Document Approval Workflow on Website: Development & Implementation

Paper approvals drag on for weeks. Documents get lost, signatures are forged, employees waste time on constant reminders. We develop digital approval workflows that end this chaos. Our engine embeds into a website or CRM, automatically routes documents along predefined paths, controls deadlines, and maintains a full audit log. No more "lost in email" — everything is transparent in one window. Over 5 years, we have implemented 50+ projects, reducing approval time by an average of 3x. More about the workflow concept can be read on Wikipedia.

Problems solved by approval workflow

If a manager is on a business trip, the process stalls. Our engine automatically escalates the task to a deputy or reassigns it based on rules. Timeouts are configurable in hours — if no response, the system reminds and then escalates higher. Manual control consumes hours: employees track statuses manually. We provide a personal cabinet with a timeline showing every step: who, when, and what they decided. The initiator sees progress, approvers see the deadline. Errors and duplicates are eliminated: the workflow strictly defines the route with role verification. In one project, we reduced errors by 90%. Integration with EDS (electronic signature) is implemented via the signatories' API, supporting qualified and non-qualified certificates. Transitioning to electronic document management provides full transparency — this is the document signing system on the website.

How we build flexible workflow?

We use a proven stack: TypeScript + Node.js (Nest.js) on the backend, React with TypeScript on the frontend. For storage — PostgreSQL with JSONB for step templates. The state engine is implemented as a separate microservice with clear transactions.

Data model — workflow templates, instances for each document, and approval tasks. Each task is linked to a step, executor, and timeout. JSONB in the template allows flexible step description: type (sequential/parallel), transition conditions, escalation.

-- Шаблоны workflow
CREATE TABLE workflow_templates (
  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name        VARCHAR(200),
  description TEXT,
  steps       JSONB NOT NULL,  -- Массив шагов с конфигурацией
  created_by  UUID REFERENCES users(id)
);

-- Экземпляр workflow для конкретного документа
CREATE TABLE workflow_instances (
  id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  template_id     UUID REFERENCES workflow_templates(id),
  document_id     UUID REFERENCES documents(id),
  initiator_id    UUID REFERENCES users(id),
  current_step    INT DEFAULT 1,
  status          VARCHAR(50) DEFAULT 'in_progress', -- in_progress, approved, rejected, cancelled
  metadata        JSONB DEFAULT '{}',
  created_at      TIMESTAMPTZ DEFAULT NOW(),
  completed_at    TIMESTAMPTZ
);

-- Задачи согласования
CREATE TABLE workflow_tasks (
  id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  instance_id     UUID REFERENCES workflow_instances(id),
  step_number     INT NOT NULL,
  assignee_id     UUID REFERENCES users(id),
  assignee_role   VARCHAR(100),    -- Альтернатива assignee_id для динамических ролей
  task_type       VARCHAR(50),     -- 'approve', 'sign', 'review'
  status          VARCHAR(50) DEFAULT 'pending', -- pending, approved, rejected, delegated
  comment         TEXT,
  due_at          TIMESTAMPTZ,
  completed_at    TIMESTAMPTZ,
  completed_by_id UUID REFERENCES users(id)  -- Если делегировал
);

The engine processes decisions: approve — checks parallel step (all approved?), then moves to next step or completes workflow. reject — stops the process or returns for revision. request_changes — sends document to initiator with comment.

class WorkflowEngine {
  async processDecision(
    taskId: string,
    decision: 'approve' | 'reject' | 'request_changes',
    comment: string,
    userId: string
  ) {
    const task = await db.workflowTasks.findOne(taskId, { include: 'instance.template' });
    if (task.assigneeId !== userId) throw new Error('Not authorized');

    await db.workflowTasks.update(taskId, {
      status: decision,
      comment,
      completedAt: new Date(),
    });

    await auditLog.record({
      action: `task.${decision}`,
      userId,
      taskId,
      instanceId: task.instanceId,
    });

    switch (decision) {
      case 'approve':
        await this.onTaskApproved(task);
        break;
      case 'reject':
        await this.onTaskRejected(task);
        break;
      case 'request_changes':
        await this.returnToInitiator(task, comment);
        break;
    }
  }

  private async onTaskApproved(task: WorkflowTask) {
    const instance = task.instance;
    const template = JSON.parse(instance.template.steps);
    const currentStep = template[task.stepNumber - 1];

