />
-                  </FormControl>
-
-                  <FormMessage />
-                </FormItem>
-              )}
-            />
-
-            <DialogFooter>
-              <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
-                <Trans>Cancel</Trans>
-              </Button>
-
-              <Button type="submit" loading={isCurrentlyAuthenticating}>
-                <Trans>Sign</Trans>
-              </Button>
-            </DialogFooter>
-          </div>
-        </fieldset>
-      </form>
-    </Form>
-  );
-};

apps/remix/app/components/general/document-signing/document-signing-auth-provider.tsx

@@ -1,6 +1,7 @@
 import { createContext, useContext, useEffect, useMemo, useState } from 'react';
 
 import { type Document, FieldType, type Passkey, type Recipient } from '@prisma/client';
+import { match } from 'ts-pattern';
 
 import type { SessionUser } from '@documenso/auth/server/lib/session/session';
 import { MAXIMUM_PASSKEYS } from '@documenso/lib/constants/auth';
@@ -32,8 +33,8 @@ export type DocumentSigningAuthContextValue = {
   recipient: Recipient;
   recipientAuthOption: TRecipientAuthOptions;
   setRecipient: (_value: Recipient) => void;
-  derivedRecipientAccessAuth: TRecipientAccessAuthTypes[];
-  derivedRecipientActionAuth: TRecipientActionAuthTypes[];
+  derivedRecipientAccessAuth: TRecipientAccessAuthTypes | null;
+  derivedRecipientActionAuth: TRecipientActionAuthTypes | null;
   isAuthRedirectRequired: boolean;
   isCurrentlyAuthenticating: boolean;
   setIsCurrentlyAuthenticating: (_value: boolean) => void;
@@ -42,6 +43,7 @@ export type DocumentSigningAuthContextValue = {
   setPreferredPasskeyId: (_value: string | null) => void;
   user?: SessionUser | null;
   refetchPasskeys: () => Promise<void>;
+  isEnterprise: boolean;
 };
 
 const DocumentSigningAuthContext = createContext<DocumentSigningAuthContextValue | null>(null);
@@ -65,6 +67,7 @@ export interface DocumentSigningAuthProviderProps {
   recipient: Recipient;
   user?: SessionUser | null;
   children: React.ReactNode;
+  isEnterprise: boolean;
 }
 
 export const DocumentSigningAuthProvider = ({
@@ -72,6 +75,7 @@ export const DocumentSigningAuthProvider = ({
   recipient: initialRecipient,
   user,
   children,
+  isEnterprise,
 }: DocumentSigningAuthProviderProps) => {
   const [documentAuthOptions, setDocumentAuthOptions] = useState(initialDocumentAuthOptions);
   const [recipient, setRecipient] = useState(initialRecipient);
@@ -99,7 +103,7 @@ export const DocumentSigningAuthProvider = ({
     },
     {
       placeholderData: (previousData) => previousData,
-      enabled: derivedRecipientActionAuth?.includes(DocumentAuth.PASSKEY) ?? false,
+      enabled: derivedRecipientActionAuth === DocumentAuth.PASSKEY,
     },
   );
 
@@ -120,32 +124,30 @@ export const DocumentSigningAuthProvider = ({
    * Will be `null` if the user still requires authentication, or if they don't need
    * authentication.
    */
-  const preCalculatedActionAuthOptions = useMemo(() => {
-    if (
-      !derivedRecipientActionAuth ||
-      derivedRecipientActionAuth.length === 0 ||
-      derivedRecipientActionAuth.includes(DocumentAuth.EXPLICIT_NONE)
-    ) {
-      return {
-        type: DocumentAuth.EXPLICIT_NONE,
-      };
-    }
+  const preCalculatedActionAuthOptions = match(derivedRecipientActionAuth)
+    .with(DocumentAuth.ACCOUNT, () => {
+      if (recipient.email !== user?.email) {
+        return null;
+      }
 
-    if (
-      derivedRecipientActionAuth.includes(DocumentAuth.ACCOUNT) &&
-      user?.email == recipient.email
-    ) {
       return {
         type: DocumentAuth.ACCOUNT,
       };
-    }
-
-    return null;
-  }, [derivedRecipientActionAuth, user, recipient]);
+    })
+    .with(DocumentAuth.EXPLICIT_NONE, () => ({
+      type: DocumentAuth.EXPLICIT_NONE,
+    }))
+    .with(DocumentAuth.PASSKEY, DocumentAuth.TWO_FACTOR_AUTH, null, () => null)
+    .exhaustive();
 
   const executeActionAuthProcedure = async (options: ExecuteActionAuthProcedureOptions) => {
-    // Directly run callback if no auth required.
-    if (!derivedRecipientActionAuth || options.actionTarget !== FieldType.SIGNATURE) {
+    // Determine if authentication is required based on enterprise status and action target.
+    const requiresAuthTrigger = isEnterprise
+      ? derivedRecipientActionAuth && options.actionTarget === FieldType.SIGNATURE
+      : derivedRecipientActionAuth && options.actionTarget === 'DOCUMENT';
+
+    // Directly run callback if no auth trigger is needed.
+    if (!requiresAuthTrigger) {
       await options.onReauthFormSubmit();
       return;
     }
@@ -176,8 +178,7 @@ export const DocumentSigningAuthProvider = ({
   // Assume that a user must be logged in for any auth requirements.
   const isAuthRedirectRequired = Boolean(
     derivedRecipientActionAuth &&
-      derivedRecipientActionAuth.length > 0 &&
-      !derivedRecipientActionAuth.includes(DocumentAuth.EXPLICIT_NONE) &&
+      derivedRecipientActionAuth !== DocumentAuth.EXPLICIT_NONE &&
       user?.email !== recipient.email,
   );
 
@@ -205,6 +206,7 @@ export const DocumentSigningAuthProvider = ({
         preferredPasskeyId,
         setPreferredPasskeyId,
         refetchPasskeys,
+        isEnterprise,
       }}
     >
       {children}
@@ -215,7 +217,7 @@ export const DocumentSigningAuthProvider = ({
           onOpenChange={() => setDocumentAuthDialogPayload(null)}
           onReauthFormSubmit={documentAuthDialogPayload.onReauthFormSubmit}
           actionTarget={documentAuthDialogPayload.actionTarget}
-          availableAuthTypes={derivedRecipientActionAuth}
+          documentAuthType={derivedRecipientActionAuth}
         />
       )}
     </DocumentSigningAuthContext.Provider>
@@ -224,7 +226,9 @@ export const DocumentSigningAuthProvider = ({
 
 type ExecuteActionAuthProcedureOptions = Omit<
   DocumentSigningAuthDialogProps,
-  'open' | 'onOpenChange' | 'documentAuthType' | 'recipientRole' | 'availableAuthTypes'
->;
+  'open' | 'onOpenChange' | 'documentAuthType' | 'recipientRole'
+> & {
+  actionTarget: FieldType | 'DOCUMENT';
+};
 
 DocumentSigningAuthProvider.displayName = 'DocumentSigningAuthProvider';

apps/remix/app/components/general/document-signing/document-signing-auto-sign.tsx

@@ -44,7 +44,6 @@ const AUTO_SIGNABLE_FIELD_TYPES: string[] = [
 // other field types.
 const NON_AUTO_SIGNABLE_ACTION_AUTH_TYPES: string[] = [
   DocumentAuth.PASSKEY,
-  DocumentAuth.PASSWORD,
   DocumentAuth.TWO_FACTOR_AUTH,
 ];
 
@@ -97,8 +96,8 @@ export const DocumentSigningAutoSign = ({ recipient, fields }: DocumentSigningAu
     return true;
   });
 
-  const actionAuthAllowsAutoSign = derivedRecipientActionAuth.every(
-    (actionAuth) => !NON_AUTO_SIGNABLE_ACTION_AUTH_TYPES.includes(actionAuth),
+  const actionAuthAllowsAutoSign = !NON_AUTO_SIGNABLE_ACTION_AUTH_TYPES.includes(
+    derivedRecipientActionAuth ?? '',
   );
 
   const onSubmit = async () => {
@@ -111,16 +110,16 @@ export const DocumentSigningAutoSign = ({ recipient, fields }: DocumentSigningAu
           .with(FieldType.DATE, () => new Date().toISOString())
           .otherwise(() => '');
 
-        const authOptions = match(derivedRecipientActionAuth.at(0))
+        const authOptions = match(derivedRecipientActionAuth)
           .with(DocumentAuth.ACCOUNT, () => ({
             type: DocumentAuth.ACCOUNT,
           }))
           .with(DocumentAuth.EXPLICIT_NONE, () => ({
             type: DocumentAuth.EXPLICIT_NONE,
           }))
-          .with(undefined, () => undefined)
+          .with(null, () => undefined)
           .with(
-            P.union(DocumentAuth.PASSKEY, DocumentAuth.TWO_FACTOR_AUTH, DocumentAuth.PASSWORD),
+            P.union(DocumentAuth.PASSKEY, DocumentAuth.TWO_FACTOR_AUTH),
             // This is a bit dirty, but the sentinel value used here is incredibly short-lived.
             () => 'NOT_SUPPORTED' as const,
           )

apps/remix/app/components/general/document-signing/document-signing-complete-dialog.tsx

@@ -92,6 +92,8 @@ export const DocumentSigningCompleteDialog = ({
   };
 
   const onFormSubmit = async (data: TNextSignerFormSchema) => {
+    console.log('data', data);
+    console.log('form.formState.errors', form.formState.errors);
     try {
       if (allowDictateNextSigner && data.name && data.email) {
         await onSignatureComplete({ name: data.name, email: data.email });

apps/remix/app/components/general/document-signing/document-signing-form.tsx

@@ -28,6 +28,7 @@ import {
   AssistantConfirmationDialog,
   type NextSigner,
 } from '../../dialogs/assistant-confirmation-dialog';
+import { useRequiredDocumentSigningAuthContext } from './document-signing-auth-provider';
 import { DocumentSigningCompleteDialog } from './document-signing-complete-dialog';
 import { useRequiredDocumentSigningContext } from './document-signing-provider';
 
@@ -39,6 +40,7 @@ export type DocumentSigningFormProps = {
   isRecipientsTurn: boolean;
   allRecipients?: RecipientWithFields[];
   setSelectedSignerId?: (id: number | null) => void;
+  isEnterprise: boolean;
 };
 
 export const DocumentSigningForm = ({
@@ -49,6 +51,7 @@ export const DocumentSigningForm = ({
   isRecipientsTurn,
   allRecipients = [],
   setSelectedSignerId,
+  isEnterprise,
 }: DocumentSigningFormProps) => {
   const { sessionData } = useOptionalSession();
   const user = sessionData?.user;
@@ -62,6 +65,7 @@ export const DocumentSigningForm = ({
   const assistantSignersId = useId();
 
   const { fullName, signature, setFullName, setSignature } = useRequiredDocumentSigningContext();
+  const { executeActionAuthProcedure } = useRequiredDocumentSigningAuthContext();
 
   const [validateUninsertedFields, setValidateUninsertedFields] = useState(false);
   const [isConfirmationDialogOpen, setIsConfirmationDialogOpen] = useState(false);
@@ -114,11 +118,16 @@ export const DocumentSigningForm = ({
     setIsAssistantSubmitting(true);
 
     try {
-      await completeDocument(undefined, nextSigner);
+      await executeActionAuthProcedure({
+        actionTarget: 'DOCUMENT',
+        onReauthFormSubmit: async (authOptions) => {
+          await completeDocument(authOptions, nextSigner);
+        },
+      });
     } catch (err) {
       toast({
-        title: 'Error',
-        description: 'An error occurred while completing the document. Please try again.',
+        title: _(msg`Error`),
+        description: _(msg`An error occurred while completing the document. Please try again.`),
         variant: 'destructive',
       });
 
@@ -229,7 +238,12 @@ export const DocumentSigningForm = ({
                     fields={fields}
                     fieldsValidated={fieldsValidated}
                     onSignatureComplete={async (nextSigner) => {
-                      await completeDocument(undefined, nextSigner);
+                      await executeActionAuthProcedure({
+                        actionTarget: 'DOCUMENT',
+                        onReauthFormSubmit: async (authOptions) => {
+                          await completeDocument(authOptions, nextSigner);
+                        },
+                      });
                     }}
                     role={recipient.role}
                     allowDictateNextSigner={document.documentMeta?.allowDictateNextSigner}
@@ -409,7 +423,12 @@ export const DocumentSigningForm = ({
                     fieldsValidated={fieldsValidated}
                     disabled={!isRecipientsTurn}
                     onSignatureComplete={async (nextSigner) => {
-                      await completeDocument(undefined, nextSigner);
+                      await executeActionAuthProcedure({
+                        actionTarget: 'DOCUMENT',
+                        onReauthFormSubmit: async (authOptions) => {
+                          await completeDocument(authOptions, nextSigner);
+                        },
+                      });
                     }}
                     role={recipient.role}
                     allowDictateNextSigner={

apps/remix/app/components/general/document-signing/document-signing-page-view.tsx

@@ -47,6 +47,7 @@ export type DocumentSigningPageViewProps = {
   completedFields: CompletedField[];
   isRecipientsTurn: boolean;
   allRecipients?: RecipientWithFields[];
+  isEnterprise: boolean;
 };
 
 export const DocumentSigningPageView = ({
@@ -56,6 +57,7 @@ export const DocumentSigningPageView = ({
   completedFields,
   isRecipientsTurn,
   allRecipients = [],
+  isEnterprise,
 }: DocumentSigningPageViewProps) => {
   const { documentData, documentMeta } = document;
 
@@ -153,6 +155,7 @@ export const DocumentSigningPageView = ({
               isRecipientsTurn={isRecipientsTurn}
               allRecipients={allRecipients}
               setSelectedSignerId={setSelectedSignerId}
+              isEnterprise={isEnterprise}
             />
           </div>
         </div>

apps/remix/app/components/general/document/document-edit-form.tsx

@@ -183,8 +183,8 @@ export const DocumentEditForm = ({
           title: data.title,
           externalId: data.externalId || null,
           visibility: data.visibility,
-          globalAccessAuth: data.globalAccessAuth ?? [],
-          globalActionAuth: data.globalActionAuth ?? [],
+          globalAccessAuth: data.globalAccessAuth ?? null,
+          globalActionAuth: data.globalActionAuth ?? null,
         },
         meta: {
           timezone,
@@ -229,7 +229,7 @@ export const DocumentEditForm = ({
           recipients: data.signers.map((signer) => ({
             ...signer,
             // Explicitly set to null to indicate we want to remove auth if required.
-            actionAuth: signer.actionAuth ?? [],
+            actionAuth: signer.actionAuth || null,
           })),
         }),
       ]);

apps/remix/app/components/general/document/document-history-sheet.tsx

@@ -81,15 +81,11 @@ export const DocumentHistorySheet = ({
    * @param text The text to format
    * @returns The formatted text
    */
-  const formatGenericText = (text?: string | string[] | null): string => {
+  const formatGenericText = (text?: string | null) => {
     if (!text) {
       return '';
     }
 
-    if (Array.isArray(text)) {
-      return text.map((t) => formatGenericText(t)).join(', ');
-    }
-
     return (text.charAt(0).toUpperCase() + text.slice(1).toLowerCase()).replaceAll('_', ' ');
   };
 
@@ -249,19 +245,11 @@ export const DocumentHistorySheet = ({
                         values={[
                           {
                             key: 'Old',
-                            value: Array.isArray(data.from)
-                              ? data.from
-                                  .map((f) => DOCUMENT_AUTH_TYPES[f]?.value || 'None')
-                                  .join(', ')
-                              : DOCUMENT_AUTH_TYPES[data.from || '']?.value || 'None',
+                            value: DOCUMENT_AUTH_TYPES[data.from || '']?.value || 'None',
                           },
                           {
                             key: 'New',
-                            value: Array.isArray(data.to)
-                              ? data.to
-                                  .map((f) => DOCUMENT_AUTH_TYPES[f]?.value || 'None')
-                                  .join(', ')
-                              : DOCUMENT_AUTH_TYPES[data.to || '']?.value || 'None',
+                            value: DOCUMENT_AUTH_TYPES[data.to || '']?.value || 'None',
                           },
                         ]}
                       />

apps/remix/app/components/general/template/template-edit-form.tsx

@@ -134,8 +134,8 @@ export const TemplateEditForm = ({
           title: data.title,
           externalId: data.externalId || null,
           visibility: data.visibility,
-          globalAccessAuth: data.globalAccessAuth ?? [],
-          globalActionAuth: data.globalActionAuth ?? [],
+          globalAccessAuth: data.globalAccessAuth ?? null,
+          globalActionAuth: data.globalActionAuth ?? null,
         },
         meta: {
           ...data.meta,
@@ -152,7 +152,7 @@ export const TemplateEditForm = ({
 
       toast({
         title: _(msg`Error`),
-        description: _(msg`An error occurred while updating the document settings.`),
+        description: _(msg`An error occurred while updating the template settings.`),
         variant: 'destructive',
       });
     }

apps/remix/app/routes/_internal+/[__htmltopdf]+/certificate.tsx

@@ -3,7 +3,6 @@ import { useLingui } from '@lingui/react';
 import { FieldType, SigningStatus } from '@prisma/client';
 import { DateTime } from 'luxon';
 import { redirect } from 'react-router';
-import { prop, sortBy } from 'remeda';
 import { match } from 'ts-pattern';
 import { UAParser } from 'ua-parser-js';
 import { renderSVG } from 'uqr';
@@ -134,30 +133,18 @@ export default function SigningCertificate({ loaderData }: Route.ComponentProps)
       recipientAuth: recipient.authOptions,
     });
 
-    const insertedAuditLogsWithFieldAuth = sortBy(
-      auditLogs.DOCUMENT_FIELD_INSERTED.filter(
-        (log) => log.data.recipientId === recipient.id && log.data.fieldSecurity,
-      ),
-      [prop('createdAt'), 'desc'],
-    );
-
-    const actionAuthMethod = insertedAuditLogsWithFieldAuth.at(0)?.data?.fieldSecurity?.type;
-
-    let authLevel = match(actionAuthMethod)
+    let authLevel = match(extractedAuthMethods.derivedRecipientActionAuth)
       .with('ACCOUNT', () => _(msg`Account Re-Authentication`))
       .with('TWO_FACTOR_AUTH', () => _(msg`Two-Factor Re-Authentication`))
-      .with('PASSWORD', () => _(msg`Password Re-Authentication`))
       .with('PASSKEY', () => _(msg`Passkey Re-Authentication`))
       .with('EXPLICIT_NONE', () => _(msg`Email`))
-      .with(undefined, () => null)
+      .with(null, () => null)
       .exhaustive();
 
     if (!authLevel) {
-      const accessAuthMethod = extractedAuthMethods.derivedRecipientAccessAuth.at(0);
-
-      authLevel = match(accessAuthMethod)
+      authLevel = match(extractedAuthMethods.derivedRecipientAccessAuth)
         .with('ACCOUNT', () => _(msg`Account Authentication`))
-        .with(undefined, () => _(msg`Email`))
+        .with(null, () => _(msg`Email`))
         .exhaustive();
     }
 

apps/remix/app/routes/_recipient+/d.$token+/_index.tsx

@@ -47,9 +47,9 @@ export async function loader({ params, request }: Route.LoaderArgs) {
   });
 
   // Ensure typesafety when we add more options.
-  const isAccessAuthValid = match(derivedRecipientAccessAuth.at(0))
+  const isAccessAuthValid = match(derivedRecipientAccessAuth)
     .with(DocumentAccessAuth.ACCOUNT, () => Boolean(session.user))
-    .with(undefined, () => true)
+    .with(null, () => true)
     .exhaustive();
 
   if (!isAccessAuthValid) {
@@ -94,6 +94,7 @@ export default function DirectTemplatePage() {
         documentAuthOptions={template.authOptions}
         recipient={directTemplateRecipient}
         user={user}
+        isEnterprise={false}
       >
         <div className="mx-auto -mt-4 w-full max-w-screen-xl px-4 md:px-8">
           <h1

apps/remix/app/routes/_recipient+/sign.$token+/_index.tsx

@@ -6,6 +6,7 @@ import { getOptionalLoaderContext } from 'server/utils/get-loader-session';
 
 import signingCelebration from '@documenso/assets/images/signing-celebration.png';
 import { getOptionalSession } from '@documenso/auth/server/lib/utils/get-session';
+import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
 import { useOptionalSession } from '@documenso/lib/client-only/providers/session';
 import { getDocumentAndSenderByToken } from '@documenso/lib/server-only/document/get-document-by-token';
 import { isRecipientAuthorized } from '@documenso/lib/server-only/document/is-recipient-authorized';
@@ -60,6 +61,10 @@ export async function loader({ params, request }: Route.LoaderArgs) {
     throw new Response('Not Found', { status: 404 });
   }
 
+  const isEnterprise = user?.id
+    ? await isUserEnterprise({ userId: user.id }).catch(() => false)
+    : false;
+
   const recipientWithFields = { ...recipient, fields };
 
   const isRecipientsTurn = await getIsRecipientsTurnToSign({ token });
@@ -115,6 +120,7 @@ export async function loader({ params, request }: Route.LoaderArgs) {
       isDocumentAccessValid: false,
       recipientEmail: recipient.email,
       recipientHasAccount,
+      isEnterprise,
     } as const);
   }
 
