SAKEN ALL — PHASE 7.29 CENTRAL DOCUMENT APPROVAL STORAGE

WHAT CHANGED
- Document Approval is still a section inside Saken All using the same login session.
- PDFs are stored centrally in Cloudflare R2, not in the browser.
- Document metadata, workflow stages, history and permissions are stored in D1.
- Saved signatures and stamps are stored privately in R2 and can be retrieved only by their owner.
- Direct approval links now work across devices after login with the assigned Saken All account.
- Server-side authorization prevents users from listing, opening or downloading other users' files.
- Every PDF page is displayed vertically in the viewer.
- Existing usernames fawzy and alhadad are supported after duplicate-account cleanup.

REQUIRED CLOUDFLARE RESOURCES
1. Existing D1 binding:
   Variable name: DB
   Database: saken_platform_db
2. New R2 bucket:
   Suggested bucket name: saken-approval-files
3. New Worker R2 binding:
   Variable name: APPROVAL_FILES
   Bucket: saken-approval-files

DEPLOYMENT ORDER
1. If duplicate fawzy/alhadad email accounts are still present, run:
   MERGE_AND_DELETE_DUPLICATE_SAKEN_ALL_USERS.sql
2. Run:
   RUN_THIS_IN_D1_PHASE7_29_CENTRAL_APPROVAL_STORAGE.sql
3. Create the R2 bucket and add the Worker binding APPROVAL_FILES.
4. Replace the existing API Worker code with:
   worker/saken-platform-api-worker.js
5. Deploy the Worker.
6. Open /api/health and verify:
   version = 2026-07-22 Phase 7.29 Central Approval Storage
   r2_bound = true
7. Upload the full platform ZIP to the existing Saken All Pages project.
8. Sign out, refresh with Ctrl+F5, and sign in again.

SECURITY
- The R2 bucket does not need to be public.
- Files are served only through authenticated Worker endpoints.
- The creator can access the original PDF.
- The current approver can access the current PDF only while authorized.
- Previous approvers can view the file through participation history.
- Users with explicit view-all permission can audit all documents.

LIMITS IN THIS VERSION
- Maximum PDF size: 25 MB.
- Maximum signature/stamp image size: 3 MB.
- Supported asset formats: PNG and JPG.
