🔖(minor) release 2.7.0

Added:
- 📄(legal) Require contributors to sign a DCO

Changed:
- ♻️(frontend) Integrate UI kit
- 🏗️(y-provider) manage auth in y-provider app

Fixed:
- 🐛(backend) compute ancestor_links in get_abilities
  if needed
- 🔒️(back) restrict access to document accesses

.github/workflows/docker-hub.yml

@@ -134,5 +134,5 @@ jobs:
         name: Call argocd github webhook
         run: |
           data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/${{ secrets.DEPLOYMENT_REPO_URL }}"}}'
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac "${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET }}" | awk '{print "X-Hub-Signature: sha1="$2}')
+          sig=$(echo -n ${data} | openssl dgst -sha256 -hmac "${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET }}" | awk '{print "X-Hub-Signature-256: sha256="$2}')
           curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" ${{ vars.ARGOCD_PREPROD_WEBHOOK_URL }}

CHANGELOG.md

@@ -8,6 +8,8 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [2.7.0] - 2025-03-28
+
 ## Added
 
 - 📄(legal) Require contributors to sign a DCO #779
@@ -15,6 +17,13 @@ and this project adheres to
 ## Changed
 
 - ♻️(frontend) Integrate UI kit #783
+- 🏗️(y-provider) manage auth in y-provider app #804
+
+## Fixed
+
+- 🐛(backend) compute ancestor_links in get_abilities if needed #725
+- 🔒️(back) restrict access to document accesses #801
+
 
 ## [2.6.0] - 2025-03-21
 
@@ -132,6 +141,8 @@ and this project adheres to
 
 ## Added
 
+- ✨(backend) add duplicate action to the document API endpoint
+- ⚗️(backend) add util to extract text from base64 yjs document
 - ✨(backend) add soft delete and restore API endpoints to documents #516
 - ✨(backend) allow organizing documents in a tree structure #516
 - ✨(backend) add "excerpt" field to document list serializer #516
@@ -495,8 +506,9 @@ and this project adheres to
 - ✨(frontend) Coming Soon page (#67)
 - 🚀 Impress, project to manage your documents easily and collaboratively.
 
-[unreleased]: https://github.com/numerique-gouv/impress/compare/v2.6.0...main
-[v2.5.0]: https://github.com/numerique-gouv/impress/releases/v2.6.0
+[unreleased]: https://github.com/numerique-gouv/impress/compare/v2.7.0...main
+[v2.7.0]: https://github.com/numerique-gouv/impress/releases/v2.7.0
+[v2.6.0]: https://github.com/numerique-gouv/impress/releases/v2.6.0
 [v2.5.0]: https://github.com/numerique-gouv/impress/releases/v2.5.0
 [v2.4.0]: https://github.com/numerique-gouv/impress/releases/v2.4.0
 [v2.3.0]: https://github.com/numerique-gouv/impress/releases/v2.3.0

Dockerfile

@@ -15,6 +15,13 @@ FROM base AS back-builder
 
 WORKDIR /builder
 
+# Install Rust and Cargo using Alpine's package manager
+RUN apk add --no-cache \
+  build-base \
+  libffi-dev \
+  rust \
+  cargo
+
 # Copy required python dependencies
 COPY ./src/backend /builder
 

Makefile

@@ -93,6 +93,7 @@ build: cache ?= --no-cache
 build: ## build the project containers
 	@$(MAKE) build-backend cache=$(cache)
 	@$(MAKE) build-yjs-provider cache=$(cache)
+	@$(MAKE) build-frontend cache=$(cache)
 .PHONY: build
 
 build-backend: cache ?=
@@ -127,6 +128,7 @@ run-backend: ## Start only the backend application and all needed services
 run: ## start the wsgi (production) and development server
 run: 
 	@$(MAKE) run-backend
+	@$(COMPOSE) up --force-recreate -d frontend
 .PHONY: run
 
 status: ## an alias for "docker compose ps"

bin/Tiltfile

@@ -39,6 +39,9 @@ docker_build(
     ]
 )
 
+k8s_resource('impress-docs-backend-migrate', resource_deps=['postgres-postgresql'])
+k8s_resource('impress-docs-backend-createsuperuser', resource_deps=['impress-docs-backend-migrate'])
+k8s_resource('impress-docs-backend', resource_deps=['impress-docs-backend-migrate'])
 k8s_yaml(local('cd ../src/helm && helmfile -n impress -e dev template .'))
 
 migration = '''

docker-compose.yml

@@ -185,11 +185,15 @@ services:
       context: .
       dockerfile: ./src/frontend/servers/y-provider/Dockerfile
       target: y-provider
+    command: ["yarn", "workspace", "server-y-provider", "run", "dev"]
+    working_dir: /app/frontend
     restart: unless-stopped
     env_file:
       - env.d/development/common
     ports:
       - "4444:4444"
+    volumes:
+      - ./src/frontend/:/app/frontend
 
   kc_postgresql:
     image: postgres:14.3

docker/files/etc/nginx/conf.d/default.conf

@@ -4,54 +4,6 @@ server {
     server_name localhost;
     charset utf-8;
 
-    # Proxy auth for collaboration server
-    location /collaboration/ws/ {
-        # Collaboration Auth request configuration
-        auth_request /collaboration-auth;
-        auth_request_set $authHeader $upstream_http_authorization;
-        auth_request_set $canEdit $upstream_http_x_can_edit;
-        auth_request_set $userId $upstream_http_x_user_id;
-
-        # Pass specific headers from the auth response
-        proxy_set_header Authorization $authHeader;
-        proxy_set_header X-Can-Edit $canEdit;
-        proxy_set_header X-User-Id $userId;
-
-        # Ensure WebSocket upgrade
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "Upgrade";
-
-        # Collaboration server
-        proxy_pass http://y-provider:4444;
-
-        # Set appropriate timeout for WebSocket
-        proxy_read_timeout 86400;
-        proxy_send_timeout 86400;
-
-        # Preserve original host and additional headers
-        proxy_set_header Host $host;
-    }
-
-    location /collaboration-auth {
-        proxy_pass http://app-dev:8000/api/v1.0/documents/collaboration-auth/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Original-URL $request_uri;
-        
-        # Prevent the body from being passed
-        proxy_pass_request_body off;
-        proxy_set_header Content-Length "";
-        proxy_set_header X-Original-Method $request_method;
-    }
-
-    location  /collaboration/api/ {
-        # Collaboration server
-        proxy_pass http://y-provider:4444;
-        proxy_set_header Host $host;
-    }
-
     # Proxy auth for media
     location /media/ {
         # Auth request configuration

env.d/development/common.dist

@@ -55,10 +55,11 @@ AI_API_KEY=password
 AI_MODEL=llama
 
 # Collaboration
-COLLABORATION_API_URL=http://nginx:8083/collaboration/api/
+COLLABORATION_API_URL=http://y-provider:4444/collaboration/api/
+COLLABORATION_BACKEND_BASE_URL=http://app-dev:8000
 COLLABORATION_SERVER_ORIGIN=http://localhost:3000
 COLLABORATION_SERVER_SECRET=my-secret
-COLLABORATION_WS_URL=ws://localhost:8083/collaboration/ws/
+COLLABORATION_WS_URL=ws://localhost:4444/collaboration/ws/
 
 # Frontend
 FRONTEND_THEME=default

src/backend/core/admin.py

@@ -151,6 +151,8 @@ class DocumentAdmin(TreeAdmin):
                     "path",
                     "depth",
                     "numchild",
+                    "duplicated_from",
+                    "attachments",
                 )
             },
         ),
@@ -166,8 +168,10 @@ class DocumentAdmin(TreeAdmin):
         "updated_at",
     )
     readonly_fields = (
+        "attachments",
         "creator",
         "depth",
+        "duplicated_from",
         "id",
         "numchild",
         "path",

src/backend/core/api/serializers.py

@@ -10,7 +10,7 @@ from django.utils.translation import gettext_lazy as _
 import magic
 from rest_framework import exceptions, serializers
 
-from core import enums, models
+from core import enums, models, utils
 from core.services.ai_services import AI_ACTIONS
 from core.services.converter_services import (
     ConversionError,
@@ -27,6 +27,26 @@ class UserSerializer(serializers.ModelSerializer):
         read_only_fields = ["id", "email", "full_name", "short_name"]
 
 
+class UserLightSerializer(UserSerializer):
+    """Serialize users with limited fields."""
+
+    id = serializers.SerializerMethodField(read_only=True)
+    email = serializers.SerializerMethodField(read_only=True)
+
+    def get_id(self, _user):
+        """Return always None. Here to have the same fields than in UserSerializer."""
+        return None
+
+    def get_email(self, _user):
+        """Return always None. Here to have the same fields than in UserSerializer."""
+        return None
+
+    class Meta:
+        model = models.User
+        fields = ["id", "email", "full_name", "short_name"]
+        read_only_fields = ["id", "email", "full_name", "short_name"]
+
+
 class BaseAccessSerializer(serializers.ModelSerializer):
     """Serialize template accesses."""
 