    // Параллельный шаг: проверяем все ли в этом шаге одобрили
    if (currentStep.type === 'parallel') {
      const stepTasks = await db.workflowTasks.findAll({
        instanceId: instance.id,
        stepNumber: task.stepNumber,
      });

      const allApproved = stepTasks.every(t => t.status === 'approve');
      const anyRejected = stepTasks.some(t => t.status === 'reject');

      if (anyRejected) return this.onTaskRejected(task);
      if (!allApproved) return; // Ждём остальных
    }

    // Переходим к следующему шагу
    const nextStep = template[task.stepNumber]; // Следующий элемент
    if (!nextStep) {
      // Все шаги пройдены — workflow завершён
      await this.completeWorkflow(instance.id);
    } else {
      await this.activateStep(instance.id, nextStep, task.stepNumber + 1);
    }
  }

  private async activateStep(instanceId: string, step: WorkflowStep, stepNumber: number) {
    await db.workflowInstances.update(instanceId, { currentStep: stepNumber });

    const assignees = await this.resolveAssignees(step);
    const dueAt = step.deadlineHours ? addHours(new Date(), step.deadlineHours) : null;

    for (const assignee of assignees) {
      const task = await db.workflowTasks.create({
        instanceId,
        stepNumber,
        assigneeId: assignee.id,
        taskType: step.taskType,
        dueAt,
      });

      await notifyAssignee(assignee, task);
    }
  }
}

How delegation and escalation work?

The approver can transfer a task to a colleague with a comment. The system closes the original task and creates a new one for the delegate. All delegations are recorded in the audit log.

async function delegateTask(taskId, delegateToId, reason, requesterId) {
  const task = await db.workflowTasks.findByPk(taskId);
  if (task.assigneeId !== requesterId) throw new Error('Not authorized');

  // Закрываем текущую задачу
  await db.workflowTasks.update(taskId, {
    status: 'delegated',
    comment: `Делегировано: ${reason}`,
    completedAt: new Date(),
  });

  // Создаём новую для делегата
  await db.workflowTasks.create({
    ...task.toJSON(),
    id: undefined,
    assigneeId: delegateToId,
    status: 'pending',
    completedAt: null,
    metadata: { delegatedFrom: task.assigneeId, reason },
  });

  await notifyDelegate(delegateToId, taskId);
}

Timeouts are checked by a cron job every hour. If a task is overdue — a notification is sent to the approver and escalation to the manager. Auto-approval on timeout can be configured.

// Cron job: проверяем просроченные задачи каждый час
async function processOverdueTasks() {
  const overdueTasks = await db.workflowTasks.findAll({
    status: 'pending',
    dueAt: { lt: new Date() },
    escalationSentAt: null,
  });

  for (const task of overdueTasks) {
    const step = getStepConfig(task);

    if (step.escalationUserId) {
      // Уведомляем руководителя
      await notifyEscalation(step.escalationUserId, task);
      await db.workflowTasks.update(task.id, { escalationSentAt: new Date() });
    }

    if (step.autoApproveOnTimeout) {
      await workflowEngine.processDecision(task.id, 'approve', 'Auto-approved on timeout', 'system');
    }
  }
}

Progress visualization

The initiator sees the workflow timeline: which step is completed, who approved, who hasn't responded yet, how long we're waiting. A React component with a vertical list, status icons (✓, ✗, ⏳), and tooltips with comments.

