fix: improve sealing process

Improves the sealing process by being strict on how
long certificate generation can take, opting to fail
generation and continue sealing.

Also changes the ordering of sealing so an error in the
process won't also cause a document to be "COMPLETED"
since it hasn't been cryptographically sealed yet.

The downside to this change is that documents that fail
during sealing will require manual intervention as a signer
or owner won't be able to *complete* the document.

packages/lib/server-only/document/complete-document-with-token.ts

@@ -137,7 +137,7 @@ export const completeDocumentWithToken = async ({
     await sendPendingEmail({ documentId, recipientId: recipient.id });
   }
 
-  const documents = await prisma.document.updateMany({
+  const haveAllRecipientsSigned = await prisma.document.findFirst({
     where: {
       id: document.id,
       Recipient: {
@@ -146,16 +146,21 @@ export const completeDocumentWithToken = async ({
         },
       },
     },
+  });
+
+  if (haveAllRecipientsSigned) {
+    await sealDocument({ documentId: document.id, requestMetadata });
+  }
+
+  await prisma.document.update({
+    where: {
+      id: document.id,
+    },
     data: {
-      status: DocumentStatus.COMPLETED,
       completedAt: new Date(),
     },
   });
 
-  if (documents.count > 0) {
-    await sealDocument({ documentId: document.id, requestMetadata });
-  }
-
   const updatedDocument = await getDocument({ token, documentId });
 
   await triggerWebhook({