Merge branch 'accessibility' of https://github.com/suitenumerique/docs into accessibility

.github/workflows/impress-frontend.yml

@@ -127,8 +127,17 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install frontend dependencies
-        uses: ./.github/workflows/front-dependencies-installation.yml
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20.x"
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        with:
+          path: "src/frontend/**/node_modules"
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+          fail-on-cache-miss: true
 
       - name: Set e2e env variables
         run: cat env.d/development/common.e2e.dist >> env.d/development/common.dist

CHANGELOG.md

@@ -11,7 +11,10 @@ and this project adheres to
 
 ## Added
 
-- github actions to manage Crowdin workflow
+- ✨(backend) add soft delete and restore API endpoints to documents #516
+- ✨(backend) allow organizing documents in a tree structure #516
+- ✨(backend) add "excerpt" field to document list serializer #516
+- ✨(backend) add github actions to manage Crowdin workflow #559 & #563
 - 📈Integrate Posthog #540
 - 🏷️(backend) add content-type to uploaded files #552
 - ✨(frontend) export pdf docx front side #537
@@ -21,6 +24,14 @@ and this project adheres to
 - 💄(frontend) add abilities on doc row #581
 - 💄(frontend) improve DocsGridItem responsive padding  #582
 
+## Changed
+
+- 🔧(backend) Bump page size to 200 #516
+
+## Removed
+
+- 🔥(backend) remove "content" field from list serializer # 516
+
 ## [2.0.1] - 2025-01-17
 
 ## Fixed

renovate.json

@@ -14,10 +14,15 @@
       "groupName": "ignored js dependencies",
       "matchManagers": ["npm"],
       "matchPackageNames": [
+        "@openfun/cunningham-react",
+        "@types/react",
+        "@types/react-dom",
+        "eslint",
         "fetch-mock",
         "node",
         "node-fetch",
-        "eslint",
+        "react",
+        "react-dom",
         "workbox-webpack-plugin"
       ]
     }

src/backend/core/admin.py

@@ -4,12 +4,16 @@ from django.contrib import admin
 from django.contrib.auth import admin as auth_admin
 from django.utils.translation import gettext_lazy as _
 
+from treebeard.admin import TreeAdmin
+from treebeard.forms import movenodeform_factory
+
 from . import models
 
 
 class TemplateAccessInline(admin.TabularInline):
     """Inline admin class for template accesses."""
 
+    autocomplete_fields = ["user"]
     model = models.TemplateAccess
     extra = 0
 
@@ -111,14 +115,47 @@ class TemplateAdmin(admin.ModelAdmin):
 class DocumentAccessInline(admin.TabularInline):
     """Inline admin class for template accesses."""
 
+    autocomplete_fields = ["user"]
     model = models.DocumentAccess
     extra = 0
 
 
 @admin.register(models.Document)
-class DocumentAdmin(admin.ModelAdmin):
+class DocumentAdmin(TreeAdmin):
     """Document admin interface declaration."""
 
+    fieldsets = (
+        (
+            None,
+            {
+                "fields": (
+                    "id",
+                    "title",
+                )
+            },
+        ),
+        (
+            _("Permissions"),
+            {
+                "fields": (
+                    "creator",
+                    "link_reach",
+                    "link_role",
+                )
+            },
+        ),
+        (
+            _("Tree structure"),
+            {
+                "fields": (
+                    "path",
+                    "depth",
+                    "numchild",
+                )
+            },
+        ),
+    )
+    form = movenodeform_factory(models.Document)
     inlines = (DocumentAccessInline,)
     list_display = (
         "id",
@@ -128,6 +165,14 @@ class DocumentAdmin(admin.ModelAdmin):
         "created_at",
         "updated_at",
     )
+    readonly_fields = (
+        "creator",
+        "depth",
+        "id",
+        "numchild",
+        "path",
+    )
+    search_fields = ("id", "title")
 
 
 @admin.register(models.Invitation)

src/backend/core/api/filters.py

@@ -24,7 +24,7 @@ class DocumentFilter(django_filters.FilterSet):
 
     class Meta:
         model = models.Document
-        fields = ["is_creator_me", "is_favorite", "link_reach", "title"]
+        fields = ["is_creator_me", "is_favorite", "title"]
 
     # pylint: disable=unused-argument
     def filter_is_creator_me(self, queryset, name, value):
@@ -63,7 +63,4 @@ class DocumentFilter(django_filters.FilterSet):
         if not user.is_authenticated:
             return queryset
 
-        if value:
-            return queryset.filter(favorited_by_users__user=user)
-
-        return queryset.exclude(favorited_by_users__user=user)
+        return queryset.filter(is_favorite=bool(value))

src/backend/core/api/permissions.py

@@ -2,13 +2,15 @@
 
 from django.core import exceptions
 from django.db.models import Q
+from django.http import Http404
 
 from rest_framework import permissions
 
-from core.models import DocumentAccess, RoleChoices
+from core.models import DocumentAccess, RoleChoices, get_trashbin_cutoff
 
 ACTION_FOR_METHOD_TO_PERMISSION = {
-    "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
+    "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"},
+    "children": {"GET": "children_list", "POST": "children_create"},
 }
 
 
@@ -109,3 +111,26 @@ class AccessPermission(permissions.BasePermission):
         except KeyError:
             pass
         return abilities.get(action, False)
+
+
+class DocumentAccessPermission(AccessPermission):
+    """Subclass to handle soft deletion specificities."""
+
+    def has_object_permission(self, request, view, obj):
+        """
+        Return a 404 on deleted documents
+        - for which the trashbin cutoff is past
+        - for which the current user is not owner of the document or one of its ancestors
+        """
+        if (
+            deleted_at := obj.ancestors_deleted_at
+        ) and deleted_at < get_trashbin_cutoff():
+            raise Http404
+
+        # Compute permission first to ensure the "user_roles" attribute is set
+        has_permission = super().has_object_permission(request, view, obj)
+
+        if obj.ancestors_deleted_at and not RoleChoices.OWNER in obj.user_roles:
+            raise Http404
+
+        return has_permission

src/backend/core/api/serializers.py

@@ -147,34 +147,54 @@ class ListDocumentSerializer(BaseResourceSerializer):
 
     is_favorite = serializers.BooleanField(read_only=True)
     nb_accesses = serializers.IntegerField(read_only=True)
+    user_roles = serializers.SerializerMethodField(read_only=True)
 
     class Meta:
         model = models.Document
         fields = [
             "id",
             "abilities",
-            "content",
             "created_at",
             "creator",
+            "depth",
+            "excerpt",
             "is_favorite",
             "link_role",
             "link_reach",
             "nb_accesses",
+            "numchild",
+            "path",
             "title",
             "updated_at",
+            "user_roles",
         ]
         read_only_fields = [
             "id",
             "abilities",
             "created_at",
             "creator",
+            "depth",
+            "excerpt",
             "is_favorite",
             "link_role",
             "link_reach",
             "nb_accesses",
+            "numchild",
+            "path",
             "updated_at",
+            "user_roles",
         ]
 
+    def get_user_roles(self, document):
+        """
+        Return roles of the logged-in user for the current document,
+        taking into account ancestors.
+        """
+        request = self.context.get("request")
+        if request:
+            return document.get_roles(request.user)
+        return []
+
 
 class DocumentSerializer(ListDocumentSerializer):
     """Serialize documents with all fields for display in detail views."""
@@ -189,23 +209,32 @@ class DocumentSerializer(ListDocumentSerializer):
             "content",
             "created_at",
             "creator",
+            "depth",
+            "excerpt",
             "is_favorite",
             "link_role",
             "link_reach",
             "nb_accesses",
+            "numchild",
+            "path",
             "title",
             "updated_at",
+            "user_roles",
         ]
         read_only_fields = [
             "id",
             "abilities",
             "created_at",
             "creator",
+            "depth",
             "is_favorite",
             "link_role",
             "link_reach",
             "nb_accesses",
+            "numchild",
+            "path",
             "updated_at",
+            "user_roles",
         ]
 
     def get_fields(self):
@@ -287,7 +316,7 @@ class ServerCreateDocumentSerializer(serializers.Serializer):
                 {"content": ["Could not convert content"]}
             ) from err
 
-        document = models.Document.objects.create(
+        document = models.Document.add_root(
             title=validated_data["title"],
             content=document_content,
             creator=user,
@@ -539,3 +568,37 @@ class AITranslateSerializer(serializers.Serializer):
         if len(value.strip()) == 0:
             raise serializers.ValidationError("Text field cannot be empty.")
         return value
+
+
+class MoveDocumentSerializer(serializers.Serializer):
+    """
+    Serializer for validating input data to move a document within the tree structure.
+
+    Fields:
+        - target_document_id (UUIDField): The ID of the target parent document where the
+            document should be moved. This field is required and must be a valid UUID.
+        - position (ChoiceField): Specifies the position of the document in relation to
+            the target parent's children.
+          Choices:
+            - "first-child": Place the document as the first child of the target parent.
+            - "last-child": Place the document as the last child of the target parent (default).
+            - "left": Place the document as the left sibling of the target parent.
+            - "right": Place the document as the right sibling of the target parent.
+
+    Example:
+        Input payload for moving a document:
+        {
+            "target_document_id": "123e4567-e89b-12d3-a456-426614174000",
+            "position": "first-child"
+        }
+
+    Notes:
+        - The `target_document_id` is mandatory.
+        - The `position` defaults to "last-child" if not provided.
+    """
+
+    target_document_id = serializers.UUIDField(required=True)
+    position = serializers.ChoiceField(
+        choices=enums.MoveNodePositionChoices.choices,
+        default=enums.MoveNodePositionChoices.LAST_CHILD,
+    )

src/backend/core/api/utils.py

@@ -11,6 +11,29 @@ import botocore
 from rest_framework.throttling import BaseThrottle
 
 
+def filter_root_paths(paths, skip_sorting=False):
+    """
+    Filters root paths from a list of paths representing a tree structure.
+    A root path is defined as a path that is not a prefix of any other path.
+
+    Args:
+        paths (list of str): The list of paths.
+
+    Returns:
+        list of str: The filtered list of root paths.
+    """
+    if not skip_sorting:
+        paths.sort()
+
+    root_paths = []
+    for path in paths:
+        # If the current path is not a prefix of the last added root path, add it
+        if not root_paths or not path.startswith(root_paths[-1]):
+            root_paths.append(path)
+
+    return root_paths
+
+
 def generate_s3_authorization_headers(key):
     """
     Generate authorization headers for an s3 object.

src/backend/core/api/viewsets.py

@@ -8,25 +8,20 @@ from urllib.parse import urlparse
 
 from django.conf import settings
 from django.contrib.postgres.aggregates import ArrayAgg
+from django.contrib.postgres.fields import ArrayField
 from django.contrib.postgres.search import TrigramSimilarity
 from django.core.exceptions import ValidationError
 from django.core.files.storage import default_storage
 from django.db import models as db
-from django.db.models import (
-    Count,
-    Exists,
-    OuterRef,
-    Q,
-    Subquery,
-    Value,
-)
+from django.db import transaction
 from django.db.models.expressions import RawSQL
+from django.db.models.functions import Left, Length
 from django.http import Http404
 
 import rest_framework as drf
 from botocore.exceptions import ClientError
 from django_filters import rest_framework as drf_filters
-from rest_framework import filters, status
+from rest_framework import filters, status, viewsets
 from rest_framework import response as drf_response
 from rest_framework.permissions import AllowAny
 
@@ -53,7 +48,7 @@ COLLABORATION_WS_URL_PATTERN = re.compile(rf"(?:^|&)room=(?P<pk>{UUID_REGEX})(?:
 # pylint: disable=too-many-ancestors
 
 
-class NestedGenericViewSet(drf.viewsets.GenericViewSet):
+class NestedGenericViewSet(viewsets.GenericViewSet):
     """
     A generic Viewset aims to be used in a nested route context.
     e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
@@ -113,28 +108,35 @@ class SerializerPerActionMixin:
 
     This mixin is useful to avoid to define a serializer class for each action in the
     `get_serializer_class` method.
-    """
 
-    serializer_classes: dict[str, type] = {}
-    default_serializer_class: type = None
+    Example:
+    ```
+    class MyViewSet(SerializerPerActionMixin, viewsets.GenericViewSet):
+        serializer_class = MySerializer
+        list_serializer_class = MyListSerializer
+        retrieve_serializer_class = MyRetrieveSerializer
+    ```
+    """
 
     def get_serializer_class(self):
         """
         Return the serializer class to use depending on the action.
         """
-        return self.serializer_classes.get(self.action, self.default_serializer_class)
+        if serializer_class := getattr(self, f"{self.action}_serializer_class", None):
+            return serializer_class
+        return super().get_serializer_class()
 
 
 class Pagination(drf.pagination.PageNumberPagination):
     """Pagination to display no more than 100 objects per page sorted by creation date."""
 
     ordering = "-created_on"
-    max_page_size = 100
+    max_page_size = 200
     page_size_query_param = "page_size"
 
 
 class UserViewSet(
-    drf.mixins.UpdateModelMixin, drf.viewsets.GenericViewSet, drf.mixins.ListModelMixin
+    drf.mixins.UpdateModelMixin, viewsets.GenericViewSet, drf.mixins.ListModelMixin
 ):
     """User ViewSet"""
 
@@ -308,100 +310,241 @@ class DocumentMetadata(drf.metadata.SimpleMetadata):
         return simple_metadata
 
 
+# pylint: disable=too-many-public-methods
 class DocumentViewSet(
+    SerializerPerActionMixin,
     drf.mixins.CreateModelMixin,
     drf.mixins.DestroyModelMixin,
+    drf.mixins.ListModelMixin,
     drf.mixins.UpdateModelMixin,
-    drf.viewsets.GenericViewSet,
+    viewsets.GenericViewSet,
 ):
     """
-    Document ViewSet for managing documents.
+    DocumentViewSet API.
 
-    Provides endpoints for creating, updating, and deleting documents,
-    along with filtering options.
+    This view set provides CRUD operations and additional actions for managing documents.
+    Supports filtering, ordering, and annotations for enhanced querying capabilities.
 
-    Filtering:
+    ### API Endpoints:
+    1. **List**: Retrieve a paginated list of documents.
+       Example: GET /documents/?page=2
+    2. **Retrieve**: Get a specific document by its ID.
+       Example: GET /documents/{id}/
+    3. **Create**: Create a new document.
+       Example: POST /documents/
+    4. **Update**: Update a document by its ID.
+       Example: PUT /documents/{id}/
+    5. **Delete**: Soft delete a document by its ID.
+       Example: DELETE /documents/{id}/
+
+    ### Additional Actions:
+    1. **Trashbin**: List soft deleted documents for a document owner
+        Example: GET /documents/{id}/trashbin/
+
+    2. **Children**: List or create child documents.
+        Example: GET, POST /documents/{id}/children/
+
+    3. **Versions List**: Retrieve version history of a document.
+        Example: GET /documents/{id}/versions/
+
+    4. **Version Detail**: Get or delete a specific document version.
+        Example: GET, DELETE /documents/{id}/versions/{version_id}/
+
+    5. **Favorite**: Get list of favorite documents for a user. Mark or unmark
+        a document as favorite.
+        Examples:
+        - GET /documents/favorite/
+        - POST, DELETE /documents/{id}/favorite/
+
+    6. **Create for Owner**: Create a document via server-to-server on behalf of a user.
+        Example: POST /documents/create-for-owner/
+
+    7. **Link Configuration**: Update document link configuration.
+        Example: PUT /documents/{id}/link-configuration/
+
+    8. **Attachment Upload**: Upload a file attachment for the document.
+        Example: POST /documents/{id}/attachment-upload/
+
+    9. **Media Auth**: Authorize access to document media.
+        Example: GET /documents/media-auth/
+
+    10. **Collaboration Auth**: Authorize access to the collaboration server for a document.
+        Example: GET /documents/collaboration-auth/
+
+    11. **AI Transform**: Apply a transformation action on a piece of text with AI.
+        Example: POST /documents/{id}/ai-transform/
+        Expected data:
+        - text (str): The input text.
+        - action (str): The transformation type, one of [prompt, correct, rephrase, summarize].
+        Returns: JSON response with the processed text.
+        Throttled by: AIDocumentRateThrottle, AIUserRateThrottle.
+
+    12. **AI Translate**: Translate a piece of text with AI.
+        Example: POST /documents/{id}/ai-translate/
+        Expected data:
+        - text (str): The input text.
+        - language (str): The target language, chosen from settings.LANGUAGES.
+        Returns: JSON response with the translated text.
+        Throttled by: AIDocumentRateThrottle, AIUserRateThrottle.
+
+    ### Ordering: created_at, updated_at, is_favorite, title
+
+        Example:
+        - Ascending: GET /api/v1.0/documents/?ordering=created_at
+        - Desceding: GET /api/v1.0/documents/?ordering=-title
+
+    ### Filtering:
         - `is_creator_me=true`: Returns documents created by the current user.
         - `is_creator_me=false`: Returns documents created by other users.
         - `is_favorite=true`: Returns documents marked as favorite by the current user
         - `is_favorite=false`: Returns documents not marked as favorite by the current user
         - `title=hello`: Returns documents which title contains the "hello" string
 
-    Example Usage:
+        Example:
         - GET /api/v1.0/documents/?is_creator_me=true&is_favorite=true
         - GET /api/v1.0/documents/?is_creator_me=false&title=hello
+
+    ### Annotations:
+    1. **is_favorite**: Indicates whether the document is marked as favorite by the current user.
+    2. **user_roles**: Roles the current user has on the document or its ancestors.
+
+    ### Notes:
+    - Only the highest ancestor in a document hierarchy is shown in list views.
+    - Implements soft delete logic to retain document tree structures.
     """
 
-    filter_backends = [drf_filters.DjangoFilterBackend, filters.OrderingFilter]
+    filter_backends = [drf_filters.DjangoFilterBackend]
     filterset_class = DocumentFilter
     metadata_class = DocumentMetadata
     ordering = ["-updated_at"]
-    ordering_fields = ["created_at", "is_favorite", "updated_at", "title"]
+    ordering_fields = ["created_at", "updated_at", "title"]
     permission_classes = [
-        permissions.AccessPermission,
+        permissions.DocumentAccessPermission,
     ]
     queryset = models.Document.objects.all()
     serializer_class = serializers.DocumentSerializer
+    list_serializer_class = serializers.ListDocumentSerializer
+    trashbin_serializer_class = serializers.ListDocumentSerializer
+    children_serializer_class = serializers.ListDocumentSerializer
+    ai_translate_serializer_class = serializers.AITranslateSerializer
 
-    def get_serializer_class(self):
+    def annotate_is_favorite(self, queryset):
         """
-        Use ListDocumentSerializer for list actions, otherwise use DocumentSerializer.
+        Annotate document queryset with the favorite status for the current user.
         """
-        if self.action == "list":
-            return serializers.ListDocumentSerializer
-        return self.serializer_class
-
-    def get_queryset(self):
-        """Optimize queryset to include favorite status for the current user."""
-        queryset = super().get_queryset()
-        user = self.request.user
-
-        # Annotate the number of accesses associated with each document
-        queryset = queryset.annotate(nb_accesses=Count("accesses", distinct=True))
-
-        if not user.is_authenticated:
-            # If the user is not authenticated, annotate `is_favorite` as False
-            return queryset.annotate(is_favorite=Value(False))
-
-        # Annotate the queryset to indicate if the document is favorited by the current user
-        favorite_exists = models.DocumentFavorite.objects.filter(
-            document_id=OuterRef("pk"), user=user
-        )
-        queryset = queryset.annotate(is_favorite=Exists(favorite_exists))
-
-        # Annotate the queryset with the logged-in user roles
-        user_roles_query = (
-            models.DocumentAccess.objects.filter(
-                Q(user=user) | Q(team__in=user.teams),
-                document_id=OuterRef("pk"),
-            )
-            .values("document")
-            .annotate(roles_array=ArrayAgg("role"))
-            .values("roles_array")
-        )
-        return queryset.annotate(user_roles=Subquery(user_roles_query)).distinct()
-
-    def list(self, request, *args, **kwargs):
-        """Restrict resources returned by the list endpoint"""
-        queryset = self.filter_queryset(self.get_queryset())
         user = self.request.user
 
         if user.is_authenticated:
-            queryset = queryset.filter(
-                db.Q(accesses__user=user)
-                | db.Q(accesses__team__in=user.teams)
-                | (
-                    db.Q(link_traces__user=user)
-                    & ~db.Q(link_reach=models.LinkReachChoices.RESTRICTED)
+            favorite_exists_subquery = models.DocumentFavorite.objects.filter(
+                document_id=db.OuterRef("pk"), user=user
+            )
+            return queryset.annotate(is_favorite=db.Exists(favorite_exists_subquery))
+
+        return queryset.annotate(is_favorite=db.Value(False))
+
+    def annotate_user_roles(self, queryset):
+        """
+        Annotate document queryset with the roles of the current user
+        on the document or its ancestors.
+        """
+        user = self.request.user
+        output_field = ArrayField(base_field=db.CharField())
+
+        if user.is_authenticated:
+            user_roles_subquery = models.DocumentAccess.objects.filter(
+                db.Q(user=user) | db.Q(team__in=user.teams),
+                document__path=Left(db.OuterRef("path"), Length("document__path")),
+            ).values_list("role", flat=True)
+
+            return queryset.annotate(
+                user_roles=db.Func(
+                    user_roles_subquery, function="ARRAY", output_field=output_field
                 )
             )
-        else:
-            queryset = queryset.none()
 
+        return queryset.annotate(
+            user_roles=db.Value([], output_field=output_field),
+        )
+
+    def get_queryset(self):
+        """Get queryset performing all annotation and filtering on the document tree structure."""
+        user = self.request.user
+        queryset = super().get_queryset()
+
+        # Only list views need filtering and annotation
+        if self.detail:
+            return queryset
+
+        if not user.is_authenticated:
+            return queryset.none()
+
+        queryset = queryset.filter(ancestors_deleted_at__isnull=True)
+
+        # Filter documents to which the current user has access...
+        access_documents_ids = models.DocumentAccess.objects.filter(
+            db.Q(user=user) | db.Q(team__in=user.teams)
+        ).values_list("document_id", flat=True)
+
+        # ...or that were previously accessed and are not restricted
+        traced_documents_ids = models.LinkTrace.objects.filter(user=user).values_list(
+            "document_id", flat=True
+        )
+
+        return queryset.filter(
+            db.Q(id__in=access_documents_ids)
+            | (
+                db.Q(id__in=traced_documents_ids)
+                & ~db.Q(link_reach=models.LinkReachChoices.RESTRICTED)
+            )
+        )
+
+    def filter_queryset(self, queryset):
+        """Apply annotations and filters sequentially."""
+        filterset = DocumentFilter(
+            self.request.GET, queryset=queryset, request=self.request
+        )
+        filterset.is_valid()
+        filter_data = filterset.form.cleaned_data
+
+        # Filter as early as possible on fields that are available on the model
+        for field in ["is_creator_me", "title"]:
+            queryset = filterset.filters[field].filter(queryset, filter_data[field])
+
+        queryset = self.annotate_user_roles(queryset)
+
+        if self.action == "list":
+            # Among the results, we may have documents that are ancestors/descendants
+            # of each other. In this case we want to keep only the highest ancestors.
+            root_paths = utils.filter_root_paths(
+                queryset.order_by("path").values_list("path", flat=True),
+                skip_sorting=True,
+            )
+            queryset = queryset.filter(path__in=root_paths)
+
+            # Annotate the queryset with an attribute marking instances as highest ancestor
+            # in order to save some time while computing abilities in the instance
+            queryset = queryset.annotate(
+                is_highest_ancestor_for_user=db.Value(
+                    True, output_field=db.BooleanField()
+                )
+            )
+
+        # Annotate favorite status and filter if applicable as late as possible
+        queryset = self.annotate_is_favorite(queryset)
+        queryset = filterset.filters["is_favorite"].filter(
+            queryset, filter_data["is_favorite"]
+        )
+
+        # Apply ordering only now that everyting is filtered and annotated
+        return filters.OrderingFilter().filter_queryset(self.request, queryset, self)
+
+    def get_response_for_queryset(self, queryset):
+        """Return paginated response for the queryset if requested."""
         page = self.paginate_queryset(queryset)
         if page is not None:
             serializer = self.get_serializer(page, many=True)
-            return self.get_paginated_response(serializer.data)
+            result = self.get_paginated_response(serializer.data)
+            return result
 
         serializer = self.get_serializer(queryset, many=True)
         return drf.response.Response(serializer.data)
@@ -412,32 +555,75 @@ class DocumentViewSet(
         on a user's list view even though the user has no specific role in the document (link
         access when the link reach configuration of the document allows it).
         """
+        user = self.request.user
         instance = self.get_object()
         serializer = self.get_serializer(instance)
 
