starred/documenso

Fork 0

mirror of https://github.com/documenso/documenso.git synced 2026-04-25 05:46:01 +03:00

[GH-ISSUE #1626] Error while removing user from admin UI: serviceaccount@documenso.com #455

New issue

Closed

opened 2026-02-26 18:47:07 +03:00 by kerem · 4 comments

kerem commented

2026-02-26 18:47:07 +03:00

Owner

Originally created by @bigbeka on GitHub (Feb 3, 2025).
Original GitHub issue: https://github.com/documenso/documenso/issues/1626

Issue Description

documenso-1  | Error: Deleted account service account not found, have you ran the appropriate migrations?
documenso-1  |     at s (/app/apps/web/.next/server/pages/api/trpc/[trpc].js:1:118336)
documenso-1  |     at async d (/app/apps/web/.next/server/pages/api/trpc/[trpc].js:1:115539)
documenso-1  |     at async /app/apps/web/.next/server/pages/api/trpc/[trpc].js:1:125365
documenso-1  |     at async resolveMiddleware (file:///app/node_modules/@trpc/server/dist/index.mjs:420:30)
documenso-1  |     at async callRecursive (file:///app/node_modules/@trpc/server/dist/index.mjs:456:32)
documenso-1  |     at async callRecursive (file:///app/node_modules/@trpc/server/dist/index.mjs:456:32)
documenso-1  |     at async /app/apps/web/.next/server/pages/api/trpc/[trpc].js:1:182897
documenso-1  |     at async callRecursive (file:///app/node_modules/@trpc/server/dist/index.mjs:456:32)
documenso-1  |     at async resolve (file:///app/node_modules/@trpc/server/dist/index.mjs:486:24)
documenso-1  |     at async inputToProcedureCall (file:///app/node_modules/@trpc/server/dist/resolveHTTPResponse-cd1a9112.mjs:46:22)

Docker compose setup:

name: documenso-production
services:
  database:
    image: postgres:15
    hostname: database
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER:?err}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?err}
      - POSTGRES_DB=${POSTGRES_DB:?err}
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER}']
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      # - ./database:/var/lib/postgresql/data
      - type: bind
        source: ./database
        target: /var/lib/postgresql/data
        read_only: false