@@ -118,6 +138,17 @@ class DocumentAccessSerializer(BaseAccessSerializer):
         read_only_fields = ["id", "abilities"]
 
 
+class DocumentAccessLightSerializer(DocumentAccessSerializer):
+    """Serialize document accesses with limited fields."""
+
+    user = UserLightSerializer(read_only=True)
+
+    class Meta:
+        model = models.DocumentAccess
+        fields = ["id", "user", "team", "role", "abilities"]
+        read_only_fields = ["id", "team", "role", "abilities"]
+
+
 class TemplateAccessSerializer(BaseAccessSerializer):
     """Serialize template accesses."""
 
@@ -268,6 +299,53 @@ class DocumentSerializer(ListDocumentSerializer):
 
         return value
 
+    def save(self, **kwargs):
+        """
+        Process the content field to extract attachment keys and update the document's
+        "attachments" field for access control.
+        """
+        content = self.validated_data.get("content", "")
+        extracted_attachments = set(utils.extract_attachments(content))
+
+        existing_attachments = (
+            set(self.instance.attachments or []) if self.instance else set()
+        )
+        new_attachments = extracted_attachments - existing_attachments
+
+        if new_attachments:
+            attachments_documents = (
+                models.Document.objects.filter(
+                    attachments__overlap=list(new_attachments)
+                )
+                .only("path", "attachments")
+                .order_by("path")
+            )
+
+            user = self.context["request"].user
+            readable_per_se_paths = (
+                models.Document.objects.readable_per_se(user)
+                .order_by("path")
+                .values_list("path", flat=True)
+            )
+            readable_attachments_paths = utils.filter_descendants(
+                [doc.path for doc in attachments_documents],
+                readable_per_se_paths,
+                skip_sorting=True,
+            )
+
+            readable_attachments = set()
+            for document in attachments_documents:
+                if document.path not in readable_attachments_paths:
+                    continue
+                readable_attachments.update(set(document.attachments) & new_attachments)
+
+            # Update attachments with readable keys
+            self.validated_data["attachments"] = list(
+                existing_attachments | readable_attachments
+            )
+
+        return super().save(**kwargs)
+
 
 class ServerCreateDocumentSerializer(serializers.Serializer):
     """
@@ -381,6 +459,27 @@ class LinkDocumentSerializer(serializers.ModelSerializer):
         ]
 
 
+class DocumentDuplicationSerializer(serializers.Serializer):
+    """
+    Serializer for duplicating a document.
+    Allows specifying whether to keep access permissions.
+    """
+
+    with_accesses = serializers.BooleanField(default=False)
+
+    def create(self, validated_data):
+        """
+        This serializer is not intended to create objects.
+        """
+        raise NotImplementedError("This serializer does not support creation.")
+
+    def update(self, instance, validated_data):
+        """
+        This serializer is not intended to update objects.
+        """
+        raise NotImplementedError("This serializer does not support updating.")
+
+
 # Suppress the warning about not implementing `create` and `update` methods
 # since we don't use a model and only rely on the serializer for validation
 # pylint: disable=abstract-method

src/backend/core/api/viewsets.py

@@ -2,7 +2,6 @@
 # pylint: disable=too-many-lines
 
 import logging
-import re
 import uuid
 from urllib.parse import unquote, urlparse
 
@@ -17,6 +16,8 @@ from django.db import transaction
 from django.db.models.expressions import RawSQL
 from django.db.models.functions import Left, Length
 from django.http import Http404, StreamingHttpResponse
+from django.utils.text import capfirst
+from django.utils.translation import gettext_lazy as _
 
 import requests
 import rest_framework as drf
@@ -29,23 +30,13 @@ from rest_framework.throttling import UserRateThrottle
 from core import authentication, enums, models
 from core.services.ai_services import AIService
 from core.services.collaboration_services import CollaborationService
+from core.utils import extract_attachments, filter_descendants
 
 from . import permissions, serializers, utils
 from .filters import DocumentFilter, ListDocumentFilter
 
 logger = logging.getLogger(__name__)
 
-ATTACHMENTS_FOLDER = "attachments"
-UUID_REGEX = (
-    r"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
-)
-FILE_EXT_REGEX = r"\.[a-zA-Z0-9]{1,10}"
-MEDIA_STORAGE_URL_PATTERN = re.compile(
-    f"{settings.MEDIA_URL:s}(?P<pk>{UUID_REGEX:s})/"
-    f"(?P<key>{ATTACHMENTS_FOLDER:s}/{UUID_REGEX:s}(?:-unsafe)?{FILE_EXT_REGEX:s})$"
-)
-COLLABORATION_WS_URL_PATTERN = re.compile(rf"(?:^|&)room=(?P<pk>{UUID_REGEX})(?:&|$)")
-
 # pylint: disable=too-many-ancestors
 
 
@@ -389,10 +380,7 @@ class DocumentViewSet(
     9. **Media Auth**: Authorize access to document media.
         Example: GET /documents/media-auth/
 
-    10. **Collaboration Auth**: Authorize access to the collaboration server for a document.
-        Example: GET /documents/collaboration-auth/
-
-    11. **AI Transform**: Apply a transformation action on a piece of text with AI.
+    10. **AI Transform**: Apply a transformation action on a piece of text with AI.
         Example: POST /documents/{id}/ai-transform/
         Expected data:
         - text (str): The input text.
@@ -400,7 +388,7 @@ class DocumentViewSet(
         Returns: JSON response with the processed text.
         Throttled by: AIDocumentRateThrottle, AIUserRateThrottle.
 
-    12. **AI Translate**: Translate a piece of text with AI.
+    11. **AI Translate**: Translate a piece of text with AI.
         Example: POST /documents/{id}/ai-translate/
         Expected data:
         - text (str): The input text.
@@ -855,14 +843,15 @@ class DocumentViewSet(
         )
 
         # Get the highest readable ancestor
-        highest_readable = ancestors.readable_per_se(request.user).only("depth").first()
+        highest_readable = (
+            ancestors.readable_per_se(request.user).only("depth", "path").first()
+        )
         if highest_readable is None:
             raise (
                 drf.exceptions.PermissionDenied()
                 if request.user.is_authenticated
                 else drf.exceptions.NotAuthenticated()
             )
-
         paths_links_mapping = {}
         ancestors_links = []
         children_clause = db.Q()
@@ -885,6 +874,17 @@ class DocumentViewSet(
 
         queryset = ancestors.filter(depth__gte=highest_readable.depth) | children
         queryset = queryset.order_by("path")
+        # Annotate if the current document is the highest ancestor for the user
+        queryset = queryset.annotate(
+            is_highest_ancestor_for_user=db.Case(
+                db.When(
+                    path=db.Value(highest_readable.path),
+                    then=db.Value(True),
+                ),
+                default=db.Value(False),
+                output_field=db.BooleanField(),
+            )
+        )
         queryset = self.annotate_user_roles(queryset)
         queryset = self.annotate_is_favorite(queryset)
 
@@ -902,6 +902,82 @@ class DocumentViewSet(
             utils.nest_tree(serializer.data, self.queryset.model.steplen)
         )
 
