zeekay be1d26a502 Let a recipient without an account sign ...

The socket the app's pages call over (/zap) opened only for a session, so
a recipient signing by their link, who has no account, could not reach
the routes that sign a field or complete a document: every field they
clicked failed with "An error occurred while signing the field". tRPC had
served those as public procedures; the port to ZAP kept their bodies and
lost the door.

A connection from the app's own pages with no session now opens as
anonymous and reaches only the routes tRPC served publicly, each
authorised by the token it carries; every other route answers it 401
before its handler runs. The operation API still refuses a request
without a token.

2026-10-20 12:41:58 -07:00

..

anonymous.test.ts

Let a recipient without an account sign

2026-10-20 12:41:58 -07:00

file.test.ts

fix(rpc): carry uploaded files over the socket

2026-08-14 00:07:22 -07:00