EQMS-1650: External approvers (#9987)

Signed-off-by: Alexey Zinoviev <alexey.zinoviev@xored.com>

dev/doc-import-tool/src/import.ts

@@ -92,6 +92,7 @@ async function createDocument (
     requests: 0,
     reviewers: [],
     approvers: [],
+    externalApprovers: [],
     coAuthors: [],
     changeControl: ccRecordId,
     author: owner,
@@ -175,6 +176,7 @@ async function createTemplateIfNotExist (
     requests: 0,
     reviewers: [],
     approvers: [],
+    externalApprovers: [],
     coAuthors: [],
     changeControl: ccRecordId,
     content: null,

models/controlled-documents/src/index.ts

@@ -20,7 +20,10 @@ import documentsPlugin, {
   documentsId,
   DocumentState,
   type Document,
-  type DocumentSpace
+  type DocumentSpace,
+  type ProjectDocument,
+  type ChangeControl,
+  type DocumentRequest
 } from '@hcengineering/controlled-documents'
 import { type Builder } from '@hcengineering/model'
 import chunter from '@hcengineering/model-chunter'
@@ -977,9 +980,38 @@ export function defineNotifications (builder: Builder): void {
     components: { input: { component: chunter.component.ChatMessageInput } }
   })
 
+  builder.createDoc<ClassCollaborators<Document>>(core.class.ClassCollaborators, core.space.Model, {
+    attachedTo: documents.class.Document,
+    fields: ['author', 'owner'],
+    provideSecurity: true
+  })
+
+  builder.createDoc<ClassCollaborators<ProjectDocument>>(core.class.ClassCollaborators, core.space.Model, {
+    attachedTo: documents.class.ProjectDocument,
+    fields: [],
+    provideSecurity: true
+  })
+
+  builder.createDoc<ClassCollaborators<ChangeControl>>(core.class.ClassCollaborators, core.space.Model, {
+    attachedTo: documents.class.ChangeControl,
+    fields: [],
+    provideSecurity: true
+  })
+
+  builder.createDoc<ClassCollaborators<DocumentRequest>>(core.class.ClassCollaborators, core.space.Model, {
+    attachedTo: documents.class.DocumentRequest,
+    fields: ['requested', 'createdBy'],
+    provideSecurity: true
+  })
+
+  builder.mixin(documents.class.DocumentApprovalRequest, core.class.Class, core.mixin.TxAccessLevel, {
+    updateAccessLevel: AccountRole.Guest
+  })
+
   builder.createDoc<ClassCollaborators<ControlledDocument>>(core.class.ClassCollaborators, core.space.Model, {
     attachedTo: documents.class.ControlledDocument,
-    fields: ['author', 'owner', 'reviewers', 'approvers', 'coAuthors']
+    fields: ['author', 'owner', 'reviewers', 'approvers', 'coAuthors', 'externalApprovers'],
+    provideSecurity: true
   })
 
   builder.createDoc(

models/controlled-documents/src/migration.ts

@@ -145,6 +145,7 @@ async function createProductChangeControlTemplate (tx: TxOperations): Promise<vo
         requests: 0,
         reviewers: [],
         approvers: [],
+        externalApprovers: [],
         coAuthors: [],
         code: `TMPL-${seq.sequence + 1}`,
         seqNumber: 0,
@@ -513,6 +514,19 @@ async function migrateCancelDuplicateActiveRequests (client: MigrationClient): P
   await client.bulk(DOMAIN_REQUEST, operations)
 }
 
+async function migrateExternalApprovers (client: MigrationClient): Promise<void> {
+  await client.update(
+    DOMAIN_DOCUMENTS,
+    {
+      _class: documents.class.ControlledDocument,
+      externalApprovers: { $exists: false }
+    },
+    {
+      externalApprovers: []
+    }
+  )
+}
+
 export const documentsOperation: MigrateOperation = {
   async migrate (client: MigrationClient, mode): Promise<void> {
     await tryMigrate(mode, client, documentsId, [
@@ -550,6 +564,10 @@ export const documentsOperation: MigrateOperation = {
       {
         state: 'migrateCancelDuplicateActiveRequests',
         func: migrateCancelDuplicateActiveRequests
+      },
+      {
+        state: 'migrateExternalApprovers',
+        func: migrateExternalApprovers
       }
     ])
   },

models/controlled-documents/src/types.ts

@@ -382,6 +382,9 @@ export class TControlledDocument extends THierarchyDocument implements Controlle
   @Prop(ArrOf(TypeRef(contact.mixin.Employee)), documents.string.Approvers)
     approvers!: Ref<Employee>[]
 
+  @Prop(ArrOf(TypeRef(contact.mixin.Employee)), documents.string.ExternalApprovers)
+    externalApprovers!: Ref<Employee>[]
+
   @Prop(ArrOf(TypeRef(contact.mixin.Employee)), documents.string.CoAuthors)
     coAuthors!: Ref<Employee>[]
 

packages/core/src/collaborators.ts

@@ -13,7 +13,7 @@
 // limitations under the License.
 //
 
-import core, { Class, ClassCollaborators, Doc, Hierarchy, ModelDb, Ref } from '@hcengineering/core'
+import core, { Class, ClassCollaborators, Doc, Hierarchy, ModelDb, Ref } from '.'
 