+    @drf.decorators.action(
+        detail=True,
+        methods=["post"],
+        permission_classes=[permissions.IsAuthenticated, permissions.AccessPermission],
+        url_path="duplicate",
+    )
+    @transaction.atomic
+    def duplicate(self, request, *args, **kwargs):
+        """
+        Duplicate a document and store the links to attached files in the duplicated
+        document to allow cross-access.
+
+        Optionally duplicates accesses if `with_accesses` is set to true
+        in the payload.
+        """
+        # Get document while checking permissions
+        document = self.get_object()
+
+        serializer = serializers.DocumentDuplicationSerializer(
+            data=request.data, partial=True
+        )
+        serializer.is_valid(raise_exception=True)
+        with_accesses = serializer.validated_data.get("with_accesses", False)
+
+        base64_yjs_content = document.content
+
+        # Duplicate the document instance
+        link_kwargs = (
+            {"link_reach": document.link_reach, "link_role": document.link_role}
+            if with_accesses
+            else {}
+        )
+        extracted_attachments = set(extract_attachments(document.content))
+        attachments = list(extracted_attachments & set(document.attachments))
+        duplicated_document = document.add_sibling(
+            "right",
+            title=capfirst(_("copy of {title}").format(title=document.title)),
+            content=base64_yjs_content,
+            attachments=attachments,
+            duplicated_from=document,
+            creator=request.user,
+            **link_kwargs,
+        )
+
+        # Always add the logged-in user as OWNER
+        accesses_to_create = [
+            models.DocumentAccess(
+                document=duplicated_document,
+                user=request.user,
+                role=models.RoleChoices.OWNER,
+            )
+        ]
+
+        # If accesses should be duplicated, add other users' accesses as per original document
+        if with_accesses:
+            original_accesses = models.DocumentAccess.objects.filter(
+                document=document
+            ).exclude(user=request.user)
+
+            accesses_to_create.extend(
+                models.DocumentAccess(
+                    document=duplicated_document,
+                    user_id=access.user_id,
+                    team=access.team,
+                    role=access.role,
+                )
+                for access in original_accesses
+            )
+
+        # Bulk create all the duplicated accesses
+        models.DocumentAccess.objects.bulk_create(accesses_to_create)
+
+        return drf_response.Response(
+            {"id": str(duplicated_document.id)}, status=status.HTTP_201_CREATED
+        )
+
     @drf.decorators.action(detail=True, methods=["get"], url_path="versions")
     def versions_list(self, request, *args, **kwargs):
         """
@@ -1051,7 +1127,7 @@ class DocumentViewSet(
 
         # Generate a generic yet unique filename to store the image in object storage
         file_id = uuid.uuid4()
-        extension = serializer.validated_data["expected_extension"]
+        ext = serializer.validated_data["expected_extension"]
 
         # Prepare metadata for storage
         extra_args = {
@@ -1063,7 +1139,7 @@ class DocumentViewSet(
             extra_args["Metadata"]["is_unsafe"] = "true"
             file_unsafe = "-unsafe"
 
-        key = f"{document.key_base}/{ATTACHMENTS_FOLDER:s}/{file_id!s}{file_unsafe}.{extension:s}"
+        key = f"{document.key_base}/{enums.ATTACHMENTS_FOLDER:s}/{file_id!s}{file_unsafe}.{ext:s}"
 
         file_name = serializer.validated_data["file_name"]
         if (
@@ -1083,15 +1159,19 @@ class DocumentViewSet(
             file, default_storage.bucket_name, key, ExtraArgs=extra_args
         )
 
+        # Make the attachment readable by document readers
+        document.attachments.append(key)
+        document.save()
+
         return drf.response.Response(
             {"file": f"{settings.MEDIA_URL:s}{key:s}"},
             status=drf.status.HTTP_201_CREATED,
         )
 
-    def _authorize_subrequest(self, request, pattern):
+    def _auth_get_original_url(self, request):
         """
-        Shared method to authorize access based on the original URL of an Nginx subrequest
-        and user permissions. Returns a dictionary of URL parameters if authorized.
+        Extracts and parses the original URL from the "HTTP_X_ORIGINAL_URL" header.
+        Raises PermissionDenied if the header is missing.
 
         The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
         See corresponding ingress configuration in Helm chart and read about the
@@ -1102,14 +1182,6 @@ class DocumentViewSet(
         to let this request go through (by returning a 200 code) or if we block it (by returning
         a 403 error). Note that we return 403 errors without any further details for security
         reasons.
-
-        Parameters:
-        - pattern: The regex pattern to extract identifiers from the URL.
-
-        Returns:
-        - A dictionary of URL parameters if the request is authorized.
-        Raises:
-        - PermissionDenied if authorization fails.
         """
         # Extract the original URL from the request header
         original_url = request.META.get("HTTP_X_ORIGINAL_URL")
@@ -1117,52 +1189,21 @@ class DocumentViewSet(
             logger.debug("Missing HTTP_X_ORIGINAL_URL header in subrequest")
             raise drf.exceptions.PermissionDenied()
 
-        parsed_url = urlparse(original_url)
-        match = pattern.search(parsed_url.path)
-
-        # If the path does not match the pattern, try to extract the parameters from the query
-        if not match:
-            match = pattern.search(parsed_url.query)
-
-        if not match:
-            logger.debug(
-                "Subrequest URL '%s' did not match pattern '%s'",
-                parsed_url.path,
-                pattern,
-            )
-            raise drf.exceptions.PermissionDenied()
+        logger.debug("Original url: '%s'", original_url)
+        return urlparse(original_url)
 
+    def _auth_get_url_params(self, pattern, fragment):
+        """
+        Extracts URL parameters from the given fragment using the specified regex pattern.
+        Raises PermissionDenied if parameters cannot be extracted.
+        """
+        match = pattern.search(fragment)
         try:
-            url_params = match.groupdict()
+            return match.groupdict()
         except (ValueError, AttributeError) as exc:
             logger.debug("Failed to extract parameters from subrequest URL: %s", exc)
             raise drf.exceptions.PermissionDenied() from exc
 
-        pk = url_params.get("pk")
-        if not pk:
-            logger.debug("Document ID (pk) not found in URL parameters: %s", url_params)
-            raise drf.exceptions.PermissionDenied()
-
-        # Fetch the document and check if the user has access
-        try:
-            document = models.Document.objects.get(pk=pk)
-        except models.Document.DoesNotExist as exc:
-            logger.debug("Document with ID '%s' does not exist", pk)
-            raise drf.exceptions.PermissionDenied() from exc
-
-        user_abilities = document.get_abilities(request.user)
-
-        if not user_abilities.get(self.action, False):
-            logger.debug(
-                "User '%s' lacks permission for document '%s'", request.user, pk
-            )
-            raise drf.exceptions.PermissionDenied()
-
-        logger.debug(
-            "Subrequest authorization successful. Extracted parameters: %s", url_params
-        )
-        return url_params, user_abilities, request.user.id
-
     @drf.decorators.action(detail=False, methods=["get"], url_path="media-auth")
     def media_auth(self, request, *args, **kwargs):
         """
@@ -1174,36 +1215,42 @@ class DocumentViewSet(
         annotation. The request will then be proxied to the object storage backend who will
         respond with the file after checking the signature included in headers.
         """
-        url_params, _, _ = self._authorize_subrequest(
-            request, MEDIA_STORAGE_URL_PATTERN
+        parsed_url = self._auth_get_original_url(request)
+        url_params = self._auth_get_url_params(
+            enums.MEDIA_STORAGE_URL_PATTERN, parsed_url.path
         )
-        pk, key = url_params.values()
+
+        user = request.user
+        key = f"{url_params['pk']:s}/{url_params['attachment']:s}"
+
+        # Look for a document to which the user has access and that includes this attachment
+        # We must look into all descendants of any document to which the user has access per se
+        readable_per_se_paths = (
+            self.queryset.readable_per_se(user)
+            .order_by("path")
+            .values_list("path", flat=True)
+        )
+
+        attachments_documents = (
+            self.queryset.filter(attachments__contains=[key])
+            .only("path")
+            .order_by("path")
+        )
+        readable_attachments_paths = filter_descendants(
+            [doc.path for doc in attachments_documents],
+            readable_per_se_paths,
+            skip_sorting=True,
+        )
+
+        if not readable_attachments_paths:
+            logger.debug("User '%s' lacks permission for attachment", user)
+            raise drf.exceptions.PermissionDenied()
 
         # Generate S3 authorization headers using the extracted URL parameters
-        request = utils.generate_s3_authorization_headers(f"{pk:s}/{key:s}")
+        request = utils.generate_s3_authorization_headers(key)
 
         return drf.response.Response("authorized", headers=request.headers, status=200)
 
