feat(ee): page verification workflow (#2102)

* feat: page verification workflow * feat: refactor page-verification * sync * fix type * fix * fix * notification icon * use full word * accept .license file * - update templates - update migration and notification * fix copy * update audit labels * sync * add space name
2026-05-07 06:23:06 +08:00 · 2026-04-13 20:20:34 +01:00
parent d6068310b4
commit bd68e47e03
50 changed files with 3828 additions and 58 deletions
@@ -143,6 +143,18 @@ export function getPageId(documentName: string) {
  return documentName.split('.')[1];
 }

+export function isEmptyParagraphDoc(tiptapJson: JSONContent): boolean {
+  if (!tiptapJson || tiptapJson.type !== 'doc') return false;
+  const content = tiptapJson.content;
+  if (!Array.isArray(content) || content.length !== 1) return false;
+  const child = content[0];
+  if (!child || child.type !== 'paragraph') return false;
+  return (
+    !child.content ||
+    (Array.isArray(child.content) && child.content.length === 0)
+  );
+}
+
 function stripUnknownNodes(
  json: JSONContent,
  schema: Schema,
@@ -18,6 +18,7 @@ import { PageRepo } from '@docmost/db/repos/page/page.repo';
 import { isDeepStrictEqual } from 'node:util';
 import { CollabHistoryService } from '../services/collab-history.service';
 import { WatcherService } from '../../core/watcher/watcher.service';
+import { isEmptyParagraphDoc } from '../collaboration.util';

@Processor(QueueName.HISTORY_QUEUE)
 export class HistoryProcessor extends WorkerHost implements OnModuleDestroy {
@@ -55,6 +56,14 @@ export class HistoryProcessor extends WorkerHost implements OnModuleDestroy {
        { includeContent: true },
      );

+      if (!lastHistory && isEmptyParagraphDoc(page.content as any)) {
+        this.logger.debug(
+          `Skipping first history for page ${pageId}: empty content`,
+        );
+        await this.collabHistory.clearContributors(pageId);
+        return;
+      }
+
      if (
        !lastHistory ||
        !isDeepStrictEqual(lastHistory.content, page.content)
@@ -59,6 +59,14 @@ export const AuditEvent = {
  PAGE_RESTRICTION_REMOVED: 'page.restriction_removed',
  PAGE_PERMISSION_ADDED: 'page.permission_added',
  PAGE_PERMISSION_REMOVED: 'page.permission_removed',
+  // Page verification
+  PAGE_VERIFICATION_CREATED: 'page.verification_created',
+  PAGE_VERIFICATION_UPDATED: 'page.verification_updated',
+  PAGE_VERIFICATION_REMOVED: 'page.verification_removed',
+  PAGE_VERIFIED: 'page.verified',
+  PAGE_APPROVAL_REQUESTED: 'page.approval_requested',
+  PAGE_APPROVAL_REJECTED: 'page.approval_rejected',
+  PAGE_MARKED_OBSOLETE: 'page.marked_obsolete',

  // Share
  SHARE_CREATED: 'share.created',
@@ -5,6 +5,11 @@ export const NotificationType = {
  PAGE_USER_MENTION: 'page.user_mention',
  PAGE_PERMISSION_GRANTED: 'page.permission_granted',
  PAGE_UPDATED: 'page.updated',
+  PAGE_VERIFICATION_EXPIRING: 'page.verification_expiring',
+  PAGE_VERIFICATION_EXPIRED: 'page.verification_expired',
+  PAGE_VERIFIED: 'page.verified',
+  PAGE_APPROVAL_REQUESTED: 'page.approval_requested',
+  PAGE_APPROVAL_REJECTED: 'page.approval_rejected',
 } as const;

 export type NotificationType =
@@ -4,6 +4,7 @@ import { NotificationController } from './notification.controller';
 import { NotificationProcessor } from './notification.processor';
 import { CommentNotificationService } from './services/comment.notification';
 import { PageNotificationService } from './services/page.notification';
+import { VerificationNotificationService } from './services/verification.notification';
 import { PageUpdateEmailRateLimiter } from './services/page-update-email-rate-limiter';

