adserver-dashboard 1.0.0

package/PCM/src/services/ApprovalService.js

@@ -0,0 +1,885 @@
+import crypto from 'crypto';
+import ApprovalToken from '../models/ApprovalToken.js';
+import ApprovalOTP from '../models/ApprovalOTP.js';
+import Deal from '../models/Deal.js';
+import LineItem from '../models/LineItem.js';
+import LineItemCreative from '../models/LineItemCreative.js';
+import ChangeHistory from '../models/ChangeHistory.js';
+import CampaignStatusService, { TRANSITION_OWNERS } from './CampaignStatusService.js';
+import LineItemStatusService from './LineItemStatusService.js';
+import emailService from './EmailNotificationService.js';
+import sequelize from '../config/db.js';
+
+const TOKEN_EXPIRY_DAYS = parseInt(process.env.APPROVAL_TOKEN_EXPIRY_DAYS || '30');
+const OTP_EXPIRY_MINUTES = parseInt(process.env.OTP_EXPIRY_MINUTES || '10');
+const MAX_OTP_ATTEMPTS = parseInt(process.env.MAX_OTP_ATTEMPTS || '5');
+const MAX_OTP_REQUESTS = parseInt(process.env.MAX_OTP_REQUESTS || '10');
+const OTP_COOLDOWN_SECONDS = parseInt(process.env.OTP_COOLDOWN_SECONDS || '60');
+const APPROVAL_BASE_URL = process.env.APPROVAL_BASE_URL || 'http://localhost:5000/approve';
+const DEV_OTP_CODE = process.env.DEV_OTP_CODE;
+
+export class ApprovalService {
+  generateSecureToken() {
+    return crypto.randomBytes(32).toString('hex');
+  }
+
+  hashToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+  }
+
+  generateOTP() {
+    if (DEV_OTP_CODE) {
+      return DEV_OTP_CODE;
+    }
+    return String(Math.floor(100000 + Math.random() * 900000));
+  }
+
+  hashOTP(otp) {
+    return crypto.createHash('sha256').update(otp).digest('hex');
+  }
+
+  encryptToken(token) {
+    const secret = process.env.APPROVAL_SECRET_KEY;
+    if (!secret) {
+      throw new Error('APPROVAL_SECRET_KEY environment variable is required');
+    }
+    const iv = crypto.randomBytes(16);
+    const key = crypto.scryptSync(secret, 'approval-salt-v1', 32);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    let encrypted = cipher.update(token, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `${iv.toString('hex')}:${authTag}:${encrypted}`;
+  }
+
+  decryptToken(encryptedToken) {
+    try {
+      const secret = process.env.APPROVAL_SECRET_KEY;
+      if (!secret) return null;
+      
+      const parts = encryptedToken.split(':');
+      if (parts.length !== 3) return null;
+      
+      const [ivHex, authTagHex, encrypted] = parts;
+      const iv = Buffer.from(ivHex, 'hex');
+      const authTag = Buffer.from(authTagHex, 'hex');
+      const key = crypto.scryptSync(secret, 'approval-salt-v1', 32);
+      const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+      decipher.setAuthTag(authTag);
+      let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+      decrypted += decipher.final('utf8');
+      return decrypted;
+    } catch (error) {
+      return null;
+    }
+  }
+
+  async initiateApprovalWorkflow(dealId, approvalEmails, requestId = null, options = {}) {
+    const { frontendUrl = null } = options;
+    const deal = await Deal.findOne({ where: { deal_id: dealId } });
+    if (!deal) {
+      throw new Error(`Deal not found: ${dealId}`);
+    }
+
+    if (!approvalEmails || approvalEmails.length === 0) {
+      return await this.autoApprove(dealId, requestId);
+    }
+
+    const validation = CampaignStatusService.validateTransition(
+      { status: deal.status, source: deal.source, mode: deal.mode },
+      'PENDING',
+      { owner: TRANSITION_OWNERS.USER, source: deal.source, workflow: deal.mode }
+    );
+
+    if (!validation.valid) {
+      throw new Error(`Cannot transition to PENDING: ${validation.errors[0]?.message || 'Invalid transition'}`);
+    }
+
+    const transaction = await sequelize.transaction();