 export function getClassCollaborators<T extends Doc> (
   model: ModelDb,

packages/core/src/index.ts

@@ -42,5 +42,6 @@ export * from './clone'
 export * from './common'
 export * from './time'
 export * from './benchmark'
+export * from './collaborators'
 
 export default core

packages/importer/src/importer/importer.ts

@@ -204,6 +204,7 @@ export interface ImportControlledDocumentTemplate extends ImportDoc {
   abstract?: string
   reviewers?: Ref<Employee>[]
   approvers?: Ref<Employee>[]
+  externalApprovers?: Ref<Employee>[]
   coAuthors?: Ref<Employee>[]
   ccReason?: string
   ccImpact?: string
@@ -223,6 +224,7 @@ export interface ImportControlledDocument extends ImportDoc {
   category?: Ref<DocumentCategory>
   reviewers?: Ref<Employee>[]
   approvers?: Ref<Employee>[]
+  externalApprovers?: Ref<Employee>[]
   coAuthors?: Ref<Employee>[]
   author?: Ref<Employee>
   owner?: Ref<Employee>
@@ -999,6 +1001,7 @@ export class WorkspaceImporter {
         category: template.category,
         reviewers: template.reviewers ?? [],
         approvers: template.approvers ?? [],
+        externalApprovers: template.externalApprovers ?? [],
         coAuthors: template.coAuthors ?? [],
         code,
         seqNumber,
@@ -1118,6 +1121,7 @@ export class WorkspaceImporter {
         abstract: document.abstract,
         reviewers: document.reviewers ?? [],
         approvers: document.approvers ?? [],
+        externalApprovers: document.externalApprovers ?? [],
         coAuthors: document.coAuthors ?? [],
         changeControl: changeControlId,
         code,

plugins/controlled-documents-assets/lang/de.json

@@ -42,6 +42,7 @@
     "SearchDocument": "Dokument suchen...",
     "CreateEnVersion": "Version zur Überprüfung erstellen",
     "Approvers": "Genehmiger",
+    "ExternalApprovers": "Externe Genehmiger",
     "CoAuthors": "Co-Autoren",
     "Status": "Status",
     "TemplateName": "Vorlagenname",

plugins/controlled-documents-assets/lang/en.json

@@ -42,6 +42,7 @@
     "SearchDocument": "Search document...",
     "CreateEnVersion": "Create version for review",
     "Approvers": "Approvers",
+    "ExternalApprovers": "External approvers",
     "CoAuthors": "Co-Authors",
     "Status": "Status",
     "TemplateName": "Template name",

plugins/controlled-documents-assets/lang/fr.json

@@ -42,6 +42,7 @@
     "SearchDocument": "Rechercher un document...",
     "CreateEnVersion": "Créer une version pour révision",
     "Approvers": "Approuveurs",
+    "ExternalApprovers": "Approuveurs externes",
     "CoAuthors": "Co-auteurs",
     "Status": "Statut",
     "TemplateName": "Nom du modèle",

plugins/controlled-documents-assets/lang/it.json

@@ -42,6 +42,7 @@
     "SearchDocument": "Cerca documento...",
     "CreateEnVersion": "Crea versione per revisione",
     "Approvers": "Approvatori",
+    "ExternalApprovers": "Approvatori esterni",
     "CoAuthors": "Co-autori",
     "Status": "Stato",
     "TemplateName": "Nome del modello",

plugins/controlled-documents-assets/lang/ja.json

@@ -41,6 +41,7 @@
     "SearchDocument": "ドキュメントを検索...",
     "CreateEnVersion": "レビュー用バージョンを作成",
     "Approvers": "承認者",
+    "ExternalApprovers": "外部承認者",
     "CoAuthors": "共同作成者",
     "Status": "ステータス",
     "TemplateName": "テンプレート名",

plugins/controlled-documents-assets/lang/pt.json

@@ -42,6 +42,7 @@
     "SearchDocument": "Buscar documento...",
     "CreateEnVersion": "Criar versão para revisão",
     "Approvers": "Aprovadores",
+    "ExternalApprovers": "Aprovadores externos",
     "CoAuthors": "Coautores",
     "Status": "Status",
     "TemplateName": "Nome do modelo",

plugins/controlled-documents-assets/lang/ru.json

@@ -42,6 +42,7 @@
     "SearchDocument": "Найти документ...",
     "CreateEnVersion": "Создать версию для оценки",
     "Approvers": "Утверждающие",
+    "ExternalApprovers": "Внешние утверждающие",
     "CoAuthors": "Соавторы",
     "Status": "Статус",
     "TemplateName": "Имя шаблона",

plugins/controlled-documents-assets/lang/zh.json

@@ -42,6 +42,7 @@
     "SearchDocument": "搜索文档...",
     "CreateEnVersion": "创建审核版本",
     "Approvers": "批准人",
+    "ExternalApprovers": "外部批准人",
     "CoAuthors": "共同作者",
     "Status": "状态",
     "TemplateName": "模板名称",

plugins/controlled-documents-resources/src/components/CreateDocument.svelte

@@ -67,6 +67,7 @@
     snapshots: 0,
     reviewers: [],
     approvers: [],
+    externalApprovers: [],
     coAuthors: [],
     changeControl: '' as Ref<ChangeControl>,
     content: null

plugins/controlled-documents-resources/src/components/DocumentTemplates.svelte

@@ -14,8 +14,8 @@
 -->
 <script lang="ts">
   import { Mixin, DocumentQuery, Ref } from '@hcengineering/core'
-  import { DocumentSpace, type DocumentTemplate } from '@hcengineering/controlled-documents'
-  import { ActionContext, createQuery } from '@hcengineering/presentation'
+  import { type DocumentTemplate } from '@hcengineering/controlled-documents'
+  import { ActionContext } from '@hcengineering/presentation'
   import { Button, IconAdd, Loading, showPopup } from '@hcengineering/ui'
   import view, { ViewOptions, Viewlet, ViewletPreference } from '@hcengineering/view'
   import { TableBrowser, ViewletPanelHeader } from '@hcengineering/view-resources'
@@ -34,22 +34,7 @@
   let loading = true
   const _class: Ref<Mixin<DocumentTemplate>> = documents.mixin.DocumentTemplate
 