@Module({
@@ -14,6 +15,7 @@ import { PageUpdateEmailRateLimiter } from './services/page-update-email-rate-li
    NotificationProcessor,
    CommentNotificationService,
    PageNotificationService,
+    VerificationNotificationService,
    PageUpdateEmailRateLimiter,
  ],
  exports: [NotificationService],
@@ -1,18 +1,26 @@
 import { Logger, OnModuleDestroy } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 import { OnWorkerEvent, Processor, WorkerHost } from '@nestjs/bullmq';
 import { Job } from 'bullmq';
 import { InjectKysely } from 'nestjs-kysely';
 import { KyselyDB } from '@docmost/db/types/kysely.types';
 import { QueueJob, QueueName } from '../../integrations/queue/constants';
 import {
+  IApprovalRejectedNotificationJob,
+  IApprovalRequestedNotificationJob,
  ICommentNotificationJob,
  ICommentResolvedNotificationJob,
  IPageMentionNotificationJob,
  IPageUpdateNotificationJob,
+  IPageVerifiedNotificationJob,
  IPermissionGrantedNotificationJob,
+  IVerificationExpiringNotificationJob,
+  IVerificationExpiredNotificationJob,
+  IVerificationReconcileJob,
 } from '../../integrations/queue/constants/queue.interface';
 import { CommentNotificationService } from './services/comment.notification';
 import { PageNotificationService } from './services/page.notification';
+import { VerificationNotificationService } from './services/verification.notification';
 import { DomainService } from '../../integrations/environment/domain.service';

@Processor(QueueName.NOTIFICATION_QUEUE)
@@ -25,7 +33,9 @@ export class NotificationProcessor
  constructor(
    private readonly commentNotificationService: CommentNotificationService,
    private readonly pageNotificationService: PageNotificationService,
+    private readonly verificationNotificationService: VerificationNotificationService,
    private readonly domainService: DomainService,
+    private readonly moduleRef: ModuleRef,
    @InjectKysely() private readonly db: KyselyDB,
  ) {
    super();
@@ -37,12 +47,23 @@ export class NotificationProcessor
      | ICommentResolvedNotificationJob
      | IPageMentionNotificationJob
      | IPageUpdateNotificationJob
-      | IPermissionGrantedNotificationJob,
+      | IPermissionGrantedNotificationJob
+      | IVerificationExpiringNotificationJob
+      | IVerificationExpiredNotificationJob
+      | IVerificationReconcileJob
+      | IPageVerifiedNotificationJob
+      | IApprovalRequestedNotificationJob
+      | IApprovalRejectedNotificationJob,
      void
    >,
  ): Promise<void> {
    try {
-      const workspaceId = (job.data as { workspaceId: string }).workspaceId;
+      if (job.name === QueueJob.VERIFICATION_RECONCILE) {
+        await this.runVerificationReconcile();
+        return;
+      }
+
+      const workspaceId = await this.resolveWorkspaceId(job);
      const appUrl = await this.getWorkspaceUrl(workspaceId);

      switch (job.name) {
@@ -92,6 +113,45 @@ export class NotificationProcessor
          break;
        }

+        case QueueJob.PAGE_VERIFICATION_EXPIRING: {
+          await this.verificationNotificationService.processVerificationExpiring(
+            job.data as IVerificationExpiringNotificationJob,
+            appUrl,
+          );
+          break;
+        }
+
+        case QueueJob.PAGE_VERIFICATION_EXPIRED: {
+          await this.verificationNotificationService.processVerificationExpired(
+            job.data as IVerificationExpiredNotificationJob,
+            appUrl,
+          );
+          break;
+        }
+
+        case QueueJob.PAGE_VERIFIED_NOTIFICATION: {
+          await this.verificationNotificationService.processPageVerified(
+            job.data as IPageVerifiedNotificationJob,
+          );
+          break;
+        }
+
+        case QueueJob.PAGE_APPROVAL_REQUESTED_NOTIFICATION: {
+          await this.verificationNotificationService.processApprovalRequested(
+            job.data as IApprovalRequestedNotificationJob,
+            appUrl,
+          );
+          break;
+        }
+
+        case QueueJob.PAGE_APPROVAL_REJECTED_NOTIFICATION: {
+          await this.verificationNotificationService.processApprovalRejected(
+            job.data as IApprovalRejectedNotificationJob,
+            appUrl,
+          );
+          break;
+        }
+
        default:
          this.logger.warn(`Unknown notification job: ${job.name}`);
      }
@@ -102,6 +162,49 @@ export class NotificationProcessor
    }
  }