+
+    try {
+      const tokens = [];
+      const expiresAt = new Date();
+      expiresAt.setDate(expiresAt.getDate() + TOKEN_EXPIRY_DAYS);
+
+      for (const email of approvalEmails) {
+        const rawToken = this.generateSecureToken();
+        const hashedToken = this.hashToken(rawToken);
+        const encryptedToken = this.encryptToken(rawToken);
+
+        const approvalToken = await ApprovalToken.create({
+          deal_id: dealId,
+          approver_email: email.toLowerCase().trim(),
+          token: hashedToken,
+          encrypted_token: encryptedToken,
+          status: 'PENDING',
+          expires_at: expiresAt,
+          request_id: requestId
+        }, { transaction });
+
+        const approvalUrl = frontendUrl 
+          ? `${frontendUrl}?token=${encodeURIComponent(encryptedToken)}`
+          : emailService.buildApprovalLink(encryptedToken);
+
+        const lineItemCount = deal.line_items_count || 0;
+        const budgetAmount = deal.budget_setup?.budgetAmount || deal.budget_setup?.budget_amount || 0;
+        const currency = deal.currency || deal.budget_setup?.currency || 'USD';
+
+        emailService.sendApprovalRequestEmailAsync({
+          approverEmail: email,
+          dealId,
+          dealName: deal.name,
+          budget: budgetAmount,
+          currency,
+          noLineItems: lineItemCount,
+          publisherName: '',
+          approvalLink: approvalUrl,
+          user: {},
+          logoUrl: null
+        }, async (historyData) => {
+          await this._recordApprovalHistory(dealId, historyData.action, {
+            approverEmail: historyData.approverEmail,
+            success: historyData.success,
+            error: historyData.error,
+            endpoint: historyData.endpoint,
+            requestPayload: historyData.requestPayload,
+            responseDetails: historyData.responseDetails,
+            timestamp: historyData.timestamp
+          }, requestId);
+        });
+
+        tokens.push({
+          id: approvalToken.id,
+          email,
+          status: 'PENDING'
+        });
+      }
+
+      await Deal.update(
+        { status: 'PENDING', version: deal.version + 1 },
+        { where: { deal_id: dealId }, transaction }
+      );
+
+      const cascadeResult = await this._cascadeStatusToLineItems(dealId, 'PENDING', deal.source, transaction);
+
+      await this._recordApprovalHistory(dealId, 'APPROVAL_REQUESTED', {
+        approverEmails: approvalEmails,
+        expiresAt,
+        cascadedLineItems: cascadeResult.cascaded.length,
+        skippedLineItems: cascadeResult.skipped.length
+      }, requestId, transaction);
+
+      await transaction.commit();
+
+      return {
+        success: true,
+        dealId,
+        status: 'PENDING',
+        approverCount: approvalEmails.length,
+        tokens: tokens.map(t => ({ email: t.email, status: t.status })),
+        cascadedLineItems: cascadeResult.cascaded.length > 0 ? cascadeResult.cascaded : undefined,
+        skippedLineItems: cascadeResult.skipped.length > 0 ? cascadeResult.skipped : undefined
+      };
+    } catch (error) {
+      await transaction.rollback();
+      throw error;
+    }
+  }
+
+  async autoApprove(dealId, requestId = null) {
+    const deal = await Deal.findOne({ where: { deal_id: dealId } });
+    if (!deal) {
+      throw new Error(`Deal not found: ${dealId}`);
+    }
+
+    const validation = CampaignStatusService.validateTransition(
+      { status: deal.status, source: deal.source, mode: deal.mode },
+      'APPROVED',
+      { owner: TRANSITION_OWNERS.USER, source: deal.source, workflow: deal.mode }
+    );
+
+    if (!validation.valid) {
+      throw new Error(`Cannot transition to APPROVED: ${validation.errors[0]?.message || 'Invalid transition'}`);