-        if self.request.user.is_authenticated:
-            try:
-                # Add a trace that the user visited the document (this is needed to include
-                # the document in the user's list view)
-                models.LinkTrace.objects.create(
-                    document=instance,
-                    user=self.request.user,
-                )
-            except ValidationError:
-                # The trace already exists, so we just pass without doing anything
-                pass
+        # The `create` query generates 5 db queries which are much less efficient than an
+        # `exists` query. The user will visit the document many times after the first visit
+        # so that's what we should optimize for.
+        if (
+            user.is_authenticated
+            and not instance.link_traces.filter(user=user).exists()
+        ):
+            models.LinkTrace.objects.create(document=instance, user=request.user)
 
         return drf.response.Response(serializer.data)
 
+    @transaction.atomic
     def perform_create(self, serializer):
         """Set the current user as creator and owner of the newly created object."""
-        obj = serializer.save(creator=self.request.user)
+        obj = models.Document.add_root(
+            creator=self.request.user,
+            **serializer.validated_data,
+        )
+        serializer.instance = obj
         models.DocumentAccess.objects.create(
             document=obj,
             user=self.request.user,
             role=models.RoleChoices.OWNER,
         )
 
+    def perform_destroy(self, instance):
+        """Override to implement a soft delete instead of dumping the record in database."""
+        instance.soft_delete()
+
+    @drf.decorators.action(
+        detail=False,
+        methods=["get"],
+    )
+    def favorite_list(self, request, *args, **kwargs):
+        """Get list of favorite documents for the current user."""
+        user = request.user
+
+        favorite_documents_ids = models.DocumentFavorite.objects.filter(
+            user=user
+        ).values_list("document_id", flat=True)
+
+        queryset = self.get_queryset()
+        queryset = queryset.filter(id__in=favorite_documents_ids)
+        return self.get_response_for_queryset(queryset)
+
+    @drf.decorators.action(
+        detail=False,
+        methods=["get"],
+    )
+    def trashbin(self, request, *args, **kwargs):
+        """
+        Retrieve soft-deleted documents for which the current user has the owner role.
+
+        The selected documents are those deleted within the cutoff period defined in the
+        settings (see TRASHBIN_CUTOFF_DAYS), before they are considered permanently deleted.
+        """
+        queryset = self.queryset.filter(
+            deleted_at__isnull=False,
+            deleted_at__gte=models.get_trashbin_cutoff(),
+        )
+        queryset = self.annotate_user_roles(queryset)
+        queryset = queryset.filter(user_roles__contains=[models.RoleChoices.OWNER])
+
+        return self.get_response_for_queryset(queryset)
+
     @drf.decorators.action(
         authentication_classes=[authentication.ServerToServerAuthentication],
         detail=False,
@@ -462,6 +648,123 @@ class DocumentViewSet(
             {"id": str(document.id)}, status=status.HTTP_201_CREATED
         )
 
+    @drf.decorators.action(detail=True, methods=["post"])
+    @transaction.atomic
+    def move(self, request, *args, **kwargs):
+        """
+        Move a document to another location within the document tree.
+
+        The user must be an administrator or owner of both the document being moved
+        and the target parent document.
+        """
+        user = request.user
+        document = self.get_object()  # including permission checks
+
+        # Validate the input payload
+        serializer = serializers.MoveDocumentSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        validated_data = serializer.validated_data
+
+        target_document_id = validated_data["target_document_id"]
+        try:
+            target_document = models.Document.objects.get(
+                id=target_document_id, ancestors_deleted_at__isnull=True
+            )
+        except models.Document.DoesNotExist:
+            return drf.response.Response(
+                {"target_document_id": "Target parent document does not exist."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        position = validated_data["position"]
+        message = None
+
+        if position in [
+            enums.MoveNodePositionChoices.FIRST_CHILD,
+            enums.MoveNodePositionChoices.LAST_CHILD,
+        ]:
+            if not target_document.get_abilities(user).get("move"):
+                message = (
+                    "You do not have permission to move documents "
+                    "as a child to this target document."
+                )
+        elif not target_document.is_root():
+            if not target_document.get_parent().get_abilities(user).get("move"):
+                message = (
+                    "You do not have permission to move documents "
+                    "as a sibling of this target document."
+                )
+
+        if message:
+            return drf.response.Response(
+                {"target_document_id": message},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        document.move(target_document, pos=position)
+
+        return drf.response.Response(
+            {"message": "Document moved successfully."}, status=status.HTTP_200_OK
+        )
+
+    @drf.decorators.action(
+        detail=True,
+        methods=["post"],
+    )
+    def restore(self, request, *args, **kwargs):
+        """
+        Restore a soft-deleted document if it was deleted less than x days ago.
+        """
+        document = self.get_object()
+        document.restore()
+
+        return drf_response.Response(
+            {"detail": "Document has been successfully restored."},
+            status=status.HTTP_200_OK,
+        )
+
+    @drf.decorators.action(
+        detail=True,
+        methods=["get", "post"],
+        ordering=["path"],
+        url_path="children",
+    )
+    def children(self, request, *args, **kwargs):
+        """Handle listing and creating children of a document"""
+        document = self.get_object()
+
+        if request.method == "POST":
+            # Create a child document
+            serializer = serializers.DocumentSerializer(
+                data=request.data, context=self.get_serializer_context()
+            )
+            serializer.is_valid(raise_exception=True)
+
+            with transaction.atomic():
+                child_document = document.add_child(
+                    creator=request.user,
+                    **serializer.validated_data,
+                )
+                models.DocumentAccess.objects.create(
+                    document=child_document,
+                    user=request.user,
+                    role=models.RoleChoices.OWNER,
+                )
+            # Set the created instance to the serializer
+            serializer.instance = child_document
+
+            headers = self.get_success_headers(serializer.data)
+            return drf.response.Response(
+                serializer.data, status=status.HTTP_201_CREATED, headers=headers
+            )
+
+        # GET: List children
+        queryset = document.get_children().filter(deleted_at__isnull=True)
+        queryset = self.filter_queryset(queryset)
+        queryset = self.annotate_is_favorite(queryset)
+        queryset = self.annotate_user_roles(queryset)
+        return self.get_response_for_queryset(queryset)
+
     @drf.decorators.action(detail=True, methods=["get"], url_path="versions")
     def versions_list(self, request, *args, **kwargs):
         """
@@ -480,8 +783,9 @@ class DocumentViewSet(
 
         # Users should not see version history dating from before they gained access to the
         # document. Filter to get the minimum access date for the logged-in user
-        access_queryset = document.accesses.filter(
-            db.Q(user=user) | db.Q(team__in=user.teams)
+        access_queryset = models.DocumentAccess.objects.filter(
+            db.Q(user=user) | db.Q(team__in=user.teams),
+            document__path=Left(db.Value(document.path), Length("document__path")),
         ).aggregate(min_date=db.Min("created_at"))
 
         # Handle the case where the user has no accesses
@@ -519,10 +823,12 @@ class DocumentViewSet(
         user = request.user
         min_datetime = min(
             access.created_at
-            for access in document.accesses.filter(
+            for access in models.DocumentAccess.objects.filter(
                 db.Q(user=user) | db.Q(team__in=user.teams),
+                document__path=Left(db.Value(document.path), Length("document__path")),
             )
         )
+
         if response["LastModified"] < min_datetime:
             raise Http404
 
@@ -777,7 +1083,6 @@ class DocumentViewSet(
         detail=True,
         methods=["post"],
         name="Translate a piece of text with AI",
-        serializer_class=serializers.AITranslateSerializer,
         url_path="ai-translate",
         throttle_classes=[utils.AIDocumentRateThrottle, utils.AIUserRateThrottle],
     )
@@ -810,7 +1115,7 @@ class DocumentAccessViewSet(
     drf.mixins.ListModelMixin,
     drf.mixins.RetrieveModelMixin,
     drf.mixins.UpdateModelMixin,
-    drf.viewsets.GenericViewSet,
+    viewsets.GenericViewSet,
 ):
     """
     API ViewSet for all interactions with document accesses.
@@ -883,7 +1188,7 @@ class TemplateViewSet(
     drf.mixins.DestroyModelMixin,
     drf.mixins.RetrieveModelMixin,
     drf.mixins.UpdateModelMixin,
-    drf.viewsets.GenericViewSet,
+    viewsets.GenericViewSet,
 ):
     """Template ViewSet"""
 
@@ -907,14 +1212,14 @@ class TemplateViewSet(
 
         user_roles_query = (
             models.TemplateAccess.objects.filter(
-                Q(user=user) | Q(team__in=user.teams),
-                template_id=OuterRef("pk"),
+                db.Q(user=user) | db.Q(team__in=user.teams),
+                template_id=db.OuterRef("pk"),
             )
             .values("template")
             .annotate(roles_array=ArrayAgg("role"))
             .values("roles_array")
         )
-        return queryset.annotate(user_roles=Subquery(user_roles_query)).distinct()
+        return queryset.annotate(user_roles=db.Subquery(user_roles_query)).distinct()
 
     def list(self, request, *args, **kwargs):
         """Restrict templates returned by the list endpoint"""
@@ -937,6 +1242,7 @@ class TemplateViewSet(
         serializer = self.get_serializer(queryset, many=True)
         return drf.response.Response(serializer.data)
 
+    @transaction.atomic
     def perform_create(self, serializer):
         """Set the current user as owner of the newly created object."""
         obj = serializer.save()
@@ -954,7 +1260,7 @@ class TemplateAccessViewSet(
     drf.mixins.ListModelMixin,
     drf.mixins.RetrieveModelMixin,
     drf.mixins.UpdateModelMixin,
-    drf.viewsets.GenericViewSet,
+    viewsets.GenericViewSet,
 ):
     """
     API ViewSet for all interactions with template accesses.
@@ -994,7 +1300,7 @@ class InvitationViewset(
     drf.mixins.RetrieveModelMixin,
     drf.mixins.DestroyModelMixin,
     drf.mixins.UpdateModelMixin,
-    drf.viewsets.GenericViewSet,
+    viewsets.GenericViewSet,
 ):
     """API ViewSet for user invitations to document.
 

src/backend/core/enums.py

@@ -3,6 +3,7 @@ Core application enums declaration
 """
 
 from django.conf import global_settings
+from django.db import models
 from django.utils.translation import gettext_lazy as _
 
 # In Django's code base, `LANGUAGES` is set by default with all supported languages.
@@ -10,3 +11,14 @@ from django.utils.translation import gettext_lazy as _
 # active in the app.
 # pylint: disable=no-member
 ALL_LANGUAGES = {language: _(name) for language, name in global_settings.LANGUAGES}
+
+
+class MoveNodePositionChoices(models.TextChoices):
+    """Defines the possible positions when moving a django-treebeard node."""
+
+    FIRST_CHILD = "first-child", _("First child")
+    LAST_CHILD = "last-child", _("Last child")
+    FIRST_SIBLING = "first-sibling", _("First sibling")
+    LAST_SIBLING = "last-sibling", _("Last sibling")
+    LEFT = "left", _("Left")
+    RIGHT = "right", _("Right")

src/backend/core/factories.py

@@ -46,6 +46,23 @@ class UserFactory(factory.django.DjangoModelFactory):
             UserTemplateAccessFactory(user=self, role="owner")
 
 
+class ParentNodeFactory(factory.declarations.ParameteredAttribute):
+    """Custom factory attribute for setting the parent node."""
+
+    def generate(self, step, params):
+        """
+        Generate a parent node for the factory.
+
+        This method is invoked during the factory's build process to determine the parent
+        node of the current object being created. If `params` is provided, it uses the factory's
+        metadata to recursively create or fetch the parent node. Otherwise, it returns `None`.
+        """
+        if not params:
+            return None
+        subfactory = step.builder.factory_meta.factory
+        return step.recurse(subfactory, params)
+
+
 class DocumentFactory(factory.django.DjangoModelFactory):
     """A factory to create documents"""
 
@@ -54,9 +71,13 @@ class DocumentFactory(factory.django.DjangoModelFactory):
         django_get_or_create = ("title",)
         skip_postgeneration_save = True
 
+    parent = ParentNodeFactory()
+
     title = factory.Sequence(lambda n: f"document{n}")
+    excerpt = factory.Sequence(lambda n: f"excerpt{n}")
     content = factory.Sequence(lambda n: f"content{n}")
     creator = factory.SubFactory(UserFactory)
+    deleted_at = None
     link_reach = factory.fuzzy.FuzzyChoice(
         [a[0] for a in models.LinkReachChoices.choices]
     )
@@ -64,6 +85,29 @@ class DocumentFactory(factory.django.DjangoModelFactory):
         [r[0] for r in models.LinkRoleChoices.choices]
     )
 
+    @classmethod
+    def _create(cls, model_class, *args, **kwargs):
+        """
+        Custom creation logic for the factory: creates a document as a child node if
+        a parent is provided; otherwise, creates it as a root node.
+        """
+        parent = kwargs.pop("parent", None)
+
+        if parent:
+            # Add as a child node
+            kwargs["ancestors_deleted_at"] = (
+                kwargs.get("ancestors_deleted_at") or parent.ancestors_deleted_at
+            )
+            return parent.add_child(instance=model_class(**kwargs))
+
+        # Add as a root node
+        return model_class.add_root(instance=model_class(**kwargs))
+
+    @factory.lazy_attribute
+    def ancestors_deleted_at(self):
+        """Should always be set when "deleted_at" is set."""
+        return self.deleted_at
+
     @factory.post_generation
     def users(self, create, extracted, **kwargs):
         """Add users to document from a given list of users with or without roles."""
@@ -74,6 +118,16 @@ class DocumentFactory(factory.django.DjangoModelFactory):
                 else:
                     UserDocumentAccessFactory(document=self, user=item[0], role=item[1])
 
+    @factory.post_generation
+    def teams(self, create, extracted, **kwargs):
+        """Add teams to document from a given list of teams with or without roles."""
+        if create and extracted:
+            for item in extracted:
+                if isinstance(item, str):
+                    TeamDocumentAccessFactory(document=self, team=item)
+                else:
+                    TeamDocumentAccessFactory(document=self, team=item[0], role=item[1])
+
     @factory.post_generation
     def link_traces(self, create, extracted, **kwargs):
         """Add link traces to document from a given list of users."""

src/backend/core/migrations/0014_add_tree_structure_to_documents.py

@@ -0,0 +1,31 @@
+# Generated by Django 5.1.2 on 2024-12-07 09:43
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0013_activate_fuzzystrmatch_extension'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='document',
+            name='depth',
+            field=models.PositiveIntegerField(default=0),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='document',
+            name='numchild',
+            field=models.PositiveIntegerField(default=0),
+        ),
+        migrations.AddField(
+            model_name='document',
+            name='path',
+            # Allow null values pending the next datamigration to populate the field
+            field=models.CharField(db_collation='C', max_length=252, null=True, unique=True),
+            preserve_default=False,
+        ),
+    ]

src/backend/core/migrations/0015_set_path_on_existing_documents.py

@@ -0,0 +1,52 @@
+# Generated by Django 5.1.2 on 2024-12-07 10:33
+
+from django.db import migrations, models
+
+from treebeard.numconv import NumConv
+
+ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+STEPLEN = 7
+
+def set_path_on_existing_documents(apps, schema_editor):
+    """
+    Updates the `path` and `depth` fields for all existing Document records 
+    to ensure valid materialized paths.
+
+    This function assigns a unique `path` to each Document as a root node
+
+    Note: After running this migration, we quickly modify the schema to make
+    the `path` field required as it should.
+    """
+    Document = apps.get_model("core", "Document")
+
+    # Iterate over all existing documents and make them root nodes
+    documents = Document.objects.order_by("created_at").values_list("id", flat=True)
+    numconv = NumConv(len(ALPHABET), ALPHABET)
+
+    updates = []
+    for i, pk in enumerate(documents):
+        key = numconv.int2str(i)
+        path = "{0}{1}".format(
+            ALPHABET[0] * (STEPLEN - len(key)),
+            key
+        )
+        updates.append(Document(pk=pk, path=path, depth=1))
+
+    # Bulk update using the prepared updates list
+    Document.objects.bulk_update(updates, ['depth', 'path'])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0014_add_tree_structure_to_documents'),
+    ]
+
+    operations = [
+        migrations.RunPython(set_path_on_existing_documents, reverse_code=migrations.RunPython.noop),
+        migrations.AlterField(
+            model_name='document',
+            name='path',
+            field=models.CharField(db_collation='C', max_length=252, unique=True),
+        ),
+    ]

src/backend/core/migrations/0016_add_document_excerpt.py

@@ -0,0 +1,23 @@
+# Generated by Django 5.1.4 on 2024-12-18 08:56
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0015_set_path_on_existing_documents'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='document',
+            name='excerpt',
+            field=models.TextField(blank=True, max_length=300, null=True, verbose_name='excerpt'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='language',
+            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'), ('de-de', 'German'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+        ),
+    ]

src/backend/core/migrations/0017_add_fields_for_soft_delete.py

@@ -0,0 +1,36 @@
+# Generated by Django 5.1.4 on 2025-01-12 14:27
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0016_add_document_excerpt'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='document',
+            options={'ordering': ('path',), 'verbose_name': 'Document', 'verbose_name_plural': 'Documents'},
+        ),
+        migrations.AddField(
+            model_name='document',
+            name='ancestors_deleted_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='document',
+            name='deleted_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='language',
+            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'), ('de-de', 'German'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+        ),
+        migrations.AddConstraint(
+            model_name='document',
+            constraint=models.CheckConstraint(condition=models.Q(('deleted_at__isnull', True), ('deleted_at', models.F('ancestors_deleted_at')), _connector='OR'), name='check_deleted_at_matches_ancestors_deleted_at_when_set'),
+        ),
+    ]

src/backend/core/models.py

@@ -13,11 +13,13 @@ from django.conf import settings
 from django.contrib.auth import models as auth_models
 from django.contrib.auth.base_user import AbstractBaseUser
 from django.contrib.sites.models import Site
-from django.core import exceptions, mail, validators
+from django.core import mail, validators
+from django.core.cache import cache
 from django.core.files.base import ContentFile
 from django.core.files.storage import default_storage
 from django.core.mail import send_mail
-from django.db import models
+from django.db import models, transaction
+from django.db.models.functions import Left, Length
 from django.template.loader import render_to_string
 from django.utils import timezone
 from django.utils.functional import cached_property, lazy
@@ -25,26 +27,25 @@ from django.utils.translation import get_language, override
 from django.utils.translation import gettext_lazy as _
 
 from botocore.exceptions import ClientError
+from rest_framework.exceptions import ValidationError
 from timezone_field import TimeZoneField
+from treebeard.mp_tree import MP_Node
 
 logger = getLogger(__name__)
 
 
-def get_resource_roles(resource, user):
-    """Compute the roles a user has on a resource."""
-    if not user.is_authenticated:
-        return []
+def get_trashbin_cutoff():
+    """
+    Calculate the cutoff datetime for soft-deleted items based on the retention policy.
 
-    try:
-        roles = resource.user_roles or []
-    except AttributeError:
-        try:
-            roles = resource.accesses.filter(
-                models.Q(user=user) | models.Q(team__in=user.teams),
-            ).values_list("role", flat=True)
-        except (models.ObjectDoesNotExist, IndexError):
-            roles = []
-    return roles
+    The function returns the current datetime minus the number of days specified in
+    the TRASHBIN_CUTOFF_DAYS setting, indicating the oldest date for items that can
+    remain in the trash bin.
+
+    Returns:
+        datetime: The cutoff datetime for soft-deleted items.
+    """
+    return timezone.now() - timedelta(days=settings.TRASHBIN_CUTOFF_DAYS)
 
 
 class LinkRoleChoices(models.TextChoices):
@@ -366,10 +367,11 @@ class BaseAccess(BaseModel):
         }
 
 
-class Document(BaseModel):
+class Document(MP_Node, BaseModel):
     """Pad document carrying the content."""
 
     title = models.CharField(_("title"), max_length=255, null=True, blank=True)
+    excerpt = models.TextField(_("excerpt"), max_length=300, null=True, blank=True)
     link_reach = models.CharField(
         max_length=20,
         choices=LinkReachChoices.choices,
@@ -385,14 +387,32 @@ class Document(BaseModel):
         blank=True,
         null=True,
     )
+    deleted_at = models.DateTimeField(null=True, blank=True)
+    ancestors_deleted_at = models.DateTimeField(null=True, blank=True)
 
     _content = None
 
+    # Tree structure
+    alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+    steplen = 7  # nb siblings max: 3,521,614,606,208
+    node_order_by = []  # Manual ordering
+
+    path = models.CharField(max_length=7 * 36, unique=True, db_collation="C")
+
     class Meta:
         db_table = "impress_document"
-        ordering = ("title",)
+        ordering = ("path",)
         verbose_name = _("Document")
         verbose_name_plural = _("Documents")
+        constraints = [
+            models.CheckConstraint(
+                check=(
+                    models.Q(deleted_at__isnull=True)
+                    | models.Q(deleted_at=models.F("ancestors_deleted_at"))
+                ),
+                name="check_deleted_at_matches_ancestors_deleted_at_when_set",
+            ),
+        ]
 
     def __str__(self):
         return str(self.title) if self.title else str(_("Untitled Document"))
@@ -531,48 +551,124 @@ class Document(BaseModel):
             Bucket=default_storage.bucket_name, Key=self.file_key, VersionId=version_id
         )
 
+    def get_nb_accesses_cache_key(self):
+        """Generate a unique cache key for each document."""
+        return f"document_{self.id!s}_nb_accesses"
+
+    @property
+    def nb_accesses(self):
+        """Calculate the number of accesses."""
+        cache_key = self.get_nb_accesses_cache_key()
+        nb_accesses = cache.get(cache_key)
+
+        if nb_accesses is None:
+            nb_accesses = DocumentAccess.objects.filter(
+                document__path=Left(models.Value(self.path), Length("document__path")),
+            ).count()
+            cache.set(cache_key, nb_accesses)
+
+        return nb_accesses
+
+    def invalidate_nb_accesses_cache(self):
+        """
+        Invalidate the cache for number of accesses, including on affected descendants.
+        """
+        for document in Document.objects.filter(path__startswith=self.path).only("id"):
+            cache_key = document.get_nb_accesses_cache_key()
+            cache.delete(cache_key)
+
+    def get_roles(self, user):
+        """Return the roles a user has on a document."""
+        if not user.is_authenticated:
+            return []
+
+        try:
+            roles = self.user_roles or []
+        except AttributeError:
+            try:
+                roles = DocumentAccess.objects.filter(
+                    models.Q(user=user) | models.Q(team__in=user.teams),
+                    document__path=Left(
+                        models.Value(self.path), Length("document__path")
+                    ),
+                ).values_list("role", flat=True)
+            except (models.ObjectDoesNotExist, IndexError):
+                roles = []
+        return roles
+
+    @cached_property
+    def links_definitions(self):
+        """Get links reach/role definitions for the current document and its ancestors."""
+        links_definitions = {self.link_reach: {self.link_role}}
+
+        # Ancestors links definitions are only interesting if the document is not the highest
+        # ancestor to which the current user has access. Look for the annotation:
+        if self.depth > 1 and not getattr(self, "is_highest_ancestor_for_user", False):
+            for ancestor in self.get_ancestors().values("link_reach", "link_role"):
+                links_definitions.setdefault(ancestor["link_reach"], set()).add(
+                    ancestor["link_role"]
+                )
+
+        return links_definitions
+
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the document.
         """
-        roles = set(get_resource_roles(self, user))
+        roles = set(
+            self.get_roles(user)
+        )  # at this point only roles based on specific access
 
-        # Compute version roles before adding link roles because we don't
+        # Characteristics that are based only on specific access
+        is_owner = RoleChoices.OWNER in roles
+        is_deleted = self.ancestors_deleted_at and not is_owner
+        is_owner_or_admin = (is_owner or RoleChoices.ADMIN in roles) and not is_deleted
+
+        # Compute access roles before adding link roles because we don't
         # want anonymous users to access versions (we wouldn't know from
         # which date to allow them anyway)
         # Anonymous users should also not see document accesses
-        has_role = bool(roles)
+        has_access_role = bool(roles) and not is_deleted
 
-        # Add role provided by the document link
-        if self.link_reach == LinkReachChoices.PUBLIC or (
-            self.link_reach == LinkReachChoices.AUTHENTICATED and user.is_authenticated
-        ):
-            roles.add(self.link_role)
+        # Add roles provided by the document link, taking into account its ancestors
 