  documenso:
    image: documenso/documenso:latest
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
    environment:
      - PORT=${PORT:-3000}
      - NEXTAUTH_URL=${NEXTAUTH_URL:-${NEXT_PUBLIC_WEBAPP_URL}}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET:?err}
      - NEXT_PRIVATE_ENCRYPTION_KEY=${NEXT_PRIVATE_ENCRYPTION_KEY:?err}
      - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=${NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY:?err}
      - NEXT_PRIVATE_GOOGLE_CLIENT_ID=${NEXT_PRIVATE_GOOGLE_CLIENT_ID}
      - NEXT_PRIVATE_GOOGLE_CLIENT_SECRET=${NEXT_PRIVATE_GOOGLE_CLIENT_SECRET}
      - NEXT_PUBLIC_WEBAPP_URL=${NEXT_PUBLIC_WEBAPP_URL:?err}
      - NEXT_PRIVATE_INTERNAL_WEBAPP_URL=${NEXT_PRIVATE_INTERNAL_WEBAPP_URL:-http://localhost:$PORT}
      - NEXT_PUBLIC_MARKETING_URL=${NEXT_PUBLIC_MARKETING_URL:-https://documenso.com}
      - NEXT_PRIVATE_DATABASE_URL=${NEXT_PRIVATE_DATABASE_URL:?err}
      - NEXT_PRIVATE_DIRECT_DATABASE_URL=${NEXT_PRIVATE_DIRECT_DATABASE_URL:-${NEXT_PRIVATE_DATABASE_URL}}
      - NEXT_PUBLIC_UPLOAD_TRANSPORT=${NEXT_PUBLIC_UPLOAD_TRANSPORT:-database}
      - NEXT_PRIVATE_UPLOAD_ENDPOINT=${NEXT_PRIVATE_UPLOAD_ENDPOINT}
      - NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE=${NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE}
      - NEXT_PRIVATE_UPLOAD_REGION=${NEXT_PRIVATE_UPLOAD_REGION}
      - NEXT_PRIVATE_UPLOAD_BUCKET=${NEXT_PRIVATE_UPLOAD_BUCKET}
      - NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID=${NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID}
      - NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY=${NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY}
      - NEXT_PRIVATE_SMTP_TRANSPORT=${NEXT_PRIVATE_SMTP_TRANSPORT:?err}
      - NEXT_PRIVATE_SMTP_HOST=${NEXT_PRIVATE_SMTP_HOST}
      - NEXT_PRIVATE_SMTP_PORT=${NEXT_PRIVATE_SMTP_PORT}
      - NEXT_PRIVATE_SMTP_USERNAME=${NEXT_PRIVATE_SMTP_USERNAME}
      - NEXT_PRIVATE_SMTP_PASSWORD=${NEXT_PRIVATE_SMTP_PASSWORD}
      - NEXT_PRIVATE_SMTP_APIKEY_USER=${NEXT_PRIVATE_SMTP_APIKEY_USER}
      - NEXT_PRIVATE_SMTP_APIKEY=${NEXT_PRIVATE_SMTP_APIKEY}
      - NEXT_PRIVATE_SMTP_SECURE=${NEXT_PRIVATE_SMTP_SECURE}
      - NEXT_PRIVATE_SMTP_FROM_NAME=${NEXT_PRIVATE_SMTP_FROM_NAME:?err}
      - NEXT_PRIVATE_SMTP_FROM_ADDRESS=${NEXT_PRIVATE_SMTP_FROM_ADDRESS:?err}
      - NEXT_PRIVATE_SMTP_SERVICE=${NEXT_PRIVATE_SMTP_SERVICE}
      - NEXT_PRIVATE_RESEND_API_KEY=${NEXT_PRIVATE_RESEND_API_KEY}
      - NEXT_PRIVATE_MAILCHANNELS_API_KEY=${NEXT_PRIVATE_MAILCHANNELS_API_KEY}
      - NEXT_PRIVATE_MAILCHANNELS_ENDPOINT=${NEXT_PRIVATE_MAILCHANNELS_ENDPOINT}
      - NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN=${NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN}
      - NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR=${NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR}
      - NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY=${NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY}
      - NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=${NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT}
      - NEXT_PUBLIC_POSTHOG_KEY=${NEXT_PUBLIC_POSTHOG_KEY}
      - NEXT_PUBLIC_DISABLE_SIGNUP=${NEXT_PUBLIC_DISABLE_SIGNUP}
      - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=${NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH:-/opt/documenso/cert.p12}
      - NEXT_PRIVATE_SIGNING_PASSPHRASE=${NEXT_PRIVATE_SIGNING_PASSPHRASE}
    ports:
      - ${PORT:-3000}:${PORT:-3000}
    volumes:
      # - ./cert.p12:/opt/documenso/cert.p12
      - type : bind
        source: ./certificate.p12
        target: /opt/documenso/cert.p12
        read_only: false


# [[AUTH]]
NEXTAUTH_URL="https://FQDN"
NEXTAUTH_SECRET="string"

# [[CRYPTO]]
# Application Key for symmetric encryption and decryption
# REQUIRED: This should be a random string of at least 32 characters
NEXT_PRIVATE_ENCRYPTION_KEY="string"
# REQUIRED: This should be a random string of at least 32 characters
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY="string"

# [[AUTH OPTIONAL]]
# Find documentation on setting up Google OAuth here:
# https://docs.documenso.com/developers/self-hosting/setting-up-oauth-providers#google-oauth-gmail
NEXT_PRIVATE_GOOGLE_CLIENT_ID="clientID"
NEXT_PRIVATE_GOOGLE_CLIENT_SECRET="secret"

NEXT_PRIVATE_OIDC_WELL_KNOWN=""
NEXT_PRIVATE_OIDC_CLIENT_ID=""
NEXT_PRIVATE_OIDC_CLIENT_SECRET=""
NEXT_PRIVATE_OIDC_PROVIDER_LABEL="OIDC"
# This can be used to still allow signups for OIDC connections
# when signup is disabled via `NEXT_PUBLIC_DISABLE_SIGNUP`
NEXT_PRIVATE_OIDC_ALLOW_SIGNUP=""
NEXT_PRIVATE_OIDC_SKIP_VERIFY=""

# [[URLS]]
NEXT_PUBLIC_WEBAPP_URL="https://FQDN"
NEXT_PUBLIC_MARKETING_URL="http://FQDN"
# URL used by the web app to request itself (e.g. local background jobs)
NEXT_PRIVATE_INTERNAL_WEBAPP_URL="https://FQDN"
PORT=3000