+  private async resolveWorkspaceId(job: Job): Promise<string> {
+    if (
+      job.name === QueueJob.PAGE_VERIFICATION_EXPIRING ||
+      job.name === QueueJob.PAGE_VERIFICATION_EXPIRED
+    ) {
+      const { verificationId } = job.data as { verificationId: string };
+      const row = await this.db
+        .selectFrom('pageVerifications')
+        .select('workspaceId')
+        .where('id', '=', verificationId)
+        .executeTakeFirst();
+      return row?.workspaceId ?? '';
+    }
+    return (job.data as { workspaceId: string }).workspaceId;
+  }
+
+  private async runVerificationReconcile(): Promise<void> {
+    let eeModule: { PageVerificationSchedulerService?: unknown };
+    try {
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      eeModule = require('../../ee/page-verification/page-verification-scheduler.service');
+    } catch {
+      this.logger.debug(
+        'VERIFICATION_RECONCILE fired but EE scheduler not bundled in this build',
+      );
+      return;
+    }
+
+    const schedulerClass = eeModule.PageVerificationSchedulerService as
+      | (new (...args: unknown[]) => { reconcile(): Promise<void> })
+      | undefined;
+    if (!schedulerClass) return;
+
+    const scheduler = this.moduleRef.get(schedulerClass, { strict: false });
+    if (!scheduler) {
+      this.logger.warn(
+        'VERIFICATION_RECONCILE fired but scheduler service not resolvable',
+      );
+      return;
+    }
+    await scheduler.reconcile();
+  }
+
  private async getWorkspaceUrl(workspaceId: string): Promise<string> {
    const workspace = await this.db
      .selectFrom('workspaces')
@@ -0,0 +1,355 @@
+import { Injectable } from '@nestjs/common';
+import { InjectKysely } from 'nestjs-kysely';
+import { KyselyDB } from '@docmost/db/types/kysely.types';
+import {
+  IApprovalRejectedNotificationJob,
+  IApprovalRequestedNotificationJob,
+  IPageVerifiedNotificationJob,
+  IVerificationExpiringNotificationJob,
+  IVerificationExpiredNotificationJob,
+} from '../../../integrations/queue/constants/queue.interface';
+import { NotificationService } from '../notification.service';
+import { NotificationType } from '../notification.constants';
+import { VerificationExpiringEmail } from '@docmost/transactional/emails/verification-expiring-email';
+import { VerificationExpiredEmail } from '@docmost/transactional/emails/verification-expired-email';
+import { ApprovalRequestedEmail } from '@docmost/transactional/emails/approval-requested-email';
+import { ApprovalRejectedEmail } from '@docmost/transactional/emails/approval-rejected-email';
+import { getPageTitle } from '../../../common/helpers';
+import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
+
+@Injectable()
+export class VerificationNotificationService {
+  constructor(
+    @InjectKysely() private readonly db: KyselyDB,
+    private readonly notificationService: NotificationService,
+    private readonly spaceMemberRepo: SpaceMemberRepo,
+    private readonly pagePermissionRepo: PagePermissionRepo,
+  ) {}
+
+  private async getAlreadyNotifiedUserIds(
+    pageVerificationId: string,
+    type: string,
+  ): Promise<Set<string>> {
+    const rows = await this.db
+      .selectFrom('notifications')
+      .select('userId')
+      .where('pageVerificationId', '=', pageVerificationId)
+      .where('type', '=', type)
+      .execute();
+    return new Set(rows.map((r) => r.userId));
+  }
+
+  private async filterAccessibleRecipients(
+    userIds: string[],
+    pageId: string,
+    spaceId: string,
+  ): Promise<string[]> {
+    if (userIds.length === 0) return [];
+    const inSpace = await this.spaceMemberRepo.getUserIdsWithSpaceAccess(
+      userIds,
+      spaceId,
+    );
+    if (inSpace.size === 0) return [];
+    return this.pagePermissionRepo.getUserIdsWithPageAccess(pageId, [
+      ...inSpace,
+    ]);
+  }
+
+  async processVerificationExpiring(
+    data: IVerificationExpiringNotificationJob,
+    appUrl: string,
+  ) {
+    const verification = await this.db
+      .selectFrom('pageVerifications')
+      .selectAll()
+      .where('id', '=', data.verificationId)
+      .executeTakeFirst();
+
+    if (!verification) return;
+    if (verification.type !== 'expiring') return;
+    if (!verification.expiresAt) return;
+    const expiresAtMs = new Date(verification.expiresAt).getTime();
+    if (expiresAtMs <= Date.now()) return;
+
+    const verifierRows = await this.db
+      .selectFrom('pageVerifiers')
+      .select('userId')
+      .where('pageVerificationId', '=', verification.id)
+      .execute();
+    const verifierIds = verifierRows.map((r) => r.userId);
+    if (verifierIds.length === 0) return;
+
+    const accessibleVerifierIds = await this.filterAccessibleRecipients(
+      verifierIds,
+      verification.pageId,
+      verification.spaceId,
+    );
+    if (accessibleVerifierIds.length === 0) return;
+
+    const alreadyNotified = await this.getAlreadyNotifiedUserIds(
+      verification.id,
+      NotificationType.PAGE_VERIFICATION_EXPIRING,
+    );
+    const recipients = accessibleVerifierIds.filter(
+      (id) => !alreadyNotified.has(id),
+    );
+    if (recipients.length === 0) return;
+
+    const context = await this.getPageContext(
+      verification.pageId,
+      verification.spaceId,
+      appUrl,
+    );
+    if (!context) return;
+
+    const { pageTitle, spaceName, basePageUrl } = context;
+    const expiresAtIso = new Date(verification.expiresAt).toISOString();
+
+    for (const userId of recipients) {
+      const notification = await this.notificationService.create({
+        userId,
+        workspaceId: verification.workspaceId,
+        type: NotificationType.PAGE_VERIFICATION_EXPIRING,
+        pageId: verification.pageId,
+        spaceId: verification.spaceId,
+        pageVerificationId: verification.id,
+        data: { expiresAt: expiresAtIso },
+      });
+
+      const subject = `"${pageTitle}" needs to be re-verified soon`;
+
+      await this.notificationService.queueEmail(
+        userId,
+        notification.id,
+        subject,
+        VerificationExpiringEmail({
+          pageTitle,
+          spaceName,
+          pageUrl: basePageUrl,
+          expiresAt: new Date(verification.expiresAt).toLocaleDateString(),
+        }),
+      );
+    }
+  }
+