-        is_owner_or_admin = bool(
-            roles.intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
+        # Add roles provided by the document link
+        links_definitions = self.links_definitions
+        public_roles = links_definitions.get(LinkReachChoices.PUBLIC, set())
+        authenticated_roles = (
+            links_definitions.get(LinkReachChoices.AUTHENTICATED, set())
+            if user.is_authenticated
+            else set()
         )
-        can_get = bool(roles)
-        can_update = is_owner_or_admin or RoleChoices.EDITOR in roles
+        roles = roles | public_roles | authenticated_roles
+
+        can_get = bool(roles) and not is_deleted
+        can_update = (
+            is_owner_or_admin or RoleChoices.EDITOR in roles
+        ) and not is_deleted
 
         return {
             "accesses_manage": is_owner_or_admin,
-            "accesses_view": has_role,
+            "accesses_view": has_access_role,
             "ai_transform": can_update,
             "ai_translate": can_update,
             "attachment_upload": can_update,
+            "children_list": can_get,
+            "children_create": can_update and user.is_authenticated,
             "collaboration_auth": can_get,
-            "destroy": RoleChoices.OWNER in roles,
+            "destroy": is_owner,
             "favorite": can_get and user.is_authenticated,
             "link_configuration": is_owner_or_admin,
-            "invite_owner": RoleChoices.OWNER in roles,
+            "invite_owner": is_owner,
+            "move": is_owner_or_admin and not self.ancestors_deleted_at,
             "partial_update": can_update,
+            "restore": is_owner,
             "retrieve": can_get,
             "media_auth": can_get,
             "update": can_update,
             "versions_destroy": is_owner_or_admin,
-            "versions_list": has_role,
-            "versions_retrieve": has_role,
+            "versions_list": has_access_role,
+            "versions_retrieve": has_access_role,
         }
 
     def send_email(self, subject, emails, context=None, language=None):
@@ -633,6 +729,77 @@ class Document(BaseModel):
 
         self.send_email(subject, [email], context, language)
 
+    @transaction.atomic
+    def soft_delete(self):
+        """
+        Soft delete the document, marking the deletion on descendants.
+        We still keep the .delete() method untouched for programmatic purposes.
+        """
+        if self.deleted_at or self.ancestors_deleted_at:
+            raise RuntimeError(
+                "This document is already deleted or has deleted ancestors."
+            )
+
+        # Check if any ancestors are deleted
+        if self.get_ancestors().filter(deleted_at__isnull=False).exists():
+            raise RuntimeError(
+                "Cannot delete this document because one or more ancestors are already deleted."
+            )
+
+        self.ancestors_deleted_at = self.deleted_at = timezone.now()
+        self.save()
+
+        # Mark all descendants as soft deleted
+        self.get_descendants().filter(ancestors_deleted_at__isnull=True).update(
+            ancestors_deleted_at=self.ancestors_deleted_at
+        )
+
+    @transaction.atomic
+    def restore(self):
+        """Cancelling a soft delete with checks."""
+        # This should not happen
+        if self.deleted_at is None:
+            raise ValidationError({"deleted_at": [_("This document is not deleted.")]})
+
+        if self.deleted_at < get_trashbin_cutoff():
+            raise ValidationError(
+                {
+                    "deleted_at": [
+                        _(
+                            "This document was permanently deleted and cannot be restored."
+                        )
+                    ]
+                }
+            )
+
+        # Restore the current document
+        self.deleted_at = None
+
+        # Calculate the minimum `deleted_at` among all ancestors
+        ancestors_deleted_at = (
+            self.get_ancestors()
+            .filter(deleted_at__isnull=False)
+            .values_list("deleted_at", flat=True)
+        )
+        self.ancestors_deleted_at = min(ancestors_deleted_at, default=None)
+        self.save()
+
+        # Update descendants excluding those who were deleted prior to the deletion of the
+        # current document (the ancestor_deleted_at date for those should already by good)
+        # The number of deleted descendants should not be too big so we can handcraft a union
+        # clause for them:
+        deleted_descendants_paths = (
+            self.get_descendants()
+            .filter(deleted_at__isnull=False)
+            .values_list("path", flat=True)
+        )
+        exclude_condition = models.Q(
+            *(models.Q(path__startswith=path) for path in deleted_descendants_paths)
+        )
+        self.get_descendants().exclude(exclude_condition).update(
+            ancestors_deleted_at=self.ancestors_deleted_at
+        )
+
 
 class LinkTrace(BaseModel):
     """
@@ -735,6 +902,16 @@ class DocumentAccess(BaseAccess):
     def __str__(self):
         return f"{self.user!s} is {self.role:s} in document {self.document!s}"
 
+    def save(self, *args, **kwargs):
+        """Override save to clear the document's cache for number of accesses."""
+        super().save(*args, **kwargs)
+        self.document.invalidate_nb_accesses_cache()
+
+    def delete(self, *args, **kwargs):
+        """Override delete to clear the document's cache for number of accesses."""
+        super().delete(*args, **kwargs)
+        self.document.invalidate_nb_accesses_cache()
+
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the document access.
@@ -764,11 +941,27 @@ class Template(BaseModel):
     def __str__(self):
         return self.title
 
+    def get_roles(self, user):
+        """Return the roles a user has on a resource as an iterable."""
+        if not user.is_authenticated:
+            return []
+
+        try:
+            roles = self.user_roles or []
+        except AttributeError:
+            try:
+                roles = self.accesses.filter(
+                    models.Q(user=user) | models.Q(team__in=user.teams),
+                ).values_list("role", flat=True)
+            except (models.ObjectDoesNotExist, IndexError):
+                roles = []
+        return roles
+
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the template.
         """
-        roles = get_resource_roles(self, user)
+        roles = self.get_roles(user)
         is_owner_or_admin = bool(
             set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
         )
@@ -872,8 +1065,8 @@ class Invitation(BaseModel):
             User.objects.filter(email=self.email).exists()
             and not settings.OIDC_ALLOW_DUPLICATE_EMAILS
         ):
-            raise exceptions.ValidationError(
-                {"email": _("This email is already associated to a registered user.")}
+            raise ValidationError(
+                {"email": [_("This email is already associated to a registered user.")]}
             )
 
     @property

src/backend/core/tests/documents/test_api_document_accesses.py

@@ -76,14 +76,14 @@ def test_api_document_accesses_list_authenticated_related(via, mock_user_teams):
         user_access = models.DocumentAccess.objects.create(
             document=document,
             user=user,
-            role=random.choice(models.RoleChoices.choices)[0],
+            role=random.choice(models.RoleChoices.values),
         )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         user_access = models.DocumentAccess.objects.create(
             document=document,
             team="lasuite",
-            role=random.choice(models.RoleChoices.choices)[0],
+            role=random.choice(models.RoleChoices.values),
         )
 
     access1 = factories.TeamDocumentAccessFactory(document=document)
@@ -227,7 +227,7 @@ def test_api_document_accesses_update_anonymous():
     new_values = {
         "id": uuid4(),
         "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     api_client = APIClient()
@@ -260,7 +260,7 @@ def test_api_document_accesses_update_authenticated_unrelated():
     new_values = {
         "id": uuid4(),
         "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     for field, value in new_values.items():
@@ -302,7 +302,7 @@ def test_api_document_accesses_update_authenticated_reader_or_editor(
     new_values = {
         "id": uuid4(),
         "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     for field, value in new_values.items():
@@ -413,7 +413,7 @@ def test_api_document_accesses_update_administrator_from_owner(via, mock_user_te
     new_values = {
         "id": uuid4(),
         "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     for field, value in new_values.items():
@@ -527,7 +527,7 @@ def test_api_document_accesses_update_owner(
     new_values = {
         "id": uuid4(),
         "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     for field, value in new_values.items():

src/backend/core/tests/documents/test_api_document_accesses_create.py

@@ -26,7 +26,7 @@ def test_api_document_accesses_create_anonymous():
         {
             "user_id": str(other_user.id),
             "document": str(document.id),
-            "role": random.choice(models.RoleChoices.choices)[0],
+            "role": random.choice(models.RoleChoices.values),
         },
         format="json",
     )

src/backend/core/tests/documents/test_api_document_invitations.py

@@ -304,7 +304,7 @@ def test_api_document_invitations_create_anonymous():
     document = factories.DocumentFactory()
     invitation_values = {
         "email": "[email protected]",
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     response = APIClient().post(
@@ -325,7 +325,7 @@ def test_api_document_invitations_create_authenticated_outsider():
     document = factories.DocumentFactory()
     invitation_values = {
         "email": "[email protected]",
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     client = APIClient()
@@ -550,7 +550,7 @@ def test_api_document_invitations_create_issuer_and_document_override():
         "document": str(other_document.id),
         "issuer": str(factories.UserFactory().id),
         "email": "[email protected]",
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     client = APIClient()
@@ -611,7 +611,7 @@ def test_api_document_invitations_create_cannot_invite_existing_users():
     # Build an invitation to the email of an exising identity in the db
     invitation_values = {
         "email": existing_user.email,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     client = APIClient()
@@ -624,7 +624,9 @@ def test_api_document_invitations_create_cannot_invite_existing_users():
     )
 
     assert response.status_code == 400
-    assert response.json() == ["This email is already associated to a registered user."]
+    assert response.json() == {
+        "email": ["This email is already associated to a registered user."]
+    }
 
 
 # Update

src/backend/core/tests/documents/test_api_document_versions.py

@@ -75,14 +75,14 @@ def test_api_document_versions_list_authenticated_related_success(via, mock_user
         models.DocumentAccess.objects.create(
             document=document,
             user=user,
-            role=random.choice(models.RoleChoices.choices)[0],
+            role=random.choice(models.RoleChoices.values),
         )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         models.DocumentAccess.objects.create(
             document=document,
             team="lasuite",
-            role=random.choice(models.RoleChoices.choices)[0],
+            role=random.choice(models.RoleChoices.values),
         )
 
     # Other versions of documents to which the user has access should not be listed
@@ -134,14 +134,14 @@ def test_api_document_versions_list_authenticated_related_pagination(
         models.DocumentAccess.objects.create(
             document=document,
             user=user,
-            role=random.choice(models.RoleChoices.choices)[0],
+            role=random.choice(models.RoleChoices.values),
         )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         models.DocumentAccess.objects.create(
             document=document,
             team="lasuite",
-            role=random.choice(models.RoleChoices.choices)[0],
+            role=random.choice(models.RoleChoices.values),
         )
 
     for i in range(4):
@@ -185,6 +185,84 @@ def test_api_document_versions_list_authenticated_related_pagination(
     assert content["versions"][0]["version_id"] == all_version_ids[2]
 
 
+@pytest.mark.parametrize("via", VIA)
+def test_api_document_versions_list_authenticated_related_pagination_parent(
+    via, mock_user_teams
+):
+    """
+    When a user gains access to a document's versions via an ancestor, the date of access
+    to the parent should be used to filter versions that were created prior to the
+    user gaining access to the document.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory()
+    parent = factories.DocumentFactory(parent=grand_parent)
+    document = factories.DocumentFactory(parent=parent)
+    for i in range(3):
+        document.content = f"before {i:d}"
+        document.save()
+
+    if via == USER:
+        models.DocumentAccess.objects.create(
+            document=grand_parent,
+            user=user,
+            role=random.choice(models.RoleChoices.values),
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        models.DocumentAccess.objects.create(
+            document=grand_parent,
+            team="lasuite",
+            role=random.choice(models.RoleChoices.values),
+        )
+
+    for i in range(4):
+        document.content = f"after {i:d}"
+        document.save()
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/versions/",
+    )
+
+    content = response.json()
+
+    assert response.status_code == 200
+    assert content["is_truncated"] is False
+    # The current version is not listed
+    assert content["count"] == 3
+    assert content["next_version_id_marker"] == ""
+    all_version_ids = [version["version_id"] for version in content["versions"]]
+
+    # - set page size
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/versions/?page_size=2",
+    )
+
+    content = response.json()
+    assert content["count"] == 2
+    assert content["is_truncated"] is True
+    marker = content["next_version_id_marker"]
+    assert marker == all_version_ids[1]
+    assert [
+        version["version_id"] for version in content["versions"]
+    ] == all_version_ids[:2]
+
+    # - get page 2
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/versions/?page_size=2&version_id={marker:s}",
+    )
+
+    content = response.json()
+    assert content["count"] == 1
+    assert content["is_truncated"] is False
+    assert content["next_version_id_marker"] == ""
+    assert content["versions"][0]["version_id"] == all_version_ids[2]
+
+
 def test_api_document_versions_list_exceeds_max_page_size():
     """Page size should not exceed the limit set on the serializer"""
     user = factories.UserFactory()
@@ -314,6 +392,74 @@ def test_api_document_versions_retrieve_authenticated_related(via, mock_user_tea
     assert response.json()["content"] == "new content 1"
 
 
+@pytest.mark.parametrize("via", VIA)
+def test_api_document_versions_retrieve_authenticated_related_parent(
+    via, mock_user_teams
+):
+    """
+    A user who gains access to a document's versions via one of its ancestors, should be able to
+    retrieve the document versions. The date of access to the parent should be used to filter
+    versions that were created prior to the user gaining access to the document.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory()
+    parent = factories.DocumentFactory(parent=grand_parent)
+    document = factories.DocumentFactory(parent=parent)
+    document.content = "new content"
+    document.save()
+
+    assert len(document.get_versions_slice()["versions"]) == 1
+    version_id = document.get_versions_slice()["versions"][0]["version_id"]
+
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=grand_parent, user=user)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(document=grand_parent, team="lasuite")
+
+    time.sleep(1)  # minio stores datetimes with the precision of a second
+
+    # Versions created before the document was shared should not be seen by the user
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
+    )
+
+    assert response.status_code == 404
+
+    # Create a new version should not make it available to the user because
+    # only the current version is available to the user but it is excluded
+    # from the list
+    document.content = "new content 1"
+    document.save()
+
+    assert len(document.get_versions_slice()["versions"]) == 2
+    version_id = document.get_versions_slice()["versions"][0]["version_id"]
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
+    )
+
+    assert response.status_code == 404
+
+    # Adding one more version should make the previous version available to the user
+    document.content = "new content 2"
+    document.save()
+
+    assert len(document.get_versions_slice()["versions"]) == 3
+    version_id = document.get_versions_slice()["versions"][0]["version_id"]
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
+    )
+
+    assert response.status_code == 200
+    assert response.json()["content"] == "new content 1"
+
+
 def test_api_document_versions_create_anonymous():
     """Anonymous users should not be allowed to create document versions."""
     document = factories.DocumentFactory()
@@ -458,15 +604,19 @@ def test_api_document_versions_update_authenticated_related(via, mock_user_teams
 # Delete
 
 
-def test_api_document_versions_delete_anonymous():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_delete_anonymous(reach):
     """Anonymous users should not be allowed to destroy a document version."""
-    access = factories.UserDocumentAccessFactory()
+    access = factories.UserDocumentAccessFactory(document__link_reach=reach)
 
     response = APIClient().delete(
         f"/api/v1.0/documents/{access.document_id!s}/versions/{access.id!s}/",
     )
 
     assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
 
 
 @pytest.mark.parametrize("reach", models.LinkReachChoices.values)

src/backend/core/tests/documents/test_api_documents_children_create.py

@@ -0,0 +1,251 @@
+"""
+Tests for Documents API endpoint in impress's core app: create
+"""
+
+from uuid import uuid4
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+from core.models import Document, LinkReachChoices, LinkRoleChoices
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize("role", LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", LinkReachChoices.values)
+def test_api_documents_children_create_anonymous(reach, role, depth):
+    """Anonymous users should not be allowed to create children documents."""
+    for i in range(depth):
+        if i == 0:
+            document = factories.DocumentFactory(link_reach=reach, link_role=role)
+        else:
+            document = factories.DocumentFactory(parent=document)
+
+    response = APIClient().post(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+        {
+            "title": "my document",
+        },
+    )
+
+    assert Document.objects.count() == depth
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize(
+    "reach,role",
+    [
+        ["restricted", "editor"],
+        ["restricted", "reader"],
+        ["public", "reader"],
+        ["authenticated", "reader"],
+    ],
+)
+def test_api_documents_children_create_authenticated_forbidden(reach, role, depth):
+    """
+    Authenticated users with no write access on a document should not be allowed
+    to create a nested document.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    for i in range(depth):
+        if i == 0:
+            document = factories.DocumentFactory(link_reach=reach, link_role=role)
+        else:
+            document = factories.DocumentFactory(parent=document, link_role="reader")
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+        {
+            "title": "my document",
+        },
+    )
+
+    assert response.status_code == 403
+    assert Document.objects.count() == depth
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize(
+    "reach,role",
+    [
+        ["public", "editor"],
+        ["authenticated", "editor"],
+    ],
+)
+def test_api_documents_children_create_authenticated_success(reach, role, depth):
+    """
+    Authenticated users with write access on a document should be able
+    to create a nested document.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    for i in range(depth):
+        if i == 0:
+            document = factories.DocumentFactory(link_reach=reach, link_role=role)
+        else:
+            document = factories.DocumentFactory(parent=document, link_role="reader")
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+        {
+            "title": "my child",
+        },
+    )
+
+    assert response.status_code == 201
+
+    child = Document.objects.get(id=response.json()["id"])
+    assert child.title == "my child"
+    assert child.link_reach == "restricted"
+    assert child.accesses.filter(role="owner", user=user).exists()
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+def test_api_documents_children_create_related_forbidden(depth):
+    """
+    Authenticated users with a specific read access on a document should not be allowed
+    to create a nested document.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    for i in range(depth):
+        if i == 0:
+            document = factories.DocumentFactory(link_reach="restricted")
+            factories.UserDocumentAccessFactory(
+                user=user, document=document, role="reader"
+            )
+        else:
+            document = factories.DocumentFactory(
+                parent=document, link_reach="restricted"
+            )
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+        {
+            "title": "my document",
+        },
+    )
+
+    assert response.status_code == 403
+    assert Document.objects.count() == depth
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
+def test_api_documents_children_create_related_success(role, depth):
+    """
+    Authenticated users with a specific write access on a document should be
+    able to create a nested document.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    for i in range(depth):
+        if i == 0:
+            document = factories.DocumentFactory(link_reach="restricted")
+            factories.UserDocumentAccessFactory(user=user, document=document, role=role)
+        else:
+            document = factories.DocumentFactory(
+                parent=document, link_reach="restricted"
+            )
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+        {
+            "title": "my child",
+        },
+    )
+
+    assert response.status_code == 201
+    child = Document.objects.get(id=response.json()["id"])
+    assert child.title == "my child"
+    assert child.link_reach == "restricted"
+    assert child.accesses.filter(role="owner", user=user).exists()
+
+
+def test_api_documents_children_create_authenticated_title_null():
+    """It should be possible to create several nested documents with a null title."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    parent = factories.DocumentFactory(
+        title=None, link_reach="authenticated", link_role="editor"
+    )
+    factories.DocumentFactory(title=None, parent=parent)
+
+    response = client.post(
+        f"/api/v1.0/documents/{parent.id!s}/children/", {}, format="json"
+    )
+
+    assert response.status_code == 201
+    assert Document.objects.filter(title__isnull=True).count() == 3
+
+
+def test_api_documents_children_create_force_id_success():
+    """It should be possible to force the document ID when creating a nested document."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    access = factories.UserDocumentAccessFactory(user=user, role="editor")
+    forced_id = uuid4()
+
+    response = client.post(
+        f"/api/v1.0/documents/{access.document.id!s}/children/",
+        {
+            "id": str(forced_id),
+            "title": "my document",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert Document.objects.count() == 2
+    assert response.json()["id"] == str(forced_id)
+
+
+def test_api_documents_children_create_force_id_existing():
+    """
+    It should not be possible to use the ID of an existing document when forcing ID on creation.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    access = factories.UserDocumentAccessFactory(user=user, role="editor")
+    document = factories.DocumentFactory()
+
+    response = client.post(
+        f"/api/v1.0/documents/{access.document.id!s}/children/",
+        {
+            "id": str(document.id),
+            "title": "my document",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "id": ["A document with this ID already exists. You cannot override it."]
+    }