# [[DATABASE]]
NEXT_PRIVATE_DATABASE_URL="postgres://documenso:pass@database:5432/documenso"
# Defines the URL to use for the database when running migrations and other commands that won't work with a connection pool.
NEXT_PRIVATE_DIRECT_DATABASE_URL="postgres://documenso:pass@database:5432/documenso"
POSTGRES_USER=documenso
POSTGRES_PASSWORD=pass
POSTGRES_DB=documenso

# [[SIGNING]]
# The transport to use for document signing. Available options: local (default) | gcloud-hsm
NEXT_PRIVATE_SIGNING_TRANSPORT="local"
# OPTIONAL: The passphrase to use for the local file-based signing transport.
NEXT_PRIVATE_SIGNING_PASSPHRASE='string'
# OPTIONAL: The local file path to the .p12 file to use for the local signing transport.
NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/cert.p12
# OPTIONAL: The base64-encoded contents of the .p12 file to use for the local signing transport.
NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS=
# OPTIONAL: The path to the Google Cloud HSM key to use for the gcloud-hsm signing transport.
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_KEY_PATH=
# OPTIONAL: The path to the Google Cloud HSM public certificate file to use for the gcloud-hsm signing transport.
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_PATH=
# OPTIONAL: The base64-encoded contents of the Google Cloud HSM public certificate file to use for the gcloud-hsm signing transport.
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_CONTENTS=
# OPTIONAL: The path to the Google Cloud Credentials file to use for the gcloud-hsm signing transport.
NEXT_PRIVATE_SIGNING_GCLOUD_APPLICATION_CREDENTIALS_CONTENTS=

# [[STORAGE]]
# OPTIONAL: Defines the storage transport to use. Available options: database (default) | s3
NEXT_PUBLIC_UPLOAD_TRANSPORT="database"
# OPTIONAL: Defines the endpoint to use for the S3 storage transport. Relevant when using third-party S3-compatible providers.
NEXT_PRIVATE_UPLOAD_ENDPOINT="http://127.0.0.1:9002"
# OPTIONAL: Defines the force path style to use for the S3 storage transport. Relevant when using third-party S3-compatible providers.
# This will change it from using virtual hosts <bucket>.domain.com/<path> to fully qualified paths domain.com/<bucket>/<path>
NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE="false"
# OPTIONAL: Defines the region to use for the S3 storage transport. Defaults to us-east-1.
NEXT_PRIVATE_UPLOAD_REGION="unknown"
# REQUIRED: Defines the bucket to use for the S3 storage transport.
NEXT_PRIVATE_UPLOAD_BUCKET="documenso"
# OPTIONAL: Defines the access key ID to use for the S3 storage transport.
NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID="documenso"
# OPTIONAL: Defines the secret access key to use for the S3 storage transport.
NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY="pass"

# [[SMTP]]
# OPTIONAL: Defines the transport to use for sending emails. Available options: smtp-auth (default) | smtp-api | mailchannels
NEXT_PRIVATE_SMTP_TRANSPORT="smtp-auth"
# OPTIONAL: Defines the host to use for sending emails.
NEXT_PRIVATE_SMTP_HOST="smtp.FQDN.net"
# OPTIONAL: Defines the port to use for sending emails.
NEXT_PRIVATE_SMTP_PORT=xxx
# OPTIONAL: Defines the username to use with the SMTP server.
NEXT_PRIVATE_SMTP_USERNAME="user"
# OPTIONAL: Defines the password to use with the SMTP server.
NEXT_PRIVATE_SMTP_PASSWORD="pass"
# OPTIONAL: Defines the API key user to use with the SMTP server.
NEXT_PRIVATE_SMTP_APIKEY_USER=
# OPTIONAL: Defines the API key to use with the SMTP server.
NEXT_PRIVATE_SMTP_APIKEY=
# OPTIONAL: Defines whether to force the use of TLS.
NEXT_PRIVATE_SMTP_SECURE=false
# OPTIONAL: if this is true and NEXT_PRIVATE_SMTP_SECURE is false then TLS is not used even if the server supports STARTTLS extension
NEXT_PRIVATE_SMTP_UNSAFE_IGNORE_TLS=false
# REQUIRED: Defines the sender name to use for the from address.
NEXT_PRIVATE_SMTP_FROM_NAME="Name"
# REQUIRED: Defines the email address to use as the from address.
NEXT_PRIVATE_SMTP_FROM_ADDRESS="name@FQDN"
# OPTIONAL: Defines the service for nodemailer
NEXT_PRIVATE_SMTP_SERVICE=
# OPTIONAL: The API key to use for Resend.com
NEXT_PRIVATE_RESEND_API_KEY=
# OPTIONAL: The API key to use for MailChannels.
NEXT_PRIVATE_MAILCHANNELS_API_KEY=
# OPTIONAL: The endpoint to use for the MailChannels API if using a proxy.
NEXT_PRIVATE_MAILCHANNELS_ENDPOINT=
# OPTIONAL: The domain to use for DKIM signing.
NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN=
# OPTIONAL: The selector to use for DKIM signing.
NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR=
# OPTIONAL: The private key to use for DKIM signing.
NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY=
# OPTIONAL: Displays the maximum document upload limit to the user in MBs
NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=xxx

