Add document approval workflow

Introduce a complete approval system for document publishing. Document
versions can now require approval from selected reviewers before being
published, with automatic publishing once all approvers have approved.

- Add approval quorum and decision tables with backfill migration
- Implement request approval, approve, and reject flows with electronic
  signature support for approve decisions
- Add employee approvals page with dedicated tab and pending approvals view
- Add changelog field to publish and request approval flows
- Pre-select previous version's approvers in the publish dialog
- Show quorum approvers in document list with 100 approver hard limit
- Expose approval workflow through GraphQL, MCP, and CLI
- Remove legacy default approvers feature entirely
- Add comprehensive e2e test coverage for approval workflows

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-03-27 17:22:54 +01:00
parent 4a2d308da0
commit 999171a626
78 changed files with 6483 additions and 1600 deletions

View File

@@ -35,6 +35,7 @@ type ElectronicSignature struct {
OrganizationID gid.GID `db:"organization_id"`
Status ElectronicSignatureStatus `db:"status"`
DocumentType ElectronicSignatureDocumentType `db:"document_type"`
DocumentName *string `db:"document_name"`
FileID gid.GID `db:"file_id"`
SignerEmail string `db:"signer_email"`
ConsentText string `db:"consent_text"`
@@ -83,11 +84,11 @@ func (es *ElectronicSignature) Insert(
) error {
q := `
INSERT INTO electronic_signatures (
id, tenant_id, organization_id, status, document_type, file_id,
id, tenant_id, organization_id, status, document_type, document_name, file_id,
signer_email, consent_text, seal_version, attempt_count, max_attempts,
created_at, updated_at
) VALUES (
@id, @tenant_id, @organization_id, @status, @document_type, @file_id,
@id, @tenant_id, @organization_id, @status, @document_type, @document_name, @file_id,
@signer_email, @consent_text, @seal_version, @attempt_count, @max_attempts,
@created_at, @updated_at
)
@@ -98,6 +99,7 @@ INSERT INTO electronic_signatures (
"organization_id": es.OrganizationID,
"status": es.Status,
"document_type": es.DocumentType,
"document_name": es.DocumentName,
"file_id": es.FileID,
"signer_email": es.SignerEmail,
"consent_text": es.ConsentText,
@@ -184,7 +186,7 @@ func (es *ElectronicSignature) LoadByID(
) error {
q := `
SELECT
id, tenant_id, organization_id, status, document_type, file_id,
id, tenant_id, organization_id, status, document_type, document_name, file_id,
signer_email, consent_text, signer_full_name, signer_ip_address,
signer_user_agent, file_hash, seal, seal_version, tsa_token, signed_at,
certificate_file_id, certificate_processing_started_at,
@@ -222,7 +224,7 @@ func (es *ElectronicSignature) LoadNextAcceptedForUpdateSkipLocked(
) error {
q := `
SELECT
id, tenant_id, organization_id, status, document_type, file_id,
id, tenant_id, organization_id, status, document_type, document_name, file_id,
signer_email, consent_text, signer_full_name, signer_ip_address,
signer_user_agent, file_hash, seal, seal_version, tsa_token, signed_at,
certificate_file_id, certificate_processing_started_at,
@@ -258,7 +260,7 @@ func (es *ElectronicSignature) LoadNextCompletedWithoutCertificateForUpdate(
) error {
q := `
SELECT
id, tenant_id, organization_id, status, document_type, file_id,
id, tenant_id, organization_id, status, document_type, document_name, file_id,
signer_email, consent_text, signer_full_name, signer_ip_address,
signer_user_agent, file_hash, seal, seal_version, tsa_token, signed_at,
certificate_file_id, certificate_processing_started_at,