@teamscala/service-boot 0.23.466 → 0.23.468

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.466",
+  "version": "0.23.468",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/public-agreement-router.ts

@@ -11,9 +11,19 @@
  * Off-the-shelf path (building-applications): typed ORPC procedure, not a
  * hand-written Hono handler; writes go through context.prisma inside the
  * handler (orpc-is-the-only-api) so the audit trigger sees the ORPC caller.
- * Multi-party model: signature_data holds a parties roster (JSON); each party
- * is gated by its own email and the agreement completes only when every party
- * has signed; single-signer falls back to signer_email/signer_name.
+ * ONE signing model, the DocuSign recipients shape: signature_data holds a
+ * parties roster (JSON), each party is gated by its own email, and the
+ * agreement completes only when every party has signed. A single signer is a
+ * roster of one -- there is no separate single-signer path.
+ *
+ * A legacy signer_email/signer_name fallback used to sit alongside this and was
+ * deleted 2026-09-03: measured across every agreement on the platform, 13 of 14
+ * carried a roster and ZERO used the fallback (the 14th was an unsent draft with
+ * no signature_data at all). It was never exercised, and it was not inert -- its
+ * write put a BARE STRING into signature_data, which would have destroyed the
+ * roster of any agreement that reached it. Keeping it also meant every change to
+ * this handler had to be made twice: the Prisma 8 timestamptz fix that made
+ * signing work at all had to be applied to both branches of one function.
  *
  * This module holds the three procedures (verify/sign/verifyDocument); the
  * supporting machinery lives as siblings (agreement-signing-evidence,
@@ -114,19 +124,9 @@ export const publicAgreementRouter = {
 			};
 		}
 
-		// Legacy single-signer path.
-		const matched =
-			String(agreement.signer_email ?? "")
-				.trim()
-				.toLowerCase() === email;
-		if (!matched) return { matched: false as const };
-		return {
-			matched: true,
-			name: agreement.name,
-			signerName: agreement.signer_name,
-			signedAt: agreement.signed_at,
-			accessToken: signAgreementAccessToken(agreementId, email, Date.now()),
-		};
+		// No roster means the agreement was never prepared for signing. It is
+		// not viewable, and it is certainly not signable.
+		return { matched: false as const };
 	}),
 
 	// Commit the authed party's signature. Returns { ok, parties } so the block
@@ -156,7 +156,29 @@ export const publicAgreementRouter = {
 		});
 		if (!agreement) return { ok: false as const, error: "Agreement not found" };
 
+		// TWO representations, deliberately, because they have two consumers.
+		//
+		// `now` is an ISO STRING and belongs in the parties roster, which is
+		// serialised to JSON in signature_data — a Temporal.Instant would
+		// stringify into that JSON as an object.
+		//
+		// `nowInstant` is what the timestamptz COLUMNS take. Under Prisma 8 the
+		// timestamptz codec ('pg/timestamptz-temporal@1') accepts a
+		// Temporal.Instant and NOTHING ELSE. Measured against the live service:
+		// a string gives "received a string", a Date gives "received a Date",
+		// and only Temporal.Instant writes. Passing `now` therefore threw on
+		// EVERY signature, and the handler's catch reported the generic "Could
+		// not submit your signature." -- so signing was impossible for every
+		// signer with nothing naming the cause.
+		//
+		// The cast is load-bearing and is NOT laziness: the generated Prisma
+		// types declare these fields `string | Date` and reject Instant, so the
+		// client's TYPES and its RUNTIME CODEC disagree. Following the types
+		// produces code that compiles and always throws, which is exactly how
+		// this shipped. The runtime is the authority here; the generated types
+		// are the defect, and they are the thing to fix upstream.
 		const now = new Date().toISOString();
+		const nowInstant = Temporal.Now.instant() as unknown as Date;
 
 		try {
 			// Multi-party path: signature_data holds a parties roster.
@@ -229,10 +251,10 @@ export const publicAgreementRouter = {
 					signature_data: JSON.stringify(
 						evidence ? { parties, evidence } : { parties },
 					),
-					viewed_at: now,
+					viewed_at: nowInstant,
 				};
 				if (executed) {
-					data.signed_at = now;
+					data.signed_at = nowInstant;
 					data.signed_by = agreement.contact_id ?? null;
 				}
 				const updated = await context.prisma.agreements.update({
@@ -287,47 +309,11 @@ export const publicAgreementRouter = {
 				return result;
 			}
 
