Move document classification from document to document version

[SachaProbo]

Classification now lives exclusively on DocumentVersion. The field is removed from the Document model, all SQL queries, GraphQL Document type, SignableDocument type, UpdateDocumentInput, and MCP Document schema.

New documents still accept classification in CreateDocumentInput, applied to the first version. New drafts inherit classification from the previous version. PDF generation uses the version classification.

The drawer allows editing classification on draft versions via the updateDocumentVersion mutation. Classification is read-only on published versions.

---

Summary by cubic

Moved document classification from Document to DocumentVersion to enable per‑version classification. UI, APIs, and PDFs now use version classification; drafts are editable, published versions are read‑only.

• New Features

  • Classification is version‑scoped; edit via updateDocumentVersion on drafts only.
  • createDocument still accepts classification; applied to the first version. New drafts inherit the previous version’s classification.
  • Console and employee lists show the latest version’s classification. PDF output uses version classification.
  • GraphQL/MCP: added EmployeeDocumentVersion.classification; removed classification from Document/EmployeeDocument. UpdateDocumentVersionInput now has optional content and optional classification.

• Migration

  • Run the DB migration to set documents.classification default to SECRET; the column will be dropped later.
  • Remove classification from GraphQL Document/EmployeeDocument and from UpdateDocumentInput; read from the latest version instead.
  • Use updateDocumentVersion with documentVersionId to change classification; pass optional classification (and optional content). Update MCP clients similarly.

^{Written for commit 5d6d0bd. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 15 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/console/src/pages/organizations/documents/_components/DocumentListItem.tsx">

<violation number="1" location="apps/console/src/pages/organizations/documents/_components/DocumentListItem.tsx:87">
P2: Delete errors are swallowed: the confirmation promise resolves on both GraphQL and network failures, so failed deletes are treated as success.</violation>
</file>

<file name="pkg/coredata/document.go">

<violation number="1" location="pkg/coredata/document.go:37">
P1: Two document-loading queries still select `classification` from `documents`, which will break after this PR’s schema move to version-level classification.</violation>
</file>

<file name="apps/console/src/pages/organizations/documents/_components/DocumentLayoutDrawer.tsx">

<violation number="1" location="apps/console/src/pages/organizations/documents/_components/DocumentLayoutDrawer.tsx:133">
P2: Replacing `useMutationWithToasts` with raw `useMutation` removes success/error feedback for document updates, causing silent failures for approver/type edits.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 16 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/console/src/pages/organizations/employee/_components/DocumentRow.tsx">

<violation number="1" location="apps/console/src/pages/organizations/employee/_components/DocumentRow.tsx:37">
P2: Guard against empty `lastVersion.edges` before reading `edges[0].node`, otherwise rendering will crash when no versions are returned.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}