@@ -149,6 +155,7 @@ export async function loader({ params, request }: Route.LoaderArgs) {
     completedFields,
     recipientSignature,
     isRecipientsTurn,
+    isEnterprise,
   } as const);
 }
 
@@ -176,6 +183,7 @@ export default function SigningPage() {
     isRecipientsTurn,
     allRecipients,
     recipientWithFields,
+    isEnterprise,
   } = data;
 
   if (document.deletedAt || document.status === DocumentStatus.REJECTED) {
@@ -241,6 +249,7 @@ export default function SigningPage() {
         documentAuthOptions={document.authOptions}
         recipient={recipient}
         user={user}
+        isEnterprise={isEnterprise}
       >
         <DocumentSigningPageView
           recipient={recipientWithFields}
@@ -249,6 +258,7 @@ export default function SigningPage() {
           completedFields={completedFields}
           isRecipientsTurn={isRecipientsTurn}
           allRecipients={allRecipients}
+          isEnterprise={isEnterprise}
         />
       </DocumentSigningAuthProvider>
     </DocumentSigningProvider>

apps/remix/app/routes/embed+/_v0+/direct.$url.tsx

@@ -68,9 +68,9 @@ export async function loader({ params, request }: Route.LoaderArgs) {
     }),
   ]);
 
-  const isAccessAuthValid = match(derivedRecipientAccessAuth.at(0))
-    .with(DocumentAccessAuth.ACCOUNT, () => !!user)
-    .with(undefined, () => true)
+  const isAccessAuthValid = match(derivedRecipientAccessAuth)
+    .with(DocumentAccessAuth.ACCOUNT, () => user !== null)
+    .with(null, () => true)
     .exhaustive();
 
   if (!isAccessAuthValid) {
@@ -143,6 +143,7 @@ export default function EmbedDirectTemplatePage() {
         documentAuthOptions={template.authOptions}
         recipient={recipient}
         user={user}
+        isEnterprise={isEnterpriseDocument}
       >
         <DocumentSigningRecipientProvider recipient={recipient}>
           <EmbedDirectTemplateClientPage

apps/remix/app/routes/embed+/_v0+/sign.$url.tsx

@@ -81,9 +81,9 @@ export async function loader({ params, request }: Route.LoaderArgs) {
     documentAuth: document.authOptions,
   });
 
-  const isAccessAuthValid = match(derivedRecipientAccessAuth.at(0))
-    .with(DocumentAccessAuth.ACCOUNT, () => user && user.email === recipient.email)
-    .with(undefined, () => true)
+  const isAccessAuthValid = match(derivedRecipientAccessAuth)
+    .with(DocumentAccessAuth.ACCOUNT, () => user !== null)
+    .with(null, () => true)
     .exhaustive();
 
   if (!isAccessAuthValid) {
@@ -168,6 +168,7 @@ export default function EmbedSignDocumentPage() {
         documentAuthOptions={document.authOptions}
         recipient={recipient}
         user={user}
+        isEnterprise={isEnterpriseDocument}
       >
         <EmbedSignDocumentClientPage
           token={token}

apps/remix/app/routes/embed+/v1+/multisign+/_index.tsx

@@ -1,325 +0,0 @@
-import { useEffect, useLayoutEffect, useState } from 'react';
-
-import { SigningStatus } from '@prisma/client';
-import { useRevalidator } from 'react-router';
-
-import { getOptionalSession } from '@documenso/auth/server/lib/utils/get-session';
-import { isCommunityPlan as isUserCommunityPlan } from '@documenso/ee/server-only/util/is-community-plan';
-import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
-import { isDocumentPlatform } from '@documenso/ee/server-only/util/is-document-platform';
-import { getDocumentAndSenderByToken } from '@documenso/lib/server-only/document/get-document-by-token';
-import { getRecipientByToken } from '@documenso/lib/server-only/recipient/get-recipient-by-token';
-import { getTeamById } from '@documenso/lib/server-only/team/get-team';
-
-import { BrandingLogo } from '~/components/general/branding-logo';
-import { DocumentSigningAuthProvider } from '~/components/general/document-signing/document-signing-auth-provider';
-import { DocumentSigningProvider } from '~/components/general/document-signing/document-signing-provider';
-import { DocumentSigningRecipientProvider } from '~/components/general/document-signing/document-signing-recipient-provider';
-import { ZSignDocumentEmbedDataSchema } from '~/types/embed-document-sign-schema';
-import { injectCss } from '~/utils/css-vars';
-import { superLoaderJson, useSuperLoaderData } from '~/utils/super-json-loader';
-
-import { MultiSignDocumentList } from '../../../../components/embed/multisign/multi-sign-document-list';
-import { MultiSignDocumentSigningView } from '../../../../components/embed/multisign/multi-sign-document-signing-view';
-import type { Route } from './+types/_index';
-
-export async function loader({ request }: Route.LoaderArgs) {
-  const { user } = await getOptionalSession(request);
-
-  const url = new URL(request.url);
-
-  const tokens = url.searchParams.getAll('token');
-
-  const envelopes = await Promise.all(
-    tokens.map(async (token) => {
-      const document = await getDocumentAndSenderByToken({
-        token,
-      });
-
-      const recipient = await getRecipientByToken({ token });
-
-      return { document, recipient };
-    }),
-  );
-
-  // Check the first envelope for whitelabelling settings (assuming all docs are from same team)
-  const firstDocument = envelopes[0]?.document;
-
-  if (!firstDocument) {
-    return superLoaderJson({
-      envelopes,
-      user,
-      hidePoweredBy: false,
-      allowWhitelabelling: false,
-    });
-  }
-
-  const team = firstDocument.teamId
-    ? await getTeamById({ teamId: firstDocument.teamId, userId: firstDocument.userId }).catch(
-        () => null,
-      )
-    : null;
-
-  const [isPlatformDocument, isEnterpriseDocument, isCommunityPlan] = await Promise.all([
-    isDocumentPlatform(firstDocument),
-    isUserEnterprise({
-      userId: firstDocument.userId,
-      teamId: firstDocument.teamId ?? undefined,
-    }),
-    isUserCommunityPlan({
-      userId: firstDocument.userId,
-      teamId: firstDocument.teamId ?? undefined,
-    }),
-  ]);
-
-  const hidePoweredBy = team?.teamGlobalSettings?.brandingHidePoweredBy ?? false;
-  const allowWhitelabelling = isCommunityPlan || isPlatformDocument || isEnterpriseDocument;
-
-  return superLoaderJson({
-    envelopes,
-    user,
-    hidePoweredBy,
-    allowWhitelabelling,
-  });
-}
-
-export default function MultisignPage() {
-  const { envelopes, user, hidePoweredBy, allowWhitelabelling } =
-    useSuperLoaderData<typeof loader>();
-  const revalidator = useRevalidator();
-
-  const [selectedDocument, setSelectedDocument] = useState<
-    (typeof envelopes)[number]['document'] | null
-  >(null);
-
-  // Additional state for embed functionality
-  const [hasFinishedInit, setHasFinishedInit] = useState(false);
-  const [isNameLocked, setIsNameLocked] = useState(false);
-  const [allowDocumentRejection, setAllowDocumentRejection] = useState(false);
-  const [showOtherRecipientsCompletedFields, setShowOtherRecipientsCompletedFields] =
-    useState(false);
-  const [embedFullName, setEmbedFullName] = useState('');
-
-  // Check if all documents are completed
-  const isCompleted = envelopes.every(
-    (envelope) => envelope.recipient.signingStatus === SigningStatus.SIGNED,
-  );
-
-  const selectedRecipient = selectedDocument
-    ? envelopes.find((e) => e.document.id === selectedDocument.id)?.recipient
-    : null;
-
-  const onSelectDocument = (document: (typeof envelopes)[number]['document']) => {
-    setSelectedDocument(document);
-  };
-
-  const onBackToDocumentList = () => {
-    setSelectedDocument(null);
-    // Revalidate to fetch fresh data when returning to document list
-    void revalidator.revalidate();
-  };
-
-  const onDocumentCompleted = (data: {
-    token: string;
-    documentId: number;
-    recipientId: number;
-  }) => {
-    // Send postMessage for individual document completion
-    if (window.parent) {
-      window.parent.postMessage(
-        {
-          action: 'document-completed',
-          data: {
-            token: data.token,
-            documentId: data.documentId,
-            recipientId: data.recipientId,
-          },
-        },
-        '*',
-      );
-    }
-  };
-
-  const onDocumentRejected = (data: {
-    token: string;
-    documentId: number;
-    recipientId: number;
-    reason: string;
-  }) => {
-    // Send postMessage for document rejection
-    if (window.parent) {
-      window.parent.postMessage(
-        {
-          action: 'document-rejected',
-          data: {
-            token: data.token,
-            documentId: data.documentId,
-            recipientId: data.recipientId,
-            reason: data.reason,
-          },
-        },
-        '*',
-      );
-    }
-  };
-
-  const onDocumentError = () => {
-    // Send postMessage for document error
-    if (window.parent) {
-      window.parent.postMessage(
-        {
-          action: 'document-error',
-          data: null,
-        },
-        '*',
-      );
-    }
-  };
-
-  const onDocumentReady = () => {
-    // Send postMessage when document is ready
-    if (window.parent) {
-      window.parent.postMessage(
-        {
-          action: 'document-ready',
-          data: null,
-        },
-        '*',
-      );
-    }
-  };
-
-  const onAllDocumentsCompleted = () => {
-    // Send postMessage for all documents completion
-    if (window.parent) {
-      window.parent.postMessage(
-        {
-          action: 'all-documents-completed',
-          data: {
-            documents: envelopes.map((envelope) => ({
-              token: envelope.recipient.token,
-              documentId: envelope.document.id,
-              recipientId: envelope.recipient.id,
-              action:
-                envelope.recipient.signingStatus === SigningStatus.SIGNED
-                  ? 'document-completed'
-                  : 'document-rejected',
-              reason:
-                envelope.recipient.signingStatus === SigningStatus.REJECTED
-                  ? envelope.recipient.rejectionReason
-                  : undefined,
-            })),
-          },
-        },
-        '*',
-      );
-    }
-  };
-
-  useEffect(() => {
-    if (
-      envelopes.every((envelope) => envelope.recipient.signingStatus !== SigningStatus.NOT_SIGNED)
-    ) {
-      onAllDocumentsCompleted();
-    }
-  }, [envelopes]);
-
-  useLayoutEffect(() => {
-    const hash = window.location.hash.slice(1);
-
-    try {
-      const data = ZSignDocumentEmbedDataSchema.parse(JSON.parse(decodeURIComponent(atob(hash))));
-
-      if (!isCompleted && data.name) {
-        setEmbedFullName(data.name);
-      }
-
-      // Since a recipient can be provided a name we can lock it without requiring
-      // a to be provided by the parent application, unlike direct templates.
-      setIsNameLocked(!!data.lockName);
-      setAllowDocumentRejection(!!data.allowDocumentRejection);
-      setShowOtherRecipientsCompletedFields(!!data.showOtherRecipientsCompletedFields);
-
-      if (data.darkModeDisabled) {
-        document.documentElement.classList.add('dark-mode-disabled');
-      }
-
-      if (allowWhitelabelling) {
-        injectCss({
-          css: data.css,
-          cssVars: data.cssVars,
-        });
-      }
-    } catch (err) {
-      console.error(err);
-    }
-
-    setHasFinishedInit(true);
-
-    // !: While the two setters are stable we still want to ensure we're avoiding
-    // !: re-renders.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  // If a document is selected, show the signing view
-  if (selectedDocument && selectedRecipient) {
-    // Determine the full name to use - prioritize embed data, then user name, then recipient name
-    const fullNameToUse =
-      embedFullName ||
-      (user?.email === selectedRecipient.email ? user?.name : selectedRecipient.name) ||
-      '';
-
-    return (
-      <div className="p-4">
-        <DocumentSigningProvider
-          email={selectedRecipient.email}
-          fullName={fullNameToUse}
-          signature={user?.email === selectedRecipient.email ? user?.signature : undefined}
-          typedSignatureEnabled={selectedDocument.documentMeta?.typedSignatureEnabled}
-          uploadSignatureEnabled={selectedDocument.documentMeta?.uploadSignatureEnabled}
-          drawSignatureEnabled={selectedDocument.documentMeta?.drawSignatureEnabled}
-        >
-          <DocumentSigningAuthProvider
-            documentAuthOptions={selectedDocument.authOptions}
-            recipient={selectedRecipient}
-            user={user}
-          >
-            <DocumentSigningRecipientProvider recipient={selectedRecipient} targetSigner={null}>
-              <MultiSignDocumentSigningView
-                token={selectedRecipient.token}
-                recipientId={selectedRecipient.id}
-                onBack={onBackToDocumentList}
-                onDocumentCompleted={onDocumentCompleted}
-                onDocumentRejected={onDocumentRejected}
-                onDocumentError={onDocumentError}
-                onDocumentReady={onDocumentReady}
-                isNameLocked={isNameLocked}
-              />
-            </DocumentSigningRecipientProvider>
-          </DocumentSigningAuthProvider>
-        </DocumentSigningProvider>
-
-        {!hidePoweredBy && (
-          <div className="bg-primary text-primary-foreground fixed bottom-0 left-0 z-40 rounded-tr px-2 py-1 text-xs font-medium opacity-60 hover:opacity-100">
-            <span>Powered by</span>
-            <BrandingLogo className="ml-2 inline-block h-[14px]" />
-          </div>
-        )}
-      </div>
-    );
-  }
-
-  // Otherwise, show the document list
-  return (
-    <div className="p-4">
-      <MultiSignDocumentList envelopes={envelopes} onDocumentSelect={onSelectDocument} />
-
-      {!hidePoweredBy && (
-        <div className="bg-primary text-primary-foreground fixed bottom-0 left-0 z-40 rounded-tr px-2 py-1 text-xs font-medium opacity-60 hover:opacity-100">
-          <span>Powered by</span>
-          <BrandingLogo className="ml-2 inline-block h-[14px]" />
-        </div>
-      )}
-    </div>
-  );
-}

apps/remix/app/types/embed-multisign-document-schema.ts

@@ -1,17 +0,0 @@
-import { z } from 'zod';
-
-import { ZBaseEmbedDataSchema } from './embed-base-schemas';
-
-export const ZEmbedMultiSignDocumentSchema = ZBaseEmbedDataSchema.extend({
-  email: z
-    .union([z.literal(''), z.string().email()])
-    .optional()
-    .transform((value) => value || undefined),
-  lockEmail: z.boolean().optional().default(false),
-  name: z
-    .string()
-    .optional()
-    .transform((value) => value || undefined),
-  lockName: z.boolean().optional().default(false),
-  allowDocumentRejection: z.boolean().optional(),
-});

apps/remix/package.json

@@ -100,5 +100,5 @@
     "vite-plugin-babel-macros": "^1.0.6",
     "vite-tsconfig-paths": "^5.1.4"
   },
-  "version": "1.12.0-rc.0"
+  "version": "1.11.1"
 }

docker/development/compose.yml

@@ -40,6 +40,43 @@ services:
     entrypoint: sh
     command: -c 'mkdir -p /data/documenso && minio server /data --console-address ":9001" --address ":9002"'
 
+  triggerdotdev:
+    image: ghcr.io/triggerdotdev/trigger.dev:latest
+    container_name: triggerdotdev
+    environment:
+      - LOGIN_ORIGIN=http://localhost:3030
+      - APP_ORIGIN=http://localhost:3030
+      - PORT=3030
+      - REMIX_APP_PORT=3030
+      - MAGIC_LINK_SECRET=secret
+      - SESSION_SECRET=secret
+      - ENCRYPTION_KEY=deadbeefcafefeed
+      - DATABASE_URL=postgresql://trigger:password@triggerdotdev_database:5432/trigger
+      - DIRECT_URL=postgresql://trigger:password@triggerdotdev_database:5432/trigger
+      - RUNTIME_PLATFORM=docker-compose
+    ports:
+      - 3030:3030
+    depends_on:
+      - triggerdotdev_database
+
+  triggerdotdev_database:
+    container_name: triggerdotdev_database
+    image: postgres:15
+    volumes:
+      - triggerdotdev_database:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER}']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    environment:
+      - POSTGRES_USER=trigger
+      - POSTGRES_PASSWORD=password
+      - POSTGRES_DB=trigger
+    ports:
+      - 54321:5432
+
 volumes:
   minio:
   documenso_database:
+  triggerdotdev_database:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@documenso/root",
-  "version": "1.12.0-rc.0",
+  "version": "1.11.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@documenso/root",
-      "version": "1.12.0-rc.0",
+      "version": "1.11.1",
       "workspaces": [
         "apps/*",
         "packages/*"
@@ -88,7 +88,7 @@
     },
     "apps/remix": {
       "name": "@documenso/remix",
-      "version": "1.12.0-rc.0",
+      "version": "1.11.1",
       "dependencies": {
         "@documenso/api": "*",
         "@documenso/assets": "*",

package.json

@@ -1,6 +1,6 @@
 {
   "private": true,
-  "version": "1.12.0-rc.0",
+  "version": "1.11.1",
   "scripts": {
     "build": "turbo run build",
     "dev": "turbo run dev --filter=@documenso/remix",
@@ -84,4 +84,4 @@
   "trigger.dev": {
     "endpointId": "documenso-app"
   }
-}
+}

packages/api/v1/implementation.ts

@@ -821,7 +821,7 @@ export const ApiContractV1Implementation = tsr.router(ApiContractV1, {
             name,
             role,
             signingOrder,
-            actionAuth: authOptions?.actionAuth ?? [],
+            actionAuth: authOptions?.actionAuth ?? null,
           },
         ],
         requestMetadata: metadata,
@@ -888,7 +888,7 @@ export const ApiContractV1Implementation = tsr.router(ApiContractV1, {
       name,
       role,
       signingOrder,
-      actionAuth: authOptions?.actionAuth ?? [],
+      actionAuth: authOptions?.actionAuth,
       requestMetadata: metadata.requestMetadata,
     }).catch(() => null);
 

packages/api/v1/schema.ts

@@ -177,8 +177,8 @@ export const ZCreateDocumentMutationSchema = z.object({
     .default({}),
   authOptions: z
     .object({
-      globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema).optional().default([]),
-      globalActionAuth: z.array(ZDocumentActionAuthTypesSchema).optional().default([]),
+      globalAccessAuth: ZDocumentAccessAuthTypesSchema.optional(),
+      globalActionAuth: ZDocumentActionAuthTypesSchema.optional(),
     })
     .optional()
     .openapi({
@@ -237,8 +237,8 @@ export const ZCreateDocumentFromTemplateMutationSchema = z.object({
     .optional(),
   authOptions: z
     .object({
-      globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema).optional().default([]),
-      globalActionAuth: z.array(ZDocumentActionAuthTypesSchema).optional().default([]),
+      globalAccessAuth: ZDocumentAccessAuthTypesSchema.optional(),
+      globalActionAuth: ZDocumentActionAuthTypesSchema.optional(),
     })
     .optional(),
   formValues: z.record(z.string(), z.union([z.string(), z.boolean(), z.number()])).optional(),
@@ -310,8 +310,8 @@ export const ZGenerateDocumentFromTemplateMutationSchema = z.object({
     .optional(),
   authOptions: z
     .object({
-      globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema).optional().default([]),
-      globalActionAuth: z.array(ZDocumentActionAuthTypesSchema).optional().default([]),
+      globalAccessAuth: ZDocumentAccessAuthTypesSchema.optional(),
+      globalActionAuth: ZDocumentActionAuthTypesSchema.optional(),
     })
     .optional(),
   formValues: z.record(z.string(), z.union([z.string(), z.boolean(), z.number()])).optional(),
@@ -350,7 +350,7 @@ export const ZCreateRecipientMutationSchema = z.object({
   signingOrder: z.number().nullish(),
   authOptions: z
     .object({
-      actionAuth: z.array(ZRecipientActionAuthTypesSchema).optional().default([]),
+      actionAuth: ZRecipientActionAuthTypesSchema.optional(),
     })
     .optional()
     .openapi({

packages/app-tests/e2e/document-auth/access-auth.spec.ts

@@ -42,8 +42,8 @@ test('[DOCUMENT_AUTH]: should allow or deny access when required', async ({ page
     {
       createDocumentOptions: {
         authOptions: createDocumentAuthOptions({
-          globalAccessAuth: ['ACCOUNT'],
-          globalActionAuth: [],
+          globalAccessAuth: 'ACCOUNT',
+          globalActionAuth: null,
         }),
       },
     },

packages/app-tests/e2e/document-auth/action-auth.spec.ts

@@ -65,8 +65,8 @@ test('[DOCUMENT_AUTH]: should allow signing with valid global auth', async ({ pa
     recipients: [recipientWithAccount],
     updateDocumentOptions: {
       authOptions: createDocumentAuthOptions({
-        globalAccessAuth: [],
-        globalActionAuth: ['ACCOUNT'],
+        globalAccessAuth: null,
+        globalActionAuth: 'ACCOUNT',
       }),
     },
   });
@@ -116,8 +116,8 @@ test.skip('[DOCUMENT_AUTH]: should deny signing document when required for globa
     recipients: [recipientWithAccount],
     updateDocumentOptions: {
       authOptions: createDocumentAuthOptions({
-        globalAccessAuth: [],
-        globalActionAuth: ['ACCOUNT'],
+        globalAccessAuth: null,
+        globalActionAuth: 'ACCOUNT',
       }),
     },
   });
@@ -147,8 +147,8 @@ test('[DOCUMENT_AUTH]: should deny signing fields when required for global auth'
     recipients: [recipientWithAccount, seedTestEmail()],
     updateDocumentOptions: {
       authOptions: createDocumentAuthOptions({
-        globalAccessAuth: [],
-        globalActionAuth: ['ACCOUNT'],
+        globalAccessAuth: null,
+        globalActionAuth: 'ACCOUNT',
       }),
     },
   });
@@ -193,20 +193,20 @@ test('[DOCUMENT_AUTH]: should allow field signing when required for recipient au
     recipientsCreateOptions: [
       {
         authOptions: createRecipientAuthOptions({
-          accessAuth: [],
-          actionAuth: [],
+          accessAuth: null,
+          actionAuth: null,
         }),
       },
       {
         authOptions: createRecipientAuthOptions({
-          accessAuth: [],
-          actionAuth: ['EXPLICIT_NONE'],
+          accessAuth: null,
+          actionAuth: 'EXPLICIT_NONE',
         }),
       },
       {
         authOptions: createRecipientAuthOptions({
-          accessAuth: [],
-          actionAuth: ['ACCOUNT'],
+          accessAuth: null,
+          actionAuth: 'ACCOUNT',
         }),
       },
     ],
@@ -218,7 +218,7 @@ test('[DOCUMENT_AUTH]: should allow field signing when required for recipient au
     const { actionAuth } = ZRecipientAuthOptionsSchema.parse(recipient.authOptions);
 
