- Shipped
- August 6, 2026 at 7:20 PM UTC
- Author
- Kamo
- Commit
- 95848ef
A caller that acts on a recipient's status has to be able to establish WHOSE status it is. DocsService's legal-package Finish writes a WORM attestation on the strength of "this recipient signed"; with no member id on the envelope read it can only trust the recipient uid it stored at delivery, and a mis-bound uid would let one employee's attestation rest on a colleague's signature. RecipientSummary now carries memberId — as a STRING, because unique_rowid() is past Number.MAX_SAFE_INTEGER and this record is serialized straight to clients. Null for an external signer, and NON_NULL drops it. EsignClientIp.isIpLiteral asked "is every character a digit or a dot", which "1.2.3.4.5" passes — and InetAddress.getByName then treats it as a HOSTNAME and resolves it: an outbound DNS query, on the request path, for a name the CLIENT chose in a header, which is exactly the lookup the javadoc says is avoided. It now counts groups and ranges. Kept identical to DocsService's LegalClientIp: the two are copies of one rule and must not disagree about which strings are addresses.