-    @drf.decorators.action(detail=False, methods=["get"], url_path="collaboration-auth")
-    def collaboration_auth(self, request, *args, **kwargs):
-        """
-        This view is used by an Nginx subrequest to control access to a document's
-        collaboration server.
-        """
-        _, user_abilities, user_id = self._authorize_subrequest(
-            request, COLLABORATION_WS_URL_PATTERN
-        )
-        can_edit = user_abilities["partial_update"]
-
-        # Add the collaboration server secret token to the headers
-        headers = {
-            "Authorization": settings.COLLABORATION_SERVER_SECRET,
-            "X-Can-Edit": str(can_edit),
-            "X-User-Id": str(user_id),
-        }
-
-        return drf.response.Response("authorized", headers=headers, status=200)
-
     @drf.decorators.action(
         detail=True,
         methods=["post"],
@@ -1323,12 +1370,7 @@ class DocumentViewSet(
 
 class DocumentAccessViewSet(
     ResourceAccessViewsetMixin,
-    drf.mixins.CreateModelMixin,
-    drf.mixins.DestroyModelMixin,
-    drf.mixins.ListModelMixin,
-    drf.mixins.RetrieveModelMixin,
-    drf.mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
+    viewsets.ModelViewSet,
 ):
     """
     API ViewSet for all interactions with document accesses.
@@ -1360,6 +1402,32 @@ class DocumentAccessViewSet(
     queryset = models.DocumentAccess.objects.select_related("user").all()
     resource_field_name = "document"
     serializer_class = serializers.DocumentAccessSerializer
+    is_current_user_owner_or_admin = False
+
+    def get_queryset(self):
+        """Return the queryset according to the action."""
+        queryset = super().get_queryset()
+
+        if self.action == "list":
+            try:
+                document = models.Document.objects.get(pk=self.kwargs["resource_id"])
+            except models.Document.DoesNotExist:
+                return queryset.none()
+
+            roles = set(document.get_roles(self.request.user))
+            is_owner_or_admin = bool(roles.intersection(set(models.PRIVILEGED_ROLES)))
+            self.is_current_user_owner_or_admin = is_owner_or_admin
+            if not is_owner_or_admin:
+                # Return only the document owner access
+                queryset = queryset.filter(role__in=models.PRIVILEGED_ROLES)
+
+        return queryset
+
+    def get_serializer_class(self):
+        if self.action == "list" and not self.is_current_user_owner_or_admin:
+            return serializers.DocumentAccessLightSerializer
+
+        return super().get_serializer_class()
 
     def perform_create(self, serializer):
         """Add a new access to the document and send an email to the new added user."""

src/backend/core/enums.py

@@ -2,10 +2,26 @@
 Core application enums declaration
 """
 
-from django.conf import global_settings
+import re
+
+from django.conf import global_settings, settings
 from django.db import models
 from django.utils.translation import gettext_lazy as _
 
+ATTACHMENTS_FOLDER = "attachments"
+UUID_REGEX = (
+    r"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
+)
+FILE_EXT_REGEX = r"\.[a-zA-Z0-9]{1,10}"
+MEDIA_STORAGE_URL_PATTERN = re.compile(
+    f"{settings.MEDIA_URL:s}(?P<pk>{UUID_REGEX:s})/"
+    f"(?P<attachment>{ATTACHMENTS_FOLDER:s}/{UUID_REGEX:s}(?:-unsafe)?{FILE_EXT_REGEX:s})$"
+)
+MEDIA_STORAGE_URL_EXTRACT = re.compile(
+    f"{settings.MEDIA_URL:s}({UUID_REGEX}/{ATTACHMENTS_FOLDER}/{UUID_REGEX}{FILE_EXT_REGEX})"
+)
+
+
 # In Django's code base, `LANGUAGES` is set by default with all supported languages.
 # We can use it for the choice of languages which should not be limited to the few languages
 # active in the app.

src/backend/core/factories.py

@@ -13,6 +13,22 @@ from core import models
 
 fake = Faker()
 
+YDOC_HELLO_WORLD_BASE64 = (
+    "AR717vLVDgAHAQ5kb2N1bWVudC1zdG9yZQMKYmxvY2tHcm91cAcA9e7y1Q4AAw5ibG9ja0NvbnRh"
+    "aW5lcgcA9e7y1Q4BAwdoZWFkaW5nBwD17vLVDgIGBgD17vLVDgMGaXRhbGljAnt9hPXu8tUOBAVI"
+    "ZWxsb4b17vLVDgkGaXRhbGljBG51bGwoAPXu8tUOAg10ZXh0QWxpZ25tZW50AXcEbGVmdCgA9e7y"
+    "1Q4CBWxldmVsAX0BKAD17vLVDgECaWQBdyQwNGQ2MjM0MS04MzI2LTQyMzYtYTA4My00ODdlMjZm"
+    "YWQyMzAoAPXu8tUOAQl0ZXh0Q29sb3IBdwdkZWZhdWx0KAD17vLVDgEPYmFja2dyb3VuZENvbG9y"
+    "AXcHZGVmYXVsdIf17vLVDgEDDmJsb2NrQ29udGFpbmVyBwD17vLVDhADDmJ1bGxldExpc3RJdGVt"
+    "BwD17vLVDhEGBAD17vLVDhIBd4b17vLVDhMEYm9sZAJ7fYT17vLVDhQCb3KG9e7y1Q4WBGJvbGQE"
+    "bnVsbIT17vLVDhcCbGQoAPXu8tUOEQ10ZXh0QWxpZ25tZW50AXcEbGVmdCgA9e7y1Q4QAmlkAXck"
+    "ZDM1MWUwNjgtM2U1NS00MjI2LThlYTUtYWJiMjYzMTk4ZTJhKAD17vLVDhAJdGV4dENvbG9yAXcH"
+    "ZGVmYXVsdCgA9e7y1Q4QD2JhY2tncm91bmRDb2xvcgF3B2RlZmF1bHSH9e7y1Q4QAw5ibG9ja0Nv"
+    "bnRhaW5lcgcA9e7y1Q4eAwlwYXJhZ3JhcGgoAPXu8tUOHw10ZXh0QWxpZ25tZW50AXcEbGVmdCgA"
+    "9e7y1Q4eAmlkAXckODk3MDBjMDctZTBlMS00ZmUwLWFjYTItODQ5MzIwOWE3ZTQyKAD17vLVDh4J"
+    "dGV4dENvbG9yAXcHZGVmYXVsdCgA9e7y1Q4eD2JhY2tncm91bmRDb2xvcgF3B2RlZmF1bHQA"
+)
+
 
 class UserFactory(factory.django.DjangoModelFactory):
     """A factory to random users for testing purposes."""
@@ -75,7 +91,7 @@ class DocumentFactory(factory.django.DjangoModelFactory):
 
     title = factory.Sequence(lambda n: f"document{n}")
     excerpt = factory.Sequence(lambda n: f"excerpt{n}")
-    content = factory.Sequence(lambda n: f"content{n}")
+    content = YDOC_HELLO_WORLD_BASE64
     creator = factory.SubFactory(UserFactory)
     deleted_at = None
     link_reach = factory.fuzzy.FuzzyChoice(

src/backend/core/migrations/0020_remove_document_is_public_and_more.py

@@ -1,17 +0,0 @@
-# Generated by Django 5.1.7 on 2025-03-14 14:03
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("core", "0019_alter_user_language_default_to_null"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="document",
-            name="has_deleted_children",
-            field=models.BooleanField(default=False),
-        ),
-    ]

src/backend/core/migrations/0020_remove_is_public_add_field_attachments_and_duplicated_from.py

@@ -0,0 +1,77 @@
+# Generated by Django 5.1.4 on 2025-01-18 11:53
+import re
+
+import django.contrib.postgres.fields
+import django.db.models.deletion
+from django.core.files.storage import default_storage
+from django.db import migrations, models
+
+from botocore.exceptions import ClientError
+
+import core.models
+from core.utils import extract_attachments
+
+
+def populate_attachments_on_all_documents(apps, schema_editor):
+    """Populate "attachments" field on all existing documents in the database."""
+    Document = apps.get_model("core", "Document")
+
+    for document in Document.objects.all():
+        try:
+            response = default_storage.connection.meta.client.get_object(
+                Bucket=default_storage.bucket_name, Key=f"{document.pk!s}/file"
+            )
+        except (FileNotFoundError, ClientError):
+            pass
+        else:
+            content = response["Body"].read().decode("utf-8")
+            document.attachments = extract_attachments(content)
+            document.save(update_fields=["attachments"])
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("core", "0019_alter_user_language_default_to_null"),
+    ]
+
+    operations = [
+        # v2.0.0 was released so we can now remove BC field "is_public"
+        migrations.RemoveField(
+            model_name="document",
+            name="is_public",
+        ),
+        migrations.AlterModelManagers(
+            name="user",
+            managers=[
+                ("objects", core.models.UserManager()),
+            ],
+        ),
+        migrations.AddField(
+            model_name="document",
+            name="attachments",
+            field=django.contrib.postgres.fields.ArrayField(
+                base_field=models.CharField(max_length=255),
+                blank=True,
+                default=list,
+                editable=False,
+                null=True,
+                size=None,
+            ),
+        ),
+        migrations.AddField(
+            model_name="document",
+            name="duplicated_from",
+            field=models.ForeignKey(
+                blank=True,
+                editable=False,
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="duplicates",
+                to="core.document",
+            ),
+        ),
+        migrations.RunPython(
+            populate_attachments_on_all_documents,
+            reverse_code=migrations.RunPython.noop,
+        ),
+    ]

src/backend/core/models.py

@@ -13,6 +13,7 @@ from logging import getLogger
 from django.conf import settings
 from django.contrib.auth import models as auth_models
 from django.contrib.auth.base_user import AbstractBaseUser
+from django.contrib.postgres.fields import ArrayField
 from django.contrib.sites.models import Site
 from django.core import mail, validators
 from django.core.cache import cache
@@ -23,7 +24,7 @@ from django.db import models, transaction
 from django.db.models.functions import Left, Length
 from django.template.loader import render_to_string
 from django.utils import timezone
-from django.utils.functional import cached_property, lazy
+from django.utils.functional import cached_property
 from django.utils.translation import get_language, override
 from django.utils.translation import gettext_lazy as _
 