-  let spaces: Ref<DocumentSpace>[] = []
-  const spacesQuery = createQuery()
-  $: spacesQuery.query(
-    documents.class.DocumentSpace,
-    {},
-    (res) => {
-      spaces = res.map((s) => s._id)
-    },
-    {
-      projection: {
-        _id: 1
-      }
-    }
-  )
-
-  $: srcQuery = { ...query, space: { $in: spaces } }
+  $: srcQuery = { ...query }
   $: canAddTemplate = checkMyPermission(
     documents.permission.CreateDocument,
     documents.space.QualityDocuments,

plugins/controlled-documents-resources/src/components/DocumentsContainer.svelte

@@ -17,11 +17,10 @@
   import { Class, DocumentQuery, Ref, Space } from '@hcengineering/core'
   import type { IntlString, Asset } from '@hcengineering/platform'
   import { IModeSelector, resolvedLocationStore } from '@hcengineering/ui'
-  import documents, { type Document, type DocumentSpace, DocumentState } from '@hcengineering/controlled-documents'
+  import { type Document, DocumentState } from '@hcengineering/controlled-documents'
 
   import Documents from './Documents.svelte'
   import document from '../plugin'
-  import { createQuery } from '@hcengineering/presentation'
 
   export let _class: Ref<Class<Document>> = document.class.Document
   export let query: DocumentQuery<Document> = {}
@@ -36,29 +35,13 @@
   let mode: string | undefined = undefined
   let modeSelectorProps: IModeSelector | undefined = undefined
 
-  let spaces: Ref<DocumentSpace>[] = []
-  const spacesQuery = createQuery()
-
-  $: spacesQuery.query(
-    documents.class.DocumentSpace,
-    {},
-    (res) => {
-      spaces = res.map((s) => s._id)
-    },
-    {
-      projection: {
-        _id: 1
-      }
-    }
-  )
-
   // NOTE: we have to use "{ type: { $in:" queries below. Otherwise, it breaks when combined
   // with custom Filters added by State.
-  $: inProgress = { state: { $in: [DocumentState.Draft] }, space: { $in: spaces } }
-  $: effective = { state: { $in: [DocumentState.Effective] }, space: { $in: spaces } }
-  $: archived = { state: { $in: [DocumentState.Archived, DocumentState.Deleted] }, space: { $in: spaces } }
-  $: obsolete = { state: { $in: [DocumentState.Obsolete] }, space: { $in: spaces } }
-  $: all = { space: { $in: spaces } }
+  $: inProgress = { state: { $in: [DocumentState.Draft] } }
+  $: effective = { state: { $in: [DocumentState.Effective] } }
+  $: archived = { state: { $in: [DocumentState.Archived, DocumentState.Deleted] } }
+  $: obsolete = { state: { $in: [DocumentState.Obsolete] } }
+  $: all = {}
 
   $: queries = { inProgress, effective, archived, obsolete, all }
 

plugins/controlled-documents-resources/src/components/TeamPopup.svelte

@@ -11,7 +11,7 @@
     ControlledDocumentState,
     DocumentRequest
   } from '@hcengineering/controlled-documents'
-  import { Class, Ref } from '@hcengineering/core'
+  import { Class, Ref, TxOperations } from '@hcengineering/core'
   import { getClient } from '@hcengineering/presentation'
   import { RequestStatus } from '@hcengineering/request'
   import { Label, ModernDialog, showPopup } from '@hcengineering/ui'
@@ -21,6 +21,14 @@
   import { sendApprovalRequest, sendReviewRequest } from '../utils'
   import SignatureDialog from './SignatureDialog.svelte'
 
+  type SendRequestFunc = (
+    client: TxOperations,
+    controlledDoc: ControlledDocument,
+    users: Array<Ref<Employee>>,
+    externalUsers: Array<Ref<Employee>>,
+    oldExternalUsers: Array<Ref<Employee>>
+  ) => Promise<void>
+
   export let controlledDoc: ControlledDocument
   export let requestClass: Ref<Class<DocumentRequest>>
   export let readonly: boolean = false
@@ -34,7 +42,7 @@
 
   const docField: keyof ControlledDocument = isReviewRequest ? 'reviewers' : 'approvers'
   const label = isReviewRequest ? documentsRes.string.SelectReviewers : documentsRes.string.SelectApprovers
-  const sendRequestFunc = isReviewRequest ? sendReviewRequest : sendApprovalRequest
+  const sendRequestFunc: SendRequestFunc = isReviewRequest ? sendReviewRequest : sendApprovalRequest
   const permissionId = isReviewRequest ? documents.permission.ReviewDocument : documents.permission.ApproveDocument
   $: permissionsSpace =
     controlledDoc.space === documents.space.UnsortedTemplates ? documents.space.QualityDocuments : controlledDoc.space
@@ -54,12 +62,14 @@
     })
 
   let users: Ref<Employee>[] = controlledDoc[docField] ?? []
+  let externalUsers: Ref<Employee>[] = isReviewRequest ? [] : controlledDoc.externalApprovers ?? []
+  const existingExternalUsers = externalUsers
 
   async function submit (): Promise<void> {
     const complete = async (): Promise<void> => {
       loading = true
 
-      await sendRequestFunc?.(client, controlledDoc, users)
+      await sendRequestFunc?.(client, controlledDoc, users, isReviewRequest ? [] : externalUsers, existingExternalUsers)
 
       loading = false
 
@@ -86,11 +96,11 @@
     }
   }
 
-  $: canSubmit = docRequest === undefined && users.length > 0
+  $: canSubmit = docRequest === undefined && (users.length > 0 || externalUsers.length > 0)
 </script>
 