     // This document has no global action auth, so only account should require auth.
-    const isAuthRequired = actionAuth.includes('ACCOUNT');
+    const isAuthRequired = actionAuth === 'ACCOUNT';
 
     const signUrl = `/sign/${token}`;
 
@@ -292,28 +292,28 @@ test('[DOCUMENT_AUTH]: should allow field signing when required for recipient an
     recipientsCreateOptions: [
       {
         authOptions: createRecipientAuthOptions({
-          accessAuth: [],
-          actionAuth: [],
+          accessAuth: null,
+          actionAuth: null,
         }),
       },
       {
         authOptions: createRecipientAuthOptions({
-          accessAuth: [],
-          actionAuth: ['EXPLICIT_NONE'],
+          accessAuth: null,
+          actionAuth: 'EXPLICIT_NONE',
         }),
       },
       {
         authOptions: createRecipientAuthOptions({
-          accessAuth: [],
-          actionAuth: ['ACCOUNT'],
+          accessAuth: null,
+          actionAuth: 'ACCOUNT',
         }),
       },
     ],
     fields: [FieldType.DATE, FieldType.SIGNATURE],
     updateDocumentOptions: {
       authOptions: createDocumentAuthOptions({
-        globalAccessAuth: [],
-        globalActionAuth: ['ACCOUNT'],
+        globalAccessAuth: null,
+        globalActionAuth: 'ACCOUNT',
       }),
     },
   });
@@ -323,7 +323,7 @@ test('[DOCUMENT_AUTH]: should allow field signing when required for recipient an
     const { actionAuth } = ZRecipientAuthOptionsSchema.parse(recipient.authOptions);
 
     // This document HAS global action auth, so account and inherit should require auth.
-    const isAuthRequired = actionAuth.includes('ACCOUNT') || actionAuth.length === 0;
+    const isAuthRequired = actionAuth === 'ACCOUNT' || actionAuth === null;
 
     const signUrl = `/sign/${token}`;
 

packages/app-tests/e2e/document-flow/settings-step.spec.ts

@@ -40,7 +40,7 @@ test.describe('[EE_ONLY]', () => {
 
     // Set EE action auth.
     await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByLabel('Require passkey').getByText('Require passkey').click();
     await expect(page.getByTestId('documentActionSelectValue')).toContainText('Require passkey');
 
     // Save the settings by going to the next step.
@@ -82,7 +82,7 @@ test.describe('[EE_ONLY]', () => {
 
     // Set EE action auth.
     await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByLabel('Require passkey').getByText('Require passkey').click();
     await expect(page.getByTestId('documentActionSelectValue')).toContainText('Require passkey');
 
     // Save the settings by going to the next step.
@@ -116,15 +116,15 @@ test.describe('[EE_ONLY]', () => {
       redirectPath: `/documents/${document.id}/edit`,
     });
 
-    // Global action auth should not be visible.
-    await expect(page.getByTestId('documentActionSelectValue')).not.toBeVisible();
+    // Global action auth should now be visible for all users
+    await expect(page.getByTestId('documentActionSelectValue')).toBeVisible();
 
     // Next step.
     await page.getByRole('button', { name: 'Continue' }).click();
     await expect(page.getByRole('heading', { name: 'Add Signers' })).toBeVisible();
 
-    // Advanced settings should not be visible.
-    await expect(page.getByLabel('Show advanced settings')).not.toBeVisible();
+    // Advanced settings should now be visible for all users
+    await expect(page.getByLabel('Show advanced settings')).toBeVisible();
   });
 });
 
@@ -143,11 +143,11 @@ test('[DOCUMENT_FLOW]: add settings', async ({ page }) => {
 
   // Set access auth.
   await page.getByTestId('documentAccessSelectValue').click();
-  await page.getByRole('option').filter({ hasText: 'Require account' }).click();
+  await page.getByLabel('Require account').getByText('Require account').click();
   await expect(page.getByTestId('documentAccessSelectValue')).toContainText('Require account');
 
-  // Action auth should NOT be visible.
-  await expect(page.getByTestId('documentActionSelectValue')).not.toBeVisible();
+  // Action auth should now be visible for all users
+  await expect(page.getByTestId('documentActionSelectValue')).toBeVisible();
 
   // Save the settings by going to the next step.
 

packages/app-tests/e2e/templates-flow/template-settings-step.spec.ts

@@ -37,7 +37,7 @@ test.describe('[EE_ONLY]', () => {
 
     // Set EE action auth.
     await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByLabel('Require passkey').getByText('Require passkey').click();
     await expect(page.getByTestId('documentActionSelectValue')).toContainText('Require passkey');
 
     // Save the settings by going to the next step.
@@ -79,7 +79,7 @@ test.describe('[EE_ONLY]', () => {
 
     // Set EE action auth.
     await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByLabel('Require passkey').getByText('Require passkey').click();
     await expect(page.getByTestId('documentActionSelectValue')).toContainText('Require passkey');
 
     // Save the settings by going to the next step.
@@ -113,8 +113,8 @@ test.describe('[EE_ONLY]', () => {
       redirectPath: `/templates/${template.id}/edit`,
     });
 
-    // Global action auth should not be visible.
-    await expect(page.getByTestId('documentActionSelectValue')).not.toBeVisible();
+    // Global action auth should now be visible for all users
+    await expect(page.getByTestId('documentActionSelectValue')).toBeVisible();
 
     // Next step.
     await page.getByRole('button', { name: 'Continue' }).click();
@@ -140,11 +140,11 @@ test('[TEMPLATE_FLOW]: add settings', async ({ page }) => {
 
   // Set access auth.
   await page.getByTestId('documentAccessSelectValue').click();
-  await page.getByRole('option').filter({ hasText: 'Require account' }).click();
+  await page.getByLabel('Require account').getByText('Require account').click();
   await expect(page.getByTestId('documentAccessSelectValue')).toContainText('Require account');
 
-  // Action auth should NOT be visible.
-  await expect(page.getByTestId('documentActionSelectValue')).not.toBeVisible();
+  // Action auth should now be visible for all users
+  await expect(page.getByTestId('documentActionSelectValue')).toBeVisible();
 
   // Save the settings by going to the next step.
   await page.getByRole('button', { name: 'Continue' }).click();

packages/app-tests/e2e/templates-flow/template-signers-step.spec.ts

@@ -58,8 +58,8 @@ test.describe('[EE_ONLY]', () => {
 
     // Add advanced settings for a single recipient.
     await page.getByLabel('Show advanced settings').check();
-    await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByRole('combobox').first().click();
+    await page.getByLabel('Require passkey').click();
 
     // Navigate to the next step and back.
     await page.getByRole('button', { name: 'Continue' }).click();

packages/app-tests/e2e/templates/create-document-from-template.spec.ts

@@ -48,13 +48,13 @@ test('[TEMPLATE]: should create a document from a template', async ({ page }) =>
 
   // Set template document access.
   await page.getByTestId('documentAccessSelectValue').click();
-  await page.getByRole('option').filter({ hasText: 'Require account' }).click();
+  await page.getByLabel('Require account').getByText('Require account').click();
   await expect(page.getByTestId('documentAccessSelectValue')).toContainText('Require account');
 
   // Set EE action auth.
   if (isBillingEnabled) {
     await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByLabel('Require passkey').getByText('Require passkey').click();
     await expect(page.getByTestId('documentActionSelectValue')).toContainText('Require passkey');
   }
 
@@ -85,8 +85,8 @@ test('[TEMPLATE]: should create a document from a template', async ({ page }) =>
   // Apply require passkey for Recipient 1.
   if (isBillingEnabled) {
     await page.getByLabel('Show advanced settings').check();
-    await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByRole('combobox').first().click();
+    await page.getByLabel('Require passkey').click();
   }
 
   await page.getByRole('button', { name: 'Continue' }).click();
@@ -119,12 +119,10 @@ test('[TEMPLATE]: should create a document from a template', async ({ page }) =>
   });
 
   expect(document.title).toEqual('TEMPLATE_TITLE');
-  expect(documentAuth.documentAuthOption.globalAccessAuth).toContain('ACCOUNT');
-
-  if (isBillingEnabled) {
-    expect(documentAuth.documentAuthOption.globalActionAuth).toContain('PASSKEY');
-  }
-
+  expect(documentAuth.documentAuthOption.globalAccessAuth).toEqual('ACCOUNT');
+  expect(documentAuth.documentAuthOption.globalActionAuth).toEqual(
+    isBillingEnabled ? 'PASSKEY' : null,
+  );
   expect(document.documentMeta?.dateFormat).toEqual('dd/MM/yyyy hh:mm a');
   expect(document.documentMeta?.message).toEqual('MESSAGE');
   expect(document.documentMeta?.redirectUrl).toEqual('https://documenso.com');
@@ -145,11 +143,11 @@ test('[TEMPLATE]: should create a document from a template', async ({ page }) =>
   });
 
   if (isBillingEnabled) {
-    expect(recipientOneAuth.derivedRecipientActionAuth).toContain('PASSKEY');
+    expect(recipientOneAuth.derivedRecipientActionAuth).toEqual('PASSKEY');
   }
 
-  expect(recipientOneAuth.derivedRecipientAccessAuth).toContain('ACCOUNT');
-  expect(recipientTwoAuth.derivedRecipientAccessAuth).toContain('ACCOUNT');
+  expect(recipientOneAuth.derivedRecipientAccessAuth).toEqual('ACCOUNT');
+  expect(recipientTwoAuth.derivedRecipientAccessAuth).toEqual('ACCOUNT');
 });
 
 /**
@@ -185,13 +183,13 @@ test('[TEMPLATE]: should create a team document from a team template', async ({
 
   // Set template document access.
   await page.getByTestId('documentAccessSelectValue').click();
-  await page.getByRole('option').filter({ hasText: 'Require account' }).click();
+  await page.getByLabel('Require account').getByText('Require account').click();
   await expect(page.getByTestId('documentAccessSelectValue')).toContainText('Require account');
 
   // Set EE action auth.
   if (isBillingEnabled) {
     await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByLabel('Require passkey').getByText('Require passkey').click();
     await expect(page.getByTestId('documentActionSelectValue')).toContainText('Require passkey');
   }
 
@@ -222,8 +220,8 @@ test('[TEMPLATE]: should create a team document from a team template', async ({
   // Apply require passkey for Recipient 1.
   if (isBillingEnabled) {
     await page.getByLabel('Show advanced settings').check();
-    await page.getByTestId('documentActionSelectValue').click();
-    await page.getByRole('option').filter({ hasText: 'Require passkey' }).click();
+    await page.getByRole('combobox').first().click();
+    await page.getByLabel('Require passkey').click();
   }
 
   await page.getByRole('button', { name: 'Continue' }).click();
@@ -258,12 +256,10 @@ test('[TEMPLATE]: should create a team document from a team template', async ({
   });
 
   expect(document.title).toEqual('TEMPLATE_TITLE');
-  expect(documentAuth.documentAuthOption.globalAccessAuth).toContain('ACCOUNT');
-
-  if (isBillingEnabled) {
-    expect(documentAuth.documentAuthOption.globalActionAuth).toContain('PASSKEY');
-  }
-
+  expect(documentAuth.documentAuthOption.globalAccessAuth).toEqual('ACCOUNT');
+  expect(documentAuth.documentAuthOption.globalActionAuth).toEqual(
+    isBillingEnabled ? 'PASSKEY' : null,
+  );
   expect(document.documentMeta?.dateFormat).toEqual('dd/MM/yyyy hh:mm a');
   expect(document.documentMeta?.message).toEqual('MESSAGE');
   expect(document.documentMeta?.redirectUrl).toEqual('https://documenso.com');
@@ -284,11 +280,11 @@ test('[TEMPLATE]: should create a team document from a team template', async ({
   });
 
   if (isBillingEnabled) {
-    expect(recipientOneAuth.derivedRecipientActionAuth).toContain('PASSKEY');
+    expect(recipientOneAuth.derivedRecipientActionAuth).toEqual('PASSKEY');
   }
 
-  expect(recipientOneAuth.derivedRecipientAccessAuth).toContain('ACCOUNT');
-  expect(recipientTwoAuth.derivedRecipientAccessAuth).toContain('ACCOUNT');
+  expect(recipientOneAuth.derivedRecipientAccessAuth).toEqual('ACCOUNT');
+  expect(recipientTwoAuth.derivedRecipientAccessAuth).toEqual('ACCOUNT');
 });
 
 /**

packages/app-tests/e2e/templates/direct-templates.spec.ts

@@ -172,8 +172,8 @@ test('[DIRECT_TEMPLATES]: direct template link auth access', async ({ page }) =>
     userId: user.id,
     createTemplateOptions: {
       authOptions: createDocumentAuthOptions({
-        globalAccessAuth: ['ACCOUNT'],
-        globalActionAuth: [],
+        globalAccessAuth: 'ACCOUNT',
+        globalActionAuth: null,
       }),
     },
   });

packages/email/template-components/template-verification-code.tsx

@@ -0,0 +1,43 @@
+import { Trans } from '@lingui/react/macro';
+
+import { Section, Text } from '../components';
+import { TemplateDocumentImage } from './template-document-image';
+
+export type TemplateVerificationCodeProps = {
+  verificationCode: string;
+  assetBaseUrl: string;
+};
+
+export const TemplateVerificationCode = ({
+  verificationCode,
+  assetBaseUrl,
+}: TemplateVerificationCodeProps) => {
+  return (
+    <>
+      <TemplateDocumentImage className="mt-6" assetBaseUrl={assetBaseUrl} />
+
+      <Section className="flex-row items-center justify-center">
+        <Text className="text-primary mx-auto mb-0 max-w-[80%] text-center text-lg font-semibold">
+          <Trans>Your verification code</Trans>
+        </Text>
+
+        <Text className="my-1 text-center text-base text-slate-400">
+          <Trans>Please use the code below to verify your identity for document signing.</Trans>
+        </Text>
+
+        <Text className="my-6 text-center text-3xl font-bold tracking-widest">
+          {verificationCode}
+        </Text>
+
+        <Text className="my-1 text-center text-sm text-slate-400">
+          <Trans>
+            If you did not request this code, you can ignore this email. The code will expire after
+            10 minutes.
+          </Trans>
+        </Text>
+      </Section>
+    </>
+  );
+};
+
+export default TemplateVerificationCode;

packages/email/templates/verification-code.tsx

@@ -0,0 +1,62 @@
+import { msg } from '@lingui/core/macro';
+import { useLingui } from '@lingui/react';
+
+import { Body, Container, Head, Hr, Html, Img, Preview, Section } from '../components';
+import { useBranding } from '../providers/branding';
+import { TemplateFooter } from '../template-components/template-footer';
+import type { TemplateVerificationCodeProps } from '../template-components/template-verification-code';
+import { TemplateVerificationCode } from '../template-components/template-verification-code';
+
+export type VerificationCodeTemplateProps = Partial<TemplateVerificationCodeProps>;
+
+export const VerificationCodeTemplate = ({
+  verificationCode = '000000',
+  assetBaseUrl = 'http://localhost:3002',
+}: VerificationCodeTemplateProps) => {
+  const { _ } = useLingui();
+  const branding = useBranding();
+
+  const previewText = msg`Your verification code for document signing`;
+
+  const getAssetUrl = (path: string) => {
+    return new URL(path, assetBaseUrl).toString();
+  };
+
+  return (
+    <Html>
+      <Head />
+      <Preview>{_(previewText)}</Preview>
+
+      <Body className="mx-auto my-auto font-sans">
+        <Section className="bg-white">
+          <Container className="mx-auto mb-2 mt-8 max-w-xl rounded-lg border border-solid border-slate-200 p-2 backdrop-blur-sm">
+            <Section className="p-2">
+              {branding.brandingEnabled && branding.brandingLogo ? (
+                <Img src={branding.brandingLogo} alt="Branding Logo" className="mb-4 h-6" />
+              ) : (
+                <Img
+                  src={getAssetUrl('/static/logo.png')}
+                  alt="Documenso Logo"
+                  className="mb-4 h-6"
+                />
+              )}
+
+              <TemplateVerificationCode
+                verificationCode={verificationCode}
+                assetBaseUrl={assetBaseUrl}
+              />
+            </Section>
+          </Container>
+
+          <Hr className="mx-auto mt-12 max-w-xl" />
+
+          <Container className="mx-auto max-w-xl">
+            <TemplateFooter isDocument={false} />
+          </Container>
+        </Section>
+      </Body>
+    </Html>
+  );
+};
+
+export default VerificationCodeTemplate;

packages/lib/client-only/hooks/use-element-bounds.ts

@@ -1,75 +0,0 @@
-import { useEffect, useState } from 'react';
-
-import { getBoundingClientRect } from '@documenso/lib/client-only/get-bounding-client-rect';
-
-export const useElementBounds = (elementOrSelector: HTMLElement | string, withScroll = false) => {
-  const [bounds, setBounds] = useState({
-    top: 0,
-    left: 0,
-    height: 0,
-    width: 0,
-  });
-
-  const calculateBounds = () => {
-    const $el =
-      typeof elementOrSelector === 'string'
-        ? document.querySelector<HTMLElement>(elementOrSelector)
-        : elementOrSelector;
-
-    if (!$el) {
-      throw new Error('Element not found');
-    }
-
-    if (withScroll) {
-      return getBoundingClientRect($el);
-    }
-
-    const { top, left, width, height } = $el.getBoundingClientRect();
-
-    return {
-      top,
-      left,
-      width,
-      height,
-    };
-  };
-
-  useEffect(() => {
-    setBounds(calculateBounds());
-  }, [calculateBounds]);
-
-  useEffect(() => {
-    const onResize = () => {
-      setBounds(calculateBounds());
-    };
-
-    window.addEventListener('resize', onResize);
-
-    return () => {
-      window.removeEventListener('resize', onResize);
-    };
-  }, [calculateBounds]);
-
-  useEffect(() => {
-    const $el =
-      typeof elementOrSelector === 'string'
-        ? document.querySelector<HTMLElement>(elementOrSelector)
-        : elementOrSelector;
-
-    if (!$el) {
-      return;
-    }
-
-    const observer = new ResizeObserver(() => {
-      setBounds(calculateBounds());
-    });
-
-    observer.observe($el);
-
-    return () => {
-      observer.disconnect();
-    };
-  }, [calculateBounds]);
-
-  return bounds;
-};

packages/lib/constants/document-auth.ts

@@ -19,10 +19,6 @@ export const DOCUMENT_AUTH_TYPES: Record<string, DocumentAuthTypeData> = {
     key: DocumentAuth.TWO_FACTOR_AUTH,
     value: 'Require 2FA',
   },
-  [DocumentAuth.PASSWORD]: {
-    key: DocumentAuth.PASSWORD,
-    value: 'Require password',
-  },
   [DocumentAuth.EXPLICIT_NONE]: {
     key: DocumentAuth.EXPLICIT_NONE,
     value: 'None (Overrides global settings)',