Notifications

Why implement workflow on the website?

Workflow on our engine is 3 times faster than paper document flow and 50% more efficient than simple email notifications. You get transparency, control, and resource savings. A typical project pays for itself in 3–6 months by reducing employee time. Average savings on operational expenses can be substantial. We guarantee quality: 5 years of experience, certified engineers, 12 months of support after implementation.

Estimated timelines

Exact timelines are calculated after an audit of your processes. Contact us — we'll conduct a free audit and propose a solution within 1 day. Order implementation and reduce approval time by 3 times. Get a consultation today.

Backend Development Services: Laravel, Node.js, Go, Django, PostgreSQL

On a production server at 3:14 AM, the Laravel Jobs queue stopped processing. 40,000 unprocessed jobs in Redis. Cause: worker crashed due to a memory leak in one of the Jobs (leak via a static variable in an Eloquent observer), supervisor didn't restart it because of misconfigured stopwaitsecs. This is not a hypothetical scenario — it's Tuesday. We analyzed such an incident on a project with 500 RPS load: diagnosis took 4 hours, fix — 20 minutes. So you don't lose money on downtime, we offer backend development services with a focus on production-grade reliability. We'll assess your project in 2 days.

Backend is what works when no one is watching. Or doesn't work. We guarantee you'll have the first option.

How do we ensure production-grade reliability from day one?

What we do correctly from day one

Service Layer over Fat Controllers. Controller receives HTTP request, validates it via Form Request, passes data to Service, returns response. Business logic in Service, not Controller. This sounds trivial, but most legacy projects have controllers with 500 lines and SQL queries inside.

Repository Pattern we use cautiously. If you just wrap Model::where(...) in a repository method — that's boilerplate without benefit. Repository is justified when: you need to abstract from the data source (DB + cache + external API) or when query logic is complex enough to isolate.

Jobs, Events, Listeners. Everything that can be async — make async. Sending email, PDF generation, external API sync, aggregate recalculation — into Queue. Laravel Horizon for queue monitoring in Redis: see throughput, failed jobs, processing time per queue.

How Octane handles high load

Laravel Octane with RoadRunner or Swoole keeps the app in memory between requests — removes bootstrap overhead (config loading, class autoloading) on each HTTP request. Gain: 3–8x on synthetic benchmarks, 2–4x on real applications. Important: no state between requests in static variables — that leads to exactly the incidents from the beginning. We use this in projects with >1000 RPS.

What to do about N+1 queries

N+1 is the most common cause of slow pages in Laravel apps. Standard story: page worked fine on dev with 10 records, on production with 10,000 — 8-second load.

Laravel Debugbar in dev environment shows the number of queries per page. More than 20 queries per page — signal for audit.

Model::preventLazyLoading(! app()->isProduction());

Telescope for profiling in staging: logs all queries, jobs, mail, notifications with time detail. Numbers: after implementing eager loading, page load time drops from 8s to 0.3s — 27 times faster.

PostgreSQL: indexes that are actually needed

PostgreSQL 14+ is the primary DB on all projects. We use PgBouncer + PostgreSQL combination. 10+ years experience, more than 50 backend projects, 5 years on the market.

How PostgreSQL helps avoid slow queries

Composite indexes for frequent WHERE + ORDER BY. If you have WHERE user_id = ? AND status = ? ORDER BY created_at DESC — you need (user_id, status, created_at DESC). A separate index on (user_id) doesn't help much with sorting.

Partial indexes. If 95% of queries go with WHERE status = 'active':

CREATE INDEX idx_orders_active ON orders (created_at DESC)
WHERE status = 'active';

The index is small, fast, covers the main load.

GIN indexes for JSONB and arrays. @> operator without GIN index — seq scan. With index — fast even on millions of rows.

GIN for full-text search. to_tsvector + GIN instead of LIKE '%query%'. LIKE without index is always seq scan. With pg_trgm extension and gin_trgm_ops — supports LIKE with index, useful for CRM search by partial match.