+    }
+
+    const transaction = await sequelize.transaction();
+
+    try {
+      await Deal.update(
+        { status: 'APPROVED', version: deal.version + 1 },
+        { where: { deal_id: dealId }, transaction }
+      );
+
+      const cascadeResult = await this._cascadeStatusToLineItems(dealId, 'APPROVED', deal.source, transaction);
+
+      await this._recordApprovalHistory(dealId, 'AUTO_APPROVED', {
+        reason: 'No approval emails configured - basic validation passed',
+        cascadedLineItems: cascadeResult.cascaded.length,
+        skippedLineItems: cascadeResult.skipped.length
+      }, requestId, transaction);
+
+      await transaction.commit();
+
+      return {
+        success: true,
+        dealId,
+        status: 'APPROVED',
+        approvalType: 'AUTO',
+        message: 'Campaign auto-approved (no approval emails configured)',
+        cascadedLineItems: cascadeResult.cascaded.length > 0 ? cascadeResult.cascaded : undefined,
+        skippedLineItems: cascadeResult.skipped.length > 0 ? cascadeResult.skipped : undefined
+      };
+    } catch (error) {
+      await transaction.rollback();
+      throw error;
+    }
+  }
+
+  async resendApprovalEmails(dealId, requestId = null, options = {}) {
+    const { frontendUrl = null, emails: specificEmails = null } = options;
+    const deal = await Deal.findOne({ where: { deal_id: dealId } });
+    if (!deal) {
+      throw new Error(`Deal not found: ${dealId}`);
+    }
+
+    if (deal.mode !== 'DIRECT') {
+      const err = new Error('Resend approval is only available for DIRECT campaigns');
+      err.code = 'INVALID_MODE';
+      err.statusCode = 400;
+      throw err;
+    }
+
+    if (deal.status !== 'PENDING') {
+      const err = new Error(`Cannot resend approval emails. Deal must be in PENDING status (current: ${deal.status})`);
+      err.code = 'INVALID_STATUS';
+      err.statusCode = 400;
+      throw err;
+    }
+
+    const pendingTokens = await ApprovalToken.findAll({
+      where: {
+        deal_id: dealId,
+        status: 'PENDING',
+        decision_at: null
+      }
+    });
+
+    if (pendingTokens.length === 0) {
+      const err = new Error('No pending approval tokens found for this deal');
+      err.code = 'NO_PENDING_TOKENS';
+      err.statusCode = 400;
+      throw err;
+    }
+
+    const emailsToResend = specificEmails 
+      ? pendingTokens.filter(t => specificEmails.map(e => e.toLowerCase().trim()).includes(t.approver_email))
+      : pendingTokens;
+
+    if (emailsToResend.length === 0) {
+      const err = new Error('No matching pending approval tokens found for the specified emails');
+      err.code = 'NO_MATCHING_TOKENS';
+      err.statusCode = 400;
+      throw err;
+    }
+
+    const resentEmails = [];
+    const lineItemCount = deal.line_items_count || 0;
+    const budgetAmount = deal.budget_setup?.budgetAmount || deal.budget_setup?.budget_amount || 0;
+    const currency = deal.currency || deal.budget_setup?.currency || 'USD';
+
+    for (const token of emailsToResend) {
+      const approvalUrl = frontendUrl 
+        ? `${frontendUrl}?token=${encodeURIComponent(token.encrypted_token)}`
+        : emailService.buildApprovalLink(token.encrypted_token);
+
+      emailService.sendApprovalRequestEmailAsync({
+        approverEmail: token.approver_email,
+        dealId,
+        dealName: deal.name,
+        budget: budgetAmount,
+        currency,
+        noLineItems: lineItemCount,
+        publisherName: '',
+        approvalLink: approvalUrl,
+        user: {},
+        logoUrl: null,
+        isResend: true
+      }, async (historyData) => {
+        await this._recordApprovalHistory(dealId, historyData.action, {
+          approverEmail: historyData.approverEmail,