src/backend/core/tests/documents/test_api_documents_children_list.py

@@ -0,0 +1,541 @@
+"""
+Tests for Documents API endpoint in impress's core app: retrieve
+"""
+
+import random
+
+from django.contrib.auth.models import AnonymousUser
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_documents_children_list_anonymous_public_standalone():
+    """Anonymous users should be allowed to retrieve the children of a public documents."""
+    document = factories.DocumentFactory(link_reach="public")
+    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    factories.UserDocumentAccessFactory(document=child1)
+
+    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 2,
+        "next": None,
+        "previous": None,
+        "results": [
+            {
+                "abilities": child1.get_abilities(AnonymousUser()),
+                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child1.creator.id),
+                "depth": 2,
+                "excerpt": child1.excerpt,
+                "id": str(child1.id),
+                "is_favorite": False,
+                "link_reach": child1.link_reach,
+                "link_role": child1.link_role,
+                "numchild": 0,
+                "nb_accesses": 1,
+                "path": child1.path,
+                "title": child1.title,
+                "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [],
+            },
+            {
+                "abilities": child2.get_abilities(AnonymousUser()),
+                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child2.creator.id),
+                "depth": 2,
+                "excerpt": child2.excerpt,
+                "id": str(child2.id),
+                "is_favorite": False,
+                "link_reach": child2.link_reach,
+                "link_role": child2.link_role,
+                "numchild": 0,
+                "nb_accesses": 0,
+                "path": child2.path,
+                "title": child2.title,
+                "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [],
+            },
+        ],
+    }
+
+
+def test_api_documents_children_list_anonymous_public_parent():
+    """
+    Anonymous users should be allowed to retrieve the children of a document who
+    has a public ancestor.
+    """
+    grand_parent = factories.DocumentFactory(link_reach="public")
+    parent = factories.DocumentFactory(
+        parent=grand_parent, link_reach=random.choice(["authenticated", "restricted"])
+    )
+    document = factories.DocumentFactory(
+        link_reach=random.choice(["authenticated", "restricted"]), parent=parent
+    )
+    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    factories.UserDocumentAccessFactory(document=child1)
+
+    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 2,
+        "next": None,
+        "previous": None,
+        "results": [
+            {
+                "abilities": child1.get_abilities(AnonymousUser()),
+                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child1.creator.id),
+                "depth": 4,
+                "excerpt": child1.excerpt,
+                "id": str(child1.id),
+                "is_favorite": False,
+                "link_reach": child1.link_reach,
+                "link_role": child1.link_role,
+                "numchild": 0,
+                "nb_accesses": 1,
+                "path": child1.path,
+                "title": child1.title,
+                "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [],
+            },
+            {
+                "abilities": child2.get_abilities(AnonymousUser()),
+                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child2.creator.id),
+                "depth": 4,
+                "excerpt": child2.excerpt,
+                "id": str(child2.id),
+                "is_favorite": False,
+                "link_reach": child2.link_reach,
+                "link_role": child2.link_role,
+                "numchild": 0,
+                "nb_accesses": 0,
+                "path": child2.path,
+                "title": child2.title,
+                "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [],
+            },
+        ],
+    }
+
+
+@pytest.mark.parametrize("reach", ["restricted", "authenticated"])
+def test_api_documents_children_list_anonymous_restricted_or_authenticated(reach):
+    """
+    Anonymous users should not be able to retrieve children of a document that is not public.
+    """
+    document = factories.DocumentFactory(link_reach=reach)
+    factories.DocumentFactory.create_batch(2, parent=document)
+
+    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_children_list_authenticated_unrelated_public_or_authenticated(
+    reach,
+):
+    """
+    Authenticated users should be able to retrieve the children of a public/authenticated
+    document to which they are not related.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach=reach)
+    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    factories.UserDocumentAccessFactory(document=child1)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+    )
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 2,
+        "next": None,
+        "previous": None,
+        "results": [
+            {
+                "abilities": child1.get_abilities(user),
+                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child1.creator.id),
+                "depth": 2,
+                "excerpt": child1.excerpt,
+                "id": str(child1.id),
+                "is_favorite": False,
+                "link_reach": child1.link_reach,
+                "link_role": child1.link_role,
+                "numchild": 0,
+                "nb_accesses": 1,
+                "path": child1.path,
+                "title": child1.title,
+                "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [],
+            },
+            {
+                "abilities": child2.get_abilities(user),
+                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child2.creator.id),
+                "depth": 2,
+                "excerpt": child2.excerpt,
+                "id": str(child2.id),
+                "is_favorite": False,
+                "link_reach": child2.link_reach,
+                "link_role": child2.link_role,
+                "numchild": 0,
+                "nb_accesses": 0,
+                "path": child2.path,
+                "title": child2.title,
+                "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [],
+            },
+        ],
+    }
+
+
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_children_list_authenticated_public_or_authenticated_parent(
+    reach,
+):
+    """
+    Authenticated users should be allowed to retrieve the children of a document who
+    has a public or authenticated ancestor.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory(link_reach=reach)
+    parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+    document = factories.DocumentFactory(link_reach="restricted", parent=parent)
+    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    factories.UserDocumentAccessFactory(document=child1)
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 2,
+        "next": None,
+        "previous": None,
+        "results": [
+            {
+                "abilities": child1.get_abilities(user),
+                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child1.creator.id),
+                "depth": 4,
+                "excerpt": child1.excerpt,
+                "id": str(child1.id),
+                "is_favorite": False,
+                "link_reach": child1.link_reach,
+                "link_role": child1.link_role,
+                "numchild": 0,
+                "nb_accesses": 1,
+                "path": child1.path,
+                "title": child1.title,
+                "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [],
+            },
+            {
+                "abilities": child2.get_abilities(user),
+                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child2.creator.id),
+                "depth": 4,
+                "excerpt": child2.excerpt,
+                "id": str(child2.id),
+                "is_favorite": False,
+                "link_reach": child2.link_reach,
+                "link_role": child2.link_role,
+                "numchild": 0,
+                "nb_accesses": 0,
+                "path": child2.path,
+                "title": child2.title,
+                "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [],
+            },
+        ],
+    }
+
+
+def test_api_documents_children_list_authenticated_unrelated_restricted():
+    """
+    Authenticated users should not be allowed to retrieve the children of a document that is
+    restricted and to which they are not related.
+    """
+    user = factories.UserFactory(with_owned_document=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach="restricted")
+    child1, _child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    factories.UserDocumentAccessFactory(document=child1)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+    )
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+
+def test_api_documents_children_list_authenticated_related_direct():
+    """
+    Authenticated users should be allowed to retrieve the children of a document
+    to which they are directly related whatever the role.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    access = factories.UserDocumentAccessFactory(document=document, user=user)
+    factories.UserDocumentAccessFactory(document=document)
+
+    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    factories.UserDocumentAccessFactory(document=child1)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+    )
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 2,
+        "next": None,
+        "previous": None,
+        "results": [
+            {
+                "abilities": child1.get_abilities(user),
+                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child1.creator.id),
+                "depth": 2,
+                "excerpt": child1.excerpt,
+                "id": str(child1.id),
+                "is_favorite": False,
+                "link_reach": child1.link_reach,
+                "link_role": child1.link_role,
+                "numchild": 0,
+                "nb_accesses": 3,
+                "path": child1.path,
+                "title": child1.title,
+                "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [access.role],
+            },
+            {
+                "abilities": child2.get_abilities(user),
+                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child2.creator.id),
+                "depth": 2,
+                "excerpt": child2.excerpt,
+                "id": str(child2.id),
+                "is_favorite": False,
+                "link_reach": child2.link_reach,
+                "link_role": child2.link_role,
+                "numchild": 0,
+                "nb_accesses": 2,
+                "path": child2.path,
+                "title": child2.title,
+                "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [access.role],
+            },
+        ],
+    }
+
+
+def test_api_documents_children_list_authenticated_related_parent():
+    """
+    Authenticated users should be allowed to retrieve the children of a document if they
+    are related to one of its ancestors whatever the role.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory(link_reach="restricted")
+    parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+    document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+
+    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    factories.UserDocumentAccessFactory(document=child1)
+
+    grand_parent_access = factories.UserDocumentAccessFactory(
+        document=grand_parent, user=user
+    )
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+    )
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 2,
+        "next": None,
+        "previous": None,
+        "results": [
+            {
+                "abilities": child1.get_abilities(user),
+                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child1.creator.id),
+                "depth": 4,
+                "excerpt": child1.excerpt,
+                "id": str(child1.id),
+                "is_favorite": False,
+                "link_reach": child1.link_reach,
+                "link_role": child1.link_role,
+                "numchild": 0,
+                "nb_accesses": 2,
+                "path": child1.path,
+                "title": child1.title,
+                "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [grand_parent_access.role],
+            },
+            {
+                "abilities": child2.get_abilities(user),
+                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child2.creator.id),
+                "depth": 4,
+                "excerpt": child2.excerpt,
+                "id": str(child2.id),
+                "is_favorite": False,
+                "link_reach": child2.link_reach,
+                "link_role": child2.link_role,
+                "numchild": 0,
+                "nb_accesses": 1,
+                "path": child2.path,
+                "title": child2.title,
+                "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [grand_parent_access.role],
+            },
+        ],
+    }
+
+
+def test_api_documents_children_list_authenticated_related_child():
+    """
+    Authenticated users should not be allowed to retrieve all the children of a document
+    as a result of being related to one of its children.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach="restricted")
+    child1, _child2 = factories.DocumentFactory.create_batch(2, parent=document)
+
+    factories.UserDocumentAccessFactory(document=child1, user=user)
+    factories.UserDocumentAccessFactory(document=document)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/children/",
+    )
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+
+def test_api_documents_children_list_authenticated_related_team_none(mock_user_teams):
+    """
+    Authenticated users should not be able to retrieve the children of a restricted document
+    related to teams in which the user is not.
+    """
+    mock_user_teams.return_value = []
+
+    user = factories.UserFactory(with_owned_document=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach="restricted")
+    factories.DocumentFactory.create_batch(2, parent=document)
+
+    factories.TeamDocumentAccessFactory(document=document, team="myteam")
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+
+def test_api_documents_children_list_authenticated_related_team_members(
+    mock_user_teams,
+):
+    """
+    Authenticated users should be allowed to retrieve the children of a document to which they
+    are related via a team whatever the role.
+    """
+    mock_user_teams.return_value = ["myteam"]
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach="restricted")
+    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+
+    access = factories.TeamDocumentAccessFactory(document=document, team="myteam")
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+
+    # pylint: disable=R0801
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 2,
+        "next": None,
+        "previous": None,
+        "results": [
+            {
+                "abilities": child1.get_abilities(user),
+                "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child1.creator.id),
+                "depth": 2,
+                "excerpt": child1.excerpt,
+                "id": str(child1.id),
+                "is_favorite": False,
+                "link_reach": child1.link_reach,
+                "link_role": child1.link_role,
+                "numchild": 0,
+                "nb_accesses": 1,
+                "path": child1.path,
+                "title": child1.title,
+                "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [access.role],
+            },
+            {
+                "abilities": child2.get_abilities(user),
+                "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
+                "creator": str(child2.creator.id),
+                "depth": 2,
+                "excerpt": child2.excerpt,
+                "id": str(child2.id),
+                "is_favorite": False,
+                "link_reach": child2.link_reach,
+                "link_role": child2.link_role,
+                "numchild": 0,
+                "nb_accesses": 1,
+                "path": child2.path,
+                "title": child2.title,
+                "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
+                "user_roles": [access.role],
+            },
+        ],
+    }

src/backend/core/tests/documents/test_api_documents_delete.py

@@ -77,6 +77,37 @@ def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_teams
     assert models.Document.objects.count() == 2
 
 
+@pytest.mark.parametrize("depth", [1, 2, 3])
+def test_api_documents_delete_authenticated_owner_of_ancestor(depth):
+    """
+    Authenticated users should not be able to delete a document for which
+    they are only owner of an ancestor.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    documents = []
+    for i in range(depth):
+        documents.append(
+            factories.UserDocumentAccessFactory(role="owner", user=user).document
+            if i == 0
+            else factories.DocumentFactory(parent=documents[-1])
+        )
+    assert models.Document.objects.count() == depth
+
+    response = client.delete(
+        f"/api/v1.0/documents/{documents[-1].id}/",
+    )
+
+    assert response.status_code == 204
+
+    # Make sure it is only a soft delete
+    assert models.Document.objects.count() == depth
+    assert models.Document.objects.filter(deleted_at__isnull=True).count() == depth - 1
+    assert models.Document.objects.filter(deleted_at__isnull=False).count() == 1
+
+
 @pytest.mark.parametrize("via", VIA)
 def test_api_documents_delete_authenticated_owner(via, mock_user_teams):
     """
@@ -101,4 +132,8 @@ def test_api_documents_delete_authenticated_owner(via, mock_user_teams):
     )
 
     assert response.status_code == 204
-    assert models.Document.objects.exists() is False
+
+    # Make sure it is only a soft delete
+    assert models.Document.objects.count() == 1
+    assert models.Document.objects.filter(deleted_at__isnull=True).exists() is False
+    assert models.Document.objects.filter(deleted_at__isnull=False).count() == 1

src/backend/core/tests/documents/test_api_documents_list.py

@@ -2,10 +2,11 @@
 Tests for Documents API endpoint in impress's core app: list
 """
 
-import operator
 import random
+from datetime import timedelta
 from unittest import mock
-from urllib.parse import urlencode
+
+from django.utils import timezone
 
 import pytest
 from faker import Faker
@@ -23,7 +24,7 @@ pytestmark = pytest.mark.django_db
 def test_api_documents_list_anonymous(reach, role):
     """
     Anonymous users should not be allowed to list documents whatever the
-    link reach and the role
+    link reach and link role
     """
     factories.DocumentFactory(link_reach=reach, link_role=role)
 
@@ -37,16 +38,16 @@ def test_api_documents_list_anonymous(reach, role):
 def test_api_documents_list_format():
     """Validate the format of documents as returned by the list view."""
     user = factories.UserFactory()
-
     client = APIClient()
     client.force_login(user)
 
     other_users = factories.UserFactory.create_batch(3)
     document = factories.DocumentFactory(
-        users=[user, *factories.UserFactory.create_batch(2)],
+        users=factories.UserFactory.create_batch(2),
         favorited_by=[user, *other_users],
         link_traces=other_users,
     )
+    access = factories.UserDocumentAccessFactory(document=document, user=user)
 
     response = client.get("/api/v1.0/documents/")
 
@@ -62,18 +63,23 @@ def test_api_documents_list_format():
     assert results[0] == {
         "id": str(document.id),
         "abilities": document.get_abilities(user),
-        "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
         "is_favorite": True,
         "link_reach": document.link_reach,
         "link_role": document.link_role,
         "nb_accesses": 3,
+        "numchild": 0,
+        "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": [access.role],
     }
 
 
+# pylint: disable=too-many-locals
 def test_api_documents_list_authenticated_direct(django_assert_num_queries):
     """
     Authenticated users should be able to list documents they are a direct
@@ -81,11 +87,10 @@ def test_api_documents_list_authenticated_direct(django_assert_num_queries):
     than restricted.
     """
     user = factories.UserFactory()
-
     client = APIClient()
     client.force_login(user)
 
-    documents = [
+    document1, document2 = [
         access.document
         for access in factories.UserDocumentAccessFactory.create_batch(2, user=user)
     ]
@@ -95,16 +100,64 @@ def test_api_documents_list_authenticated_direct(django_assert_num_queries):
         for role in models.LinkRoleChoices:
             factories.DocumentFactory(link_reach=reach, link_role=role)
 
-    expected_ids = {str(document.id) for document in documents}
+    # Children of visible documents should not get listed even with a specific access
+    factories.DocumentFactory(parent=document1)
 
-    with django_assert_num_queries(3):
+    child1_with_access = factories.DocumentFactory(parent=document1)
+    factories.UserDocumentAccessFactory(user=user, document=child1_with_access)
+
+    middle_document = factories.DocumentFactory(parent=document2)
+    child2_with_access = factories.DocumentFactory(parent=middle_document)
+    factories.UserDocumentAccessFactory(user=user, document=child2_with_access)
+
+    # Children of hidden documents should get listed when visible by the logged-in user
+    hidden_root = factories.DocumentFactory()
+    child3_with_access = factories.DocumentFactory(parent=hidden_root)
+    factories.UserDocumentAccessFactory(user=user, document=child3_with_access)
+    child4_with_access = factories.DocumentFactory(parent=hidden_root)
+    factories.UserDocumentAccessFactory(user=user, document=child4_with_access)
+
+    # Documents that are soft deleted and children of a soft deleted document should not be listed
+    soft_deleted_document = factories.DocumentFactory(users=[user])
+    child_of_soft_deleted_document = factories.DocumentFactory(
+        users=[user],
+        parent=soft_deleted_document,
+    )
+    factories.DocumentFactory(users=[user], parent=child_of_soft_deleted_document)
+    soft_deleted_document.soft_delete()
+
+    # Documents that are permanently deleted and children of a permanently deleted
+    # document should not be listed
+    permanently_deleted_document = factories.DocumentFactory(users=[user])
+    child_of_permanently_deleted_document = factories.DocumentFactory(
+        users=[user], parent=permanently_deleted_document
+    )
+    factories.DocumentFactory(
+        users=[user], parent=child_of_permanently_deleted_document
+    )
+
+    fourty_days_ago = timezone.now() - timedelta(days=40)
+    with mock.patch("django.utils.timezone.now", return_value=fourty_days_ago):
+        permanently_deleted_document.soft_delete()
+
+    expected_ids = {
+        str(document1.id),
+        str(document2.id),
+        str(child3_with_access.id),
+        str(child4_with_access.id),
+    }
+
+    with django_assert_num_queries(8):
+        response = client.get("/api/v1.0/documents/")
+
+    # nb_accesses should now be cached
+    with django_assert_num_queries(4):
         response = client.get("/api/v1.0/documents/")
 
     assert response.status_code == 200
     results = response.json()["results"]
-    assert len(results) == 2
-    results_id = {result["id"] for result in results}
-    assert expected_ids == results_id
+    results_ids = {result["id"] for result in results}
+    assert expected_ids == results_ids
 
 
 def test_api_documents_list_authenticated_via_team(
@@ -132,7 +185,11 @@ def test_api_documents_list_authenticated_via_team(
 
     expected_ids = {str(document.id) for document in documents_team1 + documents_team2}
 
-    with django_assert_num_queries(3):
+    with django_assert_num_queries(9):
+        response = client.get("/api/v1.0/documents/")
+
+    # nb_accesses should now be cached
+    with django_assert_num_queries(4):
         response = client.get("/api/v1.0/documents/")
 
     assert response.status_code == 200
@@ -161,10 +218,12 @@ def test_api_documents_list_authenticated_link_reach_restricted(
     other_document = factories.DocumentFactory(link_reach="public")
     models.LinkTrace.objects.create(document=other_document, user=user)
 
-    with django_assert_num_queries(3):
-        response = client.get(
-            "/api/v1.0/documents/",
-        )
+    with django_assert_num_queries(5):
+        response = client.get("/api/v1.0/documents/")
+
+    # nb_accesses should now be cached
+    with django_assert_num_queries(4):
+        response = client.get("/api/v1.0/documents/")
 
     assert response.status_code == 200
     results = response.json()["results"]
@@ -186,21 +245,37 @@ def test_api_documents_list_authenticated_link_reach_public_or_authenticated(
     client = APIClient()
     client.force_login(user)
 
-    documents = [
+    document1, document2 = [
         factories.DocumentFactory(link_traces=[user], link_reach=reach)
         for reach in models.LinkReachChoices
         if reach != "restricted"
     ]
-    expected_ids = {str(document.id) for document in documents}
+    factories.DocumentFactory(
+        link_reach=random.choice(["public", "authenticated"]),
+        link_traces=[user],
+        parent=document1,
+    )
 
-    with django_assert_num_queries(3):
-        response = client.get(
-            "/api/v1.0/documents/",
-        )
+    hidden_document = factories.DocumentFactory(
+        link_reach=random.choice(["public", "authenticated"])
+    )
+    visible_child = factories.DocumentFactory(
+        link_traces=[user],
+        link_reach=random.choice(["public", "authenticated"]),
+        parent=hidden_document,
+    )
+
+    expected_ids = {str(document1.id), str(document2.id), str(visible_child.id)}
+
+    with django_assert_num_queries(7):
+        response = client.get("/api/v1.0/documents/")
+
+    # nb_accesses should now be cached
+    with django_assert_num_queries(4):
+        response = client.get("/api/v1.0/documents/")
 
     assert response.status_code == 200
     results = response.json()["results"]
-    assert len(results) == 2
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
 
@@ -287,7 +362,11 @@ def test_api_documents_list_favorites_no_extra_queries(django_assert_num_queries
     factories.DocumentFactory.create_batch(2, users=[user])
 
     url = "/api/v1.0/documents/"
-    with django_assert_num_queries(3):
+    with django_assert_num_queries(9):
+        response = client.get(url)
+
+    # nb_accesses should now be cached
+    with django_assert_num_queries(4):
         response = client.get(url)
 
     assert response.status_code == 200
@@ -300,7 +379,7 @@ def test_api_documents_list_favorites_no_extra_queries(django_assert_num_queries
     for document in special_documents:
         models.DocumentFavorite.objects.create(document=document, user=user)
 
-    with django_assert_num_queries(3):
+    with django_assert_num_queries(4):
         response = client.get(url)
 
     assert response.status_code == 200
@@ -314,361 +393,3 @@ def test_api_documents_list_favorites_no_extra_queries(django_assert_num_queries
             assert result["is_favorite"] is True
         else:
             assert result["is_favorite"] is False
-
-
-def test_api_documents_list_filter_and_access_rights():
-    """Filtering on querystring parameters should respect access rights."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    other_user = factories.UserFactory()
-
-    def random_favorited_by():
-        return random.choice([[], [user], [other_user]])
-
-    # Documents that should be listed to this user
-    listed_documents = [
-        factories.DocumentFactory(
-            link_reach="public",
-            link_traces=[user],
-            favorited_by=random_favorited_by(),
-            creator=random.choice([user, other_user]),
-        ),
-        factories.DocumentFactory(
-            link_reach="authenticated",
-            link_traces=[user],
-            favorited_by=random_favorited_by(),
-            creator=random.choice([user, other_user]),
-        ),
-        factories.DocumentFactory(
-            link_reach="restricted",
-            users=[user],
-            favorited_by=random_favorited_by(),
-            creator=random.choice([user, other_user]),
-        ),
-    ]
-    listed_ids = [str(doc.id) for doc in listed_documents]
-    word_list = [word for doc in listed_documents for word in doc.title.split(" ")]
-
-    # Documents that should not be listed to this user
-    factories.DocumentFactory(
-        link_reach="public",
-        favorited_by=random_favorited_by(),
-        creator=random.choice([user, other_user]),
-    )
-    factories.DocumentFactory(
-        link_reach="authenticated",
-        favorited_by=random_favorited_by(),
-        creator=random.choice([user, other_user]),
-    )
-    factories.DocumentFactory(
-        link_reach="restricted",
-        favorited_by=random_favorited_by(),
-        creator=random.choice([user, other_user]),
-    )
-    factories.DocumentFactory(
-        link_reach="restricted",
-        link_traces=[user],
-        favorited_by=random_favorited_by(),
-        creator=random.choice([user, other_user]),
-    )
-
-    filters = {
-        "link_reach": random.choice([None, *models.LinkReachChoices.values]),
-        "title": random.choice([None, *word_list]),
-        "favorite": random.choice([None, True, False]),
-        "creator": random.choice([None, user, other_user]),
-        "ordering": random.choice(
-            [
-                None,
-                "created_at",
-                "-created_at",
-                "is_favorite",
-                "-is_favorite",
-                "nb_accesses",
-                "-nb_accesses",
-                "title",
-                "-title",
-                "updated_at",
-                "-updated_at",
-            ]
-        ),
-    }
-    query_params = {key: value for key, value in filters.items() if value is not None}
-    querystring = urlencode(query_params)
-
-    response = client.get(f"/api/v1.0/documents/?{querystring:s}")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-
-    # Ensure all documents in results respect expected access rights
-    for result in results:
-        assert result["id"] in listed_ids
-
-
-# Filters: ordering
-
-
-def test_api_documents_list_ordering_default():
-    """Documents should be ordered by descending "updated_at" by default"""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(5, users=[user])
-
-    response = client.get("/api/v1.0/documents/")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 5
-
-    # Check that results are sorted by descending "updated_at" as expected
-    for i in range(4):
-        assert operator.ge(results[i]["updated_at"], results[i + 1]["updated_at"])
-
-
-def test_api_documents_list_ordering_by_fields():
-    """It should be possible to order by several fields"""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(5, users=[user])
-
-    for parameter in [
-        "created_at",
-        "-created_at",
-        "is_favorite",
-        "-is_favorite",
-        "nb_accesses",
-        "-nb_accesses",
-        "title",
-        "-title",
-        "updated_at",
-        "-updated_at",
-    ]:
-        is_descending = parameter.startswith("-")
-        field = parameter.lstrip("-")
-        querystring = f"?ordering={parameter}"
-
-        response = client.get(f"/api/v1.0/documents/{querystring:s}")
-        assert response.status_code == 200
-        results = response.json()["results"]
-        assert len(results) == 5
-
-        # Check that results are sorted by the field in querystring as expected
-        compare = operator.ge if is_descending else operator.le
-        for i in range(4):
-            assert compare(results[i][field], results[i + 1][field])
-
-
-# Filters: is_creator_me
-
-
-def test_api_documents_list_filter_is_creator_me_true():
-    """
-    Authenticated users should be able to filter documents they created.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(3, users=[user], creator=user)
-    factories.DocumentFactory.create_batch(2, users=[user])
-
-    response = client.get("/api/v1.0/documents/?is_creator_me=true")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 3
-
-    # Ensure all results are created by the current user
-    for result in results:
-        assert result["creator"] == str(user.id)
-
-
-def test_api_documents_list_filter_is_creator_me_false():
-    """
-    Authenticated users should be able to filter documents created by others.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(3, users=[user], creator=user)
-    factories.DocumentFactory.create_batch(2, users=[user])
-
-    response = client.get("/api/v1.0/documents/?is_creator_me=false")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 2
-
-    # Ensure all results are created by other users
-    for result in results:
-        assert result["creator"] != str(user.id)
-
-
-def test_api_documents_list_filter_is_creator_me_invalid():
-    """Filtering with an invalid `is_creator_me` value should do nothing."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(3, users=[user], creator=user)
-    factories.DocumentFactory.create_batch(2, users=[user])
-
-    response = client.get("/api/v1.0/documents/?is_creator_me=invalid")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 5
-
-
-# Filters: is_favorite
-
-
-def test_api_documents_list_filter_is_favorite_true():
-    """
-    Authenticated users should be able to filter documents they marked as favorite.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(3, users=[user], favorited_by=[user])
-    factories.DocumentFactory.create_batch(2, users=[user])
-
-    response = client.get("/api/v1.0/documents/?is_favorite=true")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 3
-
-    # Ensure all results are marked as favorite by the current user
-    for result in results:
-        assert result["is_favorite"] is True
-
-
-def test_api_documents_list_filter_is_favorite_false():
-    """
-    Authenticated users should be able to filter documents they didn't mark as favorite.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(3, users=[user], favorited_by=[user])
-    factories.DocumentFactory.create_batch(2, users=[user])
-
-    response = client.get("/api/v1.0/documents/?is_favorite=false")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 2
-
-    # Ensure all results are not marked as favorite by the current user
-    for result in results:
-        assert result["is_favorite"] is False
-
-
-def test_api_documents_list_filter_is_favorite_invalid():
-    """Filtering with an invalid `is_favorite` value should do nothing."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(3, users=[user], favorited_by=[user])
-    factories.DocumentFactory.create_batch(2, users=[user])
-
-    response = client.get("/api/v1.0/documents/?is_favorite=invalid")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == 5
-
-
-# Filters: link_reach
-
-
-@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
-def test_api_documents_list_filter_link_reach(reach):
-    """Authenticated users should be able to filter documents by link reach."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(5, users=[user])
-
-    response = client.get(f"/api/v1.0/documents/?link_reach={reach:s}")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-
-    # Ensure all results have the chosen link reach
-    for result in results:
-        assert result["link_reach"] == reach
-
-
-def test_api_documents_list_filter_link_reach_invalid():
-    """Filtering with an invalid `link_reach` value should raise an error."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory.create_batch(3, users=[user])
-
-    response = client.get("/api/v1.0/documents/?link_reach=invalid")
-
-    assert response.status_code == 400
-    assert response.json() == {
-        "link_reach": [
-            "Select a valid choice. invalid is not one of the available choices."
-        ]
-    }
-
-
-# Filters: title
-
-
-@pytest.mark.parametrize(
-    "query,nb_results",
-    [
-        ("Project Alpha", 1),  # Exact match
-        ("project", 2),  # Partial match (case-insensitive)
-        ("Guide", 1),  # Word match within a title
-        ("Special", 0),  # No match (nonexistent keyword)
-        ("2024", 2),  # Match by numeric keyword
-        ("", 5),  # Empty string
-    ],
-)
-def test_api_documents_list_filter_title(query, nb_results):
-    """Authenticated users should be able to search documents by their title."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    # Create documents with predefined titles
-    titles = [
-        "Project Alpha Documentation",
-        "Project Beta Overview",
-        "User Guide",
-        "Financial Report 2024",
-        "Annual Review 2024",
-    ]
-    for title in titles:
-        factories.DocumentFactory(title=title, users=[user])
-
-    # Perform the search query
-    response = client.get(f"/api/v1.0/documents/?title={query:s}")
-
-    assert response.status_code == 200
-    results = response.json()["results"]
-    assert len(results) == nb_results
-
-    # Ensure all results contain the query in their title
-    for result in results:
-        assert query.lower().strip() in result["title"].lower()