 <ModernDialog {loading} {label} {canSubmit} on:submit={submit} on:close>
-  <div class="flex-col pt-2">
+  <div class="flex-col pt-2 flex-gap-4">
     <div class="flex">
       <div class="flex labelContainer">
         <div class="label mr-1">
@@ -113,6 +123,31 @@
         />
       </div>
     </div>
+    {#if !isReviewRequest}
+      <div class="flex">
+        <div class="flex labelContainer">
+          <div class="label mr-1">
+            <Label label={documentsRes.string.ExternalApprovers} />
+          </div>
+          {externalUsers?.length}
+        </div>
+        <div class="flex-col">
+          <UserBoxItems
+            items={externalUsers}
+            label={documentsRes.string.ExternalApprovers}
+            readonly={controlledDoc.controlledState === ControlledDocumentState.InReview ||
+              controlledDoc.controlledState === ControlledDocumentState.InApproval ||
+              readonly}
+            docQuery={{
+              active: true,
+              role: 'GUEST',
+              _id: { $nin: permittedEmployees }
+            }}
+            on:update={({ detail }) => (externalUsers = detail)}
+          />
+        </div>
+      </div>
+    {/if}
   </div>
 </ModernDialog>
 

plugins/controlled-documents-resources/src/components/create-doc/QmsDocumentWizard.svelte

@@ -53,6 +53,7 @@
     currentStepUpdated
   } from '../../stores/wizards/create-document'
   import FailedToCreateDocument from '../FailedToCreateDocument.svelte'
+  import { updateExternalApproversAccess } from '../../utils'
 
   export let _class: Ref<Class<ControlledDocument>> = documents.class.ControlledDocument
 
@@ -119,6 +120,7 @@
     requests: 0,
     reviewers: [],
     approvers: [],
+    externalApprovers: [],
     coAuthors: [],
     plannedEffectiveDate: 0,
     reviewInterval: DEFAULT_PERIODIC_REVIEW_INTERVAL
@@ -176,6 +178,14 @@
 
     await createChangeControl(client, ccRecordId, ccRecord, _space)
 
+    if (docObject.externalApprovers.length > 0) {
+      const controlledDoc = await client.findOne(documents.class.ControlledDocument, { _id: newDocId })
+
+      if (controlledDoc !== undefined) {
+        await updateExternalApproversAccess(client, controlledDoc, docObject.externalApprovers, [])
+      }
+    }
+
     const loc = getProjectDocumentLink(newDocId, $locationStep.project)
     navigate(loc)
 

plugins/controlled-documents-resources/src/components/create-doc/QmsTemplateWizard.svelte

@@ -52,6 +52,7 @@
     wizardClosed
   } from '../../stores/wizards/create-document'
   import FailedToCreateDocument from '../FailedToCreateDocument.svelte'
+  import { updateExternalApproversAccess } from '../../utils'
 
   export let _class: Ref<Class<ControlledDocument>> = documents.class.ControlledDocument
   export let _templateMixin: Ref<Mixin<DocumentTemplate>> = documents.mixin.DocumentTemplate
@@ -114,6 +115,7 @@
     requests: 0,
     reviewers: [],
     approvers: [],
+    externalApprovers: [],
     coAuthors: [],
     plannedEffectiveDate: 0,
     reviewInterval: DEFAULT_PERIODIC_REVIEW_INTERVAL
@@ -178,6 +180,14 @@
 
     await createChangeControl(client, ccRecordId, ccRecord, space)
 
+    if (docObject.externalApprovers.length > 0) {
+      const controlledDoc = await client.findOne(documents.class.ControlledDocument, { _id: newDocId })
+
+      if (controlledDoc !== undefined) {
+        await updateExternalApproversAccess(client, controlledDoc, docObject.externalApprovers, [])
+      }
+    }
+
     const loc = getProjectDocumentLink(newDocId, $locationStep.project)
     navigate(loc)
 

plugins/controlled-documents-resources/src/components/create-doc/steps/TeamStep.svelte

@@ -26,7 +26,7 @@
   async function handleUpdate ({
     detail
   }: {
-    detail: { type: 'reviewers' | 'approvers', users: Ref<Employee>[] }
+    detail: { type: 'reviewers' | 'approvers' | 'coAuthors' | 'externalApprovers', users: Ref<Employee>[] }
   }): Promise<void> {
     if (docObject === undefined) {
       return
@@ -40,11 +40,20 @@
   $: reviewers = docObject?.reviewers ?? []
   $: approvers = docObject?.approvers ?? []
   $: coAuthors = docObject?.coAuthors ?? []
+  $: externalApprovers = docObject?.externalApprovers ?? []
 </script>
 
 {#if docObject !== undefined}
   <div class="root">
-    <DocTeam controlledDoc={docObject} {space} on:update={handleUpdate} {approvers} {reviewers} {coAuthors} />
+    <DocTeam
+      controlledDoc={docObject}
+      {space}
+      on:update={handleUpdate}
+      {approvers}
+      {reviewers}
+      {coAuthors}
+      {externalApprovers}
+    />
   </div>
 {/if}
 

plugins/controlled-documents-resources/src/components/document/DocTeam.svelte

@@ -27,6 +27,7 @@
   export let canChangeCoAuthors: boolean = true
   export let reviewers: Ref<Employee>[] = controlledDoc?.reviewers ?? []
   export let approvers: Ref<Employee>[] = controlledDoc?.approvers ?? []
+  export let externalApprovers: Ref<Employee>[] = controlledDoc?.externalApprovers ?? []
   export let coAuthors: Ref<Employee>[] = controlledDoc?.coAuthors ?? []
 
   const dispatch = createEventDispatcher()
@@ -52,7 +53,10 @@
     $permissionsStore
   ).filter((person) => person !== currentEmployee) as Ref<Employee>[]
 