packages/lib/server-only/2fa/send-email-verification.ts

@@ -0,0 +1,120 @@
+import { createElement } from 'react';
+
+import { msg } from '@lingui/core/macro';
+import { randomInt } from 'crypto';
+
+import { AuthenticationErrorCode } from '@documenso/auth/server/lib/errors/error-codes';
+import { mailer } from '@documenso/email/mailer';
+import { VerificationCodeTemplate } from '@documenso/email/templates/verification-code';
+import { AppError } from '@documenso/lib/errors/app-error';
+import { prisma } from '@documenso/prisma';
+
+import { getI18nInstance } from '../../client-only/providers/i18n-server';
+import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
+import { FROM_ADDRESS, FROM_NAME } from '../../constants/email';
+import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
+
+const ExtendedAuthErrorCode = {
+  ...AuthenticationErrorCode,
+  InternalError: 'INTERNAL_ERROR',
+  VerificationNotFound: 'VERIFICATION_NOT_FOUND',
+  VerificationExpired: 'VERIFICATION_EXPIRED',
+};
+
+const VERIFICATION_CODE_EXPIRY = 10 * 60 * 1000;
+
+export type SendEmailVerificationOptions = {
+  userId: number;
+  email: string;
+};
+
+export const sendEmailVerification = async ({ userId, email }: SendEmailVerificationOptions) => {
+  try {
+    const verificationCode = randomInt(100000, 1000000).toString();
+    const i18n = await getI18nInstance();
+
+    await prisma.userTwoFactorEmailVerification.upsert({
+      where: {
+        userId,
+      },
+      create: {
+        userId,
+        verificationCode,
+        expiresAt: new Date(Date.now() + VERIFICATION_CODE_EXPIRY),
+      },
+      update: {
+        verificationCode,
+        expiresAt: new Date(Date.now() + VERIFICATION_CODE_EXPIRY),
+      },
+    });
+
+    const template = createElement(VerificationCodeTemplate, {
+      verificationCode,
+      assetBaseUrl: NEXT_PUBLIC_WEBAPP_URL(),
+    });
+
+    const [html, text] = await Promise.all([
+      renderEmailWithI18N(template, { lang: 'en' }),
+      renderEmailWithI18N(template, { lang: 'en', plainText: true }),
+    ]);
+
+    await mailer.sendMail({
+      to: email,
+      from: {
+        name: FROM_NAME,
+        address: FROM_ADDRESS,
+      },
+      subject: i18n._(msg`Your verification code for document signing`),
+      html,
+      text,
+    });
+
+    return { success: true };
+  } catch (error) {
+    console.error('Error sending email verification', error);
+    throw new AppError(ExtendedAuthErrorCode.InternalError);
+  }
+};
+
+export type VerifyEmailCodeOptions = {
+  userId: number;
+  code: string;
+};
+
+export const verifyEmailCode = async ({ userId, code }: VerifyEmailCodeOptions) => {
+  try {
+    const verification = await prisma.userTwoFactorEmailVerification.findUnique({
+      where: {
+        userId,
+      },
+    });
+
+    if (!verification) {
+      throw new AppError(ExtendedAuthErrorCode.VerificationNotFound);
+    }
+
+    if (verification.expiresAt < new Date()) {
+      throw new AppError(ExtendedAuthErrorCode.VerificationExpired);
+    }
+
+    if (verification.verificationCode !== code) {
+      throw new AppError(AuthenticationErrorCode.InvalidTwoFactorCode);
+    }
+
+    await prisma.userTwoFactorEmailVerification.delete({
+      where: {
+        userId,
+      },
+    });
+
+    return { success: true };
+  } catch (error) {
+    console.error('Error verifying email code', error);
+
+    if (error instanceof AppError) {
+      throw error;
+    }
+
+    throw new AppError(ExtendedAuthErrorCode.InternalError);
+  }
+};

packages/lib/server-only/2fa/verify-password.ts

@@ -1,20 +0,0 @@
-import { compare } from '@node-rs/bcrypt';
-
-import { prisma } from '@documenso/prisma';
-
-type VerifyPasswordOptions = {
-  userId: number;
-  password: string;
-};
-
-export const verifyPassword = async ({ userId, password }: VerifyPasswordOptions) => {
-  const user = await prisma.user.findUnique({
-    where: { id: userId },
-  });
-
-  if (!user || !user.password) {
-    return false;
-  }
-
-  return await compare(password, user.password);
-};

packages/lib/server-only/document/complete-document-with-token.ts

@@ -23,7 +23,6 @@ import {
   ZWebhookDocumentSchema,
   mapDocumentToWebhookDocumentPayload,
 } from '../../types/webhook-payload';
-import { extractDocumentAuthMethods } from '../../utils/document-auth';
 import { getIsRecipientsTurnToSign } from '../recipient/get-is-recipient-turn';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 import { sendPendingEmail } from './send-pending-email';
@@ -141,11 +140,6 @@ export const completeDocumentWithToken = async ({
       },
     });
 
-    const authOptions = extractDocumentAuthMethods({
-      documentAuth: document.authOptions,
-      recipientAuth: recipient.authOptions,
-    });
-
     await tx.documentAuditLog.create({
       data: createDocumentAuditLogData({
         type: DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_RECIPIENT_COMPLETED,
@@ -160,7 +154,6 @@ export const completeDocumentWithToken = async ({
           recipientName: recipient.name,
           recipientId: recipient.id,
           recipientRole: recipient.role,
-          actionAuth: authOptions.derivedRecipientActionAuth,
         },
       }),
     });

packages/lib/server-only/document/create-document-v2.ts

@@ -39,8 +39,8 @@ export type CreateDocumentOptions = {
     title: string;
     externalId?: string;
     visibility?: DocumentVisibility;
-    globalAccessAuth?: TDocumentAccessAuthTypes[];
-    globalActionAuth?: TDocumentActionAuthTypes[];
+    globalAccessAuth?: TDocumentAccessAuthTypes;
+    globalActionAuth?: TDocumentActionAuthTypes;
     formValues?: TDocumentFormValues;
     recipients: TCreateDocumentV2Request['recipients'];
   };
@@ -113,16 +113,14 @@ export const createDocumentV2 = async ({
   }
 
   const authOptions = createDocumentAuthOptions({
-    globalAccessAuth: data?.globalAccessAuth || [],
-    globalActionAuth: data?.globalActionAuth || [],
+    globalAccessAuth: data?.globalAccessAuth || null,
+    globalActionAuth: data?.globalActionAuth || null,
   });
 
-  const recipientsHaveActionAuth = data.recipients?.some(
-    (recipient) => recipient.actionAuth && recipient.actionAuth.length > 0,
-  );
+  const recipientsHaveActionAuth = data.recipients?.some((recipient) => recipient.actionAuth);
 
   // Check if user has permission to set the global action auth.
-  if (authOptions.globalActionAuth.length > 0 || recipientsHaveActionAuth) {
+  if (authOptions.globalActionAuth || recipientsHaveActionAuth) {
     const isDocumentEnterprise = await isUserEnterprise({
       userId,
       teamId,
@@ -173,8 +171,8 @@ export const createDocumentV2 = async ({
     await Promise.all(
       (data.recipients || []).map(async (recipient) => {
         const recipientAuthOptions = createRecipientAuthOptions({
-          accessAuth: recipient.accessAuth ?? [],
-          actionAuth: recipient.actionAuth ?? [],
+          accessAuth: recipient.accessAuth || null,
+          actionAuth: recipient.actionAuth || null,
         });
 
         await tx.recipient.create({

packages/lib/server-only/document/get-document-certificate-audit-logs.ts

@@ -17,7 +17,6 @@ export const getDocumentCertificateAuditLogs = async ({
         in: [
           DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_RECIPIENT_COMPLETED,
           DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_RECIPIENT_REJECTED,
-          DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_FIELD_INSERTED,
           DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_OPENED,
           DOCUMENT_AUDIT_LOG_TYPE.EMAIL_SENT,
         ],
@@ -37,9 +36,6 @@ export const getDocumentCertificateAuditLogs = async ({
     [DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_OPENED]: auditLogs.filter(
       (log) => log.type === DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_OPENED,
     ),
-    [DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_FIELD_INSERTED]: auditLogs.filter(
-      (log) => log.type === DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_FIELD_INSERTED,
-    ),
     [DOCUMENT_AUDIT_LOG_TYPE.EMAIL_SENT]: auditLogs.filter(
       (log) =>
         log.type === DOCUMENT_AUDIT_LOG_TYPE.EMAIL_SENT &&

packages/lib/server-only/document/is-recipient-authorized.ts

@@ -5,7 +5,6 @@ import { match } from 'ts-pattern';
 import { prisma } from '@documenso/prisma';
 
 import { verifyTwoFactorAuthenticationToken } from '../2fa/verify-2fa-token';
-import { verifyPassword } from '../2fa/verify-password';
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import type { TDocumentAuth, TDocumentAuthMethods } from '../../types/document-auth';
 import { DocumentAuth } from '../../types/document-auth';
@@ -61,26 +60,23 @@ export const isRecipientAuthorized = async ({
     recipientAuth: recipient.authOptions,
   });
 
-  const authMethods: TDocumentAuth[] =
+  const authMethod: TDocumentAuth | null =
     type === 'ACCESS' ? derivedRecipientAccessAuth : derivedRecipientActionAuth;
 
   // Early true return when auth is not required.
-  if (
-    authMethods.length === 0 ||
-    authMethods.some((method) => method === DocumentAuth.EXPLICIT_NONE)
-  ) {
+  if (!authMethod || authMethod === DocumentAuth.EXPLICIT_NONE) {
     return true;
   }
 
   // Create auth options when none are passed for account.
-  if (!authOptions && authMethods.some((method) => method === DocumentAuth.ACCOUNT)) {
+  if (!authOptions && authMethod === DocumentAuth.ACCOUNT) {
     authOptions = {
       type: DocumentAuth.ACCOUNT,
     };
   }
 
   // Authentication required does not match provided method.
-  if (!authOptions || !authMethods.includes(authOptions.type) || !userId) {
+  if (!authOptions || authOptions.type !== authMethod || !userId) {
     return false;
   }
 
@@ -121,15 +117,6 @@ export const isRecipientAuthorized = async ({
         window: 10, // 5 minutes worth of tokens
       });
     })
-    .with({ type: DocumentAuth.PASSWORD }, async ({ password }) => {
-      return await verifyPassword({
-        userId,
-        password,
-      });
-    })
-    .with({ type: DocumentAuth.EXPLICIT_NONE }, () => {
-      return true;
-    })
     .exhaustive();
 };
 
@@ -173,7 +160,7 @@ const verifyPasskey = async ({
 }: VerifyPasskeyOptions): Promise<void> => {
   const passkey = await prisma.passkey.findFirst({
     where: {
-      credentialId: new Uint8Array(Buffer.from(authenticationResponse.id, 'base64')),
+      credentialId: Buffer.from(authenticationResponse.id, 'base64'),
       userId,
     },
   });

packages/lib/server-only/document/seal-document.ts

@@ -128,7 +128,7 @@ export const sealDocument = async ({
 
   // Normalize and flatten layers that could cause issues with the signature
   normalizeSignatureAppearances(doc);
-  await flattenForm(doc);
+  flattenForm(doc);
   flattenAnnotations(doc);
 
   // Add rejection stamp if the document is rejected
@@ -153,7 +153,7 @@ export const sealDocument = async ({
   }
 
   // Re-flatten post-insertion to handle fields that create arcoFields
-  await flattenForm(doc);
+  flattenForm(doc);
 
   const pdfBytes = await doc.save();
 

packages/lib/server-only/document/update-document.ts

@@ -1,8 +1,6 @@
-import { DocumentVisibility } from '@prisma/client';
-import { DocumentStatus, TeamMemberRole } from '@prisma/client';
+import { DocumentStatus, DocumentVisibility, TeamMemberRole } from '@prisma/client';
 import { match } from 'ts-pattern';
 
-import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import type { CreateDocumentAuditLogDataResponse } from '@documenso/lib/utils/document-audit-logs';
@@ -21,8 +19,8 @@ export type UpdateDocumentOptions = {
     title?: string;
     externalId?: string | null;
     visibility?: DocumentVisibility | null;
-    globalAccessAuth?: TDocumentAccessAuthTypes[];
-    globalActionAuth?: TDocumentActionAuthTypes[];
+    globalAccessAuth?: TDocumentAccessAuthTypes | null;
+    globalActionAuth?: TDocumentActionAuthTypes | null;
     useLegacyFieldInsertion?: boolean;
   };
   requestMetadata: ApiRequestMetadata;
@@ -117,8 +115,8 @@ export const updateDocument = async ({
     }
   }
 
-  // If no data just return the document since this function is normally chained after a meta update.
   if (!data || Object.values(data).length === 0) {
+    console.log('no data');
     return document;
   }
 
@@ -129,26 +127,11 @@ export const updateDocument = async ({
   const documentGlobalAccessAuth = documentAuthOption?.globalAccessAuth ?? null;
   const documentGlobalActionAuth = documentAuthOption?.globalActionAuth ?? null;
 
-  // If the new global auth values aren't passed in, fallback to the current document values.
   const newGlobalAccessAuth =
     data?.globalAccessAuth === undefined ? documentGlobalAccessAuth : data.globalAccessAuth;
   const newGlobalActionAuth =
     data?.globalActionAuth === undefined ? documentGlobalActionAuth : data.globalActionAuth;
 
-  // Check if user has permission to set the global action auth.
-  if (newGlobalActionAuth && newGlobalActionAuth.length > 0) {
-    const isDocumentEnterprise = await isUserEnterprise({
-      userId,
-      teamId,
-    });
-
-    if (!isDocumentEnterprise) {
-      throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'You do not have permission to set the action auth',
-      });
-    }
-  }
-
   const isTitleSame = data.title === undefined || data.title === document.title;
   const isExternalIdSame = data.externalId === undefined || data.externalId === document.externalId;
   const isGlobalAccessSame =

packages/lib/server-only/document/validate-field-auth.ts

@@ -3,6 +3,7 @@ import { FieldType } from '@prisma/client';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import type { TRecipientActionAuth } from '../../types/document-auth';
+import { extractDocumentAuthMethods } from '../../utils/document-auth';
 import { isRecipientAuthorized } from './is-recipient-authorized';
 
 export type ValidateFieldAuthOptions = {
@@ -25,9 +26,14 @@ export const validateFieldAuth = async ({
   userId,
   authOptions,
 }: ValidateFieldAuthOptions) => {
+  const { derivedRecipientActionAuth } = extractDocumentAuthMethods({
+    documentAuth: documentAuthOptions,
+    recipientAuth: recipient.authOptions,
+  });
+
   // Override all non-signature fields to not require any auth.
   if (field.type !== FieldType.SIGNATURE) {
-    return undefined;
+    return null;
   }
 
   const isValid = await isRecipientAuthorized({
@@ -44,5 +50,5 @@ export const validateFieldAuth = async ({
     });
   }
 
-  return authOptions?.type;
+  return derivedRecipientActionAuth;
 };

packages/lib/server-only/document/viewed-document.ts

@@ -15,7 +15,7 @@ import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
 
 export type ViewedDocumentOptions = {
   token: string;
-  recipientAccessAuth?: TDocumentAccessAuthTypes[];
+  recipientAccessAuth?: TDocumentAccessAuthTypes | null;
   requestMetadata?: RequestMetadata;
 };
 
@@ -63,7 +63,7 @@ export const viewedDocument = async ({
           recipientId: recipient.id,
           recipientName: recipient.name,
           recipientRole: recipient.role,
-          accessAuth: recipientAccessAuth ?? [],
+          accessAuth: recipientAccessAuth || undefined,
         },
       }),
     });

packages/lib/server-only/embedding-presign/create-embedding-presign-token.ts

@@ -27,6 +27,7 @@ export const createEmbeddingPresignToken = async ({
     // In development mode, allow setting expiresIn to 0 for testing
     // In production, enforce a minimum expiration time
     const isDevelopment = env('NODE_ENV') !== 'production';
+    console.log('isDevelopment', isDevelopment);
     const minExpirationMinutes = isDevelopment ? 0 : 5;
 
     // Ensure expiresIn is at least the minimum allowed value

packages/lib/server-only/field/sign-field-with-token.ts

@@ -2,6 +2,7 @@ import { DocumentStatus, FieldType, RecipientRole, SigningStatus } from '@prisma
 import { DateTime } from 'luxon';
 import { match } from 'ts-pattern';
 
+import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
 import { validateCheckboxField } from '@documenso/lib/advanced-fields-validation/validate-checkbox';
 import { validateDropdownField } from '@documenso/lib/advanced-fields-validation/validate-dropdown';
 import { validateNumberField } from '@documenso/lib/advanced-fields-validation/validate-number';
@@ -13,7 +14,7 @@ import { prisma } from '@documenso/prisma';
 import { DEFAULT_DOCUMENT_DATE_FORMAT } from '../../constants/date-formats';
 import { DEFAULT_DOCUMENT_TIME_ZONE } from '../../constants/time-zones';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
-import type { TRecipientActionAuth } from '../../types/document-auth';
+import type { TRecipientActionAuth, TRecipientActionAuthTypes } from '../../types/document-auth';
 import {
   ZCheckboxFieldMeta,
   ZDropdownFieldMeta,
@@ -23,6 +24,7 @@ import {
 } from '../../types/field-meta';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
+import { extractDocumentAuthMethods } from '../../utils/document-auth';
 import { validateFieldAuth } from '../document/validate-field-auth';
 
 export type SignFieldWithTokenOptions = {
@@ -169,13 +171,24 @@ export const signFieldWithToken = async ({
     }
   }
 
-  const derivedRecipientActionAuth = await validateFieldAuth({
-    documentAuthOptions: document.authOptions,
-    recipient,
-    field,
-    userId,
-    authOptions,
-  });
+  const isEnterprise = userId ? await isUserEnterprise({ userId }) : false;
+  let requiredAuthType: TRecipientActionAuthTypes | null = null;
+
+  if (isEnterprise) {
+    requiredAuthType = await validateFieldAuth({
+      documentAuthOptions: document.authOptions,
+      recipient,
+      field,
+      userId,
+      authOptions,
+    });
+  } else {
+    const { derivedRecipientActionAuth } = extractDocumentAuthMethods({
+      documentAuth: document.authOptions,
+      recipientAuth: recipient.authOptions,
+    });
+    requiredAuthType = derivedRecipientActionAuth;
+  }
 
   const documentMeta = await prisma.documentMeta.findFirst({
     where: {
@@ -286,9 +299,9 @@ export const signFieldWithToken = async ({
               }),
             )
             .exhaustive(),
-          fieldSecurity: derivedRecipientActionAuth
+          fieldSecurity: requiredAuthType
             ? {
-                type: derivedRecipientActionAuth,
+                type: requiredAuthType,
               }
             : undefined,
         },

packages/lib/server-only/pdf/flatten-form.ts

@@ -1,4 +1,3 @@
-import fontkit from '@pdf-lib/fontkit';
 import type { PDFField, PDFWidgetAnnotation } from 'pdf-lib';
 import {
   PDFCheckBox,
@@ -14,8 +13,6 @@ import {
   translate,
 } from 'pdf-lib';
 
-import { NEXT_PUBLIC_WEBAPP_URL } from '../../constants/app';
-
 export const removeOptionalContentGroups = (document: PDFDocument) => {
   const context = document.context;
   const catalog = context.lookup(context.trailerInfo.Root);
@@ -24,20 +21,12 @@ export const removeOptionalContentGroups = (document: PDFDocument) => {
   }
 };
 
-export const flattenForm = async (document: PDFDocument) => {
+export const flattenForm = (document: PDFDocument) => {
   removeOptionalContentGroups(document);
 
   const form = document.getForm();
 
-  const fontNoto = await fetch(`${NEXT_PUBLIC_WEBAPP_URL()}/fonts/noto-sans.ttf`).then(
-    async (res) => res.arrayBuffer(),
-  );
-
-  document.registerFontkit(fontkit);
-
-  const font = await document.embedFont(fontNoto);
-
-  form.updateFieldAppearances(font);
+  form.updateFieldAppearances();
 
   for (const field of form.getFields()) {
     for (const widget of field.acroField.getWidgets()) {

packages/lib/server-only/pdf/insert-field-in-pdf.ts

@@ -1,15 +1,8 @@
 // https://github.com/Hopding/pdf-lib/issues/20#issuecomment-412852821
 import fontkit from '@pdf-lib/fontkit';
 import { FieldType } from '@prisma/client';
-import type { PDFDocument, PDFFont, PDFTextField } from 'pdf-lib';
-import {
-  RotationTypes,
-  TextAlignment,
-  degrees,
-  radiansToDegrees,
-  rgb,
-  setFontAndSize,
-} from 'pdf-lib';
+import type { PDFDocument, PDFFont } from 'pdf-lib';
+import { RotationTypes, TextAlignment, degrees, radiansToDegrees, rgb } from 'pdf-lib';
 import { P, match } from 'ts-pattern';
 
 import {
@@ -449,10 +442,6 @@ export const insertFieldInPDF = async (pdf: PDFDocument, field: FieldWithSignatu
         adjustedFieldY = adjustedPosition.yPos;
       }
 
-      // Set properties for the text field
-      setTextFieldFontSize(textField, font, fontSize);
-      textField.setText(textToInsert);
-
       // Set the position and size of the text field
       textField.addToPage(page, {
         x: adjustedFieldX,
@@ -461,8 +450,6 @@ export const insertFieldInPDF = async (pdf: PDFDocument, field: FieldWithSignatu
         height: adjustedFieldHeight,
         rotate: degrees(pageRotationInDegrees),
 
-        font,
-
         // Hide borders.
         borderWidth: 0,
         borderColor: undefined,
@@ -470,6 +457,10 @@ export const insertFieldInPDF = async (pdf: PDFDocument, field: FieldWithSignatu
 
