added unapprove

actions/approvals.ts

@@ -128,3 +128,68 @@ export async function getApprovalHistory(versionId: string) {
     orderBy: { createdAt: "desc" },
   });
 }
+
+/**
+ * Resets an approved version back to PENDING_REVIEW and the associated task
+ * back to INTERNAL_REVIEW. Recalculates shot status.
+ * Only ADMIN, PRODUCER, SUPERVISOR can unapprove.
+ */
+export async function unapproveVersion(versionId: string) {
+  const session = await auth();
+  if (!session?.user) throw new Error("Unauthorized");
+
+  const allowedRoles = ["ADMIN", "PRODUCER", "SUPERVISOR"];
+  if (!allowedRoles.includes(session.user.role)) {
+    throw new Error("Insufficient permissions to unapprove versions");
+  }
+
+  const version = await db.version.findUnique({
+    where: { id: versionId },
+    include: {
+      task: {
+        include: { shot: true },
+      },
+    },
+  });
+  if (!version) throw new Error("Version not found");
+  if (version.approvalStatus !== "APPROVED") {
+    throw new Error("Only approved versions can be unapproved");
+  }
+
+  // Create an audit record for the unapproval
+  await db.approval.create({
+    data: {
+      versionId,
+      userId: session.user.id,
+      status: "PENDING_REVIEW",
+      notes: "Approval undone",
+    },
+  });
+
+  // Reset version approval status
+  await db.version.update({
+    where: { id: versionId },
+    data: { approvalStatus: "PENDING_REVIEW" },
+  });
+
+  // Reset task back to INTERNAL_REVIEW if it was moved to DONE
+  if (version.task && version.task.status === "DONE") {
+    await db.task.update({
+      where: { id: version.task.id },
+      data: { status: "INTERNAL_REVIEW" },
+    });
+  }
+
+  // Recalculate shot status
+  if (version.task?.shot) {
+    await recalcShotStatus(version.task.shot.id).catch(() => {});
+  }
+
+  revalidatePath(`/review/${versionId}`);
+  if (version.task) {
+    revalidatePath(`/tasks/${version.task.id}`);
+    revalidatePath(`/projects/${version.task.projectId}`);
+  }
+
+  return { success: true };
+}