+  async processVerificationExpired(
+    data: IVerificationExpiredNotificationJob,
+    appUrl: string,
+  ) {
+    const verification = await this.db
+      .selectFrom('pageVerifications')
+      .selectAll()
+      .where('id', '=', data.verificationId)
+      .executeTakeFirst();
+
+    if (!verification) return;
+    if (verification.type !== 'expiring') return;
+    if (!verification.expiresAt) return;
+    if (new Date(verification.expiresAt).getTime() > Date.now()) return;
+
+    const verifierRows = await this.db
+      .selectFrom('pageVerifiers')
+      .select('userId')
+      .where('pageVerificationId', '=', verification.id)
+      .execute();
+    const verifierIds = verifierRows.map((r) => r.userId);
+    if (verifierIds.length === 0) return;
+
+    const accessibleVerifierIds = await this.filterAccessibleRecipients(
+      verifierIds,
+      verification.pageId,
+      verification.spaceId,
+    );
+    if (accessibleVerifierIds.length === 0) return;
+
+    const alreadyNotified = await this.getAlreadyNotifiedUserIds(
+      verification.id,
+      NotificationType.PAGE_VERIFICATION_EXPIRED,
+    );
+    const recipients = accessibleVerifierIds.filter(
+      (id) => !alreadyNotified.has(id),
+    );
+    if (recipients.length === 0) return;
+
+    const context = await this.getPageContext(
+      verification.pageId,
+      verification.spaceId,
+      appUrl,
+    );
+    if (!context) return;
+
+    const { pageTitle, spaceName, basePageUrl } = context;
+
+    for (const userId of recipients) {
+      const notification = await this.notificationService.create({
+        userId,
+        workspaceId: verification.workspaceId,
+        type: NotificationType.PAGE_VERIFICATION_EXPIRED,
+        pageId: verification.pageId,
+        spaceId: verification.spaceId,
+        pageVerificationId: verification.id,
+      });
+
+      const subject = `"${pageTitle}" verification has expired`;
+
+      await this.notificationService.queueEmail(
+        userId,
+        notification.id,
+        subject,
+        VerificationExpiredEmail({
+          pageTitle,
+          spaceName,
+          pageUrl: basePageUrl,
+        }),
+      );
+    }
+  }
+
+  async processPageVerified(data: IPageVerifiedNotificationJob) {
+    const { verifierIds, pageId, spaceId, workspaceId, actorId } = data;
+    if (verifierIds.length === 0) return;
+
+    const accessibleVerifierIds = await this.filterAccessibleRecipients(
+      verifierIds,
+      pageId,
+      spaceId,
+    );
+    if (accessibleVerifierIds.length === 0) return;
+
+    for (const userId of accessibleVerifierIds) {
+      await this.notificationService.create({
+        userId,
+        workspaceId,
+        type: NotificationType.PAGE_VERIFIED,
+        actorId,
+        pageId,
+        spaceId,
+      });
+    }
+  }
+
+  async processApprovalRequested(
+    data: IApprovalRequestedNotificationJob,
+    appUrl: string,
+  ) {
+    const { verifierIds, pageId, spaceId, workspaceId, actorId } = data;
+    if (verifierIds.length === 0) return;
+
+    const accessibleVerifierIds = await this.filterAccessibleRecipients(
+      verifierIds,
+      pageId,
+      spaceId,
+    );
+    if (accessibleVerifierIds.length === 0) return;
+
+    const context = await this.getPageContext(pageId, spaceId, appUrl);
+    if (!context) return;
+
+    const { pageTitle, spaceName, basePageUrl } = context;
+    const actorName = await this.getUserName(actorId);
+
+    for (const userId of accessibleVerifierIds) {
+      const notification = await this.notificationService.create({
+        userId,
+        workspaceId,
+        type: NotificationType.PAGE_APPROVAL_REQUESTED,
+        actorId,
+        pageId,
+        spaceId,
+      });
+
+      const subject = `"${pageTitle}" needs your approval`;
+
+      await this.notificationService.queueEmail(
+        userId,
+        notification.id,
+        subject,
+        ApprovalRequestedEmail({
+          actorName,
+          pageTitle,
+          spaceName,
+          pageUrl: basePageUrl,
+        }),
+      );
+    }
+  }
+
+  async processApprovalRejected(
+    data: IApprovalRejectedNotificationJob,
+    appUrl: string,
+  ) {
+    const { pageId, spaceId, workspaceId, actorId, requestedById, comment } =
+      data;
+
+    const recipients = await this.filterAccessibleRecipients(
+      [requestedById],
+      pageId,
+      spaceId,
+    );
+    if (recipients.length === 0) return;
+
+    const context = await this.getPageContext(pageId, spaceId, appUrl);
+    if (!context) return;
+
+    const { pageTitle, spaceName, basePageUrl } = context;
+    const actorName = await this.getUserName(actorId);
+
+    const notification = await this.notificationService.create({
+      userId: requestedById,
+      workspaceId,
+      type: NotificationType.PAGE_APPROVAL_REJECTED,
+      actorId,
+      pageId,
+      spaceId,
+    });
+
+    const subject = `"${pageTitle}" was returned for revision`;
+
+    await this.notificationService.queueEmail(
+      requestedById,
+      notification.id,
+      subject,
+      ApprovalRejectedEmail({
+        actorName,
+        pageTitle,
+        spaceName,
+        pageUrl: basePageUrl,
+        comment,
+      }),
+    );
+  }
+
+  private async getUserName(userId: string): Promise<string> {
+    const user = await this.db
+      .selectFrom('users')
+      .select('name')
+      .where('id', '=', userId)
+      .executeTakeFirst();
+    return user?.name ?? 'Someone';
+  }
+
+  private async getPageContext(
+    pageId: string,
+    spaceId: string,
+    appUrl: string,
+  ) {
+    const [page, space] = await Promise.all([
+      this.db
+        .selectFrom('pages')
+        .select(['id', 'title', 'slugId'])
+        .where('id', '=', pageId)
+        .executeTakeFirst(),
+      this.db
+        .selectFrom('spaces')
+        .select(['id', 'slug', 'name'])
+        .where('id', '=', spaceId)
+        .executeTakeFirst(),
+    ]);
+
+    if (!page || !space) return null;
+
+    const basePageUrl = `${appUrl}/s/${space.slug}/p/${page.slugId}`;
+    return { pageTitle: getPageTitle(page.title), spaceName: space.name ?? space.slug, basePageUrl };
+  }
+}
@@ -452,6 +452,20 @@ export class PageService {
          .where('pageId', 'in', pageIdsToMove)
          .execute();