+          success: historyData.success,
+          error: historyData.error,
+          endpoint: historyData.endpoint,
+          requestPayload: historyData.requestPayload,
+          responseDetails: historyData.responseDetails,
+          timestamp: historyData.timestamp,
+          isResend: true
+        }, requestId);
+      });
+
+      resentEmails.push({
+        email: token.approver_email,
+        status: 'RESENT',
+        expiresAt: token.expires_at
+      });
+    }
+
+    await this._recordApprovalHistory(dealId, 'APPROVAL_RESENT', {
+      resentEmails: resentEmails.map(e => e.email),
+      totalPendingTokens: pendingTokens.length,
+      resentCount: resentEmails.length
+    }, requestId);
+
+    return {
+      success: true,
+      dealId,
+      resentCount: resentEmails.length,
+      totalPendingApprovers: pendingTokens.length,
+      resentEmails: resentEmails.map(e => ({ email: e.email, expiresAt: e.expiresAt }))
+    };
+  }
+
+  async getApprovalTokenByEncrypted(encryptedToken) {
+    const rawToken = this.decryptToken(encryptedToken);
+    if (!rawToken) {
+      return null;
+    }
+
+    const hashedToken = this.hashToken(rawToken);
+    return ApprovalToken.findOne({
+      where: { token: hashedToken },
+      include: [{
+        model: Deal,
+        as: 'deal'
+      }]
+    });
+  }
+
+  async getCampaignDetailsForApproval(encryptedToken) {
+    const approvalToken = await this.getApprovalTokenByEncrypted(encryptedToken);
+    
+    if (!approvalToken) {
+      return { error: 'INVALID_TOKEN', message: 'Invalid or expired approval token' };
+    }
+
+    if (new Date() > new Date(approvalToken.expires_at)) {
+      return { error: 'TOKEN_EXPIRED', message: 'Approval token has expired' };
+    }
+
+    if (approvalToken.status !== 'PENDING') {
+      const deal = approvalToken.deal;
+      return { 
+        error: 'ALREADY_DECIDED', 
+        message: `Approval already submitted: ${approvalToken.status}`,
+        decision: approvalToken.status,
+        decisionAt: approvalToken.decision_at,
+        rejectionReason: deal?.rejection_reason || approvalToken.rejection_reason,
+        dealStatus: deal?.status
+      };
+    }
+
+    const deal = approvalToken.deal;
+    const lineItems = await LineItem.findAll({
+      where: { deal_id: deal.deal_id },
+      include: [{
+        model: LineItemCreative,
+        as: 'creatives'
+      }]
+    });
+
+    const allApprovals = await ApprovalToken.findAll({
+      where: { deal_id: deal.deal_id },
+      attributes: ['approver_email', 'status', 'decision_at']
+    });
+
+    return {
+      success: true,
+      approverEmail: approvalToken.approver_email,
+      otpVerified: approvalToken.otp_verified,
+      campaign: {
+        dealId: deal.deal_id,
+        name: deal.name,
+        brand: deal.brand,
+        mode: deal.mode,
+        status: deal.status,
+        rejectionReason: deal.rejection_reason,
+        marketSelection: deal.market_selection,
+        budgetSetup: deal.budget_setup,
+        campaignGoal: deal.campaign_goal,
+        targeting: deal.targeting,
+        flightDates: {
+          startDate: deal.start_date,
+          endDate: deal.end_date
+        }
+      },
+      lineItems: lineItems.map(li => ({
+        externalId: li.external_id,
+        name: li.name,
+        publisher: li.publisher,
+        resolutions: li.resolutions,
+        duration: li.duration,
+        totalInventories: li.total_inventories,
+        creatives: (li.creatives || []).map(c => ({
+          creativeId: c.creative_id,
+          creativeUri: c.creative_uri,
+          creativeType: c.creative_type,
+          mimeType: c.mime_type,
+          resolution: c.resolution,
+          status: c.status
