Resolve document publish approvers from defaults

The MCP publishDocument tool required callers to pass approver_ids and
to distinguish an omitted list (rejected) from an empty one (direct
publish), a null-vs-empty subtlety that is awkward for an LLM to get
right.

Drop approver_ids from the MCP tool and resolve a major publish's
approvers from the document's default approvers instead: an approval is
requested when the document has default approvers, otherwise the version
is published directly. Default approvers are configured with addDocument
or updateDocument.

Replace a document's default approvers on every major publish that
supplies an explicit list, even when the list is empty, so a direct
publish through the GraphQL API clears stale approvers instead of
leaving them behind (previously the empty case skipped the update).

Expose the default-approver behaviour as a separate entry point,
PublishVersionWithDefaultApprovers, that loads the defaults and
delegates to PublishVersion. PublishVersion keeps its explicit-approver
contract for the GraphQL API.

Require only the publish permission to publish a version, whether or not
it opens an approval quorum, and drop the now-unused request-approval
action.

Fold the publish steps into the publishMinor and publishMajor primitives
shared by both the single and bulk publish paths, and drop the redundant
InTx suffix from RequestApproval and emitDocumentEvent, which already
take a transaction argument.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

e2e/console/document_version_test.go

@@ -1688,6 +1688,45 @@ func TestDocument_DefaultApprovers(t *testing.T) {
 
 		assert.Empty(t, result.UpdateDocument.Document.DefaultApprovers)
 	})
+
+	t.Run("major publish with explicit approvers updates default approvers, even when empty", func(t *testing.T) {
+		t.Parallel()
+
+		docID := createTestDocumentWithApprovers(t, owner, []string{approverID})
+
+		var result struct {
+			PublishDocument struct {
+				Document struct {
+					DefaultApprovers []struct {
+						ID string `json:"id"`
+					} `json:"defaultApprovers"`
+				} `json:"document"`
+				DocumentVersion struct {
+					Status string `json:"status"`
+				} `json:"documentVersion"`
+			} `json:"publishDocument"`
+		}
+
+		err := owner.Execute(`
+			mutation($input: PublishDocumentInput!) {
+				publishDocument(input: $input) {
+					document { defaultApprovers { id } }
+					documentVersion { status }
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"minor":       false,
+				"documentId":  docID,
+				"approverIds": []string{},
+				"changelog":   "Direct publish clearing approvers",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, "PUBLISHED", result.PublishDocument.DocumentVersion.Status)
+		assert.Empty(t, result.PublishDocument.Document.DefaultApprovers)
+	})
 }
 
 func TestDocumentVersion_DeleteDraft(t *testing.T) {

e2e/mcp/document_test.go

@@ -93,3 +93,71 @@ func TestMCP_Document_CRUD(t *testing.T) {
 	}, &deleteResult)
 	assert.Equal(t, addResult.Document.ID, deleteResult.DeletedDocumentID)
 }
+
+func TestMCP_Document_PublishUsesDefaultApprovers(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	mc := testutil.NewMCPClient(t, owner)
+	orgID := owner.GetOrganizationID().String()
+	approverID := owner.GetProfileID().String()
+
+	addDocument := func(defaultApproverIDs []string) string {
+		input := map[string]any{
+			"organizationId": orgID,
+			"title":          factory.SafeName("Document"),
+			"content":        "Body content",
+			"classification": "INTERNAL",
+			"documentType":   "POLICY",
+		}
+		if defaultApproverIDs != nil {
+			input["defaultApproverIds"] = defaultApproverIDs
+		}
+
+		var addResult struct {
+			Document struct {
+				ID string `json:"id"`
+			} `json:"document"`
+		}
+		mc.CallToolInto("addDocument", input, &addResult)
+		require.NotEmpty(t, addResult.Document.ID)
+
+		return addResult.Document.ID
+	}
+
+	type publishResult struct {
+		DocumentVersion struct {
+			Status string `json:"status"`
+		} `json:"documentVersion"`
+		ApprovalQuorum *struct {
+			ID string `json:"id"`
+		} `json:"approvalQuorum"`
+	}
+
+	t.Run("requests approval from default approvers", func(t *testing.T) {
+		docID := addDocument([]string{approverID})
+
+		var result publishResult
+		mc.CallToolInto("publishDocument", map[string]any{
+			"documentId": docID,
+			"minor":      false,
+			"changelog":  "Initial major",
+		}, &result)
+
+		require.NotNil(t, result.ApprovalQuorum)
+		assert.Equal(t, "PENDING_APPROVAL", result.DocumentVersion.Status)
+	})
+
+	t.Run("publishes directly without default approvers", func(t *testing.T) {
+		docID := addDocument(nil)
+
+		var result publishResult
+		mc.CallToolInto("publishDocument", map[string]any{
+			"documentId": docID,
+			"minor":      false,
+			"changelog":  "Initial major",
+		}, &result)
+
+		assert.Nil(t, result.ApprovalQuorum)
+		assert.Equal(t, "PUBLISHED", result.DocumentVersion.Status)
+	})
+}