# [[STRIPE]]
NEXT_PRIVATE_STRIPE_API_KEY=
NEXT_PRIVATE_STRIPE_WEBHOOK_SECRET=
NEXT_PUBLIC_STRIPE_COMMUNITY_PLAN_MONTHLY_PRICE_ID=
NEXT_PUBLIC_STRIPE_ENTERPRISE_PLAN_MONTHLY_PRICE_ID=

# [[BACKGROUND JOBS]]
NEXT_PRIVATE_JOBS_PROVIDER="local"
NEXT_PRIVATE_TRIGGER_API_KEY=
NEXT_PRIVATE_TRIGGER_API_URL=
NEXT_PRIVATE_INNGEST_EVENT_KEY=

# [[FEATURES]]
# OPTIONAL: Leave blank to disable PostHog and feature flags.
NEXT_PUBLIC_POSTHOG_KEY=""
# OPTIONAL: Leave blank to disable billing.
NEXT_PUBLIC_FEATURE_BILLING_ENABLED=
# OPTIONAL: Leave blank to allow users to signup through /signup page.
NEXT_PUBLIC_DISABLE_SIGNUP=

# [[E2E Tests]]
E2E_TEST_AUTHENTICATE_USERNAME="Test User"
E2E_TEST_AUTHENTICATE_USER_EMAIL="testuser@mail.com"
E2E_TEST_AUTHENTICATE_USER_PASSWORD="test_Password123"

# This is only required for the marketing site
# [[REDIS]]
NEXT_PRIVATE_REDIS_URL=
NEXT_PRIVATE_REDIS_TOKEN=

# [[LOGGER]]
NEXT_PRIVATE_LOGGER_HONEY_BADGER_API_KEY=

Steps to Reproduce

Setup fresh instance of Documenso with docker compose
Create a user (via WebUI)
Through PSQL assign admin role to the user
Login to admin user management dashboard
Delete user serviceaccount@documenso.com

Expected Behavior

Admin should be able to delete the user

Current Behavior

While deleting, error message pops up with the error logs pasted above.

Screenshots (optional)

No response

Operating System [e.g., Windows 10]

No response

Browser [e.g., Chrome, Firefox]

No response

Version [e.g., 2.0.1]

v1.8.0-rc.0

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.
I want to work on creating a PR for this issue if approved