+        }))
+      })),
+      approvalStatus: {
+        total: allApprovals.length,
+        pending: allApprovals.filter(a => a.status === 'PENDING').length,
+        approved: allApprovals.filter(a => a.status === 'APPROVED').length,
+        rejected: allApprovals.filter(a => a.status === 'REJECTED').length
+      }
+    };
+  }
+
+  async getLineItemsForApproval(encryptedToken) {
+    const approvalToken = await this.getApprovalTokenByEncrypted(encryptedToken);
+    
+    if (!approvalToken) {
+      return { error: 'INVALID_TOKEN', message: 'Invalid or expired approval token' };
+    }
+
+    if (new Date() > new Date(approvalToken.expires_at)) {
+      return { error: 'TOKEN_EXPIRED', message: 'Approval token has expired' };
+    }
+
+    const deal = approvalToken.deal;
+    const lineItems = await LineItem.findAll({
+      where: { deal_id: deal.deal_id },
+      include: [{
+        model: LineItemCreative,
+        as: 'creatives'
+      }]
+    });
+
+    return {
+      success: true,
+      dealId: deal.deal_id,
+      dealName: deal.name,
+      lineItems: lineItems.map(li => ({
+        id: li.id,
+        externalId: li.external_id,
+        name: li.name,
+        publisher: li.publisher,
+        resolutions: li.resolutions,
+        duration: li.duration,
+        creativeType: li.creative_type,
+        schedule: li.schedule,
+        pacing: li.pacing,
+        totalInventories: li.total_inventories,
+        planning: li.planning,
+        creatives: (li.creatives || []).map(c => ({
+          creativeId: c.creative_id,
+          creativeUri: c.creative_uri,
+          creativeType: c.creative_type,
+          mimeType: c.mime_type,
+          resolution: c.resolution,
+          duration: c.duration,
+          status: c.status
+        }))
+      })),
+      pagination: {
+        total: lineItems.length
+      }
+    };
+  }
+
+  async getInventoriesForApproval(encryptedToken, lineItemId = null) {
+    const approvalToken = await this.getApprovalTokenByEncrypted(encryptedToken);
+    
+    if (!approvalToken) {
+      return { error: 'INVALID_TOKEN', message: 'Invalid or expired approval token' };
+    }
+
+    if (new Date() > new Date(approvalToken.expires_at)) {
+      return { error: 'TOKEN_EXPIRED', message: 'Approval token has expired' };
+    }
+
+    const deal = approvalToken.deal;
+    const { default: LineItemInventory } = await import('../models/LineItemInventory.js');
+
+    const whereClause = { deal_id: deal.deal_id };
+    if (lineItemId) {
+      const lineItem = await LineItem.findOne({
+        where: { deal_id: deal.deal_id, external_id: lineItemId }
+      });
+      if (!lineItem) {
+        const lineItemById = await LineItem.findOne({
+          where: { deal_id: deal.deal_id, id: lineItemId }
+        });
+        if (lineItemById) {
+          whereClause.line_item_id = lineItemById.id;
+        } else {
+          return { error: 'LINE_ITEM_NOT_FOUND', message: 'Line item not found' };
+        }
+      } else {
+        whereClause.line_item_id = lineItem.id;
+      }
+    }
+
+    const inventories = await LineItemInventory.findAll({ where: whereClause });
+
+    return {
+      success: true,
+      dealId: deal.deal_id,
+      dealName: deal.name,
+      lineItemId: lineItemId || null,
+      inventories: inventories.map(inv => ({
+        id: inv.id,
+        name: inv.name,
+        referenceId: inv.reference_id,
+        deviceId: inv.device_id,
+        publisher: {
+          id: inv.publisher_id,
+          name: inv.publisher_name,
+          domain: inv.publisher_domain
+        },
+        size: inv.size,
+        venueType: inv.venue_type,
+        metadata: inv.metadata,
+        planning: inv.planning
+      })),
+      pagination: {