+        // Update page verifications
+        await trx
+          .updateTable('pageVerifications')
+          .set({ spaceId: spaceId })
+          .where('pageId', 'in', pageIdsToMove)
+          .execute();
+
+        // Update notifications — access follows the page after a move
+        await trx
+          .updateTable('notifications')
+          .set({ spaceId: spaceId })
+          .where('pageId', 'in', pageIdsToMove)
+          .execute();
+
        // Update attachments
        await this.attachmentRepo.updateAttachmentsByPageId(
          { spaceId },
@@ -0,0 +1,117 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('page_verifications')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.notNull().unique().references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('space_id', 'uuid', (col) =>
+      col.notNull().references('spaces.id').onDelete('cascade'),
+    )
+    .addColumn('type', 'varchar', (col) => col.notNull().defaultTo('expiring'))
+    .addColumn('status', 'varchar')
+    .addColumn('mode', 'varchar')
+    .addColumn('period_amount', 'integer')
+    .addColumn('period_unit', 'varchar')
+    .addColumn('verified_at', 'timestamptz')
+    .addColumn('verified_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('expires_at', 'timestamptz')
+    .addColumn('requested_at', 'timestamptz')
+    .addColumn('requested_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('rejected_at', 'timestamptz')
+    .addColumn('rejected_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('rejection_comment', 'text')
+    .addColumn('data', 'jsonb')
+    .addColumn('creator_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createTable('page_verifiers')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_verification_id', 'uuid', (col) =>
+      col.notNull().references('page_verifications.id').onDelete('cascade'),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.notNull().references('users.id').onDelete('cascade'),
+    )
+    .addColumn('is_primary', 'boolean', (col) => col.notNull().defaultTo(false))
+    .addColumn('added_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addUniqueConstraint('page_verifiers_verification_user_unique', [
+      'page_verification_id',
+      'user_id',
+    ])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_verifications_expires_at')
+    .ifNotExists()
+    .on('page_verifications')
+    .column('expires_at')
+    .where('expires_at', 'is not', null)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_verifications_workspace_id_id')
+    .ifNotExists()
+    .on('page_verifications')
+    .columns(['workspace_id', 'id desc'])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_verifications_space_id')
+    .ifNotExists()
+    .on('page_verifications')
+    .column('space_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_verifiers_user_id')
+    .ifNotExists()
+    .on('page_verifiers')
+    .column('user_id')
+    .execute();
+
+  await db.schema
+    .alterTable('notifications')
+    .addColumn('page_verification_id', 'uuid', (col) =>
+      col.references('page_verifications.id').onDelete('cascade'),
+    )
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable('notifications')
+    .dropColumn('page_verification_id')
+    .execute();
+  await db.schema.dropTable('page_verifiers').ifExists().execute();
+  await db.schema.dropTable('page_verifications').ifExists().execute();
+}
@@ -11,7 +11,10 @@ import { ExpressionBuilder } from 'kysely';
 import { DB } from '@docmost/db/types/db';
 import { jsonObjectFrom } from 'kysely/helpers/postgres';
 import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
-import { NotificationTab, NotificationType } from '../../../core/notification/notification.constants';
+import {
+  NotificationTab,
+  NotificationType,
+} from '../../../core/notification/notification.constants';