src/backend/core/tests/documents/test_api_documents_list_filters.py

@@ -0,0 +1,356 @@
+"""
+Tests for Documents API endpoint in impress's core app: list
+"""
+
+import operator
+import random
+from urllib.parse import urlencode
+
+import pytest
+from faker import Faker
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+fake = Faker()
+pytestmark = pytest.mark.django_db
+
+
+def test_api_documents_list_filter_and_access_rights():
+    """Filtering on querystring parameters should respect access rights."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+
+    def random_favorited_by():
+        return random.choice([[], [user], [other_user]])
+
+    # Documents that should be listed to this user
+    listed_documents = [
+        factories.DocumentFactory(
+            link_reach="public",
+            link_traces=[user],
+            favorited_by=random_favorited_by(),
+            creator=random.choice([user, other_user]),
+        ),
+        factories.DocumentFactory(
+            link_reach="authenticated",
+            link_traces=[user],
+            favorited_by=random_favorited_by(),
+            creator=random.choice([user, other_user]),
+        ),
+        factories.DocumentFactory(
+            link_reach="restricted",
+            users=[user],
+            favorited_by=random_favorited_by(),
+            creator=random.choice([user, other_user]),
+        ),
+    ]
+    listed_ids = [str(doc.id) for doc in listed_documents]
+    word_list = [word for doc in listed_documents for word in doc.title.split(" ")]
+
+    # Documents that should not be listed to this user
+    factories.DocumentFactory(
+        link_reach="public",
+        favorited_by=random_favorited_by(),
+        creator=random.choice([user, other_user]),
+    )
+    factories.DocumentFactory(
+        link_reach="authenticated",
+        favorited_by=random_favorited_by(),
+        creator=random.choice([user, other_user]),
+    )
+    factories.DocumentFactory(
+        link_reach="restricted",
+        favorited_by=random_favorited_by(),
+        creator=random.choice([user, other_user]),
+    )
+    factories.DocumentFactory(
+        link_reach="restricted",
+        link_traces=[user],
+        favorited_by=random_favorited_by(),
+        creator=random.choice([user, other_user]),
+    )
+
+    filters = {
+        "link_reach": random.choice([None, *models.LinkReachChoices.values]),
+        "title": random.choice([None, *word_list]),
+        "favorite": random.choice([None, True, False]),
+        "creator": random.choice([None, user, other_user]),
+        "ordering": random.choice(
+            [
+                None,
+                "created_at",
+                "-created_at",
+                "is_favorite",
+                "-is_favorite",
+                "title",
+                "-title",
+                "updated_at",
+                "-updated_at",
+            ]
+        ),
+    }
+    query_params = {key: value for key, value in filters.items() if value is not None}
+    querystring = urlencode(query_params)
+
+    response = client.get(f"/api/v1.0/documents/?{querystring:s}")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+
+    # Ensure all documents in results respect expected access rights
+    for result in results:
+        assert result["id"] in listed_ids
+
+
+# Filters: ordering
+
+
+def test_api_documents_list_ordering_default():
+    """Documents should be ordered by descending "updated_at" by default"""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(5, users=[user])
+
+    response = client.get("/api/v1.0/documents/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 5
+
+    # Check that results are sorted by descending "updated_at" as expected
+    for i in range(4):
+        assert operator.ge(results[i]["updated_at"], results[i + 1]["updated_at"])
+
+
+def test_api_documents_list_ordering_by_fields():
+    """It should be possible to order by several fields"""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(5, users=[user])
+
+    for parameter in [
+        "created_at",
+        "-created_at",
+        "is_favorite",
+        "-is_favorite",
+        "title",
+        "-title",
+        "updated_at",
+        "-updated_at",
+    ]:
+        is_descending = parameter.startswith("-")
+        field = parameter.lstrip("-")
+        querystring = f"?ordering={parameter}"
+
+        response = client.get(f"/api/v1.0/documents/{querystring:s}")
+        assert response.status_code == 200
+        results = response.json()["results"]
+        assert len(results) == 5
+
+        # Check that results are sorted by the field in querystring as expected
+        compare = operator.ge if is_descending else operator.le
+        for i in range(4):
+            assert compare(results[i][field], results[i + 1][field])
+
+
+# Filters: unknown field
+
+
+def test_api_documents_list_filter_unknown_field():
+    """
+    Trying to filter by an unknown field should raise a 400 error.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory()
+    expected_ids = {
+        str(document.id)
+        for document in factories.DocumentFactory.create_batch(2, users=[user])
+    }
+
+    response = client.get("/api/v1.0/documents/?unknown=true")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 2
+    assert {result["id"] for result in results} == expected_ids
+
+
+# Filters: is_creator_me
+
+
+def test_api_documents_list_filter_is_creator_me_true():
+    """
+    Authenticated users should be able to filter documents they created.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(3, users=[user], creator=user)
+    factories.DocumentFactory.create_batch(2, users=[user])
+
+    response = client.get("/api/v1.0/documents/?is_creator_me=true")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 3
+
+    # Ensure all results are created by the current user
+    for result in results:
+        assert result["creator"] == str(user.id)
+
+
+def test_api_documents_list_filter_is_creator_me_false():
+    """
+    Authenticated users should be able to filter documents created by others.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(3, users=[user], creator=user)
+    factories.DocumentFactory.create_batch(2, users=[user])
+
+    response = client.get("/api/v1.0/documents/?is_creator_me=false")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 2
+
+    # Ensure all results are created by other users
+    for result in results:
+        assert result["creator"] != str(user.id)
+
+
+def test_api_documents_list_filter_is_creator_me_invalid():
+    """Filtering with an invalid `is_creator_me` value should do nothing."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(3, users=[user], creator=user)
+    factories.DocumentFactory.create_batch(2, users=[user])
+
+    response = client.get("/api/v1.0/documents/?is_creator_me=invalid")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 5
+
+
+# Filters: is_favorite
+
+
+def test_api_documents_list_filter_is_favorite_true():
+    """
+    Authenticated users should be able to filter documents they marked as favorite.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(3, users=[user], favorited_by=[user])
+    factories.DocumentFactory.create_batch(2, users=[user])
+
+    response = client.get("/api/v1.0/documents/?is_favorite=true")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 3
+
+    # Ensure all results are marked as favorite by the current user
+    for result in results:
+        assert result["is_favorite"] is True
+
+
+def test_api_documents_list_filter_is_favorite_false():
+    """
+    Authenticated users should be able to filter documents they didn't mark as favorite.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(3, users=[user], favorited_by=[user])
+    factories.DocumentFactory.create_batch(2, users=[user])
+
+    response = client.get("/api/v1.0/documents/?is_favorite=false")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 2
+
+    # Ensure all results are not marked as favorite by the current user
+    for result in results:
+        assert result["is_favorite"] is False
+
+
+def test_api_documents_list_filter_is_favorite_invalid():
+    """Filtering with an invalid `is_favorite` value should do nothing."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(3, users=[user], favorited_by=[user])
+    factories.DocumentFactory.create_batch(2, users=[user])
+
+    response = client.get("/api/v1.0/documents/?is_favorite=invalid")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 5
+
+
+# Filters: title
+
+
+@pytest.mark.parametrize(
+    "query,nb_results",
+    [
+        ("Project Alpha", 1),  # Exact match
+        ("project", 2),  # Partial match (case-insensitive)
+        ("Guide", 1),  # Word match within a title
+        ("Special", 0),  # No match (nonexistent keyword)
+        ("2024", 2),  # Match by numeric keyword
+        ("", 5),  # Empty string
+    ],
+)
+def test_api_documents_list_filter_title(query, nb_results):
+    """Authenticated users should be able to search documents by their title."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Create documents with predefined titles
+    titles = [
+        "Project Alpha Documentation",
+        "Project Beta Overview",
+        "User Guide",
+        "Financial Report 2024",
+        "Annual Review 2024",
+    ]
+    for title in titles:
+        parent = factories.DocumentFactory() if random.choice([True, False]) else None
+        factories.DocumentFactory(title=title, users=[user], parent=parent)
+
+    # Perform the search query
+    response = client.get(f"/api/v1.0/documents/?title={query:s}")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == nb_results
+
+    # Ensure all results contain the query in their title
+    for result in results:
+        assert query.lower().strip() in result["title"].lower()

src/backend/core/tests/documents/test_api_documents_move.py

@@ -0,0 +1,339 @@
+"""
+Test moving documents within the document tree via an detail action API endpoint.
+"""
+
+import random
+from uuid import uuid4
+
+from django.utils import timezone
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import enums, factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_documents_move_anonymous_user():
+    """Anonymous users should not be able to move documents."""
+    document = factories.DocumentFactory()
+    target = factories.DocumentFactory()
+
+    response = APIClient().post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id)},
+    )
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+@pytest.mark.parametrize("role", [None, "reader", "editor"])
+def test_api_documents_move_authenticated_document_no_permission(role):
+    """
+    Authenticated users should not be able to move documents with insufficient
+    permissions on the origin document.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    target = factories.UserDocumentAccessFactory(user=user, role="owner").document
+
+    if role:
+        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id)},
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+
+def test_api_documents_move_invalid_target_string():
+    """Test for moving a document to an invalid target as a random string."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.UserDocumentAccessFactory(user=user, role="owner").document
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": "non-existent-id"},
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {"target_document_id": ["Must be a valid UUID."]}
+
+
+def test_api_documents_move_invalid_target_uuid():
+    """Test for moving a document to an invalid target that looks like a UUID."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.UserDocumentAccessFactory(user=user, role="owner").document
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(uuid4())},
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "target_document_id": "Target parent document does not exist."
+    }
+
+
+def test_api_documents_move_invalid_position():
+    """Test moving a document to an invalid position."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.UserDocumentAccessFactory(user=user, role="owner").document
+    target = factories.UserDocumentAccessFactory(user=user, role="owner").document
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={
+            "target_document_id": str(target.id),
+            "position": "invalid-position",
+        },
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "position": ['"invalid-position" is not a valid choice.']
+    }
+
+
+@pytest.mark.parametrize("position", enums.MoveNodePositionChoices.values)
+@pytest.mark.parametrize("target_parent_role", models.RoleChoices.values)
+@pytest.mark.parametrize("target_role", models.RoleChoices.values)
+def test_api_documents_move_authenticated_target_roles_mocked(
+    target_role, target_parent_role, position
+):
+    """
+    Authenticated users with insufficient permissions on the target document (or its
+    parent depending on the position chosen), should not be allowed to move documents.
+    """
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    power_roles = ["administrator", "owner"]
+
+    document = factories.DocumentFactory(users=[(user, random.choice(power_roles))])
+    children = factories.DocumentFactory.create_batch(3, parent=document)
+
+    target_parent = factories.DocumentFactory(users=[(user, target_parent_role)])
+    sibling1, target, sibling2 = factories.DocumentFactory.create_batch(
+        3, parent=target_parent
+    )
+    models.DocumentAccess.objects.create(document=target, user=user, role=target_role)
+    target_children = factories.DocumentFactory.create_batch(2, parent=target)
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id), "position": position},
+    )
+
+    document.refresh_from_db()
+
+    if (
+        position in ["first-child", "last-child"]
+        and (target_role in power_roles or target_parent_role in power_roles)
+    ) or (
+        position in ["first-sibling", "last-sibling", "left", "right"]
+        and target_parent_role in power_roles
+    ):
+        assert response.status_code == 200
+        assert response.json() == {"message": "Document moved successfully."}
+
+        match position:
+            case "first-child":
+                assert list(target.get_children()) == [document, *target_children]
+            case "last-child":
+                assert list(target.get_children()) == [*target_children, document]
+            case "first-sibling":
+                assert list(target.get_siblings()) == [
+                    document,
+                    sibling1,
+                    target,
+                    sibling2,
+                ]
+            case "last-sibling":
+                assert list(target.get_siblings()) == [
+                    sibling1,
+                    target,
+                    sibling2,
+                    document,
+                ]
+            case "left":
+                assert list(target.get_siblings()) == [
+                    sibling1,
+                    document,
+                    target,
+                    sibling2,
+                ]
+            case "right":
+                assert list(target.get_siblings()) == [
+                    sibling1,
+                    target,
+                    document,
+                    sibling2,
+                ]
+            case _:
+                raise ValueError(f"Invalid position: {position}")
+
+        # Verify that the document's children have also been moved
+        assert list(document.get_children()) == children
+    else:
+        assert response.status_code == 400
+        assert (
+            "You do not have permission to move documents"
+            in response.json()["target_document_id"]
+        )
+        assert document.is_root() is True
+
+
+def test_api_documents_move_authenticated_deleted_document():
+    """
+    It should not be possible to move a deleted document or its descendants, even
+    for an owner.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(
+        users=[(user, "owner")], deleted_at=timezone.now()
+    )
+    child = factories.DocumentFactory(parent=document, users=[(user, "owner")])
+
+    target = factories.DocumentFactory(users=[(user, "owner")])
+
+    # Try moving the deleted document
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id)},
+    )
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    # Verify that the document has not moved
+    document.refresh_from_db()
+    assert document.is_root() is True
+
+    # Try moving the child of the deleted document
+    response = client.post(
+        f"/api/v1.0/documents/{child.id!s}/move/",
+        data={"target_document_id": str(target.id)},
+    )
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    # Verify that the child has not moved
+    child.refresh_from_db()
+    assert child.is_child_of(document) is True
+
+
+@pytest.mark.parametrize(
+    "position",
+    enums.MoveNodePositionChoices.values,
+)
+def test_api_documents_move_authenticated_deleted_target_as_child(position):
+    """
+    It should not be possible to move a document as a child of a deleted target
+    even for a owner.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(users=[(user, "owner")])
+
+    target = factories.DocumentFactory(
+        users=[(user, "owner")], deleted_at=timezone.now()
+    )
+    child = factories.DocumentFactory(parent=target, users=[(user, "owner")])
+
+    # Try moving the document to the deleted target
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id), "position": position},
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "target_document_id": "Target parent document does not exist."
+    }
+
+    # Verify that the document has not moved
+    document.refresh_from_db()
+    assert document.is_root() is True
+
+    # Try moving the document to the child of the deleted target
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(child.id), "position": position},
+    )
+    assert response.status_code == 400
+    assert response.json() == {
+        "target_document_id": "Target parent document does not exist."
+    }
+
+    # Verify that the document has not moved
+    document.refresh_from_db()
+    assert document.is_root() is True
+
+
+@pytest.mark.parametrize(
+    "position",
+    ["first-sibling", "last-sibling", "left", "right"],
+)
+def test_api_documents_move_authenticated_deleted_target_as_sibling(position):
+    """
+    It should not be possible to move a document as a sibling of a deleted target document
+    if the user has no rigths on its parent.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(users=[(user, "owner")])
+
+    target_parent = factories.DocumentFactory(
+        users=[(user, "owner")], deleted_at=timezone.now()
+    )
+    target = factories.DocumentFactory(users=[(user, "owner")], parent=target_parent)
+
+    # Try moving the document as a sibling of the target
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id), "position": position},
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "target_document_id": "Target parent document does not exist."
+    }
+
+    # Verify that the document has not moved
+    document.refresh_from_db()
+    assert document.is_root() is True

src/backend/core/tests/documents/test_api_documents_restore.py

@@ -0,0 +1,126 @@
+"""
+Test restoring documents after a soft delete via the detail action API endpoint.
+"""
+
+from datetime import timedelta
+
+from django.utils import timezone
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_documents_restore_anonymous_user():
+    """Anonymous users should not be able to restore deleted documents."""
+    now = timezone.now() - timedelta(days=15)
+    document = factories.DocumentFactory(deleted_at=now)
+
+    response = APIClient().post(f"/api/v1.0/documents/{document.id!s}/restore/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}
+
+    document.refresh_from_db()
+    assert document.deleted_at == now
+    assert document.ancestors_deleted_at == now
+
+
+@pytest.mark.parametrize("role", [None, "reader", "editor", "administrator"])
+def test_api_documents_restore_authenticated_no_permission(role):
+    """
+    Authenticated users who are not owners of a deleted document should
+    not be allowed to restore it.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    now = timezone.now() - timedelta(days=15)
+    document = factories.DocumentFactory(
+        deleted_at=now, link_reach="public", link_role="editor"
+    )
+    if role:
+        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
+
+    response = client.post(f"/api/v1.0/documents/{document.id!s}/restore/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}
+
+    document.refresh_from_db()
+    assert document.deleted_at == now
+    assert document.ancestors_deleted_at == now
+
+
+def test_api_documents_restore_authenticated_owner_success():
+    """The owner of a deleted document should be able to restore it."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    now = timezone.now() - timedelta(days=15)
+    document = factories.DocumentFactory(deleted_at=now)
+    factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
+
+    response = client.post(f"/api/v1.0/documents/{document.id!s}/restore/")
+
+    assert response.status_code == 200
+    assert response.json() == {"detail": "Document has been successfully restored."}
+
+    document.refresh_from_db()
+    assert document.deleted_at is None
+    assert document.ancestors_deleted_at is None
+
+
+def test_api_documents_restore_authenticated_owner_ancestor_deleted():
+    """
+    The restored document should still be marked as deleted if one of its
+    ancestors is soft deleted as well.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory()
+    parent = factories.DocumentFactory(parent=grand_parent)
+    document = factories.DocumentFactory(parent=parent)
+    factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
+
+    document.soft_delete()
+    document_deleted_at = document.deleted_at
+    assert document_deleted_at is not None
+
+    grand_parent.soft_delete()
+    grand_parent_deleted_at = grand_parent.deleted_at
+    assert grand_parent_deleted_at is not None
+
+    response = client.post(f"/api/v1.0/documents/{document.id!s}/restore/")
+
+    assert response.status_code == 200
+    assert response.json() == {"detail": "Document has been successfully restored."}
+
+    document.refresh_from_db()
+    assert document.deleted_at is None
+    # document is still marked as deleted
+    assert document.ancestors_deleted_at == grand_parent_deleted_at
+    assert grand_parent_deleted_at > document_deleted_at
+
+
+def test_api_documents_restore_authenticated_owner_expired():
+    """It should not be possible to restore a document beyond the allowed time limit."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    now = timezone.now() - timedelta(days=40)
+    document = factories.DocumentFactory(deleted_at=now)
+    factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
+
+    response = client.post(f"/api/v1.0/documents/{document.id!s}/restore/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}

src/backend/core/tests/documents/test_api_documents_retrieve.py

@@ -2,16 +2,21 @@
 Tests for Documents API endpoint in impress's core app: retrieve
 """
 
+import random
+from datetime import timedelta
+from unittest import mock
+
+from django.utils import timezone
+
 import pytest
 from rest_framework.test import APIClient
 
 from core import factories, models
-from core.api import serializers
 
 pytestmark = pytest.mark.django_db
 
 
-def test_api_documents_retrieve_anonymous_public():
+def test_api_documents_retrieve_anonymous_public_standalone():
     """Anonymous users should be allowed to retrieve public documents."""
     document = factories.DocumentFactory(link_reach="public")
 
@@ -26,6 +31,8 @@ def test_api_documents_retrieve_anonymous_public():
             "ai_transform": document.link_role == "editor",
             "ai_translate": document.link_role == "editor",
             "attachment_upload": document.link_role == "editor",
+            "children_create": False,
+            "children_list": True,
             "collaboration_auth": True,
             "destroy": False,
             # Anonymous user can't favorite a document even with read access
@@ -33,7 +40,9 @@ def test_api_documents_retrieve_anonymous_public():
             "invite_owner": False,
             "link_configuration": False,
             "media_auth": True,
+            "move": False,
             "partial_update": document.link_role == "editor",
+            "restore": False,
             "retrieve": True,
             "update": document.link_role == "editor",
             "versions_destroy": False,
@@ -43,12 +52,90 @@ def test_api_documents_retrieve_anonymous_public():
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
         "is_favorite": False,
         "link_reach": "public",
         "link_role": document.link_role,
         "nb_accesses": 0,
+        "numchild": 0,
+        "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": [],
+    }
+
+
+def test_api_documents_retrieve_anonymous_public_parent():
+    """Anonymous users should be allowed to retrieve a document who has a public ancestor."""
+    grand_parent = factories.DocumentFactory(link_reach="public")
+    parent = factories.DocumentFactory(
+        parent=grand_parent, link_reach=random.choice(["authenticated", "restricted"])
+    )
+    document = factories.DocumentFactory(
+        link_reach=random.choice(["authenticated", "restricted"]), parent=parent
+    )
+
+    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": str(document.id),
+        "abilities": {
+            "accesses_manage": False,
+            "accesses_view": False,
+            "ai_transform": grand_parent.link_role == "editor",
+            "ai_translate": grand_parent.link_role == "editor",
+            "attachment_upload": grand_parent.link_role == "editor",
+            "children_create": False,
+            "children_list": True,
+            "collaboration_auth": True,
+            "destroy": False,
+            # Anonymous user can't favorite a document even with read access
+            "favorite": False,
+            "invite_owner": False,
+            "link_configuration": False,
+            "media_auth": True,
+            "move": False,
+            "partial_update": grand_parent.link_role == "editor",
+            "restore": False,
+            "retrieve": True,
+            "update": grand_parent.link_role == "editor",
+            "versions_destroy": False,
+            "versions_list": False,
+            "versions_retrieve": False,
+        },
+        "content": document.content,
+        "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
+        "creator": str(document.creator.id),
+        "depth": 3,
+        "excerpt": document.excerpt,
+        "is_favorite": False,
+        "link_reach": document.link_reach,
+        "link_role": document.link_role,
+        "nb_accesses": 0,
+        "numchild": 0,
+        "path": document.path,
+        "title": document.title,
+        "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": [],
+    }
+
+
+def test_api_documents_retrieve_anonymous_public_child():
+    """
+    Anonymous users having access to a document should not gain access to a parent document.
+    """
+    document = factories.DocumentFactory(
+        link_reach=random.choice(["authenticated", "restricted"])
+    )
+    factories.DocumentFactory(link_reach="public", parent=document)
+
+    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
     }
 
 
@@ -68,8 +155,8 @@ def test_api_documents_retrieve_anonymous_restricted_or_authenticated(reach):
 @pytest.mark.parametrize("reach", ["public", "authenticated"])
 def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(reach):
     """
-    Authenticated users should be able to retrieve a public document to which they are
-    not related.
+    Authenticated users should be able to retrieve a public/authenticated document to
+    which they are not related.
     """
     user = factories.UserFactory()
 
@@ -90,13 +177,17 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
             "ai_transform": document.link_role == "editor",
             "ai_translate": document.link_role == "editor",
             "attachment_upload": document.link_role == "editor",
+            "children_create": document.link_role == "editor",
+            "children_list": True,
             "collaboration_auth": True,
             "destroy": False,
             "favorite": True,
             "invite_owner": False,
-            "media_auth": True,
             "link_configuration": False,
+            "media_auth": True,
+            "move": False,
             "partial_update": document.link_role == "editor",
+            "restore": False,
             "retrieve": True,
             "update": document.link_role == "editor",
             "versions_destroy": False,
@@ -106,18 +197,104 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
         "is_favorite": False,
         "link_reach": reach,
         "link_role": document.link_role,
         "nb_accesses": 0,
+        "numchild": 0,
+        "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": [],
     }
     assert (
         models.LinkTrace.objects.filter(document=document, user=user).exists() is True
     )
 