+        total: inventories.length
+      }
+    };
+  }
+
+  async requestOTP(encryptedToken) {
+    const approvalToken = await this.getApprovalTokenByEncrypted(encryptedToken);
+    
+    if (!approvalToken) {
+      return { error: 'INVALID_TOKEN', message: 'Invalid approval token' };
+    }
+
+    if (new Date() > new Date(approvalToken.expires_at)) {
+      return { error: 'TOKEN_EXPIRED', message: 'Approval token has expired' };
+    }
+
+    if (approvalToken.status !== 'PENDING') {
+      return { error: 'ALREADY_DECIDED', message: 'Approval already submitted' };
+    }
+
+    const totalOTPRequests = await ApprovalOTP.count({
+      where: { approval_token_id: approvalToken.id }
+    });
+
+    if (totalOTPRequests >= MAX_OTP_REQUESTS) {
+      return { error: 'MAX_OTP_REQUESTS', message: 'Maximum OTP requests exceeded for this approval.' };
+    }
+
+    const recentOTP = await ApprovalOTP.findOne({
+      where: { approval_token_id: approvalToken.id },
+      order: [['created_at', 'DESC']]
+    });
+
+    if (recentOTP) {
+      const cooldownEnd = new Date(recentOTP.created_at);
+      cooldownEnd.setSeconds(cooldownEnd.getSeconds() + OTP_COOLDOWN_SECONDS);
+      if (new Date() < cooldownEnd) {
+        const waitSeconds = Math.ceil((cooldownEnd - new Date()) / 1000);
+        return { error: 'OTP_COOLDOWN', message: `Please wait ${waitSeconds} seconds before requesting a new OTP.` };
+      }
+    }
+
+    const otpCode = this.generateOTP();
+    const hashedOTP = this.hashOTP(otpCode);
+    const expiresAt = new Date();
+    expiresAt.setMinutes(expiresAt.getMinutes() + OTP_EXPIRY_MINUTES);
+
+    await ApprovalOTP.update(
+      { verified: true },
+      { where: { approval_token_id: approvalToken.id, verified: false } }
+    );
+
+    await ApprovalOTP.create({
+      approval_token_id: approvalToken.id,
+      otp_code: hashedOTP,
+      expires_at: expiresAt
+    });
+
+    const dealId = approvalToken.deal_id;
+
+    emailService.sendOTPEmailAsync({
+      approverEmail: approvalToken.approver_email,
+      otpCode,
+      mediaownerName: '',
+      user: {},
+      logoUrl: null
+    }, async (historyData) => {
+      await this._recordApprovalHistory(dealId, historyData.action, {
+        approverEmail: historyData.approverEmail,
+        success: historyData.success,
+        error: historyData.error,
+        endpoint: historyData.endpoint,
+        requestPayload: historyData.requestPayload,
+        responseDetails: historyData.responseDetails,
+        timestamp: historyData.timestamp
+      });
+    });
+
+    return {
+      success: true,
+      message: 'OTP sent to your email',
+      expiresInMinutes: OTP_EXPIRY_MINUTES
+    };
+  }
+
+  async verifyOTP(encryptedToken, otpCode) {
+    const approvalToken = await this.getApprovalTokenByEncrypted(encryptedToken);
+    
+    if (!approvalToken) {
+      return { error: 'INVALID_TOKEN', message: 'Invalid approval token' };
+    }
+
+    const otp = await ApprovalOTP.findOne({
+      where: { 
+        approval_token_id: approvalToken.id,
+        verified: false
+      },
+      order: [['created_at', 'DESC']]
+    });
+
+    if (!otp) {
+      return { error: 'NO_OTP', message: 'No active OTP found. Please request a new one.' };
+    }
+
+    if (otp.attempts >= MAX_OTP_ATTEMPTS) {
+      return { error: 'MAX_ATTEMPTS', message: 'Maximum OTP attempts exceeded. Please request a new OTP.' };
+    }
+
+    if (new Date() > new Date(otp.expires_at)) {
+      return { error: 'OTP_EXPIRED', message: 'OTP has expired. Please request a new one.' };
+    }
+
+    const hashedInput = this.hashOTP(otpCode);
+    if (otp.otp_code !== hashedInput) {
+      await otp.update({ attempts: otp.attempts + 1 });