@Injectable()
 export class NotificationRepo {
@@ -43,7 +46,11 @@ export class NotificationRepo {
      .where((eb) =>
        eb.or([
          eb('spaceId', 'is', null),
-          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
+          eb(
+            'spaceId',
+            'in',
+            this.spaceMemberRepo.getUserSpaceIdsQuery(userId),
+          ),
        ]),
      );

@@ -62,6 +69,14 @@ export class NotificationRepo {
    });
  }

+  async insert(notification: InsertableNotification): Promise<Notification> {
+    return this.db
+      .insertInto('notifications')
+      .values(notification)
+      .returningAll()
+      .executeTakeFirst();
+  }
+
  async getUnreadCount(userId: string): Promise<number> {
    const result = await this.db
      .selectFrom('notifications')
@@ -71,7 +86,11 @@ export class NotificationRepo {
      .where((eb) =>
        eb.or([
          eb('spaceId', 'is', null),
-          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
+          eb(
+            'spaceId',
+            'in',
+            this.spaceMemberRepo.getUserSpaceIdsQuery(userId),
+          ),
        ]),
      )
      .executeTakeFirst();
@@ -79,14 +98,6 @@ export class NotificationRepo {
    return Number(result?.count ?? 0);
  }

-  async insert(notification: InsertableNotification): Promise<Notification> {
-    return this.db
-      .insertInto('notifications')
-      .values(notification)
-      .returningAll()
-      .executeTakeFirst();
-  }
-
  async markAsRead(notificationId: string, userId: string): Promise<void> {
    await this.db
      .updateTable('notifications')
@@ -94,12 +105,6 @@ export class NotificationRepo {
      .where('id', '=', notificationId)
      .where('userId', '=', userId)
      .where('readAt', 'is', null)
-      .where((eb) =>
-        eb.or([
-          eb('spaceId', 'is', null),
-          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
-        ]),
-      )
      .execute();
  }

@@ -116,21 +121,6 @@ export class NotificationRepo {
      .where('id', 'in', notificationIds)
      .where('userId', '=', userId)
      .where('readAt', 'is', null)
-      .where((eb) =>
-        eb.or([
-          eb('spaceId', 'is', null),
-          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
-        ]),
-      )
-      .execute();
-  }
-
-  async markAsEmailed(notificationId: string): Promise<void> {
-    await this.db
-      .updateTable('notifications')
-      .set({ emailedAt: new Date() })
-      .where('id', '=', notificationId)
-      .where('emailedAt', 'is', null)
      .execute();
  }

@@ -140,12 +130,15 @@ export class NotificationRepo {
      .set({ readAt: new Date() })
      .where('userId', '=', userId)
      .where('readAt', 'is', null)
-      .where((eb) =>
-        eb.or([
-          eb('spaceId', 'is', null),
-          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
-        ]),
-      )
+      .execute();
+  }
+
+  async markAsEmailed(notificationId: string): Promise<void> {
+    await this.db
+      .updateTable('notifications')
+      .set({ emailedAt: new Date() })
+      .where('id', '=', notificationId)
+      .where('emailedAt', 'is', null)
      .execute();
  }