-  function handleUsersUpdated (type: 'reviewers' | 'approvers' | 'coAuthors', users: Ref<Employee>[]): void {
+  function handleUsersUpdated (
+    type: 'reviewers' | 'approvers' | 'coAuthors' | 'externalApprovers',
+    users: Ref<Employee>[]
+  ): void {
     dispatch('update', { type, users })
   }
 </script>
@@ -120,6 +124,28 @@
       }}
     />
   </div>
+  <div class="mt-6 mb-6 divider" />
+  <div class="flex labelContainer">
+    <div class="label mr-1">
+      <Label label={documents.string.ExternalApprovers} />
+    </div>
+    {externalApprovers?.length}
+  </div>
+  <div class="flex-col mt-4">
+    <UserBoxItems
+      items={externalApprovers}
+      docQuery={{
+        active: true,
+        role: 'GUEST',
+        _id: { $nin: permittedApprovers }
+      }}
+      label={documents.string.ExternalApprovers}
+      readonly={!canChangeApprovers}
+      on:update={({ detail }) => {
+        handleUsersUpdated('externalApprovers', detail)
+      }}
+    />
+  </div>
 </div>
 
 <style lang="scss">

plugins/controlled-documents-resources/src/components/document/EditDocTeam.svelte

@@ -13,19 +13,20 @@
 // limitations under the License.
 -->
 <script lang="ts">
-  import { Employee, Person } from '@hcengineering/contact'
-  import {
+  import contact, { Employee, Person } from '@hcengineering/contact'
+  import documents, {
     ControlledDocument,
     ControlledDocumentState,
     DocumentApprovalRequest,
     DocumentReviewRequest,
     DocumentState
   } from '@hcengineering/controlled-documents'
-  import { DocumentUpdate, Ref } from '@hcengineering/core'
+  import core, { AccountUuid, DocumentUpdate, notEmpty, PersonUuid, Ref } from '@hcengineering/core'
   import { getClient } from '@hcengineering/presentation'
   import { Scroller } from '@hcengineering/ui'
 
   import DocTeam from './DocTeam.svelte'
+  import { updateExternalApproversAccess } from '../../utils'
 
   export let controlledDoc: ControlledDocument
   export let editable: boolean = true
@@ -46,7 +47,8 @@
   $: canChangeApprovers = isEditableDraft && (inCleanState || inApproval || inReview || isReviewed)
 
   $: reviewers = (reviewRequest?.requested as Ref<Employee>[]) ?? controlledDoc.reviewers
-  $: approvers = (approvalRequest?.requested as Ref<Employee>[]) ?? controlledDoc.approvers
+  $: approvers = controlledDoc.approvers
+  $: externalApprovers = controlledDoc.externalApprovers
   $: coAuthors = controlledDoc.coAuthors
 
   const client = getClient()
@@ -54,13 +56,22 @@
   async function handleUpdate ({
     detail
   }: {
-    detail: { type: 'reviewers' | 'approvers', users: Ref<Person>[] }
+    detail: { type: 'reviewers' | 'approvers' | 'externalApprovers', users: Ref<Person>[] }
   }): Promise<void> {
     const { type, users } = detail
 
     const request = detail.type === 'reviewers' ? reviewRequest : approvalRequest
+    let requestUsers: Ref<Person>[] = []
 
-    const ops = client.apply()
+    if (type === 'reviewers') {
+      requestUsers = users
+    } else if (type === 'externalApprovers') {
+      requestUsers = [...controlledDoc.approvers, ...users]
+    } else if (type === 'approvers') {
+      requestUsers = [...users, ...controlledDoc.externalApprovers]
+    }
+
+    const ops = client.apply(controlledDoc._id)
 
     if (request?._id !== undefined) {
       const requested = request.requested?.slice() ?? []
@@ -69,7 +80,7 @@
       const addedPersons = new Set<Ref<Person>>()
       const removedPersons = new Set<Ref<Person>>(requested)
 
-      for (const u of users) {
+      for (const u of requestUsers) {
         if (requestedSet.has(u)) {
           removedPersons.delete(u)
         } else {
@@ -87,7 +98,7 @@
         approvedDates.splice(idx, 1)
       }
 
-      const requiredApprovesCount = users.length
+      const requiredApprovesCount = requestUsers.length
       const requestedQuery: DocumentUpdate<DocumentReviewRequest | DocumentApprovalRequest> = {}
 
       if (addedPersons.size > 0) {
@@ -107,8 +118,8 @@
       })
     }
 
-    const added = new Set()
-    const removed = new Set()
+    const added = new Set<Ref<Person>>()
+    const removed = new Set<Ref<Person>>()
 
     for (const user of users) {
       if (!controlledDoc[type].includes(user as Ref<Employee>)) {
@@ -133,6 +144,11 @@
     if (Object.keys(updateQuery).length > 0) {
       await ops.update(controlledDoc, updateQuery)
     }
+
+    if (type === 'externalApprovers') {
+      await updateExternalApproversAccess(client, controlledDoc, Array.from(added), Array.from(removed))
+    }
+
     await ops.commit()
   }
 </script>
@@ -148,6 +164,7 @@
         {canChangeApprovers}
         {reviewers}
         {approvers}
+        {externalApprovers}
         {coAuthors}
         on:update={handleUpdate}
       />

plugins/controlled-documents-resources/src/docutils.ts

@@ -122,6 +122,7 @@ export async function createNewDraftForControlledDoc (
     abstract: document.abstract ?? '',
     reviewers: document.reviewers,
     approvers: document.approvers,
+    externalApprovers: [], // Require manual request for all external approvers for new versions of documents. Automatic carry-on would require to set collaborators to all related documents.
     coAuthors: document.coAuthors,
     reviewInterval: document.reviewInterval,
     changeControl: newCCId,

plugins/controlled-documents-resources/src/stores/editors/document/query.ts

@@ -145,22 +145,20 @@ const queryReviewRequestHistoryFx = createEffect(
   }
 )
 