         ...(isDebugMode ? { borderWidth: 1, borderColor: rgb(0, 0, 1) } : {}),
       });
+
+      // Set properties for the text field
+      textField.setFontSize(fontSize);
+      textField.setText(textToInsert);
     });
 
   return pdf;
@@ -638,21 +629,3 @@ function breakLongString(text: string, maxWidth: number, font: PDFFont, fontSize
 
   return lines.join('\n');
 }
-
-const setTextFieldFontSize = (textField: PDFTextField, font: PDFFont, fontSize: number) => {
-  textField.defaultUpdateAppearances(font);
-  textField.updateAppearances(font);
-
-  try {
-    textField.setFontSize(fontSize);
-  } catch (err) {
-    let da = textField.acroField.getDefaultAppearance() ?? '';
-
-    da += `\n ${setFontAndSize(font.name, fontSize)}`;
-
-    textField.acroField.setDefaultAppearance(da);
-  }
-
-  textField.defaultUpdateAppearances(font);
-  textField.updateAppearances(font);
-};

packages/lib/server-only/recipient/create-document-recipients.ts

@@ -22,8 +22,8 @@ export interface CreateDocumentRecipientsOptions {
     name: string;
     role: RecipientRole;
     signingOrder?: number | null;
-    accessAuth?: TRecipientAccessAuthTypes[];
-    actionAuth?: TRecipientActionAuthTypes[];
+    accessAuth?: TRecipientAccessAuthTypes | null;
+    actionAuth?: TRecipientActionAuthTypes | null;
   }[];
   requestMetadata: ApiRequestMetadata;
 }
@@ -71,9 +71,7 @@ export const createDocumentRecipients = async ({
     });
   }
 
-  const recipientsHaveActionAuth = recipientsToCreate.some(
-    (recipient) => recipient.actionAuth && recipient.actionAuth.length > 0,
-  );
+  const recipientsHaveActionAuth = recipientsToCreate.some((recipient) => recipient.actionAuth);
 
   // Check if user has permission to set the global action auth.
   if (recipientsHaveActionAuth) {
@@ -112,8 +110,8 @@ export const createDocumentRecipients = async ({
     return await Promise.all(
       normalizedRecipients.map(async (recipient) => {
         const authOptions = createRecipientAuthOptions({
-          accessAuth: recipient.accessAuth ?? [],
-          actionAuth: recipient.actionAuth ?? [],
+          accessAuth: recipient.accessAuth || null,
+          actionAuth: recipient.actionAuth || null,
         });
 
         const createdRecipient = await tx.recipient.create({
@@ -142,8 +140,8 @@ export const createDocumentRecipients = async ({
               recipientName: createdRecipient.name,
               recipientId: createdRecipient.id,
               recipientRole: createdRecipient.role,
-              accessAuth: recipient.accessAuth ?? [],
-              actionAuth: recipient.actionAuth ?? [],
+              accessAuth: recipient.accessAuth || undefined,
+              actionAuth: recipient.actionAuth || undefined,
             },
           }),
         });

packages/lib/server-only/recipient/create-template-recipients.ts

@@ -19,8 +19,8 @@ export interface CreateTemplateRecipientsOptions {
     name: string;
     role: RecipientRole;
     signingOrder?: number | null;
-    accessAuth?: TRecipientAccessAuthTypes[];
-    actionAuth?: TRecipientActionAuthTypes[];
+    accessAuth?: TRecipientAccessAuthTypes | null;
+    actionAuth?: TRecipientActionAuthTypes | null;
   }[];
 }
 
@@ -60,9 +60,7 @@ export const createTemplateRecipients = async ({
     });
   }
 
-  const recipientsHaveActionAuth = recipientsToCreate.some(
-    (recipient) => recipient.actionAuth && recipient.actionAuth.length > 0,
-  );
+  const recipientsHaveActionAuth = recipientsToCreate.some((recipient) => recipient.actionAuth);
 
   // Check if user has permission to set the global action auth.
   if (recipientsHaveActionAuth) {
@@ -101,8 +99,8 @@ export const createTemplateRecipients = async ({
     return await Promise.all(
       normalizedRecipients.map(async (recipient) => {
         const authOptions = createRecipientAuthOptions({
-          accessAuth: recipient.accessAuth ?? [],
-          actionAuth: recipient.actionAuth ?? [],
+          accessAuth: recipient.accessAuth || null,
+          actionAuth: recipient.actionAuth || null,
         });
 
         const createdRecipient = await tx.recipient.create({

packages/lib/server-only/recipient/set-document-recipients.ts

@@ -4,7 +4,6 @@ import { msg } from '@lingui/core/macro';
 import type { Recipient } from '@prisma/client';
 import { RecipientRole } from '@prisma/client';
 import { SendStatus, SigningStatus } from '@prisma/client';
-import { isDeepEqual } from 'remeda';
 
 import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
 import { mailer } from '@documenso/email/mailer';
@@ -97,9 +96,7 @@ export const setDocumentRecipients = async ({
     throw new Error('Document already complete');
   }
 
-  const recipientsHaveActionAuth = recipients.some(
-    (recipient) => recipient.actionAuth && recipient.actionAuth.length > 0,
-  );
+  const recipientsHaveActionAuth = recipients.some((recipient) => recipient.actionAuth);
 
   // Check if user has permission to set the global action auth.
   if (recipientsHaveActionAuth) {
@@ -248,8 +245,8 @@ export const setDocumentRecipients = async ({
               metadata: requestMetadata,
               data: {
                 ...baseAuditLog,
-                accessAuth: recipient.accessAuth || [],
-                actionAuth: recipient.actionAuth || [],
+                accessAuth: recipient.accessAuth || undefined,
+                actionAuth: recipient.actionAuth || undefined,
               },
             }),
           });
@@ -364,8 +361,8 @@ type RecipientData = {
   name: string;
   role: RecipientRole;
   signingOrder?: number | null;
-  accessAuth?: TRecipientAccessAuthTypes[];
-  actionAuth?: TRecipientActionAuthTypes[];
+  accessAuth?: TRecipientAccessAuthTypes | null;
+  actionAuth?: TRecipientActionAuthTypes | null;
 };
 
 type RecipientDataWithClientId = Recipient & {
@@ -375,15 +372,15 @@ type RecipientDataWithClientId = Recipient & {
 const hasRecipientBeenChanged = (recipient: Recipient, newRecipientData: RecipientData) => {
   const authOptions = ZRecipientAuthOptionsSchema.parse(recipient.authOptions);
 
-  const newRecipientAccessAuth = newRecipientData.accessAuth || [];
-  const newRecipientActionAuth = newRecipientData.actionAuth || [];
+  const newRecipientAccessAuth = newRecipientData.accessAuth || null;
+  const newRecipientActionAuth = newRecipientData.actionAuth || null;
 
   return (
     recipient.email !== newRecipientData.email ||
     recipient.name !== newRecipientData.name ||
     recipient.role !== newRecipientData.role ||
     recipient.signingOrder !== newRecipientData.signingOrder ||
-    !isDeepEqual(authOptions.accessAuth, newRecipientAccessAuth) ||
-    !isDeepEqual(authOptions.actionAuth, newRecipientActionAuth)
+    authOptions.accessAuth !== newRecipientAccessAuth ||
+    authOptions.actionAuth !== newRecipientActionAuth
   );
 };

packages/lib/server-only/recipient/set-template-recipients.ts

@@ -26,7 +26,7 @@ export type SetTemplateRecipientsOptions = {
     name: string;
     role: RecipientRole;
     signingOrder?: number | null;
-    actionAuth?: TRecipientActionAuthTypes[];
+    actionAuth?: TRecipientActionAuthTypes | null;
   }[];
 };
 
@@ -64,9 +64,7 @@ export const setTemplateRecipients = async ({
     throw new Error('Template not found');
   }
 
-  const recipientsHaveActionAuth = recipients.some(
-    (recipient) => recipient.actionAuth && recipient.actionAuth.length > 0,
-  );
+  const recipientsHaveActionAuth = recipients.some((recipient) => recipient.actionAuth);
 
   // Check if user has permission to set the global action auth.
   if (recipientsHaveActionAuth) {

packages/lib/server-only/recipient/update-document-recipients.ts

@@ -1,7 +1,6 @@
 import type { Recipient } from '@prisma/client';
 import { RecipientRole } from '@prisma/client';
 import { SendStatus, SigningStatus } from '@prisma/client';
-import { isDeepEqual } from 'remeda';
 
 import { isUserEnterprise } from '@documenso/ee/server-only/util/is-document-enterprise';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
@@ -73,9 +72,7 @@ export const updateDocumentRecipients = async ({
     });
   }
 
-  const recipientsHaveActionAuth = recipients.some(
-    (recipient) => recipient.actionAuth && recipient.actionAuth.length > 0,
-  );
+  const recipientsHaveActionAuth = recipients.some((recipient) => recipient.actionAuth);
 
   // Check if user has permission to set the global action auth.
   if (recipientsHaveActionAuth) {
@@ -221,8 +218,8 @@ type RecipientData = {
   name?: string;
   role?: RecipientRole;
   signingOrder?: number | null;
-  accessAuth?: TRecipientAccessAuthTypes[];
-  actionAuth?: TRecipientActionAuthTypes[];
+  accessAuth?: TRecipientAccessAuthTypes | null;
+  actionAuth?: TRecipientActionAuthTypes | null;
 };
 
 const hasRecipientBeenChanged = (recipient: Recipient, newRecipientData: RecipientData) => {
@@ -236,7 +233,7 @@ const hasRecipientBeenChanged = (recipient: Recipient, newRecipientData: Recipie
     recipient.name !== newRecipientData.name ||
     recipient.role !== newRecipientData.role ||
     recipient.signingOrder !== newRecipientData.signingOrder ||
-    !isDeepEqual(authOptions.accessAuth, newRecipientAccessAuth) ||
-    !isDeepEqual(authOptions.actionAuth, newRecipientActionAuth)
+    authOptions.accessAuth !== newRecipientAccessAuth ||
+    authOptions.actionAuth !== newRecipientActionAuth
   );
 };

packages/lib/server-only/recipient/update-recipient.ts

@@ -20,7 +20,7 @@ export type UpdateRecipientOptions = {
   name?: string;
   role?: RecipientRole;
   signingOrder?: number | null;
-  actionAuth?: TRecipientActionAuthTypes[];
+  actionAuth?: TRecipientActionAuthTypes | null;
   userId: number;
   teamId?: number;
   requestMetadata?: RequestMetadata;
@@ -90,7 +90,7 @@ export const updateRecipient = async ({
     throw new Error('Recipient not found');
   }
 
-  if (actionAuth && actionAuth.length > 0) {
+  if (actionAuth) {
     const isDocumentEnterprise = await isUserEnterprise({
       userId,
       teamId,
@@ -117,7 +117,7 @@ export const updateRecipient = async ({
         signingOrder,
         authOptions: createRecipientAuthOptions({
           accessAuth: recipientAuthOptions.accessAuth,
-          actionAuth: actionAuth ?? [],
+          actionAuth: actionAuth ?? null,
         }),
       },
     });

packages/lib/server-only/recipient/update-template-recipients.ts

@@ -22,8 +22,8 @@ export interface UpdateTemplateRecipientsOptions {
     name?: string;
     role?: RecipientRole;
     signingOrder?: number | null;
-    accessAuth?: TRecipientAccessAuthTypes[];
-    actionAuth?: TRecipientActionAuthTypes[];
+    accessAuth?: TRecipientAccessAuthTypes | null;
+    actionAuth?: TRecipientActionAuthTypes | null;
   }[];
 }
 
@@ -63,9 +63,7 @@ export const updateTemplateRecipients = async ({
     });
   }
 
-  const recipientsHaveActionAuth = recipients.some(
-    (recipient) => recipient.actionAuth && recipient.actionAuth.length > 0,
-  );
+  const recipientsHaveActionAuth = recipients.some((recipient) => recipient.actionAuth);
 
   // Check if user has permission to set the global action auth.
   if (recipientsHaveActionAuth) {

packages/lib/server-only/template/create-document-from-direct-template.ts

@@ -70,7 +70,7 @@ export type CreateDocumentFromDirectTemplateOptions = {
 
 type CreatedDirectRecipientField = {
   field: Field & { signature?: Signature | null };
-  derivedRecipientActionAuth?: TRecipientActionAuthTypes;
+  derivedRecipientActionAuth: TRecipientActionAuthTypes | null;
 };
 
 export const ZCreateDocumentFromDirectTemplateResponseSchema = z.object({
@@ -151,9 +151,9 @@ export const createDocumentFromDirectTemplate = async ({
   const directRecipientName = user?.name || initialDirectRecipientName;
 
   // Ensure typesafety when we add more options.
-  const isAccessAuthValid = match(derivedRecipientAccessAuth.at(0))
+  const isAccessAuthValid = match(derivedRecipientAccessAuth)
     .with(DocumentAccessAuth.ACCOUNT, () => user && user?.email === directRecipientEmail)
-    .with(undefined, () => true)
+    .with(null, () => true)
     .exhaustive();
 
   if (!isAccessAuthValid) {
@@ -460,7 +460,7 @@ export const createDocumentFromDirectTemplate = async ({
     const createdDirectRecipientFields: CreatedDirectRecipientField[] = [
       ...createdDirectRecipient.fields.map((field) => ({
         field,
-        derivedRecipientActionAuth: undefined,
+        derivedRecipientActionAuth: null,
       })),
       ...createdDirectRecipientSignatureFields,
     ];
@@ -567,7 +567,6 @@ export const createDocumentFromDirectTemplate = async ({
           recipientId: createdDirectRecipient.id,
           recipientName: createdDirectRecipient.name,
           recipientRole: createdDirectRecipient.role,
-          actionAuth: createdDirectRecipient.authOptions?.actionAuth ?? [],
         },
       }),
     ];

packages/lib/server-only/template/update-template.ts

@@ -5,6 +5,7 @@ import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import type { TDocumentAccessAuthTypes, TDocumentActionAuthTypes } from '../../types/document-auth';
+import { DocumentAuth } from '../../types/document-auth';
 import { createDocumentAuthOptions, extractDocumentAuthMethods } from '../../utils/document-auth';
 
 export type UpdateTemplateOptions = {
@@ -15,8 +16,8 @@ export type UpdateTemplateOptions = {
     title?: string;
     externalId?: string | null;
     visibility?: DocumentVisibility;
-    globalAccessAuth?: TDocumentAccessAuthTypes[];
-    globalActionAuth?: TDocumentActionAuthTypes[];
+    globalAccessAuth?: TDocumentAccessAuthTypes | null;
+    globalActionAuth?: TDocumentActionAuthTypes | null;
     publicTitle?: string;
     publicDescription?: string;
     type?: Template['type'];
@@ -74,7 +75,11 @@ export const updateTemplate = async ({
     data?.globalActionAuth === undefined ? documentGlobalActionAuth : data.globalActionAuth;
 
   // Check if user has permission to set the global action auth.
-  if (newGlobalActionAuth && newGlobalActionAuth.length > 0) {
+  // Only ACCOUNT and PASSKEY require enterprise permissions
+  if (
+    newGlobalActionAuth &&
+    (newGlobalActionAuth === DocumentAuth.ACCOUNT || newGlobalActionAuth === DocumentAuth.PASSKEY)
+  ) {
     const isDocumentEnterprise = await isUserEnterprise({
       userId,
       teamId,
@@ -82,7 +87,7 @@ export const updateTemplate = async ({
 
     if (!isDocumentEnterprise) {
       throw new AppError(AppErrorCode.UNAUTHORIZED, {
-        message: 'You do not have permission to set the action auth',
+        message: 'You do not have permission to set this action auth type',
       });
     }
   }

packages/lib/types/document-audit-logs.ts

@@ -123,8 +123,8 @@ export const ZDocumentAuditLogFieldDiffSchema = z.union([
 ]);
 
 export const ZGenericFromToSchema = z.object({
-  from: z.union([z.string(), z.array(z.string())]).nullable(),
-  to: z.union([z.string(), z.array(z.string())]).nullable(),
+  from: z.string().nullable(),
+  to: z.string().nullable(),
 });
 
 export const ZRecipientDiffActionAuthSchema = ZGenericFromToSchema.extend({
@@ -296,7 +296,7 @@ export const ZDocumentAuditLogEventDocumentFieldInsertedSchema = z.object({
       },
       z
         .object({
-          type: ZRecipientActionAuthTypesSchema.optional(),
+          type: ZRecipientActionAuthTypesSchema,
         })
         .optional(),
     ),
@@ -384,7 +384,7 @@ export const ZDocumentAuditLogEventDocumentFieldPrefilledSchema = z.object({
       },
       z
         .object({
-          type: ZRecipientActionAuthTypesSchema.optional(),
+          type: ZRecipientActionAuthTypesSchema,
         })
         .optional(),
     ),
@@ -428,13 +428,7 @@ export const ZDocumentAuditLogEventDocumentMetaUpdatedSchema = z.object({
 export const ZDocumentAuditLogEventDocumentOpenedSchema = z.object({
   type: z.literal(DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_OPENED),
   data: ZBaseRecipientDataSchema.extend({
-    accessAuth: z.preprocess((unknownValue) => {
-      if (!unknownValue) {
-        return [];
-      }
-
-      return Array.isArray(unknownValue) ? unknownValue : [unknownValue];
-    }, z.array(ZRecipientAccessAuthTypesSchema)),
+    accessAuth: z.string().optional(),
   }),
 });
 
@@ -444,13 +438,7 @@ export const ZDocumentAuditLogEventDocumentOpenedSchema = z.object({
 export const ZDocumentAuditLogEventDocumentRecipientCompleteSchema = z.object({
   type: z.literal(DOCUMENT_AUDIT_LOG_TYPE.DOCUMENT_RECIPIENT_COMPLETED),
   data: ZBaseRecipientDataSchema.extend({
-    actionAuth: z.preprocess((unknownValue) => {
-      if (!unknownValue) {
-        return [];
-      }
-
-      return Array.isArray(unknownValue) ? unknownValue : [unknownValue];
-    }, z.array(ZRecipientActionAuthTypesSchema)),
+    actionAuth: z.string().optional(),
   }),
 });
 
@@ -528,20 +516,8 @@ export const ZDocumentAuditLogEventFieldUpdatedSchema = z.object({
 export const ZDocumentAuditLogEventRecipientAddedSchema = z.object({
   type: z.literal(DOCUMENT_AUDIT_LOG_TYPE.RECIPIENT_CREATED),
   data: ZBaseRecipientDataSchema.extend({
-    accessAuth: z.preprocess((unknownValue) => {
-      if (!unknownValue) {
-        return [];
-      }
-
-      return Array.isArray(unknownValue) ? unknownValue : [unknownValue];
-    }, z.array(ZRecipientAccessAuthTypesSchema)),
-    actionAuth: z.preprocess((unknownValue) => {
-      if (!unknownValue) {
-        return [];
-      }
-
-      return Array.isArray(unknownValue) ? unknownValue : [unknownValue];
-    }, z.array(ZRecipientActionAuthTypesSchema)),
+    accessAuth: ZRecipientAccessAuthTypesSchema.optional(),
+    actionAuth: ZRecipientActionAuthTypesSchema.optional(),
   }),
 });
 

packages/lib/types/document-auth.ts

@@ -9,10 +9,8 @@ export const ZDocumentAuthTypesSchema = z.enum([
   'ACCOUNT',
   'PASSKEY',
   'TWO_FACTOR_AUTH',
-  'PASSWORD',
   'EXPLICIT_NONE',
 ]);
-
 export const DocumentAuth = ZDocumentAuthTypesSchema.Enum;
 
 const ZDocumentAuthAccountSchema = z.object({
@@ -29,11 +27,6 @@ const ZDocumentAuthPasskeySchema = z.object({
   tokenReference: z.string().min(1),
 });
 
-const ZDocumentAuthPasswordSchema = z.object({
-  type: z.literal(DocumentAuth.PASSWORD),
-  password: z.string().min(1),
-});
-
 const ZDocumentAuth2FASchema = z.object({
   type: z.literal(DocumentAuth.TWO_FACTOR_AUTH),
   token: z.string().min(4).max(10),
@@ -47,7 +40,6 @@ export const ZDocumentAuthMethodsSchema = z.discriminatedUnion('type', [
   ZDocumentAuthExplicitNoneSchema,
   ZDocumentAuthPasskeySchema,
   ZDocumentAuth2FASchema,
-  ZDocumentAuthPasswordSchema,
 ]);
 
 /**
@@ -69,19 +61,23 @@ export const ZDocumentActionAuthSchema = z.discriminatedUnion('type', [
   ZDocumentAuthAccountSchema,
   ZDocumentAuthPasskeySchema,
   ZDocumentAuth2FASchema,
-  ZDocumentAuthPasswordSchema,
 ]);
 export const ZDocumentActionAuthTypesSchema = z
-  .enum([
-    DocumentAuth.ACCOUNT,
-    DocumentAuth.PASSKEY,
-    DocumentAuth.TWO_FACTOR_AUTH,
-    DocumentAuth.PASSWORD,
-  ])
+  .enum([DocumentAuth.ACCOUNT, DocumentAuth.PASSKEY, DocumentAuth.TWO_FACTOR_AUTH])
   .describe(
     'The type of authentication required for the recipient to sign the document. This field is restricted to Enterprise plan users only.',
   );
 