@@ -400,6 +400,7 @@ export interface Notifications {
  pageId: string | null;
  spaceId: string | null;
  commentId: string | null;
+  pageVerificationId: string | null;
  data: Json | null;
  readAt: Timestamp | null;
  emailedAt: Timestamp | null;
@@ -441,6 +442,39 @@ export interface PagePermissions {
  updatedAt: Generated<Timestamp>;
 }

+export interface PageVerifications {
+  id: Generated<string>;
+  pageId: string;
+  workspaceId: string;
+  spaceId: string;
+  type: Generated<string>;
+  status: string | null;
+  mode: string | null;
+  periodAmount: number | null;
+  periodUnit: string | null;
+  verifiedAt: Timestamp | null;
+  verifiedById: string | null;
+  expiresAt: Timestamp | null;
+  requestedAt: Timestamp | null;
+  requestedById: string | null;
+  rejectedAt: Timestamp | null;
+  rejectedById: string | null;
+  rejectionComment: string | null;
+  data: Json | null;
+  creatorId: string | null;
+  createdAt: Generated<Timestamp>;
+  updatedAt: Generated<Timestamp>;
+}
+
+export interface PageVerifiers {
+  id: Generated<string>;
+  pageVerificationId: string;
+  userId: string;
+  isPrimary: Generated<boolean>;
+  addedById: string | null;
+  createdAt: Generated<Timestamp>;
+}
+
 export interface Templates {
  id: Generated<string>;
  title: string | null;
@@ -519,6 +553,8 @@ export interface DB {
  pageAccess: PageAccess;
  pagePermissions: PagePermissions;
  pageHistory: PageHistory;
+  pageVerifications: PageVerifications;
+  pageVerifiers: PageVerifiers;
  pages: Pages;
  shares: Shares;
  spaceMembers: SpaceMembers;
@@ -8,6 +8,8 @@ import {
  Notifications,
  PageAccess as _PageAccess,
  PagePermissions as _PagePermissions,
+  PageVerifications as _PageVerifications,
+  PageVerifiers as _PageVerifiers,
  Pages,
  Spaces,
  Users,
@@ -182,6 +184,15 @@ export type PagePermission = Selectable<_PagePermissions>;
 export type InsertablePagePermission = Insertable<_PagePermissions>;
 export type UpdatablePagePermission = Updateable<Omit<_PagePermissions, 'id'>>;

+// Page Verification
+export type PageVerification = Selectable<_PageVerifications>;
+export type InsertablePageVerification = Insertable<_PageVerifications>;
+export type UpdatablePageVerification = Updateable<Omit<_PageVerifications, 'id'>>;
+
+// Page Verifier
+export type PageVerifier = Selectable<_PageVerifiers>;
+export type InsertablePageVerifier = Insertable<_PageVerifiers>;
+
 // User Session
 export type UserSession = Selectable<UserSessions>;
 export type InsertableUserSession = Insertable<UserSessions>;
@@ -71,6 +71,12 @@ export enum QueueJob {
  PAGE_MENTION_NOTIFICATION = 'page-mention-notification',
  PAGE_PERMISSION_GRANTED = 'page-permission-granted',
  PAGE_UPDATE_DIGEST = 'page-update-digest',
+  PAGE_VERIFICATION_EXPIRING = 'page-verification-expiring',
+  PAGE_VERIFICATION_EXPIRED = 'page-verification-expired',
+  VERIFICATION_RECONCILE = 'verification-reconcile',
+  PAGE_VERIFIED_NOTIFICATION = 'page-verified-notification',
+  PAGE_APPROVAL_REQUESTED_NOTIFICATION = 'page-approval-requested-notification',
+  PAGE_APPROVAL_REJECTED_NOTIFICATION = 'page-approval-rejected-notification',