@@ -243,7 +244,7 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
 
     language = models.CharField(
         max_length=10,
-        choices=lazy(lambda: settings.LANGUAGES, tuple)(),
+        choices=settings.LANGUAGES,
         default=None,
         verbose_name=_("language"),
         help_text=_("The language in which the user wants to see the interface."),
@@ -363,10 +364,9 @@ class BaseAccess(BaseModel):
     class Meta:
         abstract = True
 
-    def _get_abilities(self, resource, user):
+    def _get_roles(self, resource, user):
         """
-        Compute and return abilities for a given user taking into account
-        the current state of the object.
+        Get the roles a user has on a resource.
         """
         roles = []
         if user.is_authenticated:
@@ -381,6 +381,15 @@ class BaseAccess(BaseModel):
                 except (self._meta.model.DoesNotExist, IndexError):
                     roles = []
 
+        return roles
+
+    def _get_abilities(self, resource, user):
+        """
+        Compute and return abilities for a given user taking into account
+        the current state of the object.
+        """
+        roles = self._get_roles(resource, user)
+
         is_owner_or_admin = bool(
             set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
         )
@@ -427,10 +436,12 @@ class DocumentQuerySet(MP_NodeQuerySet):
 
     def readable_per_se(self, user):
         """
-        Filters the queryset to return documents that the given user has
-        permission to read.
+        Filters the queryset to return documents on which the given user has
+        direct access, team access or link access. This will not return all the
+        documents that a user can read because it can be obtained via an ancestor.
         :param user: The user for whom readable documents are to be fetched.
-        :return: A queryset of documents readable by the user.
+        :return: A queryset of documents for which the user has direct access,
+            team access or link access.
         """
         if user.is_authenticated:
             return self.filter(
@@ -442,26 +453,15 @@ class DocumentQuerySet(MP_NodeQuerySet):
         return self.filter(link_reach=LinkReachChoices.PUBLIC)
 
 
-class DocumentManager(MP_NodeManager):
+class DocumentManager(MP_NodeManager.from_queryset(DocumentQuerySet)):
     """
     Custom manager for the Document model, enabling the use of the custom
     queryset methods directly from the model manager.
     """
 
     def get_queryset(self):
-        """
-        Overrides the default get_queryset method to return a custom queryset.
-        :return: An instance of DocumentQuerySet.
-        """
-        return DocumentQuerySet(self.model, using=self._db)
-
-    def readable_per_se(self, user):
-        """
-        Filters documents based on user permissions using the custom queryset.
-        :param user: The user for whom readable documents are to be fetched.
-        :return: A queryset of documents readable by the user.
-        """
-        return self.get_queryset().readable_per_se(user)
+        """Sets the custom queryset as the default."""
+        return self._queryset_class(self.model).order_by("path")
 
 
 class Document(MP_Node, BaseModel):
@@ -486,7 +486,21 @@ class Document(MP_Node, BaseModel):
     )
     deleted_at = models.DateTimeField(null=True, blank=True)
     ancestors_deleted_at = models.DateTimeField(null=True, blank=True)
-    has_deleted_children = models.BooleanField(default=False)
+    duplicated_from = models.ForeignKey(
+        "self",
+        on_delete=models.SET_NULL,
+        related_name="duplicates",
+        editable=False,
+        blank=True,
+        null=True,
+    )
+    attachments = ArrayField(
+        models.CharField(max_length=255),
+        default=list,
+        editable=False,
+        blank=True,
+        null=True,
+    )
 
     _content = None
 
@@ -547,12 +561,6 @@ class Document(MP_Node, BaseModel):
                 content_file = ContentFile(bytes_content)
                 default_storage.save(file_key, content_file)
 
-    def is_leaf(self):
-        """
-        :returns: True if the node is has no children
-        """
-        return not self.has_deleted_children and self.numchild == 0
-
     @property
     def key_base(self):
         """Key base of the location where the document is stored in object storage."""
@@ -741,6 +749,32 @@ class Document(MP_Node, BaseModel):
 
         return dict(links_definitions)  # Convert defaultdict back to a normal dict
 
+    def compute_ancestors_links(self, user):
+        """
+        Compute the ancestors links for the current document up to the highest readable ancestor.
+        """
+        ancestors = (
+            (self.get_ancestors() | self._meta.model.objects.filter(pk=self.pk))
+            .filter(ancestors_deleted_at__isnull=True)
+            .order_by("path")
+        )
+        highest_readable = ancestors.readable_per_se(user).only("depth").first()
+
+        if highest_readable is None:
+            return []
+
+        ancestors_links = []
+        paths_links_mapping = {}
+        for ancestor in ancestors.filter(depth__gte=highest_readable.depth):
+            ancestors_links.append(
+                {"link_reach": ancestor.link_reach, "link_role": ancestor.link_role}
+            )
+            paths_links_mapping[ancestor.path] = ancestors_links.copy()
+
+        ancestors_links = paths_links_mapping.get(self.path[: -self.steplen], [])
+
+        return ancestors_links
+
     def get_abilities(self, user, ancestors_links=None):
         """
         Compute and return abilities for a given user on the document.
@@ -748,7 +782,7 @@ class Document(MP_Node, BaseModel):
         if self.depth <= 1 or getattr(self, "is_highest_ancestor_for_user", False):
             ancestors_links = []
         elif ancestors_links is None:
-            ancestors_links = self.get_ancestors().values("link_reach", "link_role")
+            ancestors_links = self.compute_ancestors_links(user=user)
 
         roles = set(
             self.get_roles(user)
@@ -807,6 +841,7 @@ class Document(MP_Node, BaseModel):
             "cors_proxy": can_get,
             "descendants": can_get,
             "destroy": is_owner,
+            "duplicate": can_get,
             "favorite": can_get and user.is_authenticated,
             "link_configuration": is_owner_or_admin,
             "invite_owner": is_owner,
@@ -910,8 +945,7 @@ class Document(MP_Node, BaseModel):
 
         if self.depth > 1:
             self._meta.model.objects.filter(pk=self.get_parent().pk).update(
-                numchild=models.F("numchild") - 1,
-                has_deleted_children=True,
+                numchild=models.F("numchild") - 1
             )
 
         # Mark all descendants as soft deleted
@@ -1077,7 +1111,41 @@ class DocumentAccess(BaseAccess):
         """
         Compute and return abilities for a given user on the document access.
         """
-        return self._get_abilities(self.document, user)
+        roles = self._get_roles(self.document, user)
+        is_owner_or_admin = bool(set(roles).intersection(set(PRIVILEGED_ROLES)))
+        if self.role == RoleChoices.OWNER:
+            can_delete = (
+                RoleChoices.OWNER in roles
+                and self.document.accesses.filter(role=RoleChoices.OWNER).count() > 1
+            )
+            set_role_to = (
+                [RoleChoices.ADMIN, RoleChoices.EDITOR, RoleChoices.READER]
+                if can_delete
+                else []
+            )
+        else:
+            can_delete = is_owner_or_admin
+            set_role_to = []
+            if RoleChoices.OWNER in roles:
+                set_role_to.append(RoleChoices.OWNER)
+            if is_owner_or_admin:
+                set_role_to.extend(
+                    [RoleChoices.ADMIN, RoleChoices.EDITOR, RoleChoices.READER]
+                )
+
+        # Remove the current role as we don't want to propose it as an option
+        try:
+            set_role_to.remove(self.role)
+        except ValueError:
+            pass
+
+        return {
+            "destroy": can_delete,
+            "update": bool(set_role_to) and is_owner_or_admin,
+            "partial_update": bool(set_role_to) and is_owner_or_admin,
+            "retrieve": self.user and self.user.id == user.id or is_owner_or_admin,
+            "set_role_to": set_role_to,
+        }
 
 
 class Template(BaseModel):

src/backend/core/tests/documents/test_api_document_accesses.py

@@ -59,8 +59,32 @@ def test_api_document_accesses_list_authenticated_unrelated():
     }
 
