Resolve document publish approvers from defaults

The MCP publishDocument tool required callers to pass approver_ids and
to distinguish an omitted list (rejected) from an empty one (direct
publish), a null-vs-empty subtlety that is awkward for an LLM to get
right.

Drop approver_ids from the MCP tool and resolve a major publish's
approvers from the document's default approvers instead: an approval is
requested when the document has default approvers, otherwise the version
is published directly. Default approvers are configured with addDocument
or updateDocument.

Replace a document's default approvers on every major publish that
supplies an explicit list, even when the list is empty, so a direct
publish through the GraphQL API clears stale approvers instead of
leaving them behind (previously the empty case skipped the update).

Expose the default-approver behaviour as a separate entry point,
PublishVersionWithDefaultApprovers, that loads the defaults and
delegates to PublishVersion. PublishVersion keeps its explicit-approver
contract for the GraphQL API.

Require only the publish permission to publish a version, whether or not
it opens an approval quorum, and drop the now-unused request-approval
action.

Fold the publish steps into the publishMinor and publishMajor primitives
shared by both the single and bulk publish paths, and drop the redundant
InTx suffix from RequestApproval and emitDocumentEvent, which already
take a transaction argument.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -6084,23 +6084,17 @@ func (r *Resolver) ListSCIMEventsTool(ctx context.Context, req *mcp.CallToolRequ
 }
 
 func (r *Resolver) PublishDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishDocumentInput) (*mcp.CallToolResult, types.PublishDocumentOutput, error) {
-	action := probo.ActionDocumentVersionPublish
-	if !input.Minor && len(input.ApproverIds) > 0 {
-		action = probo.ActionDocumentVersionRequestApproval
-	}
-
-	scope, err := r.Authorize(ctx, input.DocumentID, action)
+	scope, err := r.Authorize(ctx, input.DocumentID, probo.ActionDocumentVersionPublish)
 	if err != nil {
 		return nil, types.PublishDocumentOutput{}, err
 	}
 
 	svc := r.proboSvc
 
-	result, err := svc.Documents.PublishVersion(ctx, scope, probo.PublishDocumentRequest{
-		DocumentID:  input.DocumentID,
-		Minor:       input.Minor,
-		ApproverIDs: input.ApproverIds,
-		Changelog:   input.Changelog,
+	result, err := svc.Documents.PublishVersionWithDefaultApprovers(ctx, scope, probo.PublishDocumentRequest{
+		DocumentID: input.DocumentID,
+		Minor:      input.Minor,
+		Changelog:  input.Changelog,
 	})
 	if err != nil {
 		panic(fmt.Errorf("cannot publish document: %w", err))

pkg/server/api/mcp/v1/specification.yaml

@@ -6305,12 +6305,7 @@ components:
           description: Document ID
         minor:
           type: boolean
-          description: When true, publish the draft as a minor version; approver_ids must be omitted. When false, publish as a new major version; approver_ids is required (a non-empty list requests approval, an empty list publishes directly without approval).
-        approver_ids:
-          type: array
-          items:
-            $ref: "#/components/schemas/GID"
-          description: "Approver profile IDs. Required when minor is false: pass a non-empty list to request approval (approvers receive an email notification), or an empty list to publish directly without approval. Must be omitted when minor is true."
+          description: When true, publish the draft as a minor version (the document must already have a published major version). When false, publish a new major version using the document's default approvers; if the document has default approvers an approval is requested from them (they receive an email notification), otherwise the version is published directly. Configure a document's default approvers with updateDocument.
         changelog:
           type: string
           description: Changelog for this version
@@ -6328,7 +6323,7 @@ components:
           $ref: "#/components/schemas/DocumentVersion"
         approval_quorum:
           $ref: "#/components/schemas/DocumentVersionApprovalQuorum"
-          description: Set when an approval was requested instead of publishing.
+          description: Set when an approval was requested from the document's default approvers instead of publishing directly.
 
     DeleteDocumentInput:
       type: object