Connection pooling: why it's more important than it seems

Rails, Laravel, Django open a new connection to PostgreSQL for each PHP/Python process. With 100 workers — 100 connections. PostgreSQL starts degrading from 200–300 active connections — overhead on connection management becomes significant.

PgBouncer — connection pooler in front of PostgreSQL. Transaction pooling mode: connection to PostgreSQL is occupied only during a transaction, returned to pool between requests. 1000 application workers → 20–50 actual connections to PostgreSQL. This reduces latency by 40% and hosting costs by 30%.

Node.js with Fastify: when it's better than Laravel

Node.js is justified for:

• Realtime: WebSocket servers, Server-Sent Events, chat, live updates
• Streaming: large files, video, streaming data
• High I/O concurrency: many parallel requests to external APIs without heavy business logic
• Serverless: Lambda/Cloud Functions — Node.js starts faster than PHP

Fastify over Express: 2–3 times faster on benchmarks, built-in JSON Schema validation, better TypeScript support, plugin architecture.

Typical realtime architecture: Laravel — core business logic and REST API. Node.js + Socket.io or ws — WebSocket server. Laravel publishes events to Redis Pub/Sub, Node.js subscribes and broadcasts to clients. This separation allows scaling the WebSocket server independently of the main app.

Go: microservices and high load

Go we use for:

• High-load microservices (>10,000 RPS)
• Background workers with strict latency requirements
• DevOps tools and CLI
• gRPC services in microservice architecture

Goroutines — thousands of times cheaper than OS threads. 10,000 concurrent connections on Go is normal on one server.

But Go is not a silver bullet. Development is slower than Laravel: more boilerplate, no ORM at Eloquent level, error handling with if err != nil everywhere. Justified only when performance is a real requirement, not an assumption.

Django and Python backend

Django with DRF (Django REST Framework) — for tasks where Python is needed: ML pipelines, data processing, integrations with AI tools.

Celery for background tasks — similar to Laravel Queue but more complex to configure. Celery Beat for cron tasks.

Django ORM vs raw SQL: ORM is convenient for CRUD. For analytical queries with multiple JOINs, window functions, and CTEs — connection.execute() with raw SQL is more readable and predictable.

Redis: not just cache

Redis in our projects plays multiple roles:

Redis Cluster for horizontal scaling. Sentinel for automatic failover on standalone setups.

Deployment and infrastructure

Docker + docker-compose — standard for local development and production. Each service in a container: PHP-FPM/Octane, Nginx, PostgreSQL, Redis, Queue Worker, Scheduler.

CI/CD via GitHub Actions:

1. Run tests (PHPUnit / Pest, Vitest, Playwright)
2. Build Docker image
3. Push to Container Registry
4. Deploy: docker pull → docker-compose up -d on server, or Kubernetes rolling update

Zero-downtime deploy for Laravel: php artisan down --secret=TOKEN is not needed with proper configuration. Strategy: new container starts next to the old one, Nginx switches traffic after health check, old container stops.

Monitoring: Sentry for exception tracking with alerting in Slack/Telegram. Grafana + Prometheus (or Grafana Cloud) for metrics: CPU, memory, request rate, queue depth, database connection count. Alerts on: error rate > 1%, p99 latency > 2s, queue depth > 1000 jobs.

What's included in turnkey work

• Architecture design (API documentation, DB schema, service diagram)
• Implementation according to agreed specification with code review
• CI/CD, monitoring, alerting setup
• Load testing (k6, wrk) with report
• Handover of source code, access, deployment instructions
• Training of customer's team (2-3 sessions)
• Warranty support for 1 month after delivery

Timeline benchmarks

Pricing is calculated individually after analyzing load, integrations, and business logic. Contact us for a free audit of your current backend — get an optimization plan in 2 days. Request a consultation.