 
+def test_api_document_accesses_list_unexisting_document():
+    """
+    Listing document accesses for an unexisting document should return an empty list.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/documents/{uuid4()!s}/accesses/")
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 0,
+        "next": None,
+        "previous": None,
+        "results": [],
+    }
+
+
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_list_authenticated_related(via, mock_user_teams):
+@pytest.mark.parametrize(
+    "role", [role for role in models.RoleChoices if role not in models.PRIVILEGED_ROLES]
+)
+def test_api_document_accesses_list_authenticated_related_non_privileged(
+    via, role, mock_user_teams
+):
     """
     Authenticated users should be able to list document accesses for a document
     to which they are directly related, whatever their role in the document.
@@ -70,24 +94,114 @@ def test_api_document_accesses_list_authenticated_related(via, mock_user_teams):
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory()
+    owner = factories.UserFactory()
+    accesses = []
+
+    document_access = factories.UserDocumentAccessFactory(
+        user=owner, role=models.RoleChoices.OWNER
+    )
+    accesses.append(document_access)
+    document = document_access.document
+    if via == USER:
+        models.DocumentAccess.objects.create(
+            document=document,
+            user=user,
+            role=role,
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        models.DocumentAccess.objects.create(
+            document=document,
+            team="lasuite",
+            role=role,
+        )
+
+    access1 = factories.TeamDocumentAccessFactory(document=document)
+    access2 = factories.UserDocumentAccessFactory(document=document)
+    accesses.append(access1)
+    accesses.append(access2)
+
+    # Accesses for other documents to which the user is related should not be listed either
+    other_access = factories.UserDocumentAccessFactory(user=user)
+    factories.UserDocumentAccessFactory(document=other_access.document)
+
+    response = client.get(
+        f"/api/v1.0/documents/{document.id!s}/accesses/",
+    )
+
+    # Return only owners
+    owners_accesses = [
+        access for access in accesses if access.role in models.PRIVILEGED_ROLES
+    ]
+    assert response.status_code == 200
+    content = response.json()
+    assert content["count"] == len(owners_accesses)
+    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
+        [
+            {
+                "id": str(access.id),
+                "user": {
+                    "id": None,
+                    "email": None,
+                    "full_name": access.user.full_name,
+                    "short_name": access.user.short_name,
+                }
+                if access.user
+                else None,
+                "team": access.team,
+                "role": access.role,
+                "abilities": access.get_abilities(user),
+            }
+            for access in owners_accesses
+        ],
+        key=lambda x: x["id"],
+    )
+
+    for access in content["results"]:
+        assert access["role"] in models.PRIVILEGED_ROLES
+
+
+@pytest.mark.parametrize("via", VIA)
+@pytest.mark.parametrize("role", models.PRIVILEGED_ROLES)
+def test_api_document_accesses_list_authenticated_related_privileged_roles(
+    via, role, mock_user_teams
+):
+    """
+    Authenticated users should be able to list document accesses for a document
+    to which they are directly related, whatever their role in the document.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    owner = factories.UserFactory()
+    accesses = []
+
+    document_access = factories.UserDocumentAccessFactory(
+        user=owner, role=models.RoleChoices.OWNER
+    )
+    accesses.append(document_access)
+    document = document_access.document
     user_access = None
     if via == USER:
         user_access = models.DocumentAccess.objects.create(
             document=document,
             user=user,
-            role=random.choice(models.RoleChoices.values),
+            role=role,
         )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         user_access = models.DocumentAccess.objects.create(
             document=document,
             team="lasuite",
-            role=random.choice(models.RoleChoices.values),
+            role=role,
         )
 
     access1 = factories.TeamDocumentAccessFactory(document=document)
     access2 = factories.UserDocumentAccessFactory(document=document)
+    accesses.append(access1)
+    accesses.append(access2)
 
     # Accesses for other documents to which the user is related should not be listed either
     other_access = factories.UserDocumentAccessFactory(user=user)
@@ -102,7 +216,7 @@ def test_api_document_accesses_list_authenticated_related(via, mock_user_teams):
 
     assert response.status_code == 200
     content = response.json()
-    assert len(content["results"]) == 3
+    assert len(content["results"]) == 4
     assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
         [
             {
@@ -126,6 +240,13 @@ def test_api_document_accesses_list_authenticated_related(via, mock_user_teams):
                 "role": access2.role,
                 "abilities": access2.get_abilities(user),
             },
+            {
+                "id": str(document_access.id),
+                "user": serializers.UserSerializer(instance=owner).data,
+                "team": "",
+                "role": models.RoleChoices.OWNER,
+                "abilities": document_access.get_abilities(user),
+            },
         ],
         key=lambda x: x["id"],
     )
@@ -184,7 +305,10 @@ def test_api_document_accesses_retrieve_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_teams):
+@pytest.mark.parametrize("role", models.RoleChoices)
+def test_api_document_accesses_retrieve_authenticated_related(
+    via, role, mock_user_teams
+):
     """
     A user who is related to a document should be allowed to retrieve the
     associated document user accesses.
@@ -196,10 +320,12 @@ def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_tea
 
     document = factories.DocumentFactory()
     if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user)
+        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamDocumentAccessFactory(document=document, team="lasuite")
+        factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role=role
+        )
 
     access = factories.UserDocumentAccessFactory(document=document)
 
@@ -207,16 +333,19 @@ def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_tea
         f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
     )
 
-    access_user = serializers.UserSerializer(instance=access.user).data
+    if not role in models.PRIVILEGED_ROLES:
+        assert response.status_code == 403
+    else:
+        access_user = serializers.UserSerializer(instance=access.user).data
 
-    assert response.status_code == 200
-    assert response.json() == {
-        "id": str(access.id),
-        "user": access_user,
-        "team": "",
-        "role": access.role,
-        "abilities": access.get_abilities(user),
-    }
+        assert response.status_code == 200
+        assert response.json() == {
+            "id": str(access.id),
+            "user": access_user,
+            "team": "",
+            "role": access.role,
+            "abilities": access.get_abilities(user),
+        }
 
 
 def test_api_document_accesses_update_anonymous():

src/backend/core/tests/documents/test_api_documents_attachment_upload.py

@@ -67,10 +67,12 @@ def test_api_documents_attachment_upload_anonymous_success():
     file_path = response.json()["file"]
     match = pattern.search(file_path)
     file_id = match.group(1)
-
     # Validate that file_id is a valid UUID
     uuid.UUID(file_id)
 
+    document.refresh_from_db()
+    assert document.attachments == [f"{document.id!s}/attachments/{file_id!s}.png"]
+
     # Now, check the metadata of the uploaded file
     key = file_path.replace("/media", "")
     file_head = default_storage.connection.meta.client.head_object(
@@ -112,6 +114,9 @@ def test_api_documents_attachment_upload_authenticated_forbidden(reach, role):
         "detail": "You do not have permission to perform this action."
     }
 
+    document.refresh_from_db()
+    assert document.attachments == []
+
 
 @pytest.mark.parametrize(
     "reach, role",
@@ -122,8 +127,8 @@ def test_api_documents_attachment_upload_authenticated_forbidden(reach, role):
 )
 def test_api_documents_attachment_upload_authenticated_success(reach, role):
     """
-    Autenticated who are not related to a document should be able to upload a file
-    if the link reach and role permit it.
+    Autenticated users who are not related to a document should be able to upload
+    a file when the link reach and role permit it.
     """
     user = factories.UserFactory()
 
@@ -145,6 +150,9 @@ def test_api_documents_attachment_upload_authenticated_success(reach, role):
     # Validate that file_id is a valid UUID
     uuid.UUID(file_id)
 
+    document.refresh_from_db()
+    assert document.attachments == [f"{document.id!s}/attachments/{file_id!s}.png"]
+
 
 @pytest.mark.parametrize("via", VIA)
 def test_api_documents_attachment_upload_reader(via, mock_user_teams):
@@ -175,6 +183,9 @@ def test_api_documents_attachment_upload_reader(via, mock_user_teams):
         "detail": "You do not have permission to perform this action."
     }
 
+    document.refresh_from_db()
+    assert document.attachments == []
+
 
 @pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
 @pytest.mark.parametrize("via", VIA)
@@ -211,6 +222,9 @@ def test_api_documents_attachment_upload_success(via, role, mock_user_teams):
     # Validate that file_id is a valid UUID
     uuid.UUID(file_id)
 
+    document.refresh_from_db()
+    assert document.attachments == [f"{document.id!s}/attachments/{file_id!s}.png"]
+
     # Now, check the metadata of the uploaded file
     key = file_path.replace("/media", "")
     file_head = default_storage.connection.meta.client.head_object(
@@ -236,6 +250,9 @@ def test_api_documents_attachment_upload_invalid(client):
     assert response.status_code == 400
     assert response.json() == {"file": ["No file was submitted."]}
 