+/**
+ * The non-enterprise document action auth methods.
+ *
+ * Only includes options available to non-enterprise users.
+ */
+export const ZNonEnterpriseDocumentActionAuthTypesSchema = z.enum([
+  DocumentAuth.TWO_FACTOR_AUTH,
+  DocumentAuth.EXPLICIT_NONE,
+]);
+
 /**
  * The recipient access auth methods.
  *
@@ -103,7 +99,6 @@ export const ZRecipientActionAuthSchema = z.discriminatedUnion('type', [
   ZDocumentAuthAccountSchema,
   ZDocumentAuthPasskeySchema,
   ZDocumentAuth2FASchema,
-  ZDocumentAuthPasswordSchema,
   ZDocumentAuthExplicitNoneSchema,
 ]);
 export const ZRecipientActionAuthTypesSchema = z
@@ -111,13 +106,13 @@ export const ZRecipientActionAuthTypesSchema = z
     DocumentAuth.ACCOUNT,
     DocumentAuth.PASSKEY,
     DocumentAuth.TWO_FACTOR_AUTH,
-    DocumentAuth.PASSWORD,
     DocumentAuth.EXPLICIT_NONE,
   ])
   .describe('The type of authentication required for the recipient to sign the document.');
 
 export const DocumentAccessAuth = ZDocumentAccessAuthTypesSchema.Enum;
 export const DocumentActionAuth = ZDocumentActionAuthTypesSchema.Enum;
+export const NonEnterpriseDocumentActionAuth = ZNonEnterpriseDocumentActionAuthTypesSchema.Enum;
 export const RecipientAccessAuth = ZRecipientAccessAuthTypesSchema.Enum;
 export const RecipientActionAuth = ZRecipientActionAuthTypesSchema.Enum;
 
@@ -126,26 +121,18 @@ export const RecipientActionAuth = ZRecipientActionAuthTypesSchema.Enum;
  */
 export const ZDocumentAuthOptionsSchema = z.preprocess(
   (unknownValue) => {
-    if (!unknownValue || typeof unknownValue !== 'object') {
-      return {
-        globalAccessAuth: [],
-        globalActionAuth: [],
-      };
+    if (unknownValue) {
+      return unknownValue;
     }
 
-    const globalAccessAuth =
-      'globalAccessAuth' in unknownValue ? processAuthValue(unknownValue.globalAccessAuth) : [];
-    const globalActionAuth =
-      'globalActionAuth' in unknownValue ? processAuthValue(unknownValue.globalActionAuth) : [];
-
     return {
-      globalAccessAuth,
-      globalActionAuth,
+      globalAccessAuth: null,
+      globalActionAuth: null,
     };
   },
   z.object({
-    globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema),
-    globalActionAuth: z.array(ZDocumentActionAuthTypesSchema),
+    globalAccessAuth: ZDocumentAccessAuthTypesSchema.nullable(),
+    globalActionAuth: ZDocumentActionAuthTypesSchema.nullable(),
   }),
 );
 
@@ -154,46 +141,21 @@ export const ZDocumentAuthOptionsSchema = z.preprocess(
  */
 export const ZRecipientAuthOptionsSchema = z.preprocess(
   (unknownValue) => {
-    if (!unknownValue || typeof unknownValue !== 'object') {
-      return {
-        accessAuth: [],
-        actionAuth: [],
-      };
+    if (unknownValue) {
+      return unknownValue;
     }
 
-    const accessAuth =
-      'accessAuth' in unknownValue ? processAuthValue(unknownValue.accessAuth) : [];
-    const actionAuth =
-      'actionAuth' in unknownValue ? processAuthValue(unknownValue.actionAuth) : [];
-
     return {
-      accessAuth,
-      actionAuth,
+      accessAuth: null,
+      actionAuth: null,
     };
   },
   z.object({
-    accessAuth: z.array(ZRecipientAccessAuthTypesSchema),
-    actionAuth: z.array(ZRecipientActionAuthTypesSchema),
+    accessAuth: ZRecipientAccessAuthTypesSchema.nullable(),
+    actionAuth: ZRecipientActionAuthTypesSchema.nullable(),
   }),
 );
 
-/**
- * Utility function to process the auth value.
- *
- * Converts the old singular auth value to an array of auth values.
- */
-const processAuthValue = (value: unknown) => {
-  if (value === null || value === undefined) {
-    return [];
-  }
-
-  if (Array.isArray(value)) {
-    return value;
-  }
-
-  return [value];
-};
-
 export type TDocumentAuth = z.infer<typeof ZDocumentAuthTypesSchema>;
 export type TDocumentAuthMethods = z.infer<typeof ZDocumentAuthMethodsSchema>;
 export type TDocumentAuthOptions = z.infer<typeof ZDocumentAuthOptionsSchema>;
@@ -201,6 +163,9 @@ export type TDocumentAccessAuth = z.infer<typeof ZDocumentAccessAuthSchema>;
 export type TDocumentAccessAuthTypes = z.infer<typeof ZDocumentAccessAuthTypesSchema>;
 export type TDocumentActionAuth = z.infer<typeof ZDocumentActionAuthSchema>;
 export type TDocumentActionAuthTypes = z.infer<typeof ZDocumentActionAuthTypesSchema>;
+export type TNonEnterpriseDocumentActionAuthTypes = z.infer<
+  typeof ZNonEnterpriseDocumentActionAuthTypesSchema
+>;
 export type TRecipientAccessAuth = z.infer<typeof ZRecipientAccessAuthSchema>;
 export type TRecipientAccessAuthTypes = z.infer<typeof ZRecipientAccessAuthTypesSchema>;
 export type TRecipientActionAuth = z.infer<typeof ZRecipientActionAuthSchema>;

packages/lib/utils/document-audit-logs.ts

@@ -2,7 +2,6 @@ import type { I18n } from '@lingui/core';
 import { msg } from '@lingui/core/macro';
 import type { DocumentAuditLog, DocumentMeta, Field, Recipient } from '@prisma/client';
 import { RecipientRole } from '@prisma/client';
-import { isDeepEqual } from 'remeda';
 import { match } from 'ts-pattern';
 
 import type {
@@ -107,7 +106,7 @@ export const diffRecipientChanges = (
   const newActionAuth =
     newAuthOptions?.actionAuth === undefined ? oldActionAuth : newAuthOptions.actionAuth;
 
-  if (!isDeepEqual(oldAccessAuth, newAccessAuth)) {
+  if (oldAccessAuth !== newAccessAuth) {
     diffs.push({
       type: RECIPIENT_DIFF_TYPE.ACCESS_AUTH,
       from: oldAccessAuth ?? '',
@@ -115,7 +114,7 @@ export const diffRecipientChanges = (
     });
   }
 
-  if (!isDeepEqual(oldActionAuth, newActionAuth)) {
+  if (oldActionAuth !== newActionAuth) {
     diffs.push({
       type: RECIPIENT_DIFF_TYPE.ACTION_AUTH,
       from: oldActionAuth ?? '',

packages/lib/utils/document-auth.ts

@@ -27,21 +27,17 @@ export const extractDocumentAuthMethods = ({
   const documentAuthOption = ZDocumentAuthOptionsSchema.parse(documentAuth);
   const recipientAuthOption = ZRecipientAuthOptionsSchema.parse(recipientAuth);
 
-  const derivedRecipientAccessAuth: TRecipientAccessAuthTypes[] =
-    recipientAuthOption.accessAuth.length > 0
-      ? recipientAuthOption.accessAuth
-      : documentAuthOption.globalAccessAuth;
+  const derivedRecipientAccessAuth: TRecipientAccessAuthTypes | null =
+    recipientAuthOption.accessAuth || documentAuthOption.globalAccessAuth;
 
-  const derivedRecipientActionAuth: TRecipientActionAuthTypes[] =
-    recipientAuthOption.actionAuth.length > 0
-      ? recipientAuthOption.actionAuth
-      : documentAuthOption.globalActionAuth;
+  const derivedRecipientActionAuth: TRecipientActionAuthTypes | null =
+    recipientAuthOption.actionAuth || documentAuthOption.globalActionAuth;
 
-  const recipientAccessAuthRequired = derivedRecipientAccessAuth.length > 0;
+  const recipientAccessAuthRequired = derivedRecipientAccessAuth !== null;
 
   const recipientActionAuthRequired =
-    derivedRecipientActionAuth.length > 0 &&
-    !derivedRecipientActionAuth.includes(DocumentAuth.EXPLICIT_NONE);
+    derivedRecipientActionAuth !== DocumentAuth.EXPLICIT_NONE &&
+    derivedRecipientActionAuth !== null;
 
   return {
     derivedRecipientAccessAuth,
@@ -58,8 +54,8 @@ export const extractDocumentAuthMethods = ({
  */
 export const createDocumentAuthOptions = (options: TDocumentAuthOptions): TDocumentAuthOptions => {
   return {
-    globalAccessAuth: options?.globalAccessAuth ?? [],
-    globalActionAuth: options?.globalActionAuth ?? [],
+    globalAccessAuth: options?.globalAccessAuth ?? null,
+    globalActionAuth: options?.globalActionAuth ?? null,
   };
 };
 
@@ -70,7 +66,7 @@ export const createRecipientAuthOptions = (
   options: TRecipientAuthOptions,
 ): TRecipientAuthOptions => {
   return {
-    accessAuth: options?.accessAuth ?? [],
-    actionAuth: options?.actionAuth ?? [],
+    accessAuth: options?.accessAuth ?? null,
+    actionAuth: options?.actionAuth ?? null,
   };
 };

packages/prisma/migrations/20250430202737_add_email_migration/migration.sql

@@ -0,0 +1,12 @@
+-- CreateTable
+CREATE TABLE "UserTwoFactorEmailVerification" (
+    "userId" INTEGER NOT NULL,
+    "verificationCode" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "UserTwoFactorEmailVerification_pkey" PRIMARY KEY ("userId")
+);
+
+-- AddForeignKey
+ALTER TABLE "UserTwoFactorEmailVerification" ADD CONSTRAINT "UserTwoFactorEmailVerification_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;

packages/prisma/schema.prisma

@@ -53,19 +53,20 @@ model User {
   avatarImageId    String?
   disabled         Boolean          @default(false)
 
-  accounts             Account[]
-  sessions             Session[]
-  documents            Document[]
-  folders              Folder[]
-  subscriptions        Subscription[]
-  passwordResetTokens  PasswordResetToken[]
-  ownedTeams           Team[]
-  ownedPendingTeams    TeamPending[]
-  teamMembers          TeamMember[]
-  twoFactorSecret      String?
-  twoFactorEnabled     Boolean              @default(false)
-  twoFactorBackupCodes String?
-  url                  String?              @unique
+  accounts                   Account[]
+  sessions                   Session[]
+  documents                  Document[]
+  folders                    Folder[]
+  subscriptions              Subscription[]
+  passwordResetTokens        PasswordResetToken[]
+  ownedTeams                 Team[]
+  ownedPendingTeams          TeamPending[]
+  teamMembers                TeamMember[]
+  twoFactorSecret            String?
+  twoFactorEnabled           Boolean                         @default(false)
+  twoFactorBackupCodes       String?
+  url                        String?                         @unique
+  twoFactorEmailVerification UserTwoFactorEmailVerification?
 
   profile            UserProfile?
   verificationTokens VerificationToken[]
@@ -839,3 +840,12 @@ model AvatarImage {
   team Team[]
   user User[]
 }
+
+model UserTwoFactorEmailVerification {
+  userId           Int      @id
+  verificationCode String
+  expiresAt        DateTime
+  createdAt        DateTime @default(now())
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+}

packages/trpc/server/auth-router/router.ts

@@ -1,5 +1,10 @@
 import type { RegistrationResponseJSON } from '@simplewebauthn/types';
 
+import { AppError } from '@documenso/lib/errors/app-error';
+import {
+  sendEmailVerification,
+  verifyEmailCode,
+} from '@documenso/lib/server-only/2fa/send-email-verification';
 import { createPasskey } from '@documenso/lib/server-only/auth/create-passkey';
 import { createPasskeyAuthenticationOptions } from '@documenso/lib/server-only/auth/create-passkey-authentication-options';
 import { createPasskeyRegistrationOptions } from '@documenso/lib/server-only/auth/create-passkey-registration-options';
@@ -8,6 +13,7 @@ import { deletePasskey } from '@documenso/lib/server-only/auth/delete-passkey';
 import { findPasskeys } from '@documenso/lib/server-only/auth/find-passkeys';
 import { updatePasskey } from '@documenso/lib/server-only/auth/update-passkey';
 import { nanoid } from '@documenso/lib/universal/id';
+import { prisma } from '@documenso/prisma';
 
 import { authenticatedProcedure, procedure, router } from '../trpc';
 import {
@@ -15,7 +21,9 @@ import {
   ZCreatePasskeyMutationSchema,
   ZDeletePasskeyMutationSchema,
   ZFindPasskeysQuerySchema,
+  ZSendEmailVerificationMutationSchema,
   ZUpdatePasskeyMutationSchema,
+  ZVerifyEmailCodeMutationSchema,
 } from './schema';
 
 export const authRouter = router({
@@ -98,4 +106,68 @@ export const authRouter = router({
         requestMetadata: ctx.metadata.requestMetadata,
       });
     }),
+
+  // Email verification for document signing
+  sendEmailVerification: authenticatedProcedure
+    .input(ZSendEmailVerificationMutationSchema)
+    .mutation(async ({ ctx, input }) => {
+      const { recipientId } = input;
+      const userId = ctx.user.id;
+      let email = ctx.user.email;
+
+      // If recipientId is provided, fetch that recipient's details
+      if (recipientId) {
+        const recipient = await prisma.recipient.findUnique({
+          where: {
+            id: recipientId,
+          },
+          select: {
+            email: true,
+          },
+        });
+
+        if (!recipient) {
+          throw new AppError('NOT_FOUND', {
+            message: 'Recipient not found',
+          });
+        }
+
+        email = recipient.email;
+      }
+
+      return sendEmailVerification({
+        userId,
+        email,
+      });
+    }),
+
+  verifyEmailCode: authenticatedProcedure
+    .input(ZVerifyEmailCodeMutationSchema)
+    .mutation(async ({ ctx, input }) => {
+      const { code, recipientId } = input;
+      const userId = ctx.user.id;
+
+      // If recipientId is provided, check that the user has access to it
+      if (recipientId) {
+        const recipient = await prisma.recipient.findUnique({
+          where: {
+            id: recipientId,
+          },
+          select: {
+            email: true,
+          },
+        });
+
+        if (!recipient) {
+          throw new AppError('NOT_FOUND', {
+            message: 'Recipient not found',
+          });
+        }
+      }
+
+      return verifyEmailCode({
+        userId,
+        code,
+      });
+    }),
 });

packages/trpc/server/auth-router/schema.ts

@@ -71,3 +71,18 @@ export const ZFindPasskeysQuerySchema = ZFindSearchParamsSchema.extend({
 });
 
 export type TSignUpMutationSchema = z.infer<typeof ZSignUpMutationSchema>;
+
+export const ZSendEmailVerificationMutationSchema = z.object({
+  recipientId: z.number().optional(),
+});
+
+export type TSendEmailVerificationMutationSchema = z.infer<
+  typeof ZSendEmailVerificationMutationSchema
+>;
+
+export const ZVerifyEmailCodeMutationSchema = z.object({
+  code: z.string().min(6).max(6),
+  recipientId: z.number().optional(),
+});
+
+export type TVerifyEmailCodeMutationSchema = z.infer<typeof ZVerifyEmailCodeMutationSchema>;

packages/trpc/server/document-router/schema.ts

@@ -206,8 +206,8 @@ export const ZCreateDocumentV2RequestSchema = z.object({
   title: ZDocumentTitleSchema,
   externalId: ZDocumentExternalIdSchema.optional(),
   visibility: ZDocumentVisibilitySchema.optional(),
-  globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema).optional(),
-  globalActionAuth: z.array(ZDocumentActionAuthTypesSchema).optional(),
+  globalAccessAuth: ZDocumentAccessAuthTypesSchema.optional(),
+  globalActionAuth: ZDocumentActionAuthTypesSchema.optional(),
   formValues: ZDocumentFormValuesSchema.optional(),
   recipients: z
     .array(

packages/trpc/server/document-router/update-document.types.ts

@@ -42,8 +42,8 @@ export const ZUpdateDocumentRequestSchema = z.object({
       title: ZDocumentTitleSchema.optional(),
       externalId: ZDocumentExternalIdSchema.nullish(),
       visibility: ZDocumentVisibilitySchema.optional(),
-      globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema).optional(),
-      globalActionAuth: z.array(ZDocumentActionAuthTypesSchema).optional(),
+      globalAccessAuth: ZDocumentAccessAuthTypesSchema.nullish(),
+      globalActionAuth: ZDocumentActionAuthTypesSchema.nullish(),
       useLegacyFieldInsertion: z.boolean().optional(),
     })
     .optional(),

packages/trpc/server/embedding-router/_router.ts

@@ -1,9 +1,7 @@
 import { router } from '../trpc';
-import { applyMultiSignSignatureRoute } from './apply-multi-sign-signature';
 import { createEmbeddingDocumentRoute } from './create-embedding-document';
 import { createEmbeddingPresignTokenRoute } from './create-embedding-presign-token';
 import { createEmbeddingTemplateRoute } from './create-embedding-template';
-import { getMultiSignDocumentRoute } from './get-multi-sign-document';
 import { updateEmbeddingDocumentRoute } from './update-embedding-document';
 import { updateEmbeddingTemplateRoute } from './update-embedding-template';
 import { verifyEmbeddingPresignTokenRoute } from './verify-embedding-presign-token';
@@ -15,6 +13,4 @@ export const embeddingPresignRouter = router({
   createEmbeddingTemplate: createEmbeddingTemplateRoute,
   updateEmbeddingDocument: updateEmbeddingDocumentRoute,
   updateEmbeddingTemplate: updateEmbeddingTemplateRoute,
-  applyMultiSignSignature: applyMultiSignSignatureRoute,
-  getMultiSignDocument: getMultiSignDocumentRoute,
 });

packages/trpc/server/embedding-router/apply-multi-sign-signature.ts

@@ -1,102 +0,0 @@
-import { FieldType, ReadStatus, SigningStatus } from '@prisma/client';
-
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { getDocumentByToken } from '@documenso/lib/server-only/document/get-document-by-token';
-import { signFieldWithToken } from '@documenso/lib/server-only/field/sign-field-with-token';
-import { getRecipientByToken } from '@documenso/lib/server-only/recipient/get-recipient-by-token';
-import { extractDocumentAuthMethods } from '@documenso/lib/utils/document-auth';
-import { prisma } from '@documenso/prisma';
-
-import { procedure } from '../trpc';
-import {
-  ZApplyMultiSignSignatureRequestSchema,
-  ZApplyMultiSignSignatureResponseSchema,
-} from './apply-multi-sign-signature.types';
-
-export const applyMultiSignSignatureRoute = procedure
-  .input(ZApplyMultiSignSignatureRequestSchema)
-  .output(ZApplyMultiSignSignatureResponseSchema)
-  .mutation(async ({ input, ctx: { metadata } }) => {
-    try {
-      const { tokens, signature, isBase64 } = input;
-
-      // Get all documents and recipients for the tokens
-      const envelopes = await Promise.all(
-        tokens.map(async (token) => {
-          const document = await getDocumentByToken({ token });
-          const recipient = await getRecipientByToken({ token });
-
-          return { document, recipient };
-        }),
-      );
-
-      // Check if all documents have been viewed
-      const hasUnviewedDocuments = envelopes.some(
-        (envelope) => envelope.recipient.readStatus !== ReadStatus.OPENED,
-      );
-
-      if (hasUnviewedDocuments) {
-        throw new AppError(AppErrorCode.INVALID_REQUEST, {
-          message: 'All documents must be viewed before signing',
-        });
-      }
-
-      // If we require action auth we should abort here for now
-      for (const envelope of envelopes) {
-        const derivedRecipientActionAuth = extractDocumentAuthMethods({
-          documentAuth: envelope.document.authOptions,
-          recipientAuth: envelope.recipient.authOptions,
-        });
-
-        if (
-          derivedRecipientActionAuth.recipientAccessAuthRequired ||
-          derivedRecipientActionAuth.recipientActionAuthRequired
-        ) {
-          throw new AppError(AppErrorCode.INVALID_REQUEST, {
-            message:
-              'Documents that require additional authentication cannot be multi signed at the moment',
-          });
-        }
-      }
-
-      // Sign all signature fields for each document
-      await Promise.all(
-        envelopes.map(async (envelope) => {
-          if (envelope.recipient.signingStatus === SigningStatus.REJECTED) {
-            return;
-          }
-
-          const signatureFields = await prisma.field.findMany({
-            where: {
-              documentId: envelope.document.id,
-              recipientId: envelope.recipient.id,
-              type: FieldType.SIGNATURE,
-              inserted: false,
-            },
-          });
-
-          await Promise.all(
-            signatureFields.map(async (field) =>
-              signFieldWithToken({
-                token: envelope.recipient.token,
-                fieldId: field.id,
-                value: signature,
-                isBase64,
-                requestMetadata: metadata.requestMetadata,
-              }),
-            ),
-          );
-        }),
-      );
-
-      return { success: true };
-    } catch (error) {
-      if (error instanceof AppError) {
-        throw error;
-      }
-
-      throw new AppError(AppErrorCode.UNKNOWN_ERROR, {
-        message: 'Failed to apply multi-sign signature',
-      });
-    }
-  });

packages/trpc/server/embedding-router/apply-multi-sign-signature.types.ts

@@ -1,18 +0,0 @@
-import { z } from 'zod';
-
-export const ZApplyMultiSignSignatureRequestSchema = z.object({
-  tokens: z.array(z.string()).min(1, { message: 'At least one token is required' }),
-  signature: z.string().min(1, { message: 'Signature is required' }),
-  isBase64: z.boolean().optional().default(false),
-});
-
-export const ZApplyMultiSignSignatureResponseSchema = z.object({
-  success: z.boolean(),
-});
-
-export type TApplyMultiSignSignatureRequestSchema = z.infer<
-  typeof ZApplyMultiSignSignatureRequestSchema
->;
-export type TApplyMultiSignSignatureResponseSchema = z.infer<
-  typeof ZApplyMultiSignSignatureResponseSchema
->;

