{"record":{"id":"55e227a57e4d3ce5","repo":"phacility/phabricator","slug":"you-can-not-sign-a-document-on-behalf-of-a-corpora","errorCode":null,"errorMessage":"You can not sign a document on behalf of a corporation unless you are logged in.","messagePattern":"You can not sign a document on behalf of a corporation unless you are logged in\\.","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/legalpad/controller/LegalpadDocumentSignController.php","lineNumber":608,"sourceCode":"          $field_errors['email'] = pht('Invalid');\n          $errors[] = pht('A valid email is required.');\n        } else {\n          $field_errors['email'] = null;\n        }\n      }\n    }\n    $signature_data['email'] = $email;\n\n    return array($signature_data, $errors, $field_errors);\n  }\n\n  private function readCorporateSignatureForm(\n    LegalpadDocument $document,\n    AphrontRequest $request) {\n\n    $viewer = $request->getUser();\n    if (!$viewer->isLoggedIn()) {\n      throw new Exception(\n        pht(\n          'You can not sign a document on behalf of a corporation unless '.\n          'you are logged in.'));\n    }\n\n    $signature_data = array();\n    $errors = array();\n    $field_errors = array();\n\n    $name = $request->getStr('name');\n\n    if (!strlen($name)) {\n      $field_errors['name'] = pht('Required');\n      $errors[] = pht('Company name is required.');\n    } else {\n      $field_errors['name'] = null;\n    }\n    $signature_data['name'] = $name;","sourceCodeStart":590,"sourceCodeEnd":626,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/legalpad/controller/LegalpadDocumentSignController.php#L590-L626","documentation":"LegalpadDocumentSignController::readCorporateSignatureForm() records which user signed on the corporation's behalf, so it requires an authenticated viewer and throws immediately when $viewer->isLoggedIn() is false. Anonymous visitors can sign documents individually, but the corporation flow has no anonymous path.","triggerScenarios":"A POST to the legalpad document sign endpoint with signatureType=corporation from a logged-out session -- curl, an expired session mid-form, or a scripted client that never authenticates.","commonSituations":"Session expiring while a long corporate-signing form was being filled; custom integrations hitting the sign controller without a logged-in cookie; UI flow bugs that render the corporate form to anonymous users.","solutions":["Log in (or restore the session) and submit the corporate signature again.","If scripting, authenticate first or use Conduit/CLI paths that operate as a real user.","In custom controllers, gate the corporate flow on $viewer->isLoggedIn() before rendering the form (see exampleFix)."],"exampleFix":"// before\n$signature_data = $this->readCorporateSignatureForm($document, $request);\n// after\nif ($viewer->isLoggedIn()) {\n  $signature_data = $this->readCorporateSignatureForm($document, $request);\n} else {\n  return $this->newDialog()\n    ->setTitle(pht('Log In Required'))\n    ->appendParagraph(pht('Corporate signatures require a logged-in account.'))\n    ->addCancelButton('/login/');\n}","handlingStrategy":"validation","validationCode":"// Gate corporate signing before reading the form:\n$viewer = $request->getUser();\nif (!$viewer->isLoggedIn()) {\n  return id(new Aphront404Response()); // or redirect to /login/\n}\n$signature_data = $this->readCorporateSignatureForm($document, $request);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never render the corporation signature form to anonymous viewers; branch on isLoggedIn() at the action level.","For long signing forms, warn before session expiry so submissions do not die on this check.","Use Conduit or authenticated CLI paths for scripted signatures."],"tags":["legalpad","phabricator","authentication","form"],"backgroundTag":"authentication-required","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}