 
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_retrieve_authenticated_public_or_authenticated_parent(reach):
+    """
+    Authenticated users should be allowed to retrieve a document who has a public or
+    authenticated ancestor.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory(link_reach=reach)
+    parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+    document = factories.DocumentFactory(link_reach="restricted", parent=parent)
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": str(document.id),
+        "abilities": {
+            "accesses_manage": False,
+            "accesses_view": False,
+            "ai_transform": grand_parent.link_role == "editor",
+            "ai_translate": grand_parent.link_role == "editor",
+            "attachment_upload": grand_parent.link_role == "editor",
+            "children_create": grand_parent.link_role == "editor",
+            "children_list": True,
+            "collaboration_auth": True,
+            "destroy": False,
+            "favorite": True,
+            "invite_owner": False,
+            "link_configuration": False,
+            "move": False,
+            "media_auth": True,
+            "partial_update": grand_parent.link_role == "editor",
+            "restore": False,
+            "retrieve": True,
+            "update": grand_parent.link_role == "editor",
+            "versions_destroy": False,
+            "versions_list": False,
+            "versions_retrieve": False,
+        },
+        "content": document.content,
+        "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
+        "creator": str(document.creator.id),
+        "depth": 3,
+        "excerpt": document.excerpt,
+        "is_favorite": False,
+        "link_reach": document.link_reach,
+        "link_role": document.link_role,
+        "nb_accesses": 0,
+        "numchild": 0,
+        "path": document.path,
+        "title": document.title,
+        "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": [],
+    }
+
+
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_retrieve_authenticated_public_or_authenticated_child(reach):
+    """
+    Authenticated users having access to a document should not gain access to a parent document.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach="restricted")
+    factories.DocumentFactory(link_reach=reach, parent=document)
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+
 @pytest.mark.parametrize("reach", ["public", "authenticated"])
 def test_api_documents_retrieve_authenticated_trace_twice(reach):
     """
@@ -179,10 +356,8 @@ def test_api_documents_retrieve_authenticated_related_direct():
     client.force_login(user)
 
     document = factories.DocumentFactory()
-    factories.UserDocumentAccessFactory(document=document, user=user)
-    access2 = factories.UserDocumentAccessFactory(document=document)
-    serializers.UserSerializer(instance=user)
-    serializers.UserSerializer(instance=access2.user)
+    access = factories.UserDocumentAccessFactory(document=document, user=user)
+    factories.UserDocumentAccessFactory(document=document)
 
     response = client.get(
         f"/api/v1.0/documents/{document.id!s}/",
@@ -194,12 +369,135 @@ def test_api_documents_retrieve_authenticated_related_direct():
         "content": document.content,
         "creator": str(document.creator.id),
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
+        "depth": 1,
+        "excerpt": document.excerpt,
         "is_favorite": False,
         "link_reach": document.link_reach,
         "link_role": document.link_role,
         "nb_accesses": 2,
+        "numchild": 0,
+        "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": [access.role],
+    }
+
+
+def test_api_documents_retrieve_authenticated_related_parent():
+    """
+    Authenticated users should be allowed to retrieve a document if they are related
+    to one of its ancestors whatever the role.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory(link_reach="restricted")
+    parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+    document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+
+    access = factories.UserDocumentAccessFactory(document=grand_parent, user=user)
+    factories.UserDocumentAccessFactory(document=grand_parent)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/",
+    )
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": str(document.id),
+        "abilities": {
+            "accesses_manage": access.role in ["administrator", "owner"],
+            "accesses_view": True,
+            "ai_transform": access.role != "reader",
+            "ai_translate": access.role != "reader",
+            "attachment_upload": access.role != "reader",
+            "children_create": access.role != "reader",
+            "children_list": True,
+            "collaboration_auth": True,
+            "destroy": access.role == "owner",
+            "favorite": True,
+            "invite_owner": access.role == "owner",
+            "link_configuration": access.role in ["administrator", "owner"],
+            "media_auth": True,
+            "move": access.role in ["administrator", "owner"],
+            "partial_update": access.role != "reader",
+            "restore": access.role == "owner",
+            "retrieve": True,
+            "update": access.role != "reader",
+            "versions_destroy": access.role in ["administrator", "owner"],
+            "versions_list": True,
+            "versions_retrieve": True,
+        },
+        "content": document.content,
+        "creator": str(document.creator.id),
+        "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
+        "depth": 3,
+        "excerpt": document.excerpt,
+        "is_favorite": False,
+        "link_reach": "restricted",
+        "link_role": document.link_role,
+        "nb_accesses": 2,
+        "numchild": 0,
+        "path": document.path,
+        "title": document.title,
+        "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": [access.role],
+    }
+
+
+def test_api_documents_retrieve_authenticated_related_nb_accesses():
+    """Validate computation of number of accesses."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory(link_reach="restricted")
+    parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+    document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+
+    factories.UserDocumentAccessFactory(document=grand_parent, user=user)
+    factories.UserDocumentAccessFactory(document=parent)
+    factories.UserDocumentAccessFactory(document=document)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/",
+    )
+    assert response.status_code == 200
+    assert response.json()["nb_accesses"] == 3
+
+    factories.UserDocumentAccessFactory(document=grand_parent)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/",
+    )
+    assert response.status_code == 200
+    assert response.json()["nb_accesses"] == 4
+
+
+def test_api_documents_retrieve_authenticated_related_child():
+    """
+    Authenticated users should not be allowed to retrieve a document as a result of being
+    related to one of its children.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach="restricted")
+    child = factories.DocumentFactory(parent=document)
+
+    factories.UserDocumentAccessFactory(document=child, user=user)
+    factories.UserDocumentAccessFactory(document=document)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/",
+    )
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
     }
 
 
@@ -238,16 +536,16 @@ def test_api_documents_retrieve_authenticated_related_team_none(mock_user_teams)
 
 
 @pytest.mark.parametrize(
-    "teams",
+    "teams,roles",
     [
-        ["readers"],
-        ["unknown", "readers"],
-        ["editors"],
-        ["unknown", "editors"],
+        [["readers"], ["reader"]],
+        [["unknown", "readers"], ["reader"]],
+        [["editors"], ["editor"]],
+        [["unknown", "editors"], ["editor"]],
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_members(
-    teams, mock_user_teams
+    teams, roles, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a document to which they
@@ -285,25 +583,30 @@ def test_api_documents_retrieve_authenticated_related_team_members(
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
         "is_favorite": False,
         "link_reach": "restricted",
         "link_role": document.link_role,
         "nb_accesses": 5,
+        "numchild": 0,
+        "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": roles,
     }
 
 
 @pytest.mark.parametrize(
-    "teams",
+    "teams,roles",
     [
-        ["administrators"],
-        ["editors", "administrators"],
-        ["unknown", "administrators"],
+        [["administrators"], ["administrator"]],
+        [["editors", "administrators"], ["administrator", "editor"]],
+        [["unknown", "administrators"], ["administrator"]],
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_administrators(
-    teams, mock_user_teams
+    teams, roles, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a document to which they
@@ -341,26 +644,31 @@ def test_api_documents_retrieve_authenticated_related_team_administrators(
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
         "is_favorite": False,
         "link_reach": "restricted",
         "link_role": document.link_role,
         "nb_accesses": 5,
+        "numchild": 0,
+        "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": roles,
     }
 
 
 @pytest.mark.parametrize(
-    "teams",
+    "teams,roles",
     [
-        ["owners"],
-        ["owners", "administrators"],
-        ["members", "administrators", "owners"],
-        ["unknown", "owners"],
+        [["owners"], ["owner"]],
+        [["owners", "administrators"], ["owner", "administrator"]],
+        [["members", "administrators", "owners"], ["owner", "administrator"]],
+        [["unknown", "owners"], ["owner"]],
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_owners(
-    teams, mock_user_teams
+    teams, roles, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a restricted document to which
@@ -369,7 +677,6 @@ def test_api_documents_retrieve_authenticated_related_team_owners(
     mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
-
     client = APIClient()
     client.force_login(user)
 
@@ -398,10 +705,231 @@ def test_api_documents_retrieve_authenticated_related_team_owners(
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
         "is_favorite": False,
         "link_reach": "restricted",
         "link_role": document.link_role,
         "nb_accesses": 5,
+        "numchild": 0,
+        "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": roles,
     }
+
+
+def test_api_documents_retrieve_user_roles(django_assert_num_queries):
+    """
+    Roles should be annotated on querysets taking into account all documents ancestors.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    grand_parent = factories.DocumentFactory(
+        users=factories.UserFactory.create_batch(2)
+    )
+    parent = factories.DocumentFactory(
+        parent=grand_parent, users=factories.UserFactory.create_batch(2)
+    )
+    document = factories.DocumentFactory(
+        parent=parent, users=factories.UserFactory.create_batch(2)
+    )
+
+    accesses = (
+        factories.UserDocumentAccessFactory(document=grand_parent, user=user),
+        factories.UserDocumentAccessFactory(document=parent, user=user),
+        factories.UserDocumentAccessFactory(document=document, user=user),
+    )
+    expected_roles = {access.role for access in accesses}
+
+    with django_assert_num_queries(10):
+        response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 200
+
+    user_roles = response.json()["user_roles"]
+    assert set(user_roles) == expected_roles
+
+
+def test_api_documents_retrieve_numqueries_with_link_trace(django_assert_num_queries):
+    """If the link traced already exists, the number of queries should be minimal."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(users=[user], link_traces=[user])
+
+    with django_assert_num_queries(4):
+        response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    with django_assert_num_queries(3):
+        response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 200
+
+    assert response.json()["id"] == str(document.id)
+
+
+# Soft/permanent delete
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_retrieve_soft_deleted_anonymous(reach, depth):
+    """
+    A soft/permanently deleted public document should not be accessible via its
+    detail endpoint for anonymous users, and should return a 404.
+    """
+    documents = []
+    for i in range(depth):
+        documents.append(
+            factories.DocumentFactory(link_reach=reach)
+            if i == 0
+            else factories.DocumentFactory(parent=documents[-1])
+        )
+    assert models.Document.objects.count() == depth
+
+    response = APIClient().get(f"/api/v1.0/documents/{documents[-1].id!s}/")
+
+    assert response.status_code == 200 if reach == "public" else 401
+
+    # Delete any one of the documents...
+    deleted_document = random.choice(documents)
+    deleted_document.soft_delete()
+
+    response = APIClient().get(f"/api/v1.0/documents/{documents[-1].id!s}/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}
+
+    fourty_days_ago = timezone.now() - timedelta(days=40)
+    deleted_document.deleted_at = fourty_days_ago
+    deleted_document.ancestors_deleted_at = fourty_days_ago
+    deleted_document.save()
+
+    response = APIClient().get(f"/api/v1.0/documents/{documents[-1].id!s}/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_retrieve_soft_deleted_authenticated(reach, depth):
+    """
+    A soft/permanently deleted document should not be accessible via its detail endpoint for
+    authenticated users not related to the document.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    documents = []
+    for i in range(depth):
+        documents.append(
+            factories.DocumentFactory(link_reach=reach)
+            if i == 0
+            else factories.DocumentFactory(parent=documents[-1])
+        )
+    assert models.Document.objects.count() == depth
+
+    response = client.get(f"/api/v1.0/documents/{documents[-1].id!s}/")
+
+    assert response.status_code == 200 if reach in ["public", "authenticated"] else 403
+
+    # Delete any one of the documents...
+    deleted_document = random.choice(documents)
+    deleted_document.soft_delete()
+
+    response = client.get(f"/api/v1.0/documents/{documents[-1].id!s}/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}
+
+    fourty_days_ago = timezone.now() - timedelta(days=40)
+    deleted_document.deleted_at = fourty_days_ago
+    deleted_document.ancestors_deleted_at = fourty_days_ago
+    deleted_document.save()
+
+    response = client.get(f"/api/v1.0/documents/{documents[-1].id!s}/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize("role", models.RoleChoices.values)
+def test_api_documents_retrieve_soft_deleted_related(role, depth):
+    """
+    A soft deleted document should only be accessible via its detail endpoint by
+    users with specific "owner" access rights.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    documents = []
+    for i in range(depth):
+        documents.append(
+            factories.UserDocumentAccessFactory(role=role, user=user).document
+            if i == 0
+            else factories.DocumentFactory(parent=documents[-1])
+        )
+    assert models.Document.objects.count() == depth
+    document = documents[-1]
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 200
+
+    # Delete any one of the documents
+    deleted_document = random.choice(documents)
+    deleted_document.soft_delete()
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    if role == "owner":
+        assert response.status_code == 200
+        assert response.json()["id"] == str(document.id)
+    else:
+        assert response.status_code == 404
+        assert response.json() == {"detail": "Not found."}
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize("role", models.RoleChoices.values)
+def test_api_documents_retrieve_permanently_deleted_related(role, depth):
+    """
+    A permanently deleted document should not be accessible via its detail endpoint for
+    authenticated users with specific access rights whatever their role.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    documents = []
+    for i in range(depth):
+        documents.append(
+            factories.UserDocumentAccessFactory(role=role, user=user).document
+            if i == 0
+            else factories.DocumentFactory(parent=documents[-1])
+        )
+    assert models.Document.objects.count() == depth
+    document = documents[-1]
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 200
+
+    # Delete any one of the documents
+    deleted_document = random.choice(documents)
+    fourty_days_ago = timezone.now() - timedelta(days=40)
+    with mock.patch("django.utils.timezone.now", return_value=fourty_days_ago):
+        deleted_document.soft_delete()
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}

src/backend/core/tests/documents/test_api_documents_trashbin.py

@@ -0,0 +1,276 @@
+"""
+Tests for Documents API endpoint in impress's core app: list
+"""
+
+from datetime import timedelta
+from unittest import mock
+
+from django.utils import timezone
+
+import pytest
+from faker import Faker
+from rest_framework.pagination import PageNumberPagination
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+fake = Faker()
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_trashbin_anonymous(reach, role):
+    """
+    Anonymous users should not be allowed to list documents from the trashbin
+    whatever the link reach and link role
+    """
+    factories.DocumentFactory(
+        link_reach=reach, link_role=role, deleted_at=timezone.now()
+    )
+
+    response = APIClient().get("/api/v1.0/documents/trashbin/")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 0,
+        "next": None,
+        "previous": None,
+        "results": [],
+    }
+
+
+def test_api_documents_trashbin_format():
+    """Validate the format of documents as returned by the trashbin view."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    other_users = factories.UserFactory.create_batch(3)
+    document = factories.DocumentFactory(
+        deleted_at=timezone.now(),
+        users=factories.UserFactory.create_batch(2),
+        favorited_by=[user, *other_users],
+        link_traces=other_users,
+    )
+    factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
+
+    response = client.get("/api/v1.0/documents/trashbin/")
+
+    assert response.status_code == 200
+
+    content = response.json()
+    results = content.pop("results")
+    assert content == {
+        "count": 1,
+        "next": None,
+        "previous": None,
+    }
+    assert len(results) == 1
+    assert results[0] == {
+        "id": str(document.id),
+        "abilities": {
+            "accesses_manage": True,
+            "accesses_view": True,
+            "ai_transform": True,
+            "ai_translate": True,
+            "attachment_upload": True,
+            "children_create": True,
+            "children_list": True,
+            "collaboration_auth": True,
+            "destroy": True,
+            "favorite": True,
+            "invite_owner": True,
+            "link_configuration": True,
+            "media_auth": True,
+            "move": False,  # Can't move a deleted document
+            "partial_update": True,
+            "restore": True,
+            "retrieve": True,
+            "update": True,
+            "versions_destroy": True,
+            "versions_list": True,
+            "versions_retrieve": True,
+        },
+        "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
+        "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
+        "link_reach": document.link_reach,
+        "link_role": document.link_role,
+        "nb_accesses": 3,
+        "numchild": 0,
+        "path": document.path,
+        "title": document.title,
+        "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "user_roles": ["owner"],
+    }
+
+
+def test_api_documents_trashbin_authenticated_direct(django_assert_num_queries):
+    """
+    The trashbin should only list deleted documents for which the current user is owner.
+    """
+    now = timezone.now()
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document1, document2 = factories.DocumentFactory.create_batch(2, deleted_at=now)
+    models.DocumentAccess.objects.create(document=document1, user=user, role="owner")
+    models.DocumentAccess.objects.create(document=document2, user=user, role="owner")
+
+    # Unrelated documents
+    for reach in models.LinkReachChoices:
+        for role in models.LinkRoleChoices:
+            factories.DocumentFactory(link_reach=reach, link_role=role, deleted_at=now)
+
+    # Role other than "owner"
+    for role in models.RoleChoices.values:
+        if role == "owner":
+            continue
+        document_not_owner = factories.DocumentFactory(deleted_at=now)
+        models.DocumentAccess.objects.create(
+            document=document_not_owner, user=user, role=role
+        )
+
+    # Nested documents should also get listed
+    parent = factories.DocumentFactory(parent=document1)
+    document3 = factories.DocumentFactory(parent=parent, deleted_at=now)
+    models.DocumentAccess.objects.create(document=parent, user=user, role="owner")
+
+    # Permanently deleted documents should not be listed
+    fourty_days_ago = timezone.now() - timedelta(days=40)
+    permanently_deleted_document = factories.DocumentFactory(users=[(user, "owner")])
+    with mock.patch("django.utils.timezone.now", return_value=fourty_days_ago):
+        permanently_deleted_document.soft_delete()
+
+    expected_ids = {str(document1.id), str(document2.id), str(document3.id)}
+
+    with django_assert_num_queries(7):
+        response = client.get("/api/v1.0/documents/trashbin/")
+
+    with django_assert_num_queries(4):
+        response = client.get("/api/v1.0/documents/trashbin/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    results_ids = {result["id"] for result in results}
+    assert len(results) == 3
+    assert expected_ids == results_ids
+
+
+def test_api_documents_trashbin_authenticated_via_team(
+    django_assert_num_queries, mock_user_teams
+):
+    """
+    Authenticated users should be able to list trashbin documents they own via a team.
+    """
+    now = timezone.now()
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    mock_user_teams.return_value = ["team1", "team2", "unknown"]
+
+    deleted_document_team1 = factories.DocumentFactory(
+        teams=[("team1", "owner")], deleted_at=now
+    )
+    factories.DocumentFactory(teams=[("team1", "owner")])
+    factories.DocumentFactory(teams=[("team1", "administrator")], deleted_at=now)
+    factories.DocumentFactory(teams=[("team1", "administrator")])
+    deleted_document_team2 = factories.DocumentFactory(
+        teams=[("team2", "owner")], deleted_at=now
+    )
+    factories.DocumentFactory(teams=[("team2", "owner")])
+    factories.DocumentFactory(teams=[("team2", "administrator")], deleted_at=now)
+    factories.DocumentFactory(teams=[("team2", "administrator")])
+
+    expected_ids = {str(deleted_document_team1.id), str(deleted_document_team2.id)}
+
+    with django_assert_num_queries(5):
+        response = client.get("/api/v1.0/documents/trashbin/")
+
+    with django_assert_num_queries(3):
+        response = client.get("/api/v1.0/documents/trashbin/")
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 2
+    results_id = {result["id"] for result in results}
+    assert expected_ids == results_id
+
+
+@mock.patch.object(PageNumberPagination, "get_page_size", return_value=2)
+def test_api_documents_trashbin_pagination(
+    _mock_page_size,
+):
+    """Pagination should work as expected."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document_ids = [
+        str(document.id)
+        for document in factories.DocumentFactory.create_batch(
+            3, deleted_at=timezone.now()
+        )
+    ]
+    for document_id in document_ids:
+        models.DocumentAccess.objects.create(
+            document_id=document_id, user=user, role="owner"
+        )
+
+    # Get page 1
+    response = client.get("/api/v1.0/documents/trashbin/")
+
+    assert response.status_code == 200
+    content = response.json()
+
+    assert content["count"] == 3
+    assert content["next"] == "http://testserver/api/v1.0/documents/trashbin/?page=2"
+    assert content["previous"] is None
+
+    assert len(content["results"]) == 2
+    for item in content["results"]:
+        document_ids.remove(item["id"])
+
+    # Get page 2
+    response = client.get(
+        "/api/v1.0/documents/trashbin/?page=2",
+    )
+
+    assert response.status_code == 200
+    content = response.json()
+
+    assert content["count"] == 3
+    assert content["next"] is None
+    assert content["previous"] == "http://testserver/api/v1.0/documents/trashbin/"
+
+    assert len(content["results"]) == 1
+    document_ids.remove(content["results"][0]["id"])
+    assert document_ids == []
+
+
+def test_api_documents_trashbin_distinct():
+    """A document with several related users should only be listed once."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+    document = factories.DocumentFactory(
+        users=[(user, "owner"), other_user], deleted_at=timezone.now()
+    )
+
+    response = client.get(
+        "/api/v1.0/documents/trashbin/",
+    )
+
+    assert response.status_code == 200
+    content = response.json()
+    assert len(content["results"]) == 1
+    assert content["results"][0]["id"] == str(document.id)

src/backend/core/tests/documents/test_api_documents_update.py

@@ -16,6 +16,7 @@ from core.tests.conftest import TEAM, USER, VIA
 pytestmark = pytest.mark.django_db
 
 
+@pytest.mark.parametrize("via_parent", [True, False])
 @pytest.mark.parametrize(
     "reach, role",
     [
@@ -26,12 +27,18 @@ pytestmark = pytest.mark.django_db
         ("public", "reader"),
     ],
 )
-def test_api_documents_update_anonymous_forbidden(reach, role):
+def test_api_documents_update_anonymous_forbidden(reach, role, via_parent):
     """
     Anonymous users should not be allowed to update a document when link
     configuration does not allow it.
     """
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    if via_parent:
+        grand_parent = factories.DocumentFactory(link_reach=reach, link_role=role)
+        parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+        document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+    else:
+        document = factories.DocumentFactory(link_reach=reach, link_role=role)
+
     old_document_values = serializers.DocumentSerializer(instance=document).data
 
     new_document_values = serializers.DocumentSerializer(
@@ -52,6 +59,7 @@ def test_api_documents_update_anonymous_forbidden(reach, role):
     assert document_values == old_document_values
 
 
+@pytest.mark.parametrize("via_parent", [True, False])
 @pytest.mark.parametrize(
     "reach,role",
     [
@@ -61,7 +69,9 @@ def test_api_documents_update_anonymous_forbidden(reach, role):
         ("restricted", "editor"),
     ],
 )
-def test_api_documents_update_authenticated_unrelated_forbidden(reach, role):
+def test_api_documents_update_authenticated_unrelated_forbidden(
+    reach, role, via_parent
+):
     """
     Authenticated users should not be allowed to update a document to which
     they are not related if the link configuration does not allow it.
@@ -71,7 +81,12 @@ def test_api_documents_update_authenticated_unrelated_forbidden(reach, role):
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    if via_parent:
+        grand_parent = factories.DocumentFactory(link_reach=reach, link_role=role)
+        parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+        document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+    else:
+        document = factories.DocumentFactory(link_reach=reach, link_role=role)
 
     old_document_values = serializers.DocumentSerializer(instance=document).data
     new_document_values = serializers.DocumentSerializer(
@@ -93,6 +108,7 @@ def test_api_documents_update_authenticated_unrelated_forbidden(reach, role):
     assert document_values == old_document_values
 
 
+@pytest.mark.parametrize("via_parent", [True, False])
 @pytest.mark.parametrize(
     "is_authenticated,reach,role",
     [
@@ -102,10 +118,10 @@ def test_api_documents_update_authenticated_unrelated_forbidden(reach, role):
     ],
 )
 def test_api_documents_update_anonymous_or_authenticated_unrelated(
-    is_authenticated, reach, role
+    is_authenticated, reach, role, via_parent
 ):
     """
-    Authenticated users should be able to update a document to which
+    Anonymous and authenticated users should be able to update a document to which
     they are not related if the link configuration allows it.
     """
     client = APIClient()
@@ -116,7 +132,12 @@ def test_api_documents_update_anonymous_or_authenticated_unrelated(
     else:
         user = AnonymousUser()
 
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    if via_parent:
+        grand_parent = factories.DocumentFactory(link_reach=reach, link_role=role)
+        parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+        document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+    else:
+        document = factories.DocumentFactory(link_reach=reach, link_role=role)
 
     old_document_values = serializers.DocumentSerializer(instance=document).data
     new_document_values = serializers.DocumentSerializer(
@@ -137,8 +158,11 @@ def test_api_documents_update_anonymous_or_authenticated_unrelated(
             "accesses",
             "created_at",
             "creator",
+            "depth",
             "link_reach",
             "link_role",
+            "numchild",
+            "path",
         ]:
             assert value == old_document_values[key]
         elif key == "updated_at":
@@ -147,24 +171,34 @@ def test_api_documents_update_anonymous_or_authenticated_unrelated(
             assert value == new_document_values[key]
 
 
+@pytest.mark.parametrize("via_parent", [True, False])
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_update_authenticated_reader(via, mock_user_teams):
+def test_api_documents_update_authenticated_reader(via, via_parent, mock_user_teams):
     """
-    Users who are reader of a document but not administrators should
-    not be allowed to update it.
+    Users who are reader of a document should not be allowed to update it.
     """
     user = factories.UserFactory(with_owned_document=True)
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(link_role="reader")
+    if via_parent:
+        grand_parent = factories.DocumentFactory(link_reach="restricted")
+        parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+        document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+        access_document = grand_parent
+    else:
+        document = factories.DocumentFactory(link_reach="restricted")
+        access_document = document
+
     if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
+        factories.UserDocumentAccessFactory(
+            document=access_document, user=user, role="reader"
+        )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role="reader"
+            document=access_document, team="lasuite", role="reader"
         )
 
     old_document_values = serializers.DocumentSerializer(instance=document).data
@@ -188,10 +222,11 @@ def test_api_documents_update_authenticated_reader(via, mock_user_teams):
     assert document_values == old_document_values
 
