Document accessRequests API for requesting document access

[tommoor]

Summary

Documents the new accessRequests.* endpoints introduced in outline/outline#10825 ("feat: request document access"), where a user can request access to a document they cannot currently view, and a user with sharing permission can approve or dismiss the request.

Adds:

• New AccessRequests tag.
• New AccessRequest schema component (id, documentId, userId, user, teamId, status, responderId, responder, respondedAt, createdAt, updatedAt). status is one of pending, approved, dismissed.
• Four endpoints, each returning { data: AccessRequest, policies: Policy[] }:
  • POST /accessRequests.create — body { documentId }.
  • POST /accessRequests.info — body { id?, documentId? } (at least one required; documentId looks up the current user's pending request for that document).
  • POST /accessRequests.approve — body { id, permission? } where permission is one of read (default), read_write, admin (matches the DocumentPermission enum used by the route).
  • POST /accessRequests.dismiss — body { id }.

Other PRs merged in the same window (#12307, #12306, #12305, #12304, #12303, #12301, #12103) are dependency bumps, internal refactors, or non-API changes — no spec updates required.

Test plan

• yarn lint (Spectral) passes with no errors.
• node utils/validateOperationIds.js passes.
• Pre-commit hook regenerates spec3.json from the updated YAML.

---

Generated by Claude Code