+    document.refresh_from_db()
+    assert document.attachments == []
+
 
 def test_api_documents_attachment_upload_size_limit_exceeded(settings):
     """The uploaded file should not exceeed the maximum size in settings."""
@@ -258,6 +275,9 @@ def test_api_documents_attachment_upload_size_limit_exceeded(settings):
     assert response.status_code == 400
     assert response.json() == {"file": ["File size exceeds the maximum limit of 1 MB."]}
 
+    document.refresh_from_db()
+    assert document.attachments == []
+
 
 @pytest.mark.parametrize(
     "name,content,extension,content_type",
@@ -293,6 +313,11 @@ def test_api_documents_attachment_upload_fix_extension(
     match = pattern.search(file_path)
     file_id = match.group(1)
 
+    document.refresh_from_db()
+    assert document.attachments == [
+        f"{document.id!s}/attachments/{file_id!s}.{extension:s}"
+    ]
+
     assert "-unsafe" in file_id
     # Validate that file_id is a valid UUID
     file_id = file_id.replace("-unsafe", "")
@@ -323,6 +348,9 @@ def test_api_documents_attachment_upload_empty_file():
     assert response.status_code == 400
     assert response.json() == {"file": ["The submitted file is empty."]}
 
+    document.refresh_from_db()
+    assert document.attachments == []
+
 
 def test_api_documents_attachment_upload_unsafe():
     """A file with an unsafe mime type should be tagged as such."""
@@ -345,6 +373,9 @@ def test_api_documents_attachment_upload_unsafe():
     match = pattern.search(file_path)
     file_id = match.group(1)
 
+    document.refresh_from_db()
+    assert document.attachments == [f"{document.id!s}/attachments/{file_id!s}.exe"]
+
     assert "-unsafe" in file_id
     # Validate that file_id is a valid UUID
     file_id = file_id.replace("-unsafe", "")

src/backend/core/tests/documents/test_api_documents_duplicate.py

@@ -0,0 +1,207 @@
+"""
+Test file uploads API endpoint for users in impress's core app.
+"""
+
+import base64
+import uuid
+from io import BytesIO
+from urllib.parse import urlparse
+
+from django.conf import settings
+from django.core.files.storage import default_storage
+from django.utils import timezone
+
+import pycrdt
+import pytest
+import requests
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+PIXEL = (
+    b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00"
+    b"\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\nIDATx\x9cc\xf8\xff\xff?\x00\x05\xfe\x02\xfe"
+    b"\xa7V\xbd\xfa\x00\x00\x00\x00IEND\xaeB`\x82"
+)
+
+
+def get_image_refs(document_id):
+    """Generate an image key for testing."""
+    image_key = f"{document_id!s}/attachments/{uuid.uuid4()!s}.png"
+    default_storage.connection.meta.client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=image_key,
+        Body=BytesIO(PIXEL),
+        ContentType="image/png",
+    )
+    return image_key, f"http://localhost/media/{image_key:s}"
+
+
+def test_api_documents_duplicate_forbidden():
+    """A user who doesn't have read access to a document should not be allowed to duplicate it."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(
+        link_reach="restricted",
+        users=[factories.UserFactory()],
+        title="my document",
+    )
+
+    response = client.post(f"/api/v1.0/documents/{document.id!s}/duplicate/")
+
+    assert response.status_code == 403
+    assert models.Document.objects.count() == 1
+
+
+def test_api_documents_duplicate_anonymous():
+    """Anonymous users should not be able to duplicate documents even with read access."""
+
+    document = factories.DocumentFactory(link_reach="public")
+
+    response = APIClient().post(f"/api/v1.0/documents/{document.id!s}/duplicate/")
+
+    assert response.status_code == 401
+    assert models.Document.objects.count() == 1
+
+
+@pytest.mark.parametrize("index", range(3))
+def test_api_documents_duplicate_success(index):
+    """
+    Anonymous users should be able to retrieve attachments linked to a public document.
+    Accesses should not be duplicated if the user does not request it specifically.
+    Attachments that are not in the content should not be passed for access in the
+    duplicated document's "attachments" list.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document_ids = [uuid.uuid4() for _ in range(3)]
+    image_refs = [get_image_refs(doc_id) for doc_id in document_ids]
+
+    # Create document content with the first image only
+    ydoc = pycrdt.Doc()
+    fragment = pycrdt.XmlFragment(
+        [
+            pycrdt.XmlElement("img", {"src": image_refs[0][1]}),
+        ]
+    )
+    ydoc["document-store"] = fragment
+    update = ydoc.get_update()
+    base64_content = base64.b64encode(update).decode("utf-8")
+
+    # Create documents
+    document = factories.DocumentFactory(
+        id=document_ids[index],
+        content=base64_content,
+        link_reach="restricted",
+        users=[user, factories.UserFactory()],
+        title="document with an image",
+        attachments=[key for key, _ in image_refs],
+    )
+    factories.DocumentFactory(id=document_ids[(index + 1) % 3])
+    # Don't create document for third ID to check that it doesn't impact access to attachments
+
+    # Duplicate the document via the API endpoint
+    response = client.post(f"/api/v1.0/documents/{document.id}/duplicate/")
+
+    assert response.status_code == 201
+
+    duplicated_document = models.Document.objects.get(id=response.json()["id"])
+    assert duplicated_document.title == "Copy of document with an image"
+    assert duplicated_document.content == document.content
+    assert duplicated_document.creator == user
+    assert duplicated_document.link_reach == "restricted"
+    assert duplicated_document.link_role == "reader"
+    assert duplicated_document.duplicated_from == document
+    assert duplicated_document.attachments == [
+        image_refs[0][0]
+    ]  # Only the first image key
+    assert duplicated_document.get_parent() == document.get_parent()
+    assert duplicated_document.path == document.get_next_sibling().path
+
+    # Check that accesses were not duplicated.
+    # The user who did the duplicate is forced as owner
+    assert duplicated_document.accesses.count() == 1
+    access = duplicated_document.accesses.first()
+    assert access.user == user
+    assert access.role == "owner"
+
+    # Ensure access persists after the owner loses access to the original document
+    models.DocumentAccess.objects.filter(document=document).delete()
+    response = client.get(
+        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=image_refs[0][1]
+    )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    response = requests.get(
+        f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{image_refs[0][0]:s}",
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content == PIXEL
+
+    # Ensure the other images are not accessible
+    for _, url in image_refs[1:]:
+        response = client.get(
+            "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=url
+        )
+        assert response.status_code == 403
+
+
+def test_api_documents_duplicate_with_accesses():
+    """Accesses should be duplicated if the user requests it specifically."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(
+        users=[user],
+        title="document with accesses",
+    )
+    user_access = factories.UserDocumentAccessFactory(document=document)
+    team_access = factories.TeamDocumentAccessFactory(document=document)
+
+    # Duplicate the document via the API endpoint requesting to duplicate accesses
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/duplicate/",
+        {"with_accesses": True},
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+    duplicated_document = models.Document.objects.get(id=response.json()["id"])
+    assert duplicated_document.title == "Copy of document with accesses"
+    assert duplicated_document.content == document.content
+    assert duplicated_document.link_reach == document.link_reach
+    assert duplicated_document.link_role == document.link_role
+    assert duplicated_document.creator == user
+    assert duplicated_document.duplicated_from == document
+    assert duplicated_document.attachments == []
+
+    # Check that accesses were duplicated and the user who did the duplicate is forced as owner
+    duplicated_accesses = duplicated_document.accesses
+    assert duplicated_accesses.count() == 3
+    assert duplicated_accesses.get(user=user).role == "owner"
+    assert duplicated_accesses.get(user=user_access.user).role == user_access.role
+    assert duplicated_accesses.get(team=team_access.team).role == team_access.role

src/backend/core/tests/documents/test_api_documents_media_auth.py

@@ -1,10 +1,10 @@
 """
-Test file uploads API endpoint for users in impress's core app.
+Test media-auth authorization API endpoint in docs core app.
 """
 
-import uuid
 from io import BytesIO
 from urllib.parse import urlparse
+from uuid import uuid4
 
 from django.conf import settings
 from django.core.files.storage import default_storage
@@ -14,19 +14,32 @@ import pytest
 import requests
 from rest_framework.test import APIClient
 