-const queryApprovalRequestFx = createEffect(
-  (payload: { _id: Ref<ControlledDocument>, _class: Ref<Class<ControlledDocument>> }) => {
-    const { _id, _class } = payload
-    if (_id == null || _class == null) {
-      approvalRequestQuery.unsubscribe()
-      return
-    }
-    approvalRequestQuery.query(
-      documents.class.DocumentApprovalRequest,
-      { attachedTo: _id, attachedToClass: _class, status: RequestStatus.Active },
-      (result) => {
-        approvalRequestUpdated(result[0] ?? null)
-      }
-    )
+const queryApprovalRequestFx = createEffect((payload: { _id: Ref<ControlledDocument> }) => {
+  const { _id } = payload
+  if (_id == null) {
+    approvalRequestQuery.unsubscribe()
+    return
   }
-)
+  approvalRequestQuery.query(
+    documents.class.DocumentApprovalRequest,
+    { attachedTo: _id, status: RequestStatus.Active },
+    (result) => {
+      approvalRequestUpdated(result[0] ?? null)
+    }
+  )
+})
 
 const queryDocumentCommentsFx = createEffect(
   (payload: { document: Document | null, filter: DocumentCommentsFilter }) => {

plugins/controlled-documents-resources/src/utils.ts

@@ -13,7 +13,7 @@
 // limitations under the License.
 
 import chunter from '@hcengineering/chunter'
-import { type Employee, type Person, getCurrentEmployee } from '@hcengineering/contact'
+import contact, { type Employee, type Person, getCurrentEmployee } from '@hcengineering/contact'
 import documents, {
   type ControlledDocument,
   type Document,
@@ -52,9 +52,12 @@ import core, {
   type Tx,
   type TxOperations,
   type WithLookup,
+  type AccountUuid,
+  type Collaborator,
   SortingOrder,
   checkPermission,
-  getCurrentAccount
+  getCurrentAccount,
+  notEmpty
 } from '@hcengineering/core'
 import { type IntlString, translate } from '@hcengineering/platform'
 import { createQuery, getClient, MessageBox } from '@hcengineering/presentation'
@@ -245,7 +248,9 @@ export async function sendReviewRequest (
 export async function sendApprovalRequest (
   client: TxOperations,
   controlledDoc: ControlledDocument,
-  approvers: Array<Ref<Employee>>
+  approvers: Array<Ref<Employee>>,
+  externalApprovers: Array<Ref<Employee>>,
+  oldExternalApprovers: Array<Ref<Employee>>
 ): Promise<void> {
   const approveTx = client.txFactory.createTxUpdateDoc(controlledDoc._class, controlledDoc.space, controlledDoc._id, {
     controlledState: ControlledDocumentState.Approved
@@ -255,24 +260,120 @@ export async function sendApprovalRequest (
     controlledState: ControlledDocumentState.Rejected
   })
 
-  await client.update(controlledDoc, {
+  const added = new Set<Ref<Person>>()
+  const removed = new Set<Ref<Person>>()
+
+  for (const user of externalApprovers) {
+    if (!oldExternalApprovers.includes(user)) {
+      added.add(user)
+    }
+  }
+
+  for (const user of oldExternalApprovers) {
+    if (!externalApprovers.includes(user)) {
+      removed.add(user)
+    }
+  }
+
+  const ops = client.apply(controlledDoc._id)
+
+  await ops.update(controlledDoc, {
     approvers,
+    externalApprovers,
     controlledState: ControlledDocumentState.InApproval
   })
 
+  await updateExternalApproversAccess(ops, controlledDoc, Array.from(added), Array.from(removed))
+
+  await ops.commit()
+
   await createRequest(
     client,
     controlledDoc._id,
     controlledDoc._class,
     documents.class.DocumentApprovalRequest,
     controlledDoc.space,
-    approvers,
+    [...approvers, ...externalApprovers],
     approveTx,
     rejectTx,
     true
   )
 }
 
+export async function updateExternalApproversAccess (
+  client: TxOperations,
+  controlledDoc: ControlledDocument,
+  added: Array<Ref<Person>>,
+  removed: Array<Ref<Person>>
+): Promise<void> {
+  if (added.length > 0) {
+    const addedPersons = (
+      await client.findAll(contact.class.Person, {
+        _id: { $in: added }
+      })
+    ).filter((p) => p.personUuid != null)
+    const projectDocs = await client.findAll(documents.class.ProjectDocument, {
+      document: controlledDoc._id
+    })
+
+    for (const person of addedPersons) {
+      for (const projectDoc of projectDocs) {
+        await client.createDoc(core.class.Collaborator, controlledDoc.space, {
+          attachedTo: projectDoc._id,
+          attachedToClass: projectDoc._class,
+          collection: 'collaborators',
+          collaborator: person.personUuid as AccountUuid
+        })
+      }
+
+      if (controlledDoc.changeControl !== undefined) {
+        await client.createDoc(core.class.Collaborator, controlledDoc.space, {
+          attachedTo: controlledDoc.changeControl,
+          attachedToClass: documents.class.ChangeControl,
+          collection: 'collaborators',
+          collaborator: person.personUuid as AccountUuid
+        })
+      }
+    }
+  }
+
+  if (removed.length > 0) {
+    const removedPersons = await client.findAll(contact.class.Person, {
+      _id: { $in: removed }
+    })
+    const removedPersonUuids = removedPersons.map((rp) => rp.personUuid as AccountUuid).filter(notEmpty)
+    const removedControlledDocCollabs: Collaborator[] =
+      removedPersons.length === 0
+        ? []
+        : await client.findAll(core.class.Collaborator, {
+          attachedTo: controlledDoc._id,
+          attachedToClass: controlledDoc._class,
+          collection: 'collaborators',
+          collaborator: { $in: removedPersonUuids }
+        })
+    const projectDocs = await client.findAll(documents.class.ProjectDocument, {
+      document: controlledDoc._id
+    })
+    const removedProjectDocCollabs = await client.findAll(core.class.Collaborator, {
+      attachedTo: { $in: projectDocs.map((pd) => pd._id) },
+      attachedToClass: documents.class.ProjectDocument,
+      collection: 'collaborators',
+      collaborator: { $in: removedPersonUuids }
+    })
+
+    const changeControlCollabs = await client.findAll(core.class.Collaborator, {
+      attachedTo: controlledDoc.changeControl,
+      attachedToClass: documents.class.ChangeControl,
+      collection: 'collaborators',
+      collaborator: { $in: removedPersonUuids }
+    })
+
+    for (const collab of [...removedControlledDocCollabs, ...removedProjectDocCollabs, ...changeControlCollabs]) {
+      await client.remove(collab)
+    }
+  }
+}
+
 async function createRequest<T extends Doc> (
   client: TxOperations,
   attachedTo: Ref<T>,