Originally created by @bigbeka on GitHub (Feb 3, 2025). Original GitHub issue: https://github.com/documenso/documenso/issues/1626 ### Issue Description ``` documenso-1 | Error: Deleted account service account not found, have you ran the appropriate migrations? documenso-1 | at s (/app/apps/web/.next/server/pages/api/trpc/[trpc].js:1:118336) documenso-1 | at async d (/app/apps/web/.next/server/pages/api/trpc/[trpc].js:1:115539) documenso-1 | at async /app/apps/web/.next/server/pages/api/trpc/[trpc].js:1:125365 documenso-1 | at async resolveMiddleware (file:///app/node_modules/@trpc/server/dist/index.mjs:420:30) documenso-1 | at async callRecursive (file:///app/node_modules/@trpc/server/dist/index.mjs:456:32) documenso-1 | at async callRecursive (file:///app/node_modules/@trpc/server/dist/index.mjs:456:32) documenso-1 | at async /app/apps/web/.next/server/pages/api/trpc/[trpc].js:1:182897 documenso-1 | at async callRecursive (file:///app/node_modules/@trpc/server/dist/index.mjs:456:32) documenso-1 | at async resolve (file:///app/node_modules/@trpc/server/dist/index.mjs:486:24) documenso-1 | at async inputToProcedureCall (file:///app/node_modules/@trpc/server/dist/resolveHTTPResponse-cd1a9112.mjs:46:22) ``` Docker compose setup: ``` name: documenso-production services: database: image: postgres:15 hostname: database restart: unless-stopped environment: - POSTGRES_USER=${POSTGRES_USER:?err} - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?err} - POSTGRES_DB=${POSTGRES_DB:?err} healthcheck: test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER}'] interval: 10s timeout: 5s retries: 5 volumes: # - ./database:/var/lib/postgresql/data - type: bind source: ./database target: /var/lib/postgresql/data read_only: false documenso: image: documenso/documenso:latest restart: unless-stopped depends_on: database: condition: service_healthy environment: - PORT=${PORT:-3000} - NEXTAUTH_URL=${NEXTAUTH_URL:-${NEXT_PUBLIC_WEBAPP_URL}} - NEXTAUTH_SECRET=${NEXTAUTH_SECRET:?err} - NEXT_PRIVATE_ENCRYPTION_KEY=${NEXT_PRIVATE_ENCRYPTION_KEY:?err} - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=${NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY:?err} - NEXT_PRIVATE_GOOGLE_CLIENT_ID=${NEXT_PRIVATE_GOOGLE_CLIENT_ID} - NEXT_PRIVATE_GOOGLE_CLIENT_SECRET=${NEXT_PRIVATE_GOOGLE_CLIENT_SECRET} - NEXT_PUBLIC_WEBAPP_URL=${NEXT_PUBLIC_WEBAPP_URL:?err} - NEXT_PRIVATE_INTERNAL_WEBAPP_URL=${NEXT_PRIVATE_INTERNAL_WEBAPP_URL:-http://localhost:$PORT} - NEXT_PUBLIC_MARKETING_URL=${NEXT_PUBLIC_MARKETING_URL:-https://documenso.com} - NEXT_PRIVATE_DATABASE_URL=${NEXT_PRIVATE_DATABASE_URL:?err} - NEXT_PRIVATE_DIRECT_DATABASE_URL=${NEXT_PRIVATE_DIRECT_DATABASE_URL:-${NEXT_PRIVATE_DATABASE_URL}} - NEXT_PUBLIC_UPLOAD_TRANSPORT=${NEXT_PUBLIC_UPLOAD_TRANSPORT:-database} - NEXT_PRIVATE_UPLOAD_ENDPOINT=${NEXT_PRIVATE_UPLOAD_ENDPOINT} - NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE=${NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE} - NEXT_PRIVATE_UPLOAD_REGION=${NEXT_PRIVATE_UPLOAD_REGION} - NEXT_PRIVATE_UPLOAD_BUCKET=${NEXT_PRIVATE_UPLOAD_BUCKET} - NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID=${NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID} - NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY=${NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY} - NEXT_PRIVATE_SMTP_TRANSPORT=${NEXT_PRIVATE_SMTP_TRANSPORT:?err} - NEXT_PRIVATE_SMTP_HOST=${NEXT_PRIVATE_SMTP_HOST} - NEXT_PRIVATE_SMTP_PORT=${NEXT_PRIVATE_SMTP_PORT} - NEXT_PRIVATE_SMTP_USERNAME=${NEXT_PRIVATE_SMTP_USERNAME} - NEXT_PRIVATE_SMTP_PASSWORD=${NEXT_PRIVATE_SMTP_PASSWORD} - NEXT_PRIVATE_SMTP_APIKEY_USER=${NEXT_PRIVATE_SMTP_APIKEY_USER} - NEXT_PRIVATE_SMTP_APIKEY=${NEXT_PRIVATE_SMTP_APIKEY} - NEXT_PRIVATE_SMTP_SECURE=${NEXT_PRIVATE_SMTP_SECURE} - NEXT_PRIVATE_SMTP_FROM_NAME=${NEXT_PRIVATE_SMTP_FROM_NAME:?err} - NEXT_PRIVATE_SMTP_FROM_ADDRESS=${NEXT_PRIVATE_SMTP_FROM_ADDRESS:?err} - NEXT_PRIVATE_SMTP_SERVICE=${NEXT_PRIVATE_SMTP_SERVICE} - NEXT_PRIVATE_RESEND_API_KEY=${NEXT_PRIVATE_RESEND_API_KEY} - NEXT_PRIVATE_MAILCHANNELS_API_KEY=${NEXT_PRIVATE_MAILCHANNELS_API_KEY} - NEXT_PRIVATE_MAILCHANNELS_ENDPOINT=${NEXT_PRIVATE_MAILCHANNELS_ENDPOINT} - NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN=${NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN} - NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR=${NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR} - NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY=${NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY} - NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=${NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT} - NEXT_PUBLIC_POSTHOG_KEY=${NEXT_PUBLIC_POSTHOG_KEY} - NEXT_PUBLIC_DISABLE_SIGNUP=${NEXT_PUBLIC_DISABLE_SIGNUP} - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=${NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH:-/opt/documenso/cert.p12} - NEXT_PRIVATE_SIGNING_PASSPHRASE=${NEXT_PRIVATE_SIGNING_PASSPHRASE} ports: - ${PORT:-3000}:${PORT:-3000} volumes: # - ./cert.p12:/opt/documenso/cert.p12 - type : bind source: ./certificate.p12 target: /opt/documenso/cert.p12 read_only: false # [[AUTH]] NEXTAUTH_URL="https://FQDN" NEXTAUTH_SECRET="string" # [[CRYPTO]] # Application Key for symmetric encryption and decryption # REQUIRED: This should be a random string of at least 32 characters NEXT_PRIVATE_ENCRYPTION_KEY="string" # REQUIRED: This should be a random string of at least 32 characters NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY="string" # [[AUTH OPTIONAL]] # Find documentation on setting up Google OAuth here: # https://docs.documenso.com/developers/self-hosting/setting-up-oauth-providers#google-oauth-gmail NEXT_PRIVATE_GOOGLE_CLIENT_ID="clientID" NEXT_PRIVATE_GOOGLE_CLIENT_SECRET="secret" NEXT_PRIVATE_OIDC_WELL_KNOWN="" NEXT_PRIVATE_OIDC_CLIENT_ID="" NEXT_PRIVATE_OIDC_CLIENT_SECRET="" NEXT_PRIVATE_OIDC_PROVIDER_LABEL="OIDC" # This can be used to still allow signups for OIDC connections # when signup is disabled via `NEXT_PUBLIC_DISABLE_SIGNUP` NEXT_PRIVATE_OIDC_ALLOW_SIGNUP="" NEXT_PRIVATE_OIDC_SKIP_VERIFY="" # [[URLS]] NEXT_PUBLIC_WEBAPP_URL="https://FQDN" NEXT_PUBLIC_MARKETING_URL="http://FQDN" # URL used by the web app to request itself (e.g. local background jobs) NEXT_PRIVATE_INTERNAL_WEBAPP_URL="https://FQDN" PORT=3000 # [[DATABASE]] NEXT_PRIVATE_DATABASE_URL="postgres://documenso:pass@database:5432/documenso" # Defines the URL to use for the database when running migrations and other commands that won't work with a connection pool. NEXT_PRIVATE_DIRECT_DATABASE_URL="postgres://documenso:pass@database:5432/documenso" POSTGRES_USER=documenso POSTGRES_PASSWORD=pass POSTGRES_DB=documenso # [[SIGNING]] # The transport to use for document signing. Available options: local (default) | gcloud-hsm NEXT_PRIVATE_SIGNING_TRANSPORT="local" # OPTIONAL: The passphrase to use for the local file-based signing transport. NEXT_PRIVATE_SIGNING_PASSPHRASE='string' # OPTIONAL: The local file path to the .p12 file to use for the local signing transport. NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/cert.p12 # OPTIONAL: The base64-encoded contents of the .p12 file to use for the local signing transport. NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS= # OPTIONAL: The path to the Google Cloud HSM key to use for the gcloud-hsm signing transport. NEXT_PRIVATE_SIGNING_GCLOUD_HSM_KEY_PATH= # OPTIONAL: The path to the Google Cloud HSM public certificate file to use for the gcloud-hsm signing transport. NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_PATH= # OPTIONAL: The base64-encoded contents of the Google Cloud HSM public certificate file to use for the gcloud-hsm signing transport. NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_CONTENTS= # OPTIONAL: The path to the Google Cloud Credentials file to use for the gcloud-hsm signing transport. NEXT_PRIVATE_SIGNING_GCLOUD_APPLICATION_CREDENTIALS_CONTENTS= # [[STORAGE]] # OPTIONAL: Defines the storage transport to use. Available options: database (default) | s3 NEXT_PUBLIC_UPLOAD_TRANSPORT="database" # OPTIONAL: Defines the endpoint to use for the S3 storage transport. Relevant when using third-party S3-compatible providers. NEXT_PRIVATE_UPLOAD_ENDPOINT="http://127.0.0.1:9002" # OPTIONAL: Defines the force path style to use for the S3 storage transport. Relevant when using third-party S3-compatible providers. # This will change it from using virtual hosts <bucket>.domain.com/<path> to fully qualified paths domain.com/<bucket>/<path> NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE="false" # OPTIONAL: Defines the region to use for the S3 storage transport. Defaults to us-east-1. NEXT_PRIVATE_UPLOAD_REGION="unknown" # REQUIRED: Defines the bucket to use for the S3 storage transport. NEXT_PRIVATE_UPLOAD_BUCKET="documenso" # OPTIONAL: Defines the access key ID to use for the S3 storage transport. NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID="documenso" # OPTIONAL: Defines the secret access key to use for the S3 storage transport. NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY="pass" # [[SMTP]] # OPTIONAL: Defines the transport to use for sending emails. Available options: smtp-auth (default) | smtp-api | mailchannels NEXT_PRIVATE_SMTP_TRANSPORT="smtp-auth" # OPTIONAL: Defines the host to use for sending emails. NEXT_PRIVATE_SMTP_HOST="smtp.FQDN.net" # OPTIONAL: Defines the port to use for sending emails. NEXT_PRIVATE_SMTP_PORT=xxx # OPTIONAL: Defines the username to use with the SMTP server. NEXT_PRIVATE_SMTP_USERNAME="user" # OPTIONAL: Defines the password to use with the SMTP server. NEXT_PRIVATE_SMTP_PASSWORD="pass" # OPTIONAL: Defines the API key user to use with the SMTP server. NEXT_PRIVATE_SMTP_APIKEY_USER= # OPTIONAL: Defines the API key to use with the SMTP server. NEXT_PRIVATE_SMTP_APIKEY= # OPTIONAL: Defines whether to force the use of TLS. NEXT_PRIVATE_SMTP_SECURE=false # OPTIONAL: if this is true and NEXT_PRIVATE_SMTP_SECURE is false then TLS is not used even if the server supports STARTTLS extension NEXT_PRIVATE_SMTP_UNSAFE_IGNORE_TLS=false # REQUIRED: Defines the sender name to use for the from address. NEXT_PRIVATE_SMTP_FROM_NAME="Name" # REQUIRED: Defines the email address to use as the from address. NEXT_PRIVATE_SMTP_FROM_ADDRESS="name@FQDN" # OPTIONAL: Defines the service for nodemailer NEXT_PRIVATE_SMTP_SERVICE= # OPTIONAL: The API key to use for Resend.com NEXT_PRIVATE_RESEND_API_KEY= # OPTIONAL: The API key to use for MailChannels. NEXT_PRIVATE_MAILCHANNELS_API_KEY= # OPTIONAL: The endpoint to use for the MailChannels API if using a proxy. NEXT_PRIVATE_MAILCHANNELS_ENDPOINT= # OPTIONAL: The domain to use for DKIM signing. NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN= # OPTIONAL: The selector to use for DKIM signing. NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR= # OPTIONAL: The private key to use for DKIM signing. NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY= # OPTIONAL: Displays the maximum document upload limit to the user in MBs NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=xxx # [[STRIPE]] NEXT_PRIVATE_STRIPE_API_KEY= NEXT_PRIVATE_STRIPE_WEBHOOK_SECRET= NEXT_PUBLIC_STRIPE_COMMUNITY_PLAN_MONTHLY_PRICE_ID= NEXT_PUBLIC_STRIPE_ENTERPRISE_PLAN_MONTHLY_PRICE_ID= # [[BACKGROUND JOBS]] NEXT_PRIVATE_JOBS_PROVIDER="local" NEXT_PRIVATE_TRIGGER_API_KEY= NEXT_PRIVATE_TRIGGER_API_URL= NEXT_PRIVATE_INNGEST_EVENT_KEY= # [[FEATURES]] # OPTIONAL: Leave blank to disable PostHog and feature flags. NEXT_PUBLIC_POSTHOG_KEY="" # OPTIONAL: Leave blank to disable billing. NEXT_PUBLIC_FEATURE_BILLING_ENABLED= # OPTIONAL: Leave blank to allow users to signup through /signup page. NEXT_PUBLIC_DISABLE_SIGNUP= # [[E2E Tests]] E2E_TEST_AUTHENTICATE_USERNAME="Test User" E2E_TEST_AUTHENTICATE_USER_EMAIL="testuser@mail.com" E2E_TEST_AUTHENTICATE_USER_PASSWORD="test_Password123" # This is only required for the marketing site # [[REDIS]] NEXT_PRIVATE_REDIS_URL= NEXT_PRIVATE_REDIS_TOKEN= # [[LOGGER]] NEXT_PRIVATE_LOGGER_HONEY_BADGER_API_KEY= ``` ### Steps to Reproduce 1. Setup fresh instance of Documenso with docker compose 2. Create a user (via WebUI) 3. Through PSQL assign admin role to the user 4. Login to admin user management dashboard 5. Delete user `serviceaccount@documenso.com` ### Expected Behavior Admin should be able to delete the user ### Current Behavior While deleting, error message pops up with the error logs pasted above. ### Screenshots (optional) _No response_ ### Operating System [e.g., Windows 10] _No response_ ### Browser [e.g., Chrome, Firefox] _No response_ ### Version [e.g., 2.0.1] v1.8.0-rc.0 ### Please check the boxes that apply to this issue report. - [x] I have searched the existing issues to make sure this is not a duplicate. - [x] I have provided steps to reproduce the issue. - [x] I have included relevant environment information. - [ ] I have included any relevant screenshots. - [x] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [ ] I want to work on creating a PR for this issue if approved