 
+@pytest.mark.parametrize("via_parent", [True, False])
 @pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_documents_update_authenticated_editor_administrator_or_owner(
-    via, role, mock_user_teams
+    via, role, via_parent, mock_user_teams
 ):
     """A user who is editor, administrator or owner of a document should be allowed to update it."""
     user = factories.UserFactory(with_owned_document=True)
@@ -199,13 +234,23 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory()
+    if via_parent:
+        grand_parent = factories.DocumentFactory(link_reach="restricted")
+        parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
+        document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+        access_document = grand_parent
+    else:
+        document = factories.DocumentFactory(link_reach="restricted")
+        access_document = document
+
     if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
+        factories.UserDocumentAccessFactory(
+            document=access_document, user=user, role=role
+        )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role=role
+            document=access_document, team="lasuite", role=role
         )
 
     old_document_values = serializers.DocumentSerializer(instance=document).data
@@ -227,55 +272,12 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
             "id",
             "created_at",
             "creator",
+            "depth",
             "link_reach",
             "link_role",
             "nb_accesses",
-        ]:
-            assert value == old_document_values[key]
-        elif key == "updated_at":
-            assert value > old_document_values[key]
-        else:
-            assert value == new_document_values[key]
-
-
-@pytest.mark.parametrize("via", VIA)
-def test_api_documents_update_authenticated_owners(via, mock_user_teams):
-    """Administrators of a document should be allowed to update it."""
-    user = factories.UserFactory(with_owned_document=True)
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory()
-    if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role="owner"
-        )
-
-    old_document_values = serializers.DocumentSerializer(instance=document).data
-
-    new_document_values = serializers.DocumentSerializer(
-        instance=factories.DocumentFactory()
-    ).data
-
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/", new_document_values, format="json"
-    )
-
-    assert response.status_code == 200
-    document = models.Document.objects.get(pk=document.pk)
-    document_values = serializers.DocumentSerializer(instance=document).data
-    for key, value in document_values.items():
-        if key in [
-            "id",
-            "created_at",
-            "creator",
-            "link_reach",
-            "link_role",
-            "nb_accesses",
+            "numchild",
+            "path",
         ]:
             assert value == old_document_values[key]
         elif key == "updated_at":

src/backend/core/tests/templates/test_api_template_accesses.py

@@ -73,14 +73,14 @@ def test_api_template_accesses_list_authenticated_related(via, mock_user_teams):
         user_access = models.TemplateAccess.objects.create(
             template=template,
             user=user,
-            role=random.choice(models.RoleChoices.choices)[0],
+            role=random.choice(models.RoleChoices.values),
         )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         user_access = models.TemplateAccess.objects.create(
             template=template,
             team="lasuite",
-            role=random.choice(models.RoleChoices.choices)[0],
+            role=random.choice(models.RoleChoices.values),
         )
 
     access1 = factories.TeamTemplateAccessFactory(template=template)
@@ -219,7 +219,7 @@ def test_api_template_accesses_update_anonymous():
     new_values = {
         "id": uuid4(),
         "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     api_client = APIClient()
@@ -252,7 +252,7 @@ def test_api_template_accesses_update_authenticated_unrelated():
     new_values = {
         "id": uuid4(),
         "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     for field, value in new_values.items():
@@ -294,7 +294,7 @@ def test_api_template_accesses_update_authenticated_editor_or_reader(
     new_values = {
         "id": uuid4(),
         "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     for field, value in new_values.items():
@@ -398,7 +398,7 @@ def test_api_template_accesses_update_administrator_from_owner(via, mock_user_te
     new_values = {
         "id": uuid4(),
         "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     for field, value in new_values.items():
@@ -497,7 +497,7 @@ def test_api_template_accesses_update_owner(via, mock_user_teams):
     new_values = {
         "id": uuid4(),
         "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
+        "role": random.choice(models.RoleChoices.values),
     }
 
     for field, value in new_values.items():

src/backend/core/tests/templates/test_api_template_accesses_create.py

@@ -23,7 +23,7 @@ def test_api_template_accesses_create_anonymous():
         {
             "user": str(other_user.id),
             "template": str(template.id),
-            "role": random.choice(models.RoleChoices.choices)[0],
+            "role": random.choice(models.RoleChoices.values),
         },
         format="json",
     )

src/backend/core/tests/test_api_utils_filter_root_paths.py

@@ -0,0 +1,94 @@
+"""
+Unit tests for the filter_root_paths utility function.
+"""
+
+from core.api.utils import filter_root_paths
+
+
+def test_api_utils_filter_root_paths_success():
+    """
+    The `filter_root_paths` function should correctly identify root paths
+    from a given list of paths.
+
+    This test uses a list of paths with missing intermediate paths to ensure that
+    only the minimal set of root paths is returned.
+    """
+    paths = [
+        "0001",
+        "00010001",
+        "000100010001",
+        "000100010002",
+        # missing 00010002
+        "000100020001",
+        "000100020002",
+        "0002",
+        "00020001",
+        "00020002",
+        # missing 0003
+        "00030001",
+        "000300010001",
+        "00030002",
+        # missing 0004
+        # missing 00040001
+        # missing 000400010001
+        # missing 000400010002
+        "000400010003",
+        "0004000100030001",
+        "000400010004",
+    ]
+    filtered_paths = filter_root_paths(paths, skip_sorting=True)
+    assert filtered_paths == [
+        "0001",
+        "0002",
+        "00030001",
+        "00030002",
+        "000400010003",
+        "000400010004",
+    ]
+
+
+def test_api_utils_filter_root_paths_sorting():
+    """
+    The `filter_root_paths` function should fail is sorting is skipped and paths are not sorted.
+
+    This test verifies that when sorting is skipped, the function respects the input order, and
+    when sorting is enabled, the result is correctly ordered and minimal.
+    """
+    paths = [
+        "0001",
+        "00010001",
+        "000100010001",
+        "000100020002",
+        "000100010002",
+        "000100020001",
+        "00020001",
+        "0002",
+        "00020002",
+        "000300010001",
+        "00030001",
+        "00030002",
+        "0004000100030001",
+        "000400010003",
+        "000400010004",
+    ]
+    filtered_paths = filter_root_paths(paths, skip_sorting=True)
+    assert filtered_paths == [
+        "0001",
+        "00020001",
+        "0002",
+        "000300010001",
+        "00030001",
+        "00030002",
+        "0004000100030001",
+        "000400010003",
+        "000400010004",
+    ]
+    filtered_paths = filter_root_paths(paths)
+    assert filtered_paths == [
+        "0001",
+        "0002",
+        "00030001",
+        "00030002",
+        "000400010003",
+        "000400010004",
+    ]

src/backend/core/tests/test_models_documents.py

@@ -2,12 +2,14 @@
 Unit tests for the Document model
 """
 
+import random
 import smtplib
 from logging import Logger
 from unittest import mock
 
 from django.contrib.auth.models import AnonymousUser
 from django.core import mail
+from django.core.cache import cache
 from django.core.exceptions import ValidationError
 from django.core.files.storage import default_storage
 from django.utils import timezone
@@ -34,20 +36,18 @@ def test_models_documents_id_unique():
 
 def test_models_documents_creator_required():
     """No field should be required on the Document model."""
-    models.Document.objects.create()
+    models.Document.add_root()
 
 
 def test_models_documents_title_null():
     """The "title" field can be null."""
-    document = models.Document.objects.create(
-        title=None, creator=factories.UserFactory()
-    )
+    document = models.Document.add_root(title=None, creator=factories.UserFactory())
     assert document.title is None
 
 
 def test_models_documents_title_empty():
     """The "title" field can be empty."""
-    document = models.Document.objects.create(title="", creator=factories.UserFactory())
+    document = models.Document.add_root(title="", creator=factories.UserFactory())
     assert document.title == ""
 
 
@@ -67,6 +67,60 @@ def test_models_documents_file_key():
     assert document.file_key == "9531a5f1-42b1-496c-b3f4-1c09ed139b3c/file"
 
 
+def test_models_documents_tree_alphabet():
+    """Test the creation of documents with treebeard methods."""
+    models.Document.load_bulk(
+        [
+            {
+                "data": {
+                    "title": f"document-{i}",
+                }
+            }
+            for i in range(len(models.Document.alphabet) * 2)
+        ]
+    )
+
+    assert models.Document.objects.count() == 124
+
+
+@pytest.mark.parametrize("depth", range(5))
+def test_models_documents_soft_delete(depth):
+    """Trying to delete a document that is already deleted or is a descendant of
+    a deleted document should raise an error.
+    """
+    documents = []
+    for i in range(depth + 1):
+        documents.append(
+            factories.DocumentFactory()
+            if i == 0
+            else factories.DocumentFactory(parent=documents[-1])
+        )
+    assert models.Document.objects.count() == depth + 1
+
+    # Delete any one of the documents...
+    deleted_document = random.choice(documents)
+    deleted_document.soft_delete()
+
+    with pytest.raises(RuntimeError):
+        documents[-1].soft_delete()
+
+    assert deleted_document.deleted_at is not None
+    assert deleted_document.ancestors_deleted_at == deleted_document.deleted_at
+
+    descendants = deleted_document.get_descendants()
+    for child in descendants:
+        assert child.deleted_at is None
+        assert child.ancestors_deleted_at is not None
+        assert child.ancestors_deleted_at == deleted_document.deleted_at
+
+    ancestors = deleted_document.get_ancestors()
+    for parent in ancestors:
+        assert parent.deleted_at is None
+        assert parent.ancestors_deleted_at is None
+
+    assert len(ancestors) + len(descendants) == depth
+
+
 # get_abilities
 
 
@@ -81,33 +135,44 @@ def test_models_documents_file_key():
         (False, "authenticated", "editor"),
     ],
 )
-def test_models_documents_get_abilities_forbidden(is_authenticated, reach, role):
+def test_models_documents_get_abilities_forbidden(
+    is_authenticated, reach, role, django_assert_num_queries
+):
     """
     Check abilities returned for a document giving insufficient roles to link holders
     i.e anonymous users or authenticated users who have no specific role on the document.
     """
     document = factories.DocumentFactory(link_reach=reach, link_role=role)
     user = factories.UserFactory() if is_authenticated else AnonymousUser()
-    abilities = document.get_abilities(user)
-    assert abilities == {
+    expected_abilities = {
         "accesses_manage": False,
         "accesses_view": False,
         "ai_transform": False,
         "ai_translate": False,
         "attachment_upload": False,
+        "children_create": False,
+        "children_list": False,
         "collaboration_auth": False,
         "destroy": False,
         "favorite": False,
         "invite_owner": False,
         "media_auth": False,
+        "move": False,
         "link_configuration": False,
         "partial_update": False,
+        "restore": False,
         "retrieve": False,
         "update": False,
         "versions_destroy": False,
         "versions_list": False,
         "versions_retrieve": False,
     }
+    nb_queries = 1 if is_authenticated else 0
+    with django_assert_num_queries(nb_queries):
+        assert document.get_abilities(user) == expected_abilities
+    document.soft_delete()
+    document.refresh_from_db()
+    assert document.get_abilities(user) == expected_abilities
 
 
 @pytest.mark.parametrize(
@@ -118,33 +183,44 @@ def test_models_documents_get_abilities_forbidden(is_authenticated, reach, role)
         (True, "authenticated"),
     ],
 )
-def test_models_documents_get_abilities_reader(is_authenticated, reach):
+def test_models_documents_get_abilities_reader(
+    is_authenticated, reach, django_assert_num_queries
+):
     """
     Check abilities returned for a document giving reader role to link holders
     i.e anonymous users or authenticated users who have no specific role on the document.
     """
     document = factories.DocumentFactory(link_reach=reach, link_role="reader")
     user = factories.UserFactory() if is_authenticated else AnonymousUser()
-    abilities = document.get_abilities(user)
-    assert abilities == {
+    expected_abilities = {
         "accesses_manage": False,
         "accesses_view": False,
         "ai_transform": False,
         "ai_translate": False,
         "attachment_upload": False,
+        "children_create": False,
+        "children_list": True,
         "collaboration_auth": True,
         "destroy": False,
         "favorite": is_authenticated,
         "invite_owner": False,
         "link_configuration": False,
         "media_auth": True,
+        "move": False,
         "partial_update": False,
+        "restore": False,
         "retrieve": True,
         "update": False,
         "versions_destroy": False,
         "versions_list": False,
         "versions_retrieve": False,
     }
+    nb_queries = 1 if is_authenticated else 0
+    with django_assert_num_queries(nb_queries):
+        assert document.get_abilities(user) == expected_abilities
+    document.soft_delete()
+    document.refresh_from_db()
+    assert all(value is False for value in document.get_abilities(user).values())
 
 
 @pytest.mark.parametrize(
@@ -155,142 +231,184 @@ def test_models_documents_get_abilities_reader(is_authenticated, reach):
         (True, "authenticated"),
     ],
 )
-def test_models_documents_get_abilities_editor(is_authenticated, reach):
+def test_models_documents_get_abilities_editor(
+    is_authenticated, reach, django_assert_num_queries
+):
     """
     Check abilities returned for a document giving editor role to link holders
     i.e anonymous users or authenticated users who have no specific role on the document.
     """
     document = factories.DocumentFactory(link_reach=reach, link_role="editor")
     user = factories.UserFactory() if is_authenticated else AnonymousUser()
-    abilities = document.get_abilities(user)
-    assert abilities == {
+    expected_abilities = {
         "accesses_manage": False,
         "accesses_view": False,
         "ai_transform": True,
         "ai_translate": True,
         "attachment_upload": True,
+        "children_create": is_authenticated,
+        "children_list": True,
         "collaboration_auth": True,
         "destroy": False,
         "favorite": is_authenticated,
         "invite_owner": False,
         "link_configuration": False,
         "media_auth": True,
+        "move": False,
         "partial_update": True,
+        "restore": False,
         "retrieve": True,
         "update": True,
         "versions_destroy": False,
         "versions_list": False,
         "versions_retrieve": False,
     }
+    nb_queries = 1 if is_authenticated else 0
+    with django_assert_num_queries(nb_queries):
+        assert document.get_abilities(user) == expected_abilities
+    document.soft_delete()
+    document.refresh_from_db()
+    assert all(value is False for value in document.get_abilities(user).values())
 
 
-def test_models_documents_get_abilities_owner():
+def test_models_documents_get_abilities_owner(django_assert_num_queries):
     """Check abilities returned for the owner of a document."""
     user = factories.UserFactory()
-    access = factories.UserDocumentAccessFactory(role="owner", user=user)
-    abilities = access.document.get_abilities(access.user)
-    assert abilities == {
+    document = factories.DocumentFactory(users=[(user, "owner")])
+    expected_abilities = {
         "accesses_manage": True,
         "accesses_view": True,
         "ai_transform": True,
         "ai_translate": True,
         "attachment_upload": True,
+        "children_create": True,
+        "children_list": True,
         "collaboration_auth": True,
         "destroy": True,
         "favorite": True,
         "invite_owner": True,
         "link_configuration": True,
         "media_auth": True,
+        "move": True,
         "partial_update": True,
+        "restore": True,
         "retrieve": True,
         "update": True,
         "versions_destroy": True,
         "versions_list": True,
         "versions_retrieve": True,
     }
+    with django_assert_num_queries(1):
+        assert document.get_abilities(user) == expected_abilities
+    document.soft_delete()
+    document.refresh_from_db()
+    expected_abilities["move"] = False
+    assert document.get_abilities(user) == expected_abilities
 
 
-def test_models_documents_get_abilities_administrator():
+def test_models_documents_get_abilities_administrator(django_assert_num_queries):
     """Check abilities returned for the administrator of a document."""
-    access = factories.UserDocumentAccessFactory(role="administrator")
-    abilities = access.document.get_abilities(access.user)
-    assert abilities == {
+    user = factories.UserFactory()
+    document = factories.DocumentFactory(users=[(user, "administrator")])
+    expected_abilities = {
         "accesses_manage": True,
         "accesses_view": True,
         "ai_transform": True,
         "ai_translate": True,
         "attachment_upload": True,
+        "children_create": True,
+        "children_list": True,
         "collaboration_auth": True,
         "destroy": False,
         "favorite": True,
         "invite_owner": False,
         "link_configuration": True,
         "media_auth": True,
+        "move": True,
         "partial_update": True,
+        "restore": False,
         "retrieve": True,
         "update": True,
         "versions_destroy": True,
         "versions_list": True,
         "versions_retrieve": True,
     }
+    with django_assert_num_queries(1):
+        assert document.get_abilities(user) == expected_abilities
+    document.soft_delete()
+    document.refresh_from_db()
+    assert all(value is False for value in document.get_abilities(user).values())
 
 
 def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
     """Check abilities returned for the editor of a document."""
-    access = factories.UserDocumentAccessFactory(role="editor")
-
-    with django_assert_num_queries(1):
-        abilities = access.document.get_abilities(access.user)
-
-    assert abilities == {
+    user = factories.UserFactory()
+    document = factories.DocumentFactory(users=[(user, "editor")])
+    expected_abilities = {
         "accesses_manage": False,
         "accesses_view": True,
         "ai_transform": True,
         "ai_translate": True,
         "attachment_upload": True,
+        "children_create": True,
+        "children_list": True,
         "collaboration_auth": True,
         "destroy": False,
         "favorite": True,
         "invite_owner": False,
         "link_configuration": False,
         "media_auth": True,
+        "move": False,
         "partial_update": True,
+        "restore": False,
         "retrieve": True,
         "update": True,
         "versions_destroy": False,
         "versions_list": True,
         "versions_retrieve": True,
     }
+    with django_assert_num_queries(1):
+        assert document.get_abilities(user) == expected_abilities
+    document.soft_delete()
+    document.refresh_from_db()
+    assert all(value is False for value in document.get_abilities(user).values())
 
 
 def test_models_documents_get_abilities_reader_user(django_assert_num_queries):
     """Check abilities returned for the reader of a document."""
-    access = factories.UserDocumentAccessFactory(
-        role="reader", document__link_role="reader"
+    user = factories.UserFactory()
+    document = factories.DocumentFactory(users=[(user, "reader")])
+    access_from_link = (
+        document.link_reach != "restricted" and document.link_role == "editor"
     )
-
-    with django_assert_num_queries(1):
-        abilities = access.document.get_abilities(access.user)
-
-    assert abilities == {
+    expected_abilities = {
         "accesses_manage": False,
         "accesses_view": True,
-        "ai_transform": False,
-        "ai_translate": False,
-        "attachment_upload": False,
+        "ai_transform": access_from_link,
+        "ai_translate": access_from_link,
+        "attachment_upload": access_from_link,
+        "children_create": access_from_link,
+        "children_list": True,
         "collaboration_auth": True,
         "destroy": False,
         "favorite": True,
         "invite_owner": False,
         "link_configuration": False,
         "media_auth": True,
-        "partial_update": False,
+        "move": False,
+        "partial_update": access_from_link,
+        "restore": False,
         "retrieve": True,
-        "update": False,
+        "update": access_from_link,
         "versions_destroy": False,
         "versions_list": True,
         "versions_retrieve": True,
     }
+    with django_assert_num_queries(1):
+        assert document.get_abilities(user) == expected_abilities
+    document.soft_delete()
+    document.refresh_from_db()
+    assert all(value is False for value in document.get_abilities(user).values())
 
 
 def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
@@ -309,13 +427,17 @@ def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
         "ai_transform": False,
         "ai_translate": False,
         "attachment_upload": False,
+        "children_create": False,
+        "children_list": True,
         "collaboration_auth": True,
         "destroy": False,
         "favorite": True,
         "invite_owner": False,
         "link_configuration": False,
         "media_auth": True,
+        "move": False,
         "partial_update": False,
+        "restore": False,
         "retrieve": True,
         "update": False,
         "versions_destroy": False,
@@ -517,3 +639,62 @@ def test_models_documents__email_invitation__failed(mock_logger, _mock_send_mail
 
     assert emails == ["[email protected]"]
     assert isinstance(exception, smtplib.SMTPException)
+
+
+# Document number of accesses
+
+
+def test_models_documents_nb_accesses_cache_is_set_and_retrieved(
+    django_assert_num_queries,
+):
+    """Test that nb_accesses is cached after the first computation."""
+    document = factories.DocumentFactory()
+    key = f"document_{document.id!s}_nb_accesses"
+    nb_accesses = random.randint(1, 4)
+    factories.UserDocumentAccessFactory.create_batch(nb_accesses, document=document)
+    factories.UserDocumentAccessFactory()  # An unrelated access should not be counted
+
+    # Initially, the nb_accesses should not be cached
+    assert cache.get(key) is None
+
+    # Compute the nb_accesses for the first time (this should set the cache)
+    with django_assert_num_queries(1):
+        assert document.nb_accesses == nb_accesses
+
+    # Ensure that the nb_accesses is now cached
+    with django_assert_num_queries(0):
+        assert document.nb_accesses == nb_accesses
+    assert cache.get(key) == nb_accesses
+
+    # The cache value should be invalidated when a document access is created
+    models.DocumentAccess.objects.create(
+        document=document, user=factories.UserFactory(), role="reader"
+    )
+    assert cache.get(key) is None  # Cache should be invalidated
+    with django_assert_num_queries(1):
+        new_nb_accesses = document.nb_accesses
+    assert new_nb_accesses == nb_accesses + 1
+    assert cache.get(key) == new_nb_accesses  # Cache should now contain the new value
+
+
+def test_models_documents_nb_accesses_cache_is_invalidated_on_access_removal(
+    django_assert_num_queries,
+):
+    """Test that the cache is invalidated when a document access is deleted."""
+    document = factories.DocumentFactory()
+    key = f"document_{document.id!s}_nb_accesses"
+    access = factories.UserDocumentAccessFactory(document=document)
+
+    # Initially, the nb_accesses should be cached
+    assert document.nb_accesses == 1
+    assert cache.get(key) == 1
+
+    # Remove the access and check if cache is invalidated
+    access.delete()
+    assert cache.get(key) is None  # Cache should be invalidated
+
+    # Recompute the nb_accesses (this should trigger a cache set)
+    with django_assert_num_queries(1):
+        new_nb_accesses = document.nb_accesses
+    assert new_nb_accesses == 0
+    assert cache.get(key) == 0  # Cache should now contain the new value

src/backend/demo/management/commands/create_demo.py

@@ -135,9 +135,14 @@ def create_demo(stdout):
     users_ids = list(models.User.objects.values_list("id", flat=True))
 
     with Timeit(stdout, "Creating documents"):
-        for _ in range(defaults.NB_OBJECTS["docs"]):
+        for i in range(defaults.NB_OBJECTS["docs"]):
+            # pylint: disable=protected-access
+            key = models.Document._int2str(i)  # noqa: SLF001
+            padding = models.Document.alphabet[0] * (models.Document.steplen - len(key))
             queue.push(
                 models.Document(
+                    depth=1,
+                    path=f"{padding}{key}",
                     creator_id=random.choice(users_ids),
                     title=fake.sentence(nb_words=4),
                     link_reach=models.LinkReachChoices.AUTHENTICATED

src/backend/demo/tests/test_commands_create_demo.py

@@ -1,5 +1,7 @@
 """Test the `create_demo` management command"""
 
+from unittest import mock
+
 from django.core.management import call_command
 from django.test import override_settings
 
@@ -10,15 +12,23 @@ from core import models
 pytestmark = pytest.mark.django_db
 
 
+@mock.patch(
+    "demo.defaults.NB_OBJECTS",
+    {
+        "users": 10,
+        "docs": 10,
+        "max_users_per_document": 5,
+    },
+)
 @override_settings(DEBUG=True)
 def test_commands_create_demo():
     """The create_demo management command should create objects as expected."""
     call_command("create_demo")
 
     assert models.Template.objects.count() == 1
-    assert models.User.objects.count() >= 50
-    assert models.Document.objects.count() >= 50
-    assert models.DocumentAccess.objects.count() > 50
+    assert models.User.objects.count() >= 10
+    assert models.Document.objects.count() >= 10
+    assert models.DocumentAccess.objects.count() > 10
 
     # assert dev users have doc accesses
     user = models.User.objects.get(email="[email protected]")

src/backend/impress/settings.py

@@ -296,9 +296,11 @@ class Base(Configuration):
         "drf_spectacular",
         # Third party apps
         "corsheaders",
+        "django_filters",
         "dockerflow.django",
         "rest_framework",
         "parler",
+        "treebeard",
         "easy_thumbnails",
         # Django
         "django.contrib.admin",
@@ -350,6 +352,10 @@ class Base(Configuration):
         "REDOC_DIST": "SIDECAR",
     }
 