plugins/controlled-documents/src/plugin.ts

@@ -183,6 +183,7 @@ export const documentsPlugin = plugin(documentsId, {
     Approval: '' as IntlString,
     Reviewers: '' as IntlString,
     Approvers: '' as IntlString,
+    ExternalApprovers: '' as IntlString,
     CoAuthors: '' as IntlString,
     ReviewInterval: '' as IntlString,
     EffectiveDate: '' as IntlString,

plugins/controlled-documents/src/types.ts

@@ -207,6 +207,7 @@ export interface ControlledDocument extends HierarchyDocument {
   requests: CollectionSize<DocumentRequest> // A collection of attached review and approval requests for the document
   reviewers: Ref<Employee>[]
   approvers: Ref<Employee>[]
+  externalApprovers: Ref<Employee>[]
   coAuthors: Ref<Employee>[]
   reviewInterval?: number // A period (in months) after which the released document must be reviewed again
   controlledState?: ControlledDocumentState

plugins/notification-resources/src/utils.ts

@@ -34,13 +34,13 @@ import core, {
   type Ref,
   SortingOrder,
   type TxOperations,
-  type WithLookup
+  type WithLookup,
+  getClassCollaborators
 } from '@hcengineering/core'
 import notification, {
   type ActivityInboxNotification,
   type DisplayInboxNotification,
   type DocNotifyContext,
-  getClassCollaborators,
   type InboxNotification,
   type MentionInboxNotification,
   notificationId,

plugins/notification/src/index.ts

@@ -45,7 +45,6 @@ import { PersonSpace } from '@hcengineering/contact'
 import { Readable, Writable } from './types'
 
 export * from './types'
-export * from './utils'
 
 export const DOMAIN_NOTIFICATION = 'notification' as Domain
 export const DOMAIN_DOC_NOTIFY = 'notification-dnc' as Domain

qms-tests/sanity/tests/model/documents/document-content-page.ts

@@ -331,7 +331,7 @@ export class DocumentContentPage extends DocumentCommonPage {
   }
 
   async clickAddMember (): Promise<void> {
-    await this.addMember.click()
+    await this.addMember.first().click()
   }
 
   async checkIfMemberDropdownHasMember (member: string, contains: boolean): Promise<void> {
@@ -745,7 +745,7 @@ export class DocumentContentPage extends DocumentCommonPage {
   }
 
   async fillSelectApproversForm (approvers: Array<string>, skipConfirm: boolean = false): Promise<void> {
-    await this.buttonAddMembers.click()
+    await this.buttonAddMembers.first().click()
     for (const approver of approvers) {
       await this.selectListItemWithSearch(this.page, approver)
     }

qms-tests/sanity/tests/model/documents/templates-page.ts

@@ -72,7 +72,7 @@ export class TemplatesPage extends CalendarPage {
     }
 
     if (data.approvers != null) {
-      await this.page.locator('div.addButton').last().click()
+      await this.page.locator('div.addButton').nth(2).click()
       for (const approver of data.approvers) {
         await this.selectListItemWithSearch(this.page, approver)
       }

server-plugins/activity-resources/src/references.ts

@@ -35,13 +35,10 @@ import core, {
   TxProcessor,
   type TxRemoveDoc,
   type TxUpdateDoc,
-  type Type
+  type Type,
+  getClassCollaborators
 } from '@hcengineering/core'
-import notification, {
-  getClassCollaborators,
-  type MentionInboxNotification,
-  type NotificationType
-} from '@hcengineering/notification'
+import notification, { type MentionInboxNotification, type NotificationType } from '@hcengineering/notification'
 import { getPerson } from '@hcengineering/server-contact'
 import { type StorageAdapter, type TriggerControl } from '@hcengineering/server-core'
 import {

server-plugins/chunter-resources/src/index.ts

@@ -36,9 +36,10 @@ import core, {
   TxProcessor,
   TxUpdateDoc,
   UserStatus,
+  getClassCollaborators,
   type MeasureContext
 } from '@hcengineering/core'
-import notification, { DocNotifyContext, getClassCollaborators, NotificationContent } from '@hcengineering/notification'
+import notification, { DocNotifyContext, NotificationContent } from '@hcengineering/notification'
 import { getMetadata, IntlString, translate } from '@hcengineering/platform'
 import { getAccountBySocialId, getPerson } from '@hcengineering/server-contact'
 import serverCore, { TriggerControl } from '@hcengineering/server-core'