  AUDIT_LOG = 'audit-log',
  AUDIT_CLEANUP = 'audit-cleanup',
@@ -76,3 +76,40 @@ export interface IPermissionGrantedNotificationJob {
  actorId: string;
  role: string;
 }
+
+export interface IVerificationExpiringNotificationJob {
+  verificationId: string;
+}
+
+export interface IVerificationExpiredNotificationJob {
+  verificationId: string;
+}
+
+export interface IVerificationReconcileJob {
+  // no payload
+}
+
+export interface IPageVerifiedNotificationJob {
+  pageId: string;
+  spaceId: string;
+  workspaceId: string;
+  actorId: string;
+  verifierIds: string[];
+}
+
+export interface IApprovalRequestedNotificationJob {
+  pageId: string;
+  spaceId: string;
+  workspaceId: string;
+  actorId: string;
+  verifierIds: string[];
+}
+
+export interface IApprovalRejectedNotificationJob {
+  pageId: string;
+  spaceId: string;
+  workspaceId: string;
+  actorId: string;
+  requestedById: string;
+  comment?: string;
+}
@@ -0,0 +1,41 @@
+import { Section, Text } from '@react-email/components';
+import * as React from 'react';
+import { content, paragraph } from '../css/styles';
+import { EmailButton, MailBody } from '../partials/partials';
+
+interface Props {
+  actorName: string;
+  pageTitle: string;
+  spaceName: string;
+  pageUrl: string;
+  comment?: string;
+}
+
+export const ApprovalRejectedEmail = ({
+  actorName,
+  pageTitle,
+  spaceName,
+  pageUrl,
+  comment,
+}: Props) => {
+  return (
+    <MailBody>
+      <Section style={content}>
+        <Text style={paragraph}>Hi there,</Text>
+        <Text style={paragraph}>
+          <strong>{actorName}</strong> returned{' '}
+          <strong>{pageTitle}</strong> in the{' '}
+          <strong>{spaceName}</strong> space for revision.
+        </Text>
+        {comment && (
+          <Text style={{ ...paragraph, fontStyle: 'italic' }}>
+            &ldquo;{comment}&rdquo;
+          </Text>
+        )}
+      </Section>
+      <EmailButton href={pageUrl}>View page</EmailButton>
+    </MailBody>
+  );
+};
+
+export default ApprovalRejectedEmail;
@@ -0,0 +1,34 @@
+import { Section, Text } from '@react-email/components';
+import * as React from 'react';
+import { content, paragraph } from '../css/styles';
+import { EmailButton, MailBody } from '../partials/partials';
+
+interface Props {
+  actorName: string;
+  pageTitle: string;
+  spaceName: string;
+  pageUrl: string;
+}
+
+export const ApprovalRequestedEmail = ({
+  actorName,
+  pageTitle,
+  spaceName,
+  pageUrl,
+}: Props) => {
+  return (
+    <MailBody>
+      <Section style={content}>
+        <Text style={paragraph}>Hi there,</Text>
+        <Text style={paragraph}>
+          <strong>{actorName}</strong> submitted{' '}
+          <strong>{pageTitle}</strong> in the{' '}
+          <strong>{spaceName}</strong> space for your approval.
+        </Text>
+      </Section>
+      <EmailButton href={pageUrl}>Review page</EmailButton>
+    </MailBody>
+  );
+};
+
+export default ApprovalRequestedEmail;
@@ -27,7 +27,7 @@ export const PageUpdateEmail = ({
          <Link href={pageUrl} style={link}>
            <strong>{pageTitle}</strong>
          </Link>{' '}
-          in <strong>{spaceName}</strong>.
+          in the <strong>{spaceName}</strong> space.
        </Text>
      </Section>
      <EmailButton href={pageUrl}>View page</EmailButton>
@@ -0,0 +1,28 @@
+import { Section, Text } from '@react-email/components';
+import * as React from 'react';
+import { content, paragraph } from '../css/styles';
+import { EmailButton, MailBody } from '../partials/partials';
+
+interface Props {
+  pageTitle: string;
+  spaceName: string;
+  pageUrl: string;
+}
+
+export const VerificationExpiredEmail = ({ pageTitle, spaceName, pageUrl }: Props) => {
+  return (
+    <MailBody>
+      <Section style={content}>
+        <Text style={paragraph}>Hi there,</Text>
+        <Text style={paragraph}>
+          The verification for <strong>{pageTitle}</strong> in the{' '}
+          <strong>{spaceName}</strong> space has expired. Please re-verify the
+          page to confirm it is still accurate.
+        </Text>
+      </Section>
+      <EmailButton href={pageUrl}>Re-verify page</EmailButton>
+    </MailBody>
+  );
+};
+
+export default VerificationExpiredEmail;
@@ -0,0 +1,34 @@
+import { Section, Text } from '@react-email/components';
+import * as React from 'react';
+import { content, paragraph } from '../css/styles';
+import { EmailButton, MailBody } from '../partials/partials';
+
+interface Props {
+  pageTitle: string;
+  spaceName: string;
+  pageUrl: string;
+  expiresAt: string;
+}
+
+export const VerificationExpiringEmail = ({
+  pageTitle,
+  spaceName,
+  pageUrl,
+  expiresAt,
+}: Props) => {
+  return (
+    <MailBody>
+      <Section style={content}>
+        <Text style={paragraph}>Hi there,</Text>
+        <Text style={paragraph}>
+          The page <strong>{pageTitle}</strong> in the{' '}
+          <strong>{spaceName}</strong> space needs to be re-verified. The
+          verification expires on <strong>{expiresAt}</strong>.
+        </Text>
+      </Section>
+      <EmailButton href={pageUrl}>Review page</EmailButton>
+    </MailBody>
+  );
+};
+
+export default VerificationExpiringEmail;