+      const remaining = MAX_OTP_ATTEMPTS - otp.attempts - 1;
+      return { 
+        error: 'INVALID_OTP', 
+        message: `Invalid OTP. ${remaining} attempts remaining.`,
+        attemptsRemaining: remaining
+      };
+    }
+
+    await otp.update({ verified: true });
+    await approvalToken.update({ otp_verified: true });
+
+    return { success: true, message: 'OTP verified successfully' };
+  }
+
+  async submitApprovalDecision(encryptedToken, decision, rejectionReason = null, requestId = null) {
+    const approvalToken = await this.getApprovalTokenByEncrypted(encryptedToken);
+    
+    if (!approvalToken) {
+      return { error: 'INVALID_TOKEN', message: 'Invalid approval token' };
+    }
+
+    if (!approvalToken.otp_verified) {
+      return { error: 'OTP_NOT_VERIFIED', message: 'Please verify OTP before submitting decision' };
+    }
+
+    if (approvalToken.status !== 'PENDING') {
+      return { error: 'ALREADY_DECIDED', message: 'Decision already submitted' };
+    }
+
+    if (!['APPROVED', 'REJECTED'].includes(decision)) {
+      return { error: 'INVALID_DECISION', message: 'Decision must be APPROVED or REJECTED' };
+    }
+
+    if (decision === 'REJECTED' && !rejectionReason) {
+      return { error: 'REJECTION_REASON_REQUIRED', message: 'Rejection reason is required' };
+    }
+
+    const transaction = await sequelize.transaction();
+
+    try {
+      await approvalToken.update({
+        status: decision,
+        rejection_reason: rejectionReason,
+        decision_at: new Date()
+      }, { transaction });
+
+      const allApprovals = await ApprovalToken.findAll({
+        where: { deal_id: approvalToken.deal_id },
+        transaction
+      });
+
+      const pending = allApprovals.filter(a => a.id !== approvalToken.id && a.status === 'PENDING');
+      const rejected = allApprovals.filter(a => a.status === 'REJECTED' || (a.id === approvalToken.id && decision === 'REJECTED'));
+      const approved = allApprovals.filter(a => a.status === 'APPROVED' || (a.id === approvalToken.id && decision === 'APPROVED'));
+
+      let newDealStatus = null;
+      
+      if (rejected.length > 0) {
+        newDealStatus = 'REJECTED';
+      } else if (pending.length === 0 && approved.length === allApprovals.length) {
+        newDealStatus = 'APPROVED';
+      }
+
+      let cascadeResult = { cascaded: [], skipped: [] };
+      const deal = await Deal.findOne({ where: { deal_id: approvalToken.deal_id }, transaction });
+
+      if (newDealStatus) {
+        const updateData = { status: newDealStatus };
+        if (newDealStatus === 'REJECTED' && rejectionReason) {
+          updateData.rejection_reason = rejectionReason;
+        }
+        await Deal.update(
+          updateData,
+          { where: { deal_id: approvalToken.deal_id }, transaction }
+        );
+
+        cascadeResult = await this._cascadeStatusToLineItems(
+          approvalToken.deal_id, 
+          newDealStatus, 
+          deal?.source, 
+          transaction
+        );
+      }
+
+      await this._recordApprovalHistory(approvalToken.deal_id, `APPROVAL_${decision}`, {
+        approverEmail: approvalToken.approver_email,
+        decision,
+        rejectionReason,
+        newDealStatus,
+        cascadedLineItems: cascadeResult.cascaded.length,
+        skippedLineItems: cascadeResult.skipped.length
+      }, requestId, transaction);
+
+      await transaction.commit();
+
+      if (newDealStatus && deal?.seller?.email) {
+        const historyCallback = async (details) => {
+          await this._recordApprovalHistory(approvalToken.deal_id, details.action, {
+            ...details,
+            approverEmail: approvalToken.approver_email
+          }, requestId);
+        };
+
+        emailService.sendDecisionEmailAsync({