server-plugins/notification-resources/src/index.ts

@@ -47,13 +47,13 @@ import core, {
   TxMixin,
   TxProcessor,
   TxRemoveDoc,
-  TxUpdateDoc
+  TxUpdateDoc,
+  getClassCollaborators
 } from '@hcengineering/core'
 import notification, {
   ActivityInboxNotification,
   CommonInboxNotification,
   DocNotifyContext,
-  getClassCollaborators,
   InboxNotification,
   MentionInboxNotification,
   NotificationType

server/middleware/src/spaceSecurity.ts

@@ -26,6 +26,7 @@ import core, {
   DOMAIN_MODEL,
   type FindResult,
   generateId,
+  getClassCollaborators,
   type LookupData,
   type MeasureContext,
   type ObjQueryType,
@@ -456,12 +457,12 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
     }
 
     ctx.contextData.broadcast.targets.spaceSec = async (tx) => {
+      const cud = tx as TxCUD<Doc>
+      if (cud.objectClass === undefined) return undefined
+
+      // For system and main spaces broadcast to all users except guests that are not collaborators for objects with collab security enabled
       if (this.systemSpaces.has(tx.objectSpace) || this.mainSpaces.has(tx.objectSpace)) {
-        const cud = tx as TxCUD<Doc>
-        if (cud.objectClass === undefined) return undefined
-        const collabSec = this.context.modelDb.findAllSync(core.class.ClassCollaborators, {
-          attachedTo: cud.objectClass
-        })[0]
+        const collabSec = getClassCollaborators(this.context.modelDb, this.context.hierarchy, cud.objectClass)
         if (collabSec?.provideSecurity === true) {
           const guests = new Set<AccountUuid>()
           for (const val of ctx.contextData.socialStringsToUsers.values()) {
@@ -483,7 +484,26 @@ export class SpaceSecurityMiddleware extends BaseMiddleware implements Middlewar
       const space = this.spacesMap.get(tx.objectSpace)
       if (space === undefined) return undefined
 
-      return space.members.length === 0 ? undefined : { target: this.getTargets(space?.members) }
+      // For all other spaces broadcast to space members + guests that are collaborators for objects with collab security enabled
+      let collabTargets: AccountUuid[] = []
+      const collabSec = getClassCollaborators(this.context.modelDb, this.context.hierarchy, cud.objectClass)
+      if (collabSec?.provideSecurity === true) {
+        const guests = new Set<AccountUuid>()
+        for (const val of ctx.contextData.socialStringsToUsers.values()) {
+          if ([AccountRole.Guest, AccountRole.ReadOnlyGuest].includes(val.role)) {
+            guests.add(val.accontUuid)
+          }
+        }
+        const collaboratorObjs = (await this.next?.findAll(ctx, core.class.Collaborator, {
+          attachedTo: cud.objectId
+        })) as Collaborator[]
+
+        collabTargets = collaboratorObjs.map((it) => it.collaborator).filter((it) => guests.has(it))
+      }
+      const spaceTargets = space.members.length === 0 ? [] : this.getTargets(space?.members)
+      const target = [...collabTargets, ...spaceTargets]
+
+      return target.length === 0 ? undefined : { target }
     }
 
     await this.next?.handleBroadcast(ctx)

server/postgres/src/storage.ts

@@ -59,7 +59,8 @@ import core, {
   withContext,
   type WithLookup,
   type WorkspaceIds,
-  type WorkspaceUuid
+  type WorkspaceUuid,
+  getClassCollaborators
 } from '@hcengineering/core'
 import {
   type ConnectionMgr,
@@ -598,14 +599,14 @@ abstract class PostgresAdapterBase implements DbAdapter {
         const privateCheck = domain === DOMAIN_SPACE ? ' OR sec.private = false' : ''
         const archivedCheck = showArchived ? '' : ' AND sec.archived = false'
         const q = `(sec._id = '${core.space.Space}' OR sec."_class" = '${core.class.SystemSpace}' OR sec.members @> '{"${acc.uuid}"}'${privateCheck})${archivedCheck}`
-        const res = `INNER JOIN ${translateDomain(DOMAIN_SPACE)} AS sec ON sec._id = ${domain}.${key} AND sec."workspaceId" = ${vars.add(this.workspaceId, '::uuid')} AND ${q}`
+        const res = `INNER JOIN ${translateDomain(DOMAIN_SPACE)} AS sec ON sec._id = ${domain}.${key} AND sec."workspaceId" = ${vars.add(this.workspaceId, '::uuid')}`
 
-        const collabSec = this.modelDb.findAllSync(core.class.ClassCollaborators, { attachedTo: _class })[0]
+        const collabSec = getClassCollaborators(this.modelDb, this.hierarchy, _class)
         if (collabSec?.provideSecurity === true && [AccountRole.Guest, AccountRole.ReadOnlyGuest].includes(acc.role)) {
-          const collab = ` INNER JOIN ${translateDomain(DOMAIN_COLLABORATOR)} AS collab_sec ON collab_sec.collaborator = '${acc.uuid}' AND collab_sec."attachedTo" = ${domain}._id AND collab_sec."workspaceId" = ${vars.add(this.workspaceId, '::uuid')} AND ${q}`
+          const collab = ` INNER JOIN ${translateDomain(DOMAIN_COLLABORATOR)} AS collab_sec ON collab_sec.collaborator = '${acc.uuid}' AND collab_sec."attachedTo" = ${domain}._id AND collab_sec."workspaceId" = ${vars.add(this.workspaceId, '::uuid')} OR ${q}`
           return res + collab
         }
-        return res
+        return `${res} AND ${q}`
       }
     }
   }