packages/trpc/server/embedding-router/get-multi-sign-document.ts

@@ -1,62 +0,0 @@
-import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
-import { getDocumentAndSenderByToken } from '@documenso/lib/server-only/document/get-document-by-token';
-import { viewedDocument } from '@documenso/lib/server-only/document/viewed-document';
-import { getCompletedFieldsForToken } from '@documenso/lib/server-only/field/get-completed-fields-for-token';
-import { getFieldsForToken } from '@documenso/lib/server-only/field/get-fields-for-token';
-import { getRecipientByToken } from '@documenso/lib/server-only/recipient/get-recipient-by-token';
-
-import { procedure } from '../trpc';
-import {
-  ZGetMultiSignDocumentRequestSchema,
-  ZGetMultiSignDocumentResponseSchema,
-} from './get-multi-sign-document.types';
-
-export const getMultiSignDocumentRoute = procedure
-  .input(ZGetMultiSignDocumentRequestSchema)
-  .output(ZGetMultiSignDocumentResponseSchema)
-  .query(async ({ input, ctx: { metadata } }) => {
-    try {
-      const { token } = input;
-
-      const [document, fields, recipient] = await Promise.all([
-        getDocumentAndSenderByToken({
-          token,
-          requireAccessAuth: false,
-        }).catch(() => null),
-        getFieldsForToken({ token }),
-        getRecipientByToken({ token }).catch(() => null),
-        getCompletedFieldsForToken({ token }).catch(() => []),
-      ]);
-
-      if (!document || !recipient) {
-        throw new AppError(AppErrorCode.NOT_FOUND, {
-          message: 'Document or recipient not found',
-        });
-      }
-
-      await viewedDocument({
-        token,
-        requestMetadata: metadata.requestMetadata,
-      });
-
-      // Transform fields to match our schema
-      const transformedFields = fields.map((field) => ({
-        ...field,
-        recipient,
-      }));
-
-      return {
-        ...document,
-        folder: null,
-        fields: transformedFields,
-      };
-    } catch (error) {
-      if (error instanceof AppError) {
-        throw error;
-      }
-
-      throw new AppError(AppErrorCode.UNKNOWN_ERROR, {
-        message: 'Failed to get document details',
-      });
-    }
-  });

packages/trpc/server/embedding-router/get-multi-sign-document.types.ts

@@ -1,50 +0,0 @@
-import { z } from 'zod';
-
-import { ZDocumentLiteSchema } from '@documenso/lib/types/document';
-import { ZRecipientLiteSchema } from '@documenso/lib/types/recipient';
-import DocumentDataSchema from '@documenso/prisma/generated/zod/modelSchema/DocumentDataSchema';
-import DocumentMetaSchema from '@documenso/prisma/generated/zod/modelSchema/DocumentMetaSchema';
-import FieldSchema from '@documenso/prisma/generated/zod/modelSchema/FieldSchema';
-import SignatureSchema from '@documenso/prisma/generated/zod/modelSchema/SignatureSchema';
-
-export const ZGetMultiSignDocumentRequestSchema = z.object({
-  token: z.string().min(1, { message: 'Token is required' }),
-});
-
-export const ZGetMultiSignDocumentResponseSchema = ZDocumentLiteSchema.extend({
-  documentData: DocumentDataSchema.pick({
-    type: true,
-    id: true,
-    data: true,
-    initialData: true,
-  }),
-  documentMeta: DocumentMetaSchema.pick({
-    signingOrder: true,
-    distributionMethod: true,
-    id: true,
-    subject: true,
-    message: true,
-    timezone: true,
-    password: true,
-    dateFormat: true,
-    documentId: true,
-    redirectUrl: true,
-    typedSignatureEnabled: true,
-    uploadSignatureEnabled: true,
-    drawSignatureEnabled: true,
-    allowDictateNextSigner: true,
-    language: true,
-    emailSettings: true,
-  }).nullable(),
-  fields: z.array(
-    FieldSchema.extend({
-      recipient: ZRecipientLiteSchema,
-      signature: SignatureSchema.nullable(),
-    }),
-  ),
-});
-
-export type TGetMultiSignDocumentRequestSchema = z.infer<typeof ZGetMultiSignDocumentRequestSchema>;
-export type TGetMultiSignDocumentResponseSchema = z.infer<
-  typeof ZGetMultiSignDocumentResponseSchema
->;

packages/trpc/server/recipient-router/schema.ts

@@ -26,8 +26,8 @@ export const ZCreateRecipientSchema = z.object({
   name: z.string(),
   role: z.nativeEnum(RecipientRole),
   signingOrder: z.number().optional(),
-  accessAuth: z.array(ZRecipientAccessAuthTypesSchema).optional().default([]),
-  actionAuth: z.array(ZRecipientActionAuthTypesSchema).optional().default([]),
+  accessAuth: ZRecipientAccessAuthTypesSchema.optional().nullable(),
+  actionAuth: ZRecipientActionAuthTypesSchema.optional().nullable(),
 });
 
 export const ZUpdateRecipientSchema = z.object({
@@ -36,8 +36,8 @@ export const ZUpdateRecipientSchema = z.object({
   name: z.string().optional(),
   role: z.nativeEnum(RecipientRole).optional(),
   signingOrder: z.number().optional(),
-  accessAuth: z.array(ZRecipientAccessAuthTypesSchema).optional().default([]),
-  actionAuth: z.array(ZRecipientActionAuthTypesSchema).optional().default([]),
+  accessAuth: ZRecipientAccessAuthTypesSchema.optional().nullable(),
+  actionAuth: ZRecipientActionAuthTypesSchema.optional().nullable(),
 });
 
 export const ZCreateDocumentRecipientRequestSchema = z.object({
@@ -106,7 +106,7 @@ export const ZSetDocumentRecipientsRequestSchema = z
         name: z.string(),
         role: z.nativeEnum(RecipientRole),
         signingOrder: z.number().optional(),
-        actionAuth: z.array(ZRecipientActionAuthTypesSchema).optional().default([]),
+        actionAuth: ZRecipientActionAuthTypesSchema.optional().nullable(),
       }),
     ),
   })
@@ -190,7 +190,7 @@ export const ZSetTemplateRecipientsRequestSchema = z
         name: z.string(),
         role: z.nativeEnum(RecipientRole),
         signingOrder: z.number().optional(),
-        actionAuth: z.array(ZRecipientActionAuthTypesSchema).optional().default([]),
+        actionAuth: ZRecipientActionAuthTypesSchema.optional().nullable(),
       }),
     ),
   })

packages/trpc/server/template-router/schema.ts

@@ -133,8 +133,8 @@ export const ZUpdateTemplateRequestSchema = z.object({
       title: z.string().min(1).optional(),
       externalId: z.string().nullish(),
       visibility: z.nativeEnum(DocumentVisibility).optional(),
-      globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema).optional().default([]),
-      globalActionAuth: z.array(ZDocumentActionAuthTypesSchema).optional().default([]),
+      globalAccessAuth: ZDocumentAccessAuthTypesSchema.nullable().optional(),
+      globalActionAuth: ZDocumentActionAuthTypesSchema.nullable().optional(),
       publicTitle: z
         .string()
         .trim()

packages/ui/components/document/document-global-auth-access-select.tsx

@@ -1,75 +1,51 @@
-import React from 'react';
+import { forwardRef } from 'react';
 
 import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
+import type { SelectProps } from '@radix-ui/react-select';
 import { InfoIcon } from 'lucide-react';
 
 import { DOCUMENT_AUTH_TYPES } from '@documenso/lib/constants/document-auth';
 import { DocumentAccessAuth } from '@documenso/lib/types/document-auth';
-import { MultiSelect, type Option } from '@documenso/ui/primitives/multiselect';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@documenso/ui/primitives/select';
 import { Tooltip, TooltipContent, TooltipTrigger } from '@documenso/ui/primitives/tooltip';
 
-export interface DocumentGlobalAuthAccessSelectProps {
-  value?: string[];
-  defaultValue?: string[];
-  onValueChange?: (value: string[]) => void;
-  disabled?: boolean;
-  placeholder?: string;
-}
+export const DocumentGlobalAuthAccessSelect = forwardRef<HTMLButtonElement, SelectProps>(
+  (props, ref) => {
+    const { _ } = useLingui();
 
-export const DocumentGlobalAuthAccessSelect = ({
-  value,
-  defaultValue,
-  onValueChange,
-  disabled,
-  placeholder,
-}: DocumentGlobalAuthAccessSelectProps) => {
-  const { _ } = useLingui();
+    return (
+      <Select {...props}>
+        <SelectTrigger ref={ref} className="bg-background text-muted-foreground">
+          <SelectValue
+            data-testid="documentAccessSelectValue"
+            placeholder={_(msg`No restrictions`)}
+          />
+        </SelectTrigger>
 
-  // Convert auth types to MultiSelect options
-  const authOptions: Option[] = [
-    {
-      value: '-1',
-      label: _(msg`No restrictions`),
-    },
-    ...Object.values(DocumentAccessAuth).map((authType) => ({
-      value: authType,
-      label: DOCUMENT_AUTH_TYPES[authType].value,
-    })),
-  ];
+        <SelectContent position="popper">
+          {/* Note: -1 is remapped in the Zod schema to the required value. */}
+          <SelectItem value={'-1'}>
+            <Trans>No restrictions</Trans>
+          </SelectItem>
 
-  // Convert string array to Option array for MultiSelect
-  const selectedOptions =
-    (value
-      ?.map((val) => authOptions.find((option) => option.value === val))
-      .filter(Boolean) as Option[]) || [];
-
-  // Convert default value to Option array
-  const defaultOptions =
-    (defaultValue
-      ?.map((val) => authOptions.find((option) => option.value === val))
-      .filter(Boolean) as Option[]) || [];
-
-  const handleChange = (options: Option[]) => {
-    const values = options.map((option) => option.value);
-    onValueChange?.(values);
-  };
-
-  return (
-    <MultiSelect
-      value={selectedOptions}
-      defaultOptions={defaultOptions}
-      options={authOptions}
-      onChange={handleChange}
-      disabled={disabled}
-      placeholder={placeholder || _(msg`Select access methods`)}
-      className="bg-background text-muted-foreground"
-      hideClearAllButton={false}
-      data-testid="documentAccessSelectValue"
-    />
-  );
-};
+          {Object.values(DocumentAccessAuth).map((authType) => (
+            <SelectItem key={authType} value={authType}>
+              {DOCUMENT_AUTH_TYPES[authType].value}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    );
+  },
+);
 
 DocumentGlobalAuthAccessSelect.displayName = 'DocumentGlobalAuthAccessSelect';
 
@@ -87,11 +63,7 @@ export const DocumentGlobalAuthAccessTooltip = () => (
       </h2>
 
       <p>
-        <Trans>The authentication methods required for recipients to view the document.</Trans>
-      </p>
-
-      <p className="mt-2">
-        <Trans>Multiple access methods can be selected.</Trans>
+        <Trans>The authentication required for recipients to view the document.</Trans>
       </p>
 
       <ul className="ml-3.5 list-outside list-disc space-y-0.5 py-2">

packages/ui/components/document/document-global-auth-action-select.tsx

@@ -1,75 +1,67 @@
+import { forwardRef } from 'react';
+
 import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
+import type { SelectProps } from '@radix-ui/react-select';
 import { InfoIcon } from 'lucide-react';
 
 import { DOCUMENT_AUTH_TYPES } from '@documenso/lib/constants/document-auth';
-import { DocumentActionAuth, DocumentAuth } from '@documenso/lib/types/document-auth';
-import { MultiSelect, type Option } from '@documenso/ui/primitives/multiselect';
+import {
+  DocumentActionAuth,
+  DocumentAuth,
+  NonEnterpriseDocumentActionAuth,
+} from '@documenso/lib/types/document-auth';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@documenso/ui/primitives/select';
 import { Tooltip, TooltipContent, TooltipTrigger } from '@documenso/ui/primitives/tooltip';
 
-export interface DocumentGlobalAuthActionSelectProps {
-  value?: string[];
-  defaultValue?: string[];
-  onValueChange?: (value: string[]) => void;
-  disabled?: boolean;
-  placeholder?: string;
+interface DocumentGlobalAuthActionSelectProps extends SelectProps {
+  isDocumentEnterprise?: boolean;
 }
 
-export const DocumentGlobalAuthActionSelect = ({
-  value,
-  defaultValue,
-  onValueChange,
-  disabled,
-  placeholder,
-}: DocumentGlobalAuthActionSelectProps) => {
+export const DocumentGlobalAuthActionSelect = forwardRef<
+  HTMLButtonElement,
+  DocumentGlobalAuthActionSelectProps
+>(({ isDocumentEnterprise, ...props }, ref) => {
   const { _ } = useLingui();
 
-  // Convert auth types to MultiSelect options
-  const authOptions: Option[] = [
-    {
-      value: '-1',
-      label: _(msg`No restrictions`),
-    },
-    ...Object.values(DocumentActionAuth)
-      .filter((auth) => auth !== DocumentAuth.ACCOUNT)
-      .map((authType) => ({
-        value: authType,
-        label: DOCUMENT_AUTH_TYPES[authType].value,
-      })),
-  ];
-
-  // Convert string array to Option array for MultiSelect
-  const selectedOptions =
-    (value
-      ?.map((val) => authOptions.find((option) => option.value === val))
-      .filter(Boolean) as Option[]) || [];
-
-  // Convert default value to Option array
-  const defaultOptions =
-    (defaultValue
-      ?.map((val) => authOptions.find((option) => option.value === val))
-      .filter(Boolean) as Option[]) || [];
-
-  const handleChange = (options: Option[]) => {
-    const values = options.map((option) => option.value);
-    onValueChange?.(values);
-  };
+  const authTypes = isDocumentEnterprise
+    ? Object.values(DocumentActionAuth).filter((auth) => auth !== DocumentAuth.ACCOUNT)
+    : Object.values(NonEnterpriseDocumentActionAuth).filter(
+        (auth) => auth !== DocumentAuth.EXPLICIT_NONE,
+      );
 
   return (
-    <MultiSelect
-      value={selectedOptions}
-      defaultOptions={defaultOptions}
-      options={authOptions}
-      onChange={handleChange}
-      disabled={disabled}
-      placeholder={placeholder || _(msg`Select authentication methods`)}
-      className="bg-background text-muted-foreground"
-      hideClearAllButton={false}
-      data-testid="documentActionSelectValue"
-    />
+    <Select {...props}>
+      <SelectTrigger className="bg-background text-muted-foreground">
+        <SelectValue
+          ref={ref}
+          data-testid="documentActionSelectValue"
+          placeholder={_(msg`No restrictions`)}
+        />
+      </SelectTrigger>
+
+      <SelectContent position="popper">
+        {/* Note: -1 is remapped in the Zod schema to the required value. */}
+        <SelectItem value={'-1'}>
+          <Trans>No restrictions</Trans>
+        </SelectItem>
+
+        {authTypes.map((authType) => (
+          <SelectItem key={authType} value={authType}>
+            {DOCUMENT_AUTH_TYPES[authType].value}
+          </SelectItem>
+        ))}
+      </SelectContent>
+    </Select>
   );
-};
+});
 
 DocumentGlobalAuthActionSelect.displayName = 'DocumentGlobalAuthActionSelect';
 
@@ -85,19 +77,20 @@ export const DocumentGlobalAuthActionTooltip = () => (
       </h2>
 
       <p>
-        <Trans>
-          The authentication methods required for recipients to sign the signature field.
-        </Trans>
+        <Trans>The authentication required for recipients to sign the signature field.</Trans>
       </p>
 
       <p>
         <Trans>
-          These can be overriden by setting the authentication requirements directly on each
-          recipient in the next step. Multiple methods can be selected.
+          This can be overriden by setting the authentication requirements directly on each
+          recipient in the next step.
         </Trans>
       </p>
 
       <ul className="ml-3.5 list-outside list-disc space-y-0.5 py-2">
+        {/* <li>
+          <strong>Require account</strong> - The recipient must be signed in
+        </li> */}
         <li>
           <Trans>
             <strong>Require passkey</strong> - The recipient must have an account and passkey
@@ -110,14 +103,6 @@ export const DocumentGlobalAuthActionTooltip = () => (
             their settings
           </Trans>
         </li>
-
-        <li>
-          <Trans>
-            <strong>Require password</strong> - The recipient must have an account and password
-            configured via their settings, the password will be verified during signing
-          </Trans>
-        </li>
-
         <li>
           <Trans>
             <strong>No restrictions</strong> - No authentication required

packages/ui/components/field/field.tsx

@@ -1,4 +1,4 @@
-import React, { useEffect, useMemo, useState } from 'react';
+import React, { useEffect, useState } from 'react';
 
 import { type Field, FieldType } from '@prisma/client';
 import { createPortal } from 'react-dom';
@@ -20,37 +20,24 @@ export function FieldContainerPortal({
   children,
   className = '',
 }: FieldContainerPortalProps) {
-  const alternativePortalRoot = document.getElementById('document-field-portal-root');
-
   const coords = useFieldPageCoords(field);
 
   const isCheckboxOrRadioField = field.type === 'CHECKBOX' || field.type === 'RADIO';
 
-  const style = useMemo(() => {
-    const portalBounds = alternativePortalRoot?.getBoundingClientRect();
-
-    const bounds = {
-      top: `${coords.y}px`,
-      left: `${coords.x}px`,
-      ...(!isCheckboxOrRadioField && {
-        height: `${coords.height}px`,
-        width: `${coords.width}px`,
-      }),
-    };
-
-    if (portalBounds) {
-      bounds.top = `${coords.y - portalBounds.top}px`;
-      bounds.left = `${coords.x - portalBounds.left}px`;
-    }
-
-    return bounds;
-  }, [coords, isCheckboxOrRadioField]);
+  const style = {
+    top: `${coords.y}px`,
+    left: `${coords.x}px`,
+    ...(!isCheckboxOrRadioField && {
+      height: `${coords.height}px`,
+      width: `${coords.width}px`,
+    }),
+  };
 
   return createPortal(
     <div className={cn('absolute', className)} style={style}>
       {children}
     </div>,
-    alternativePortalRoot ?? document.body,
+    document.body,
   );
 }
 

packages/ui/components/recipient/recipient-action-auth-select.tsx

@@ -3,124 +3,97 @@ import React from 'react';
 import { msg } from '@lingui/core/macro';
 import { useLingui } from '@lingui/react';
 import { Trans } from '@lingui/react/macro';
+import type { SelectProps } from '@radix-ui/react-select';
 import { InfoIcon } from 'lucide-react';
 
 import { DOCUMENT_AUTH_TYPES } from '@documenso/lib/constants/document-auth';
 import { RecipientActionAuth } from '@documenso/lib/types/document-auth';
-import { MultiSelect, type Option } from '@documenso/ui/primitives/multiselect';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@documenso/ui/primitives/select';
 import { Tooltip, TooltipContent, TooltipTrigger } from '@documenso/ui/primitives/tooltip';
 
-export interface RecipientActionAuthSelectProps {
-  value?: string[];
-  defaultValue?: string[];
-  onValueChange?: (value: string[]) => void;
-  disabled?: boolean;
-  placeholder?: string;
-}
+export type RecipientActionAuthSelectProps = SelectProps;
 
-export const RecipientActionAuthSelect = ({
-  value,
-  defaultValue,
-  onValueChange,
-  disabled,
-  placeholder,
-}: RecipientActionAuthSelectProps) => {
+export const RecipientActionAuthSelect = (props: RecipientActionAuthSelectProps) => {
   const { _ } = useLingui();
 
-  // Convert auth types to MultiSelect options
-  const authOptions: Option[] = [
-    {
-      value: '-1',
-      label: _(msg`Inherit authentication method`),
-    },
-    ...Object.values(RecipientActionAuth)
-      .filter((auth) => auth !== RecipientActionAuth.ACCOUNT)
-      .map((authType) => ({
-        value: authType,
-        label: DOCUMENT_AUTH_TYPES[authType].value,
-      })),
-  ];
-
-  // Convert string array to Option array for MultiSelect
-  const selectedOptions =
-    (value
-      ?.map((val) => authOptions.find((option) => option.value === val))
-      .filter(Boolean) as Option[]) || [];
-
-  // Convert default value to Option array
-  const defaultOptions =
-    (defaultValue
-      ?.map((val) => authOptions.find((option) => option.value === val))
-      .filter(Boolean) as Option[]) || [];
-
-  const handleChange = (options: Option[]) => {
-    const values = options.map((option) => option.value);
-    onValueChange?.(values);
-  };
-
   return (
-    <div className="relative">
-      <MultiSelect
-        value={selectedOptions}
-        defaultOptions={defaultOptions}
-        options={authOptions}
-        onChange={handleChange}
-        disabled={disabled}
-        placeholder={placeholder || _(msg`Select authentication methods`)}
-        className="bg-background text-muted-foreground"
-        maxSelected={4} // Allow selecting up to 4 auth methods
-        hideClearAllButton={false}
-      />
+    <Select {...props}>
+      <SelectTrigger className="bg-background text-muted-foreground">
+        <SelectValue placeholder={_(msg`Inherit authentication method`)} />
 