+          sellerEmail: deal.seller.email,
+          dealId: approvalToken.deal_id,
+          dealName: deal.name,
+          budget: deal.budget_setup?.budgetAmount || deal.budget_setup?.budget_amount || deal.net_cost || 0,
+          currency: deal.currency || deal.budget_setup?.currency || 'USD',
+          noLineItems: deal.line_items_count || 0,
+          decision: newDealStatus,
+          approverEmail: approvalToken.approver_email
+        }, historyCallback);
+      }
+
+      return {
+        success: true,
+        decision,
+        dealStatus: newDealStatus || 'PENDING',
+        approvalStatus: {
+          total: allApprovals.length,
+          pending: pending.length,
+          approved: approved.length,
+          rejected: rejected.length
+        },
+        cascadedLineItems: cascadeResult.cascaded.length > 0 ? cascadeResult.cascaded : undefined,
+        skippedLineItems: cascadeResult.skipped.length > 0 ? cascadeResult.skipped : undefined
+      };
+    } catch (error) {
+      await transaction.rollback();
+      throw error;
+    }
+  }
+
+  async getApprovalHistory(dealId) {
+    const approvals = await ApprovalToken.findAll({
+      where: { deal_id: dealId },
+      attributes: ['approver_email', 'status', 'rejection_reason', 'decision_at', 'created_at'],
+      order: [['created_at', 'ASC']]
+    });
+
+    return approvals.map(a => ({
+      approverEmail: a.approver_email,
+      status: a.status,
+      rejectionReason: a.rejection_reason,
+      decisionAt: a.decision_at,
+      requestedAt: a.created_at
+    }));
+  }
+
+  async _recordApprovalHistory(dealId, action, details, requestId, transaction) {
+    const deal = await Deal.findOne({ where: { deal_id: dealId }, transaction });
+    if (!deal) return;
+
+    await ChangeHistory.create({
+      entity_type: 'DEAL',
+      entity_id: deal.id,
+      deal_id: dealId,
+      action: 'UPDATE',
+      changed_by: details.approverEmail || 'SYSTEM',
+      metadata: {
+        approvalAction: action,
+        ...details
+      },
+      request_id: requestId
+    }, { transaction });
+  }
+
+  async _cascadeStatusToLineItems(dealId, newStatus, sourceType, transaction) {
+    const cascadeStatus = LineItemStatusService.getCascadeStatus(newStatus);
+    if (!cascadeStatus || !LineItemStatusService.shouldCascadeStatus(newStatus)) {
+      return { cascaded: [], skipped: [] };
+    }
+
+    const lineItems = await LineItem.findAll({ 
+      where: { deal_id: dealId },
+      transaction 
+    });
+
+    const cascaded = [];
+    const skipped = [];
+
+    for (const li of lineItems) {
+      if (li.status === cascadeStatus) continue;
+      if (li.status === 'ARCHIVED') {
+        skipped.push({
+          lineItemId: li.id,
+          externalId: li.external_id,
+          reason: 'Archived line items are not updated by cascade'
+        });
+        continue;
+      }
+
+      const validation = LineItemStatusService.validateTransition(
+        { status: li.status, source: sourceType },
+        cascadeStatus,
+        { owner: TRANSITION_OWNERS.ADMIN, source: sourceType, campaignStatus: newStatus }
+      );
+
+      if (!validation.valid) {
+        skipped.push({
+          lineItemId: li.id,
+          externalId: li.external_id,
+          reason: validation.errors[0]?.message || 'Invalid transition'
+        });
+        continue;
+      }
+
+      const previousStatus = li.status;
+      await li.update({ status: cascadeStatus }, { transaction });
+      cascaded.push({
+        lineItemId: li.id,
+        externalId: li.external_id,
+        previousStatus,
+        currentStatus: cascadeStatus
+      });
+    }
+
+    return { cascaded, skipped };
+  }
+}
+
+export default new ApprovalService();