kerem

2026-02-26 18:47:07 +03:00

closed this issue
added the
status: triage
label

kerem commented

2026-02-26 18:47:08 +03:00

Author

Owner

@ephraimduncan commented on GitHub (Feb 3, 2025):

The serviceaccount@documenso.com cannot be removed because it's a system account that preserves document integrity when users delete their accounts

Look here:

github.com/documenso/documenso@cbad065dac/packages/lib/server-only/user/delete-user.ts (L27-L38)

This account becomes the custodian of orphaned documents to prevent data loss.

@ephraimduncan commented on GitHub (Feb 3, 2025): The serviceaccount@documenso.com cannot be removed because it's a system account that preserves document integrity when users delete their accounts Look here: https://github.com/documenso/documenso/blob/cbad065dac7256f229bfcf2d86b7b1ef797a8ade/packages/lib/server-only/user/delete-user.ts#L27-L38 This account becomes the custodian of orphaned documents to prevent data loss.

kerem commented

2026-02-26 18:47:08 +03:00

Author

Owner

@bigbeka commented on GitHub (Feb 3, 2025):

@ephraimduncan thank you for clarifying, this is helpful.

What about the deleted-account@documenso.com account?

@bigbeka commented on GitHub (Feb 3, 2025): @ephraimduncan thank you for clarifying, this is helpful. What about the `deleted-account@documenso.com` account?

kerem commented

2026-02-26 18:47:08 +03:00

Author

Owner

@ephraimduncan commented on GitHub (Feb 3, 2025):

The serviceaccount@documenso.com is an older implementation that was later replaced by deleted-account@documenso.com

@ephraimduncan commented on GitHub (Feb 3, 2025): The `serviceaccount@documenso.com` is an older implementation that was later replaced by `deleted-account@documenso.com`

kerem commented

2026-02-26 18:47:08 +03:00

Author

Owner

@bigbeka commented on GitHub (Feb 3, 2025):

Wait a second, you said:

The serviceaccount@documenso.com cannot be removed because it's a system account that preserves document integrity when users delete their accounts

And now you are saying that "The serviceaccount@documenso.com is an older implementation that was later replaced by deleted-account@documenso.com?

I can easily remove deleted-account@documenso.com from WebUI Admin dashboard, but not the older implementation?

Another question, (I am able to change the email address of those account) what happens if I change them to my own domain?

@bigbeka commented on GitHub (Feb 3, 2025): Wait a second, you said: > The [serviceaccount@documenso.com](mailto:serviceaccount@documenso.com) cannot be removed because it's a system account that preserves document integrity when users delete their accounts And now you are saying that "The `serviceaccount@documenso.com` is an older implementation that was later replaced by `deleted-account@documenso.com`? I can easily remove `deleted-account@documenso.com` from WebUI Admin dashboard, but not the older implementation? Another question, (I am able to change the email address of those account) what happens if I change them to my own domain?

kerem referenced this issue

2026-02-26 19:31:19 +03:00

[PR #455] [MERGED] fix: resolve issues with signing document stickiness #984

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#455

No description provided.

Rows
Columns