-			// Legacy single-signer path.
-			const signerEmail = String(agreement.signer_email ?? "")
-				.trim()
-				.toLowerCase();
-			if (!signerEmail || signerEmail !== email) {
-				return {
-					ok: false as const,
-					error: "This email does not match the agreement's signer.",
-				};
-			}
-			if (agreement.signed_at) {
-				return {
-					ok: true as const,
-					alreadySigned: true,
-					signedAt: agreement.signed_at,
-					signerName: agreement.signer_name,
-				};
-			}
-			const updated = await context.prisma.agreements.update({
-				where: { id: agreementId },
-				data: {
-					signature_data: input.signatureData ?? agreement.signer_name ?? "",
-					signed_at: now,
-					viewed_at: now,
-					signed_by: agreement.contact_id ?? null,
-					...(input.signerName ? { signer_name: input.signerName } : {}),
-				},
-			});
-			// Every captured identity → CRM: connect this signer to client_database.
-			await connectSignerToCrm(
-				context.prisma,
-				agreement,
-				email,
-				input.signerName ?? agreement.signer_name,
-				input.company,
-			);
+			// An agreement with no roster was never prepared for signing.
+			// Refuse rather than invent a signer.
 			return {
-				ok: true as const,
-				signedAt: updated.signed_at,
-				signerName: updated.signer_name,
-				payUrl: await invoicePayUrl(agreementId, originFrom(context.headers)),
+				ok: false as const,
+				error: "This agreement has no signers recorded and cannot be signed.",
 			};
 		} catch (err) {
 			log.error(

package/src/register-registry-page-route/apply-page-branding.test.ts

@@ -0,0 +1,118 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * applySessionOrgBranding must never repaint a TENANT document in the
+ * VIEWER's brand.
+ *
+ * A public document belongs to the org that PUBLISHED it and must look
+ * identical to every reader. Personalising to the reader's org is right for a
+ * portal (you are looking at your own workspace) and wrong for a document.
+ *
+ * The regression this locks: sign.scala.business's website is owned by the
+ * PLATFORM org, so the website-level test passed and the session override
+ * fired on agreements owned by tenants. Every signed-in staff viewer saw a
+ * GMG APAC agreement in their own org's brand while an anonymous client saw
+ * it correctly — so the only people who could not see what the client sees
+ * were the people reviewing it before sending.
+ */
+
+import { describe, expect, mock, test } from "bun:test";
+
+const PLATFORM_ORG = "c503629a-85d9-4d25-9431-f6fa59504868";
+const TENANT_ORG = "5b742740-0f37-494c-a059-d8399ae4b350";
+const VIEWER_ORG = PLATFORM_ORG;
+
+mock.module("@teamscala/db/registry/platform", () => ({
+	getPlatformOrgId: () => PLATFORM_ORG,
+}));
+
+// The override's only way to change anything is to fetch the viewer org's
+// branding. If it is never called, no personalisation happened.
+const fetchBranding = mock(async () => ({
+	company_name: "Viewer Org",
+	company_friendly_name: "Viewer Org",
+	brand_primary_color: "#000080",
+	brand_heading_font: null,
+	brand_body_font: null,
+	company_logo_for_light_theme: "/viewer-light.png",
+	company_logo_for_dark_theme: "/viewer-dark.png",
+}));
+mock.module("@teamscala/db/fetch-organisation-page-branding", () => ({
+	fetchOrganisationPageBranding: fetchBranding,
+}));
+mock.module("../page-server-orpc/server-client.ts", () => ({
+	getServerClient: () => ({}),
+}));
+
+const { applySessionOrgBranding } = await import("./apply-page-branding.ts");
+
+function pageOwnedBy(pageOrgId: string, websiteOrgId: string) {
+	return {
+		orgId: pageOrgId,
+		website: { organisation_id: websiteOrgId },
+		brand: { companyName: "Publisher", primaryColor: "#FF4500" },
+	} as Record<string, unknown>;
+}
+
+describe("applySessionOrgBranding — a document is never repainted for its reader", () => {
+	test("a TENANT document on a PLATFORM-owned website keeps the publisher's brand", async () => {
+		fetchBranding.mockClear();
+		// Exactly the sign.scala.business shape: the website is the platform's,
+		// the agreement belongs to the tenant, the viewer is platform staff.
+		const pageData = pageOwnedBy(TENANT_ORG, PLATFORM_ORG);
+
+		await applySessionOrgBranding(pageData, undefined, VIEWER_ORG);
+
+		expect(fetchBranding).not.toHaveBeenCalled();
+		expect(pageData.orgId).toBe(TENANT_ORG);
+		expect((pageData.brand as { primaryColor: string }).primaryColor).toBe(
+			"#FF4500",
+		);
+	});
+
+	test("a TENANT-owned website is untouched too", async () => {
+		fetchBranding.mockClear();
+		const pageData = pageOwnedBy(TENANT_ORG, TENANT_ORG);
+
+		await applySessionOrgBranding(pageData, undefined, VIEWER_ORG);
+
+		expect(fetchBranding).not.toHaveBeenCalled();
+		expect(pageData.orgId).toBe(TENANT_ORG);
+	});
+
+	test("an anonymous reader is never personalised", async () => {
+		fetchBranding.mockClear();
+		const pageData = pageOwnedBy(TENANT_ORG, PLATFORM_ORG);
+
+		await applySessionOrgBranding(pageData, undefined, undefined);
+
+		expect(fetchBranding).not.toHaveBeenCalled();
+		expect(pageData.orgId).toBe(TENANT_ORG);
+	});
+
+	test("a public render mode is never personalised", async () => {
+		fetchBranding.mockClear();
+		const pageData = pageOwnedBy(TENANT_ORG, PLATFORM_ORG);
+
+		await applySessionOrgBranding(pageData, "public", VIEWER_ORG);
+
+		expect(fetchBranding).not.toHaveBeenCalled();
+	});
+
+	test("a genuine PLATFORM page still personalises to the viewer's org", async () => {
+		// The behaviour the override exists for: a shared platform portal page,
+		// viewed by a member of another org, shows that member their own brand.
+		fetchBranding.mockClear();
+		const pageData = pageOwnedBy(PLATFORM_ORG, PLATFORM_ORG);
+
+		await applySessionOrgBranding(pageData, undefined, TENANT_ORG);
+
+		expect(fetchBranding).toHaveBeenCalledTimes(1);
+		expect(pageData.orgId).toBe(TENANT_ORG);
+		expect((pageData.brand as { companyName: string }).companyName).toBe(
+			"Viewer Org",
+		);
+	});
+});