-      <Tooltip>
-        <TooltipTrigger className="absolute right-2 top-1/2 -translate-y-1/2">
-          <InfoIcon className="h-4 w-4" />
-        </TooltipTrigger>
+        <Tooltip>
+          <TooltipTrigger className="-mr-1 ml-auto">
+            <InfoIcon className="mx-2 h-4 w-4" />
+          </TooltipTrigger>
 
-        <TooltipContent className="text-foreground max-w-md p-4">
-          <h2>
-            <strong>
-              <Trans>Recipient action authentication</Trans>
-            </strong>
-          </h2>
+          <TooltipContent className="text-foreground max-w-md p-4">
+            <h2>
+              <strong>
+                <Trans>Recipient action authentication</Trans>
+              </strong>
+            </h2>
 
-          <p>
-            <Trans>The authentication methods required for recipients to sign fields</Trans>
-          </p>
+            <p>
+              <Trans>The authentication required for recipients to sign fields</Trans>
+            </p>
 
-          <p className="mt-2">
-            <Trans>
-              These will override any global settings. Multiple methods can be selected.
-            </Trans>
-          </p>
+            <p className="mt-2">
+              <Trans>This will override any global settings.</Trans>
+            </p>
 
-          <ul className="ml-3.5 list-outside list-disc space-y-0.5 py-2">
-            <li>
-              <Trans>
-                <strong>Inherit authentication method</strong> - Use the global action signing
-                authentication method configured in the "General Settings" step
-              </Trans>
-            </li>
-            <li>
-              <Trans>
-                <strong>Require passkey</strong> - The recipient must have an account and passkey
-                configured via their settings
-              </Trans>
-            </li>
-            <li>
-              <Trans>
-                <strong>Require 2FA</strong> - The recipient must have an account and 2FA enabled
-                via their settings
-              </Trans>
-            </li>
-            <li>
-              <Trans>
-                <strong>None</strong> - No authentication required
-              </Trans>
-            </li>
-          </ul>
-        </TooltipContent>
-      </Tooltip>
-    </div>
+            <ul className="ml-3.5 list-outside list-disc space-y-0.5 py-2">
+              <li>
+                <Trans>
+                  <strong>Inherit authentication method</strong> - Use the global action signing
+                  authentication method configured in the "General Settings" step
+                </Trans>
+              </li>
+              {/* <li>
+                <strong>Require account</strong> - The recipient must be
+                signed in
+              </li> */}
+              <li>
+                <Trans>
+                  <strong>Require passkey</strong> - The recipient must have an account and passkey
+                  configured via their settings
+                </Trans>
+              </li>
+              <li>
+                <Trans>
+                  <strong>Require 2FA</strong> - The recipient must have an account and 2FA enabled
+                  via their settings
+                </Trans>
+              </li>
+              <li>
+                <Trans>
+                  <strong>None</strong> - No authentication required
+                </Trans>
+              </li>
+            </ul>
+          </TooltipContent>
+        </Tooltip>
+      </SelectTrigger>
+
+      <SelectContent position="popper">
+        {/* Note: -1 is remapped in the Zod schema to the required value. */}
+        <SelectItem value="-1">
+          <Trans>Inherit authentication method</Trans>
+        </SelectItem>
+
+        {Object.values(RecipientActionAuth)
+          .filter((auth) => auth !== RecipientActionAuth.ACCOUNT)
+          .map((authType) => (
+            <SelectItem key={authType} value={authType}>
+              {DOCUMENT_AUTH_TYPES[authType].value}
+            </SelectItem>
+          ))}
+      </SelectContent>
+    </Select>
   );
 };

packages/ui/primitives/alert.tsx

@@ -58,7 +58,7 @@ const AlertDescription = React.forwardRef<
   HTMLParagraphElement,
   React.HTMLAttributes<HTMLParagraphElement>
 >(({ className, ...props }, ref) => (
-  <div ref={ref} className={cn('mt-2 text-sm', className)} {...props} />
+  <div ref={ref} className={cn('text-sm', className)} {...props} />
 ));
 
 AlertDescription.displayName = 'AlertDescription';

packages/ui/primitives/document-flow/add-settings.tsx

@@ -1,10 +1,15 @@
 import { useEffect } from 'react';
 
 import { zodResolver } from '@hookform/resolvers/zod';
-import { Trans } from '@lingui/react/macro';
-import { useLingui } from '@lingui/react/macro';
-import { DocumentVisibility, TeamMemberRole } from '@prisma/client';
-import { DocumentStatus, type Field, type Recipient, SendStatus } from '@prisma/client';
+import { Trans, useLingui } from '@lingui/react/macro';
+import {
+  DocumentStatus,
+  DocumentVisibility,
+  type Field,
+  type Recipient,
+  SendStatus,
+  TeamMemberRole,
+} from '@prisma/client';
 import { InfoIcon } from 'lucide-react';
 import { useForm } from 'react-hook-form';
 import { match } from 'ts-pattern';
@@ -98,8 +103,8 @@ export const AddSettingsFormPartial = ({
       title: document.title,
       externalId: document.externalId || '',
       visibility: document.visibility || '',
-      globalAccessAuth: documentAuthOption?.globalAccessAuth || [],
-      globalActionAuth: documentAuthOption?.globalActionAuth || [],
+      globalAccessAuth: documentAuthOption?.globalAccessAuth || undefined,
+      globalActionAuth: documentAuthOption?.globalActionAuth || undefined,
 
       meta: {
         timezone:
@@ -131,12 +136,6 @@ export const AddSettingsFormPartial = ({
     )
     .otherwise(() => false);
 
-  const onFormSubmit = form.handleSubmit(onSubmit);
-
-  const onGoNextClick = () => {
-    void onFormSubmit().catch(console.error);
-  };
-
   // We almost always want to set the timezone to the user's local timezone to avoid confusion
   // when the document is signed.
   useEffect(() => {
@@ -220,11 +219,7 @@ export const AddSettingsFormPartial = ({
                   </FormLabel>
 
                   <FormControl>
-                    <Select
-                      value={field.value}
-                      disabled={field.disabled}
-                      onValueChange={field.onChange}
-                    >
+                    <Select {...field} onValueChange={field.onChange}>
                       <SelectTrigger className="bg-background">
                         <SelectValue />
                       </SelectTrigger>
@@ -254,11 +249,7 @@ export const AddSettingsFormPartial = ({
                   </FormLabel>
 
                   <FormControl>
-                    <DocumentGlobalAuthAccessSelect
-                      value={field.value}
-                      disabled={field.disabled}
-                      onValueChange={field.onChange}
-                    />
+                    <DocumentGlobalAuthAccessSelect {...field} onValueChange={field.onChange} />
                   </FormControl>
                 </FormItem>
               )}
@@ -288,28 +279,22 @@ export const AddSettingsFormPartial = ({
               />
             )}
 
-            {isDocumentEnterprise && (
-              <FormField
-                control={form.control}
-                name="globalActionAuth"
-                render={({ field }) => (
-                  <FormItem>
-                    <FormLabel className="flex flex-row items-center">
-                      <Trans>Recipient action authentication</Trans>
-                      <DocumentGlobalAuthActionTooltip />
-                    </FormLabel>
+            <FormField
+              control={form.control}
+              name="globalActionAuth"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel className="flex flex-row items-center">
+                    <Trans>Recipient action authentication</Trans>
+                    <DocumentGlobalAuthActionTooltip />
+                  </FormLabel>
 
-                    <FormControl>
-                      <DocumentGlobalAuthActionSelect
-                        value={field.value}
-                        disabled={field.disabled}
-                        onValueChange={field.onChange}
-                      />
-                    </FormControl>
-                  </FormItem>
-                )}
-              />
-            )}
+                  <FormControl>
+                    <DocumentGlobalAuthActionSelect {...field} onValueChange={field.onChange} />
+                  </FormControl>
+                </FormItem>
+              )}
+            />
 
             <Accordion type="multiple" className="mt-6">
               <AccordionItem value="advanced-options" className="border-none">
@@ -388,7 +373,7 @@ export const AddSettingsFormPartial = ({
 
                           <FormControl>
                             <Select
-                              value={field.value}
+                              {...field}
                               onValueChange={field.onChange}
                               disabled={documentHasBeenSent}
                             >
@@ -424,7 +409,7 @@ export const AddSettingsFormPartial = ({
                             <Combobox
                               className="bg-background"
                               options={TIME_ZONES}
-                              value={field.value}
+                              {...field}
                               onChange={(value) => value && field.onChange(value)}
                               disabled={documentHasBeenSent}
                             />
@@ -479,7 +464,7 @@ export const AddSettingsFormPartial = ({
           disabled={form.formState.isSubmitting}
           canGoBack={stepIndex !== 0}
           onGoBackClick={previousStep}
-          onGoNextClick={onGoNextClick}
+          onGoNextClick={form.handleSubmit(onSubmit)}
         />
       </DocumentFlowFormContainerFooter>
     </>

packages/ui/primitives/document-flow/add-settings.types.ts

@@ -16,6 +16,17 @@ import {
   ZDocumentMetaTimezoneSchema,
 } from '@documenso/trpc/server/document-router/schema';
 
+export const ZMapNegativeOneToUndefinedSchema = z
+  .string()
+  .optional()
+  .transform((val) => {
+    if (val === '-1') {
+      return undefined;
+    }
+
+    return val;
+  });
+
 export const ZAddSettingsFormSchema = z.object({
   title: z
     .string()
@@ -23,8 +34,12 @@ export const ZAddSettingsFormSchema = z.object({
     .min(1, { message: msg`Title cannot be empty`.id }),
   externalId: z.string().optional(),
   visibility: z.nativeEnum(DocumentVisibility).optional(),
-  globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema),
-  globalActionAuth: z.array(ZDocumentActionAuthTypesSchema),
+  globalAccessAuth: ZMapNegativeOneToUndefinedSchema.pipe(
+    ZDocumentAccessAuthTypesSchema.optional(),
+  ),
+  globalActionAuth: ZMapNegativeOneToUndefinedSchema.pipe(
+    ZDocumentActionAuthTypesSchema.optional(),
+  ),
   meta: z.object({
     timezone: ZDocumentMetaTimezoneSchema.optional().default(DEFAULT_DOCUMENT_TIME_ZONE),
     dateFormat: ZDocumentMetaDateFormatSchema.optional().default(DEFAULT_DOCUMENT_DATE_FORMAT),

packages/ui/primitives/document-flow/add-signers.tsx

@@ -85,7 +85,7 @@ export const AddSignersFormPartial = ({
       email: '',
       role: RecipientRole.SIGNER,
       signingOrder: 1,
-      actionAuth: [],
+      actionAuth: undefined,
     },
   ];
 
@@ -119,14 +119,10 @@ export const AddSignersFormPartial = ({
     const recipientHasAuthOptions = recipients.find((recipient) => {
       const recipientAuthOptions = ZRecipientAuthOptionsSchema.parse(recipient.authOptions);
 
-      return (
-        recipientAuthOptions.accessAuth.length > 0 || recipientAuthOptions.actionAuth.length > 0
-      );
+      return recipientAuthOptions?.accessAuth || recipientAuthOptions?.actionAuth;
     });
 
-    const formHasActionAuth = form
-      .getValues('signers')
-      .find((signer) => signer.actionAuth.length > 0);
+    const formHasActionAuth = form.getValues('signers').find((signer) => signer.actionAuth);
 
     return recipientHasAuthOptions !== undefined || formHasActionAuth !== undefined;
   }, [recipients, form]);
@@ -194,7 +190,7 @@ export const AddSignersFormPartial = ({
       name: '',
       email: '',
       role: RecipientRole.SIGNER,
-      actionAuth: [],
+      actionAuth: undefined,
       signingOrder: signers.length > 0 ? (signers[signers.length - 1]?.signingOrder ?? 0) + 1 : 1,
     });
   };
@@ -230,7 +226,7 @@ export const AddSignersFormPartial = ({
         name: user?.name ?? '',
         email: user?.email ?? '',
         role: RecipientRole.SIGNER,
-        actionAuth: [],
+        actionAuth: undefined,
         signingOrder: signers.length > 0 ? (signers[signers.length - 1]?.signingOrder ?? 0) + 1 : 1,
       });
     }

packages/ui/primitives/document-flow/add-signers.types.ts

@@ -4,6 +4,8 @@ import { z } from 'zod';
 
 import { ZRecipientActionAuthTypesSchema } from '@documenso/lib/types/document-auth';
 
+import { ZMapNegativeOneToUndefinedSchema } from './add-settings.types';
+
 export const ZAddSignersFormSchema = z
   .object({
     signers: z.array(
@@ -17,7 +19,9 @@ export const ZAddSignersFormSchema = z
         name: z.string(),
         role: z.nativeEnum(RecipientRole),
         signingOrder: z.number().optional(),
-        actionAuth: z.array(ZRecipientActionAuthTypesSchema).optional().default([]),
+        actionAuth: ZMapNegativeOneToUndefinedSchema.pipe(
+          ZRecipientActionAuthTypesSchema.optional(),
+        ),
       }),
     ),
     signingOrder: z.nativeEnum(DocumentSigningOrder),

packages/ui/primitives/multiselect.tsx

@@ -78,8 +78,6 @@ interface MultiSelectProps {
   >;
   /** hide the clear all button. */
   hideClearAllButton?: boolean;
-  /** test id for the select value. */
-  'data-testid'?: string;
 }
 
 export interface MultiSelectRef {
@@ -172,7 +170,6 @@ const MultiSelect = ({
   commandProps,
   inputProps,
   hideClearAllButton = false,
-  'data-testid': dataTestId,
 }: MultiSelectProps) => {
   const inputRef = React.useRef<HTMLInputElement>(null);
   const [open, setOpen] = React.useState(false);
@@ -406,7 +403,6 @@ const MultiSelect = ({
         commandProps?.shouldFilter !== undefined ? commandProps.shouldFilter : !onSearch
       } // When onSearch is provided, we don&lsquo;t want to filter the options. You can still override it.
       filter={commandFilter()}
-      data-testid={dataTestId}
     >
       <div
         className={cn(

packages/ui/primitives/template-flow/add-template-placeholder-recipients.tsx

@@ -86,7 +86,7 @@ export const AddTemplatePlaceholderRecipientsFormPartial = ({
         {
           formId: initialId,
           role: RecipientRole.SIGNER,
-          actionAuth: [],
+          actionAuth: undefined,
           ...generateRecipientPlaceholder(1),
           signingOrder: 1,
         },
@@ -136,14 +136,10 @@ export const AddTemplatePlaceholderRecipientsFormPartial = ({
     const recipientHasAuthOptions = recipients.find((recipient) => {
       const recipientAuthOptions = ZRecipientAuthOptionsSchema.parse(recipient.authOptions);
 
-      return (
-        recipientAuthOptions.accessAuth.length > 0 || recipientAuthOptions.actionAuth.length > 0
-      );
+      return recipientAuthOptions?.accessAuth || recipientAuthOptions?.actionAuth;
     });
 
-    const formHasActionAuth = form
-      .getValues('signers')
-      .find((signer) => signer.actionAuth.length > 0);
+    const formHasActionAuth = form.getValues('signers').find((signer) => signer.actionAuth);
 
     return recipientHasAuthOptions !== undefined || formHasActionAuth !== undefined;
   }, [recipients, form]);
@@ -183,7 +179,6 @@ export const AddTemplatePlaceholderRecipientsFormPartial = ({
       email: user.email ?? '',
       role: RecipientRole.SIGNER,
       signingOrder: signers.length > 0 ? (signers[signers.length - 1]?.signingOrder ?? 0) + 1 : 1,
-      actionAuth: [],
     });
   };
 
@@ -193,7 +188,6 @@ export const AddTemplatePlaceholderRecipientsFormPartial = ({
       role: RecipientRole.SIGNER,
       ...generateRecipientPlaceholder(placeholderRecipientCount),
       signingOrder: signers.length > 0 ? (signers[signers.length - 1]?.signingOrder ?? 0) + 1 : 1,
-      actionAuth: [],
     });
 
     setPlaceholderRecipientCount((count) => count + 1);

packages/ui/primitives/template-flow/add-template-placeholder-recipients.types.ts

@@ -3,6 +3,8 @@ import { z } from 'zod';
 
 import { ZRecipientActionAuthTypesSchema } from '@documenso/lib/types/document-auth';
 
+import { ZMapNegativeOneToUndefinedSchema } from '../document-flow/add-settings.types';
+
 export const ZAddTemplatePlacholderRecipientsFormSchema = z
   .object({
     signers: z.array(
@@ -13,7 +15,9 @@ export const ZAddTemplatePlacholderRecipientsFormSchema = z
         name: z.string(),
         role: z.nativeEnum(RecipientRole),
         signingOrder: z.number().optional(),
-        actionAuth: z.array(ZRecipientActionAuthTypesSchema).optional().default([]),
+        actionAuth: ZMapNegativeOneToUndefinedSchema.pipe(
+          ZRecipientActionAuthTypesSchema.optional(),
+        ),
       }),
     ),
     signingOrder: z.nativeEnum(DocumentSigningOrder),

packages/ui/primitives/template-flow/add-template-settings.tsx

@@ -1,10 +1,14 @@
 import { useEffect } from 'react';
 
 import { zodResolver } from '@hookform/resolvers/zod';
-import { useLingui } from '@lingui/react/macro';
-import { Trans } from '@lingui/react/macro';
-import { DocumentVisibility, TeamMemberRole } from '@prisma/client';
-import { DocumentDistributionMethod, type Field, type Recipient } from '@prisma/client';
+import { Trans, useLingui } from '@lingui/react/macro';
+import {
+  DocumentDistributionMethod,
+  DocumentVisibility,
+  type Field,
+  type Recipient,
+  TeamMemberRole,
+} from '@prisma/client';
 import { InfoIcon } from 'lucide-react';
 import { useForm } from 'react-hook-form';
 import { match } from 'ts-pattern';
@@ -106,8 +110,8 @@ export const AddTemplateSettingsFormPartial = ({
       title: template.title,
       externalId: template.externalId || undefined,
       visibility: template.visibility || '',
-      globalAccessAuth: documentAuthOption?.globalAccessAuth || [],
-      globalActionAuth: documentAuthOption?.globalActionAuth || [],
+      globalAccessAuth: documentAuthOption?.globalAccessAuth || undefined,
+      globalActionAuth: documentAuthOption?.globalActionAuth || undefined,
       meta: {
         subject: template.templateMeta?.subject ?? '',
         message: template.templateMeta?.message ?? '',
@@ -237,11 +241,7 @@ export const AddTemplateSettingsFormPartial = ({
                   </FormLabel>
 
                   <FormControl>
-                    <DocumentGlobalAuthAccessSelect
-                      value={field.value}
-                      disabled={field.disabled}
-                      onValueChange={field.onChange}
-                    />
+                    <DocumentGlobalAuthAccessSelect {...field} onValueChange={field.onChange} />
                   </FormControl>
                 </FormItem>
               )}
@@ -370,28 +370,26 @@ export const AddTemplateSettingsFormPartial = ({
               )}
             />
 
-            {isEnterprise && (
-              <FormField
-                control={form.control}
-                name="globalActionAuth"
-                render={({ field }) => (
-                  <FormItem>
-                    <FormLabel className="flex flex-row items-center">
-                      <Trans>Recipient action authentication</Trans>
-                      <DocumentGlobalAuthActionTooltip />
-                    </FormLabel>
+            <FormField
+              control={form.control}
+              name="globalActionAuth"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel className="flex flex-row items-center">
+                    <Trans>Recipient action authentication</Trans>
+                    <DocumentGlobalAuthActionTooltip />
+                  </FormLabel>
 
-                    <FormControl>
-                      <DocumentGlobalAuthActionSelect
-                        value={field.value}
-                        disabled={field.disabled}
-                        onValueChange={field.onChange}
-                      />
-                    </FormControl>
-                  </FormItem>
-                )}
-              />
-            )}
+                  <FormControl>
+                    <DocumentGlobalAuthActionSelect
+                      {...field}
+                      onValueChange={field.onChange}
+                      isDocumentEnterprise={isEnterprise}
+                    />
+                  </FormControl>
+                </FormItem>
+              )}
+            />
 
             {distributionMethod === DocumentDistributionMethod.EMAIL && (
               <Accordion type="multiple">

packages/ui/primitives/template-flow/add-template-settings.types.tsx

@@ -18,12 +18,18 @@ import {
   ZDocumentMetaTimezoneSchema,
 } from '@documenso/trpc/server/document-router/schema';
 
+import { ZMapNegativeOneToUndefinedSchema } from '../document-flow/add-settings.types';
+
 export const ZAddTemplateSettingsFormSchema = z.object({
   title: z.string().trim().min(1, { message: "Title can't be empty" }),
   externalId: z.string().optional(),
   visibility: z.nativeEnum(DocumentVisibility).optional(),
-  globalAccessAuth: z.array(ZDocumentAccessAuthTypesSchema).optional().default([]),
-  globalActionAuth: z.array(ZDocumentActionAuthTypesSchema).optional().default([]),
+  globalAccessAuth: ZMapNegativeOneToUndefinedSchema.pipe(
+    ZDocumentAccessAuthTypesSchema.optional(),
+  ),
+  globalActionAuth: ZMapNegativeOneToUndefinedSchema.pipe(
+    ZDocumentActionAuthTypesSchema.optional(),
+  ),
   meta: z.object({
     subject: z.string(),
     message: z.string(),