+    TRASHBIN_CUTOFF_DAYS = values.Value(
+        30, environ_name="TRASHBIN_CUTOFF_DAYS", environ_prefix=None
+    )
+
     # Mail
     EMAIL_BACKEND = values.Value("django.core.mail.backends.smtp.EmailBackend")
     EMAIL_BRAND_NAME = values.Value(None)
@@ -770,6 +776,11 @@ class Production(Base):
                 environ_name="REDIS_URL",
                 environ_prefix=None,
             ),
+            "TIMEOUT": values.IntegerValue(
+                30,  # timeout in seconds
+                environ_name="CACHES_DEFAULT_TIMEOUT",
+                environ_prefix=None,
+            ),
             "OPTIONS": {
                 "CLIENT_CLASS": "django_redis.client.DefaultClient",
             },

src/backend/pyproject.toml

@@ -38,6 +38,7 @@ dependencies = [
     "django-storages[s3]==1.14.4",
     "django-timezone-field>=5.1",
     "django==5.1.5",
+    "django-treebeard==4.7.1",
     "djangorestframework==3.15.2",
     "drf_spectacular==0.28.0",
     "dockerflow==2024.4.2",

src/frontend/apps/e2e/__tests__/app-impress/common.ts

@@ -26,7 +26,7 @@ export const createDoc = async (
   page: Page,
   docName: string,
   browserName: string,
-  length: number,
+  length: number = 1,
 ) => {
   const randomDocs = randomName(docName, browserName, length);
 
@@ -40,7 +40,8 @@ export const createDoc = async (
       })
       .click();
 
-    const input = page.getByRole('textbox', { name: 'doc title input' });
+    const input = page.getByLabel('doc title input');
+    await expect(input).toHaveText('');
     await input.click();
     await input.fill(randomDocs[i]);
     await input.blur();
@@ -91,6 +92,22 @@ export const addNewMember = async (
   return users[index].email;
 };
 
+export const getGridRow = async (page: Page, title: string) => {
+  const docsGrid = page.getByRole('grid');
+  await expect(docsGrid).toBeVisible();
+  await expect(page.getByTestId('grid-loader')).toBeHidden();
+
+  const rows = docsGrid.getByRole('row');
+
+  const row = rows.filter({
+    hasText: title,
+  });
+
+  await expect(row).toBeVisible();
+
+  return row;
+};
+
 interface GoToGridDocOptions {
   nthRow?: number;
   title?: string;
@@ -104,7 +121,7 @@ export const goToGridDoc = async (
 
   const docsGrid = page.getByTestId('docs-grid');
   await expect(docsGrid).toBeVisible();
-  await expect(docsGrid.getByTestId('grid-loader')).toBeHidden();
+  await expect(page.getByTestId('grid-loader')).toBeHidden();
 
   const rows = docsGrid.getByRole('row');
 

src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts

@@ -220,7 +220,7 @@ test.describe('Doc Editor', () => {
     browserName,
   }) => {
     // Check the first doc
-    const [doc] = await createDoc(page, 'doc-saves-change', browserName, 1);
+    const [doc] = await createDoc(page, 'doc-saves-change', browserName);
     await verifyDocName(page, doc);
 
     const editor = page.locator('.ProseMirror');
@@ -228,9 +228,11 @@ test.describe('Doc Editor', () => {
     await editor.fill('Hello World Doc persisted 1');
     await expect(editor.getByText('Hello World Doc persisted 1')).toBeVisible();
 
-    const secondDoc = await goToGridDoc(page, {
-      nthRow: 2,
-    });
+    const [secondDoc] = await createDoc(
+      page,
+      'doc-saves-change-other',
+      browserName,
+    );
 
     await verifyDocName(page, secondDoc);
 
@@ -238,6 +240,7 @@ test.describe('Doc Editor', () => {
       title: doc,
     });
 
+    await verifyDocName(page, doc);
     await expect(editor.getByText('Hello World Doc persisted 1')).toBeVisible();
   });
 
@@ -246,8 +249,7 @@ test.describe('Doc Editor', () => {
     test.skip(browserName === 'webkit', 'This test is very flaky with webkit');
 
     // Check the first doc
-    const doc = await goToGridDoc(page);
-
+    const [doc] = await createDoc(page, 'doc-quit-1', browserName, 1);
     await verifyDocName(page, doc);
 
     const editor = page.locator('.ProseMirror');

src/frontend/apps/e2e/__tests__/app-impress/doc-favorite.spec.ts

@@ -1,75 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-import { createDoc, verifyDocName } from './common';
-
-type SmallDoc = {
-  id: string;
-  title: string;
-};
-
-test.describe('Document favorite', () => {
-  test('it check the favorite workflow', async ({ page, browserName }) => {
-    const id = Math.random().toString(7);
-    await page.goto('/');
-
-    // Create document
-    const createdDoc = await createDoc(page, `Doc ${id}`, browserName, 1);
-    await verifyDocName(page, createdDoc[0]);
-
-    // Reload page
-    await page.reload();
-    await page.goto('/');
-
-    // Get all documents
-    let docs: SmallDoc[] = [];
-    const response = await page.waitForResponse(
-      (response) =>
-        response.url().endsWith('documents/?page=1') &&
-        response.status() === 200,
-    );
-    const result = await response.json();
-    docs = result.results as SmallDoc[];
-    const docsGrid = page.getByTestId('docs-grid');
-    await docsGrid.getByRole('heading', { name: 'All docs' }).click();
-    await expect(docsGrid.getByText(`Doc ${id}`)).toBeVisible();
-    const doc = docs.find((doc) => doc.title === createdDoc[0]) as SmallDoc;
-
-    // Check document
-    expect(doc).not.toBeUndefined();
-    expect(doc?.title).toBe(createdDoc[0]);
-
-    // Open document actions
-    const button = docsGrid.getByTestId(`docs-grid-actions-button-${doc.id}`);
-    await expect(button).toBeVisible();
-    await button.click();
-
-    // Pin document
-    const pinButton = page.getByTestId(`docs-grid-actions-pin-${docs[0].id}`);
-    await expect(pinButton).toBeVisible();
-    await pinButton.click();
-
-    // Check response
-    const responsePin = await page.waitForResponse(
-      (response) =>
-        response.url().includes(`documents/${doc.id}/favorite/`) &&
-        response.status() === 201,
-    );
-    expect(responsePin.ok()).toBeTruthy();
-
-    // Check left panel favorites
-    const leftPanelFavorites = page.getByTestId('left-panel-favorites');
-    await expect(leftPanelFavorites).toBeVisible();
-    await expect(leftPanelFavorites.getByText(`Doc ${id}`)).toBeVisible();
-
-    //
-    await button.click();
-    const unpinButton = page.getByTestId(
-      `docs-grid-actions-unpin-${docs[0].id}`,
-    );
-    await expect(unpinButton).toBeVisible();
-    await unpinButton.click();
-
-    // Check left panel favorites
-    await expect(leftPanelFavorites.getByText(`Doc ${id}`)).toBeHidden();
-  });
-});

src/frontend/apps/e2e/__tests__/app-impress/doc-grid.spec.ts

@@ -1,5 +1,7 @@
 import { expect, test } from '@playwright/test';
 
+import { createDoc, getGridRow } from './common';
+
 type SmallDoc = {
   id: string;
   title: string;
@@ -92,6 +94,31 @@ test.describe('Documents Grid mobile', () => {
 });
 
 test.describe('Document grid item options', () => {
+  test('it pins a document', async ({ page, browserName }) => {
+    const [docTitle] = await createDoc(page, `Favorite doc`, browserName);
+
+    await page.goto('/');
+
+    const row = await getGridRow(page, docTitle);
+
+    // Pin
+    await row.getByText(`more_horiz`).click();
+    await page.getByText('push_pin').click();
+
+    // Check is pinned
+    await expect(row.getByLabel('Pin document icon')).toBeVisible();
+    const leftPanelFavorites = page.getByTestId('left-panel-favorites');
+    await expect(leftPanelFavorites.getByText(docTitle)).toBeVisible();
+
+    // Unpin
+    await row.getByText(`more_horiz`).click();
+    await page.getByText('Unpin').click();
+
+    // Check is unpinned
+    await expect(row.getByLabel('Pin document icon')).toBeHidden();
+    await expect(leftPanelFavorites.getByText(docTitle)).toBeHidden();
+  });
+
   test('it deletes the document', async ({ page }) => {
     let docs: SmallDoc[] = [];
     const response = await page.waitForResponse(

src/frontend/apps/e2e/__tests__/app-impress/doc-member-create.spec.ts

@@ -26,7 +26,7 @@ test.describe('Document create member', () => {
     const response = await responsePromise;
     const users = (await response.json()).results as {
       email: string;
-      full_name: string;
+      full_name?: string | null;
     }[];
 
     const list = page.getByTestId('doc-share-add-member-list');
@@ -40,7 +40,9 @@ test.describe('Document create member', () => {
     await expect(
       list.getByTestId(`doc-share-add-member-${users[0].email}`),
     ).toBeVisible();
-    await expect(list.getByText(`${users[0].full_name}`)).toBeVisible();
+    await expect(
+      list.getByText(`${users[0].full_name || users[0].email}`),
+    ).toBeVisible();
 
     // Select user 2 and verify tag
     await inputSearch.fill('user');
@@ -51,7 +53,9 @@ test.describe('Document create member', () => {
     await expect(
       list.getByTestId(`doc-share-add-member-${users[1].email}`),
     ).toBeVisible();
-    await expect(list.getByText(`${users[1].full_name}`)).toBeVisible();
+    await expect(
+      list.getByText(`${users[1].full_name || users[1].email}`),
+    ).toBeVisible();
 
     // Select email and verify tag
     const email = randomName('[email protected]', browserName, 1)[0];
@@ -81,7 +85,9 @@ test.describe('Document create member', () => {
     // Check user added
     await expect(page.getByText('Share with 3 users')).toBeVisible();
     await expect(
-      quickSearchContent.getByText(users[0].full_name).first(),
+      quickSearchContent
+        .getByText(users[0].full_name || users[0].email)
+        .first(),
     ).toBeVisible();
     await expect(
       quickSearchContent.getByText(users[0].email).first(),
@@ -90,7 +96,9 @@ test.describe('Document create member', () => {
       quickSearchContent.getByText(users[1].email).first(),
     ).toBeVisible();
     await expect(
-      quickSearchContent.getByText(users[1].full_name).first(),
+      quickSearchContent
+        .getByText(users[1].full_name || users[1].email)
+        .first(),
     ).toBeVisible();
   });
 

src/frontend/apps/e2e/__tests__/app-impress/doc-search.spec.ts

@@ -1,21 +1,32 @@
 import { expect, test } from '@playwright/test';
-import { DateTime } from 'luxon';
 
 import { createDoc, verifyDocName } from './common';
 
-type SmallDoc = {
-  id: string;
-  title: string;
-  updated_at: string;
-};
-
 test.beforeEach(async ({ page }) => {
   await page.goto('/');
 });
 
 test.describe('Document search', () => {
-  test('it checks all elements are visible', async ({ page }) => {
+  test('it searches documents', async ({ page, browserName }) => {
+    const [doc1Title] = await createDoc(
+      page,
+      'My doc search super',
+      browserName,
+      1,
+    );
+    await verifyDocName(page, doc1Title);
+    await page.goto('/');
+
+    const [doc2Title] = await createDoc(
+      page,
+      'My doc search doc',
+      browserName,
+      1,
+    );
+    await verifyDocName(page, doc2Title);
+    await page.goto('/');
     await page.getByRole('button', { name: 'search' }).click();
+
     await expect(
       page.getByRole('img', { name: 'No active search' }),
     ).toBeVisible();
@@ -24,91 +35,32 @@ test.describe('Document search', () => {
       page.getByLabel('Search modal').getByText('search'),
     ).toBeVisible();
 
-    await expect(
-      page.getByPlaceholder('Type the name of a document'),
-    ).toBeVisible();
-  });
+    const inputSearch = page.getByPlaceholder('Type the name of a document');
 
-  test('it checks search for a document', async ({ page, browserName }) => {
-    const id = Math.random().toString(36).substring(7);
+    await inputSearch.click();
+    await inputSearch.fill('My doc search');
+    await inputSearch.press('ArrowDown');
 
-    const doc1 = await createDoc(page, `My super ${id} doc`, browserName, 1);
-    await verifyDocName(page, doc1[0]);
-    await page.goto('/');
-    const doc2 = await createDoc(
-      page,
-      `My super ${id} very doc`,
-      browserName,
-      1,
-    );
-    await verifyDocName(page, doc2[0]);
-    await page.goto('/');
-    await page.getByRole('button', { name: 'search' }).click();
-    await page.getByPlaceholder('Type the name of a document').click();
-    await page
-      .getByPlaceholder('Type the name of a document')
-      .fill(`My super ${id}`);
-
-    let responsePromisePage = page.waitForResponse(
-      (response) =>
-        response.url().includes(`/documents/?page=1&title=My+super+${id}`) &&
-        response.status() === 200,
-    );
-    let response = await responsePromisePage;
-    let result = (await response.json()) as { results: SmallDoc[] };
-    let docs = result.results;
-    expect(docs.length).toEqual(2);
-
-    await Promise.all(
-      docs.map(async (doc: SmallDoc) => {
-        await expect(
-          page.getByTestId(`doc-search-item-${doc.id}`),
-        ).toBeVisible();
-        const updatedAt = DateTime.fromISO(doc.updated_at ?? DateTime.now())
-          .setLocale('en')
-          .toRelative();
-        await expect(
-          page.getByTestId(`doc-search-item-${doc.id}`).getByText(updatedAt!),
-        ).toBeVisible();
-      }),
-    );
-
-    const firstDoc = docs[0];
+    const listSearch = page.getByRole('listbox').getByRole('group');
+    const rowdoc = listSearch.getByRole('option').first();
+    await expect(rowdoc.getByText('keyboard_return')).toBeVisible();
+    await expect(rowdoc.getByText(/seconds? ago/)).toBeVisible();
 
     await expect(
-      page
-        .getByTestId(`doc-search-item-${firstDoc.id}`)
-        .getByText('keyboard_return'),
+      listSearch.getByRole('option').getByText(doc1Title),
     ).toBeVisible();
-
-    await page
-      .getByPlaceholder('Type the name of a document')
-      .press('ArrowDown');
-
-    const secondDoc = docs[1];
     await expect(
-      page
-        .getByTestId(`doc-search-item-${secondDoc.id}`)
-        .getByText('keyboard_return'),
+      listSearch.getByRole('option').getByText(doc2Title),
     ).toBeVisible();
 
-    await page.getByPlaceholder('Type the name of a document').click();
-    await page
-      .getByPlaceholder('Type the name of a document')
-      .fill(`My super ${id} doc`);
+    await inputSearch.fill('My doc search super');
 
-    responsePromisePage = page.waitForResponse(
-      (response) =>
-        response
-          .url()
-          .includes(`/documents/?page=1&title=My+super+${id}+doc`) &&
-        response.status() === 200,
-    );
+    await expect(
+      listSearch.getByRole('option').getByText(doc1Title),
+    ).toBeVisible();
 
-    response = await responsePromisePage;
-    result = (await response.json()) as { results: SmallDoc[] };
-    docs = result.results;
-
-    expect(docs.length).toEqual(1);
+    await expect(
+      listSearch.getByRole('option').getByText(doc2Title),
+    ).toBeHidden();
   });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-visibility.spec.ts

@@ -171,6 +171,9 @@ test.describe('Doc Visibility: Restricted', () => {
 
     await page.goto(urlDoc);
 
+    // eslint-disable-next-line playwright/no-wait-for-timeout
+    await page.waitForTimeout(1000);
+
     await verifyDocName(page, docTitle);
     await expect(page.getByLabel('Share button')).toBeVisible();
   });
@@ -209,6 +212,7 @@ test.describe('Doc Visibility: Public', () => {
       page.getByText('The document visibility has been updated.'),
     ).toBeVisible();
 
+    await expect(page.getByLabel('Visibility mode')).toBeVisible();
     await page.getByLabel('Visibility mode').click();
     await page
       .getByRole('button', {

src/frontend/apps/e2e/package.json

@@ -12,12 +12,10 @@
     "test:ui::chromium": "yarn test:ui --project=chromium"
   },
   "devDependencies": {
-    "@playwright/test": "1.49.1",
-    "@types/luxon": "3.4.2",
+    "@playwright/test": "1.50.0",
     "@types/node": "*",
     "@types/pdf-parse": "1.1.4",
     "eslint-config-impress": "*",
-    "luxon": "3.5.0",
     "typescript": "*"
   },
   "dependencies": {

src/frontend/apps/impress/package.json

@@ -21,42 +21,42 @@
     "@blocknote/xl-docx-exporter": "0.21.0",
     "@blocknote/xl-pdf-exporter": "0.21.0",
     "@gouvfr-lasuite/integration": "1.0.2",
-    "@hocuspocus/provider": "2.15.0",
+    "@hocuspocus/provider": "2.15.1",
     "@openfun/cunningham-react": "2.9.4",
     "@react-pdf/renderer": "4.1.6",
-    "@sentry/nextjs": "8.47.0",
-    "@tanstack/react-query": "5.62.11",
+    "@sentry/nextjs": "8.52.0",
+    "@tanstack/react-query": "5.65.1",
     "cmdk": "1.0.4",
     "crisp-sdk-web": "1.0.25",
-    "docx": "9.1.0",
-    "i18next": "24.2.0",
+    "docx": "9.1.1",
+    "i18next": "24.2.2",
     "i18next-browser-languagedetector": "8.0.2",
     "idb": "8.0.1",
     "lodash": "4.17.21",
     "luxon": "3.5.0",
-    "next": "15.1.3",
-    "posthog-js": "1.204.0",
+    "next": "15.1.6",
+    "posthog-js": "1.211.3",
     "react": "*",
-    "react-aria-components": "1.5.0",
+    "react-aria-components": "1.6.0",
     "react-dom": "*",
     "react-i18next": "15.4.0",
-    "react-intersection-observer": "9.13.1",
-    "react-select": "5.9.0",
-    "styled-components": "6.1.13",
+    "react-intersection-observer": "9.15.1",
+    "react-select": "5.10.0",
+    "styled-components": "6.1.14",
     "use-debounce": "10.0.4",
     "y-protocols": "1.0.6",
-    "yjs": "13.6.21",
-    "zustand": "5.0.2"
+    "yjs": "13.6.23",
+    "zustand": "5.0.3"
   },
   "devDependencies": {
     "@svgr/webpack": "8.1.0",
-    "@tanstack/react-query-devtools": "5.62.11",
+    "@tanstack/react-query-devtools": "5.65.1",
     "@testing-library/dom": "10.4.0",
     "@testing-library/jest-dom": "6.6.3",
-    "@testing-library/react": "16.1.0",
-    "@testing-library/user-event": "14.5.2",
+    "@testing-library/react": "16.2.0",
+    "@testing-library/user-event": "14.6.1",
     "@types/jest": "29.5.14",
-    "@types/lodash": "4.17.13",
+    "@types/lodash": "4.17.15",
     "@types/luxon": "3.4.2",
     "@types/node": "*",
     "@types/react": "18.3.12",
@@ -69,9 +69,9 @@
     "jest-environment-jsdom": "29.7.0",
     "node-fetch": "2.7.0",
     "prettier": "3.4.2",
-    "stylelint": "16.12.0",
-    "stylelint-config-standard": "36.0.1",
-    "stylelint-prettier": "5.0.2",
+    "stylelint": "16.14.1",
+    "stylelint-config-standard": "37.0.0",
+    "stylelint-prettier": "5.0.3",
     "typescript": "*",
     "webpack": "5.97.1",
     "workbox-webpack-plugin": "7.1.0"

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareModal.tsx

@@ -30,12 +30,9 @@ import { DocShareModalFooter } from './DocShareModalFooter';
 import { DocShareModalInviteUserRow } from './DocShareModalInviteUserByEmail';
 
 const ShareModalStyle = createGlobalStyle`
-
   .c__modal__title {
     padding-bottom: 0 !important;
-
-}
-
+  }
 `;
 
 type Props = {

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGrid.tsx

@@ -70,6 +70,7 @@ export const DocsGrid = ({
     >
       <DocsGridLoader isLoading={isRefetching || loading} />
       <Card
+        role="grid"
         data-testid="docs-grid"
         $height="100%"
         $width="100%"

src/frontend/apps/impress/src/features/docs/docs-grid/components/SimpleDocItem.tsx

@@ -1,4 +1,5 @@
 import { DateTime } from 'luxon';
+import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 
 import { Box, Text } from '@/components';
@@ -30,6 +31,7 @@ export const SimpleDocItem = ({
   isPinned = false,
   showAccesses = false,
 }: SimpleDocItemProps) => {
+  const { t } = useTranslation();
   const { spacingsTokens } = useCunninghamTheme();
   const { isDesktop } = useResponsiveStore();
   const spacings = spacingsTokens();
@@ -44,7 +46,11 @@ export const SimpleDocItem = ({
           filter: drop-shadow(0px 2px 2px rgba(0, 0, 0, 0.05));
         `}
       >
-        {isPinned ? <PinnedDocumentIcon /> : <SimpleFileIcon />}
+        {isPinned ? (
+          <PinnedDocumentIcon aria-label={t('Pin document icon')} />
+        ) : (
+          <SimpleFileIcon aria-label={t('Simple document icon')} />
+        )}
       </Box>
       <Box $justify="center">
         <Text

src/frontend/package.json

@@ -28,13 +28,13 @@
     "server:test": "yarn COLLABORATION_SERVER run test"
   },
   "resolutions": {
-    "@types/node": "22.10.3",
+    "@types/node": "22.12.0",
     "@types/react-dom": "18.3.1",
-    "@typescript-eslint/eslint-plugin": "8.19.0",
-    "@typescript-eslint/parser": "8.19.0",
+    "@typescript-eslint/eslint-plugin": "8.22.0",
+    "@typescript-eslint/parser": "8.22.0",
     "eslint": "8.57.0",
     "react": "18.3.1",
     "react-dom": "18.3.1",
-    "typescript": "5.7.2"
+    "typescript": "5.7.3"
   }
 }

src/frontend/packages/eslint-config-impress/package.json

@@ -6,19 +6,19 @@
     "lint": "eslint --ext .js ."
   },
   "dependencies": {
-    "@next/eslint-plugin-next": "15.1.3",
-    "@tanstack/eslint-plugin-query": "5.62.9",
+    "@next/eslint-plugin-next": "15.1.6",
+    "@tanstack/eslint-plugin-query": "5.65.0",
     "@typescript-eslint/eslint-plugin": "*",
     "@typescript-eslint/parser": "*",
     "eslint": "*",
-    "eslint-config-next": "15.1.3",
-    "eslint-config-prettier": "9.1.0",
+    "eslint-config-next": "15.1.6",
+    "eslint-config-prettier": "10.0.1",
     "eslint-plugin-import": "2.31.0",
-    "eslint-plugin-jest": "28.10.0",
+    "eslint-plugin-jest": "28.11.0",
     "eslint-plugin-jsx-a11y": "6.10.2",
-    "eslint-plugin-playwright": "2.1.0",
-    "eslint-plugin-prettier": "5.2.1",
-    "eslint-plugin-react": "7.37.3",
+    "eslint-plugin-playwright": "2.2.0",
+    "eslint-plugin-prettier": "5.2.3",
+    "eslint-plugin-react": "7.37.4",
     "eslint-plugin-testing-library": "7.1.1",
     "prettier": "3.4.2"
   }

src/frontend/servers/y-provider/package.json

@@ -16,25 +16,25 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@blocknote/server-util": "0.22.0",
-    "@hocuspocus/server": "2.15.0",
-    "@sentry/node": "8.47.0",
-    "@sentry/profiling-node": "8.47.0",
+    "@blocknote/server-util": "0.21.0",
+    "@hocuspocus/server": "2.15.1",
+    "@sentry/node": "8.52.0",
+    "@sentry/profiling-node": "8.52.0",
     "cors": "2.8.5",
     "express": "4.21.2",
     "express-ws": "5.0.2",
     "y-protocols": "1.0.6",
-    "yjs": "13.6.21"
+    "yjs": "13.6.23"
   },
   "devDependencies": {
-    "@hocuspocus/provider": "2.15.0",
+    "@hocuspocus/provider": "2.15.1",
     "@types/cors": "2.8.17",
     "@types/express": "5.0.0",
     "@types/express-ws": "3.0.5",
     "@types/jest": "29.5.14",
     "@types/node": "*",
     "@types/supertest": "6.0.2",
-    "@types/ws": "8.5.13",
+    "@types/ws": "8.5.14",
     "cross-env": "7.0.3",
     "eslint-config-impress": "*",
     "jest": "29.7.0",