package/src/register-registry-page-route/apply-page-branding.ts

@@ -135,6 +135,7 @@ export async function applySessionOrgBranding(
 	renderMode: string | undefined,
 	sessionOrgId: string | undefined,
 ): Promise<void> {
+	const platformOrgId = getPlatformOrgId();
 	if (
 		renderMode !== "public" &&
 		sessionOrgId &&
@@ -144,9 +145,27 @@ export async function applySessionOrgBranding(
 		// (super-admin org). A TENANT-owned site (a customer GPT/quiz/portal)
 		// keeps its page-org brand regardless of the viewer session org. The
 		// old pageData.orgId===website.org mis-fired for a tenant whose page org equals their own website org.
-		getPlatformOrgId() ===
+		platformOrgId ===
 			((pageData.website as { organisation_id?: string | null } | undefined)
-				?.organisation_id ?? undefined)
+				?.organisation_id ?? undefined) &&
+		// ...AND the PAGE itself must be platform-owned. A platform-owned
+		// WEBSITE also hosts tenant DOCUMENTS — an agreement, a proposal, a
+		// signed contract — and those belong to the org that published them.
+		// Testing only the website let the viewer's own org repaint a tenant
+		// document, which is the same defect this rule already fixed once at
+		// the website level (2026-08-17, the Launcha Authority Blueprint).
+		//
+		// It recurred on sign.scala.business, whose website IS owned by the
+		// platform org (c503629a), so the website test passed and every
+		// signed-in staff viewer saw a GMG APAC agreement painted in their own
+		// org's brand — while an anonymous client saw it correctly. That is
+		// the worst possible shape: the only people who cannot see what the
+		// client sees are the people reviewing it before it is sent.
+		//
+		// A public document belongs to the org that PUBLISHED it and must look
+		// identical to every reader, so a page whose org is not the platform's
+		// is never personalised.
+		platformOrgId === (pageData.orgId as string | undefined)
 	) {
 		try {
 			const branding = await fetchOrganisationPageBranding(