-from core import factories
+from core import factories, models
 from core.tests.conftest import TEAM, USER, VIA
 
 pytestmark = pytest.mark.django_db
 
 
+def test_api_documents_media_auth_unkown_document():
+    """
+    Trying to download a media related to a document ID that does not exist
+    should not have the side effect to create it (no regression test).
+    """
+    original_url = f"http://localhost/media/{uuid4()!s}/attachments/{uuid4()!s}.jpg"
+
+    response = APIClient().get(
+        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 403
+    assert models.Document.objects.exists() is False
+
+
 def test_api_documents_media_auth_anonymous_public():
     """Anonymous users should be able to retrieve attachments linked to a public document"""
-    document = factories.DocumentFactory(link_reach="public")
-
-    filename = f"{uuid.uuid4()!s}.jpg"
-    key = f"{document.pk!s}/attachments/{filename:s}"
-
+    document_id = uuid4()
+    filename = f"{uuid4()!s}.jpg"
+    key = f"{document_id!s}/attachments/{filename:s}"
     default_storage.connection.meta.client.put_object(
         Bucket=default_storage.bucket_name,
         Key=key,
@@ -34,6 +47,8 @@ def test_api_documents_media_auth_anonymous_public():
         ContentType="text/plain",
     )
 
+    factories.DocumentFactory(id=document_id, link_reach="public", attachments=[key])
+
     original_url = f"http://localhost/media/{key:s}"
     response = APIClient().get(
         "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
@@ -66,8 +81,6 @@ def test_api_documents_media_auth_anonymous_public():
 
 def test_api_documents_media_auth_extensions():
     """Files with extensions of any format should work."""
-    document = factories.DocumentFactory(link_reach="public")
-
     extensions = [
         "c",
         "go",
@@ -76,10 +89,15 @@ def test_api_documents_media_auth_extensions():
         "woff2",
         "appimage",
     ]
+    document_id = uuid4()
+    keys = []
     for ext in extensions:
-        filename = f"{uuid.uuid4()!s}.{ext:s}"
-        key = f"{document.pk!s}/attachments/{filename:s}"
+        filename = f"{uuid4()!s}.{ext:s}"
+        keys.append(f"{document_id!s}/attachments/{filename:s}")
 
+    factories.DocumentFactory(link_reach="public", attachments=keys)
+
+    for key in keys:
         original_url = f"http://localhost/media/{key:s}"
         response = APIClient().get(
             "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
@@ -94,10 +112,11 @@ def test_api_documents_media_auth_anonymous_authenticated_or_restricted(reach):
     Anonymous users should not be allowed to retrieve attachments linked to a document
     with link reach set to authenticated or restricted.
     """
-    document = factories.DocumentFactory(link_reach=reach)
+    document_id = uuid4()
+    filename = f"{uuid4()!s}.jpg"
+    media_url = f"http://localhost/media/{document_id!s}/attachments/{filename:s}"
 
-    filename = f"{uuid.uuid4()!s}.jpg"
-    media_url = f"http://localhost/media/{document.pk!s}/attachments/{filename:s}"
+    factories.DocumentFactory(id=document_id, link_reach=reach)
 
     response = APIClient().get(
         "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
@@ -107,20 +126,16 @@ def test_api_documents_media_auth_anonymous_authenticated_or_restricted(reach):
     assert "Authorization" not in response
 
 
-@pytest.mark.parametrize("reach", ["public", "authenticated"])
-def test_api_documents_media_auth_authenticated_public_or_authenticated(reach):
+def test_api_documents_media_auth_anonymous_attachments():
     """
-    Authenticated users who are not related to a document should be able to retrieve
-    attachments related to a document with public or authenticated link reach.
+    Declaring a media key as original attachment on a document to which
+    a user has access should give them access to the attachment file
+    regardless of their access rights on the original document.
     """
-    document = factories.DocumentFactory(link_reach=reach)
-
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    filename = f"{uuid.uuid4()!s}.jpg"
-    key = f"{document.pk!s}/attachments/{filename:s}"
+    document_id = uuid4()
+    filename = f"{uuid4()!s}.jpg"
+    key = f"{document_id!s}/attachments/{filename:s}"
+    media_url = f"http://localhost/media/{key:s}"
 
     default_storage.connection.meta.client.put_object(
         Bucket=default_storage.bucket_name,
@@ -129,9 +144,73 @@ def test_api_documents_media_auth_authenticated_public_or_authenticated(reach):
         ContentType="text/plain",
     )
 
-    original_url = f"http://localhost/media/{key:s}"
+    factories.DocumentFactory(id=document_id, link_reach="restricted")
+
+    response = APIClient().get(
+        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
+    )
+    assert response.status_code == 403
+
+    # Let's now add a document to which the anonymous user has access and
+    # pointing to the attachment
+    parent = factories.DocumentFactory(link_reach="public")
+    factories.DocumentFactory(parent=parent, link_reach="restricted", attachments=[key])
+
+    response = APIClient().get(
+        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
+    )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
+    response = requests.get(
+        file_url,
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content.decode("utf-8") == "my prose"
+
+
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_media_auth_authenticated_public_or_authenticated(reach):
+    """
+    Authenticated users who are not related to a document should be able to retrieve
+    attachments related to a document with public or authenticated link reach.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document_id = uuid4()
+    filename = f"{uuid4()!s}.jpg"
+    key = f"{document_id!s}/attachments/{filename:s}"
+    media_url = f"http://localhost/media/{key:s}"
+
+    default_storage.connection.meta.client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=key,
+        Body=BytesIO(b"my prose"),
+        ContentType="text/plain",
+    )
+
+    factories.DocumentFactory(id=document_id, link_reach=reach, attachments=[key])
+
     response = client.get(
-        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
     )
 
     assert response.status_code == 200
@@ -164,14 +243,18 @@ def test_api_documents_media_auth_authenticated_restricted():
     Authenticated users who are not related to a document should not be allowed to
     retrieve attachments linked to a document that is restricted.
     """
-    document = factories.DocumentFactory(link_reach="restricted")
-
     user = factories.UserFactory(with_owned_document=True)
     client = APIClient()
     client.force_login(user)
 
-    filename = f"{uuid.uuid4()!s}.jpg"
-    media_url = f"http://localhost/media/{document.pk!s}/attachments/{filename:s}"
+    document_id = uuid4()
+    filename = f"{uuid4()!s}.jpg"
+    key = f"{document_id!s}/attachments/{filename:s}"
+    media_url = f"http://localhost/media/{key:s}"
+
+    factories.DocumentFactory(
+        id=document_id, link_reach="restricted", attachments=[key]
+    )
 
     response = client.get(
         "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
@@ -191,16 +274,10 @@ def test_api_documents_media_auth_related(via, mock_user_teams):
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory()
-    if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user)
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamDocumentAccessFactory(document=document, team="lasuite")
-
-    filename = f"{uuid.uuid4()!s}.jpg"
-    key = f"{document.pk!s}/attachments/{filename:s}"
-
+    document_id = uuid4()
+    filename = f"{uuid4()!s}.jpg"
+    key = f"{document_id!s}/attachments/{filename:s}"
+    media_url = f"http://localhost/media/{key:s}"
     default_storage.connection.meta.client.put_object(
         Bucket=default_storage.bucket_name,
         Key=key,
@@ -208,9 +285,17 @@ def test_api_documents_media_auth_related(via, mock_user_teams):
         ContentType="text/plain",
     )
 
-    original_url = f"http://localhost/media/{key:s}"
+    document = factories.DocumentFactory(
+        id=document_id, link_reach="restricted", attachments=[key]
+    )
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=document, user=user)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(document=document, team="lasuite")
+
     response = client.get(
-        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
     )
 
     assert response.status_code == 200

src/backend/core/tests/documents/test_api_documents_retrieve.py

@@ -37,6 +37,7 @@ def test_api_documents_retrieve_anonymous_public_standalone():
             "cors_proxy": True,
             "descendants": True,
             "destroy": False,
+            "duplicate": True,
             # Anonymous user can't favorite a document even with read access
             "favorite": False,
             "invite_owner": False,
@@ -103,6 +104,7 @@ def test_api_documents_retrieve_anonymous_public_parent():
             "descendants": True,
             "cors_proxy": True,
             "destroy": False,
+            "duplicate": True,
             # Anonymous user can't favorite a document even with read access
             "favorite": False,
             "invite_owner": False,
@@ -198,6 +200,7 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
             "descendants": True,
             "cors_proxy": True,
             "destroy": False,
+            "duplicate": True,
             "favorite": True,
             "invite_owner": False,
             "link_configuration": False,
@@ -271,6 +274,7 @@ def test_api_documents_retrieve_authenticated_public_or_authenticated_parent(rea
             "descendants": True,
             "cors_proxy": True,
             "destroy": False,
+            "duplicate": True,
             "favorite": True,
             "invite_owner": False,
             "link_configuration": False,
@@ -450,6 +454,7 @@ def test_api_documents_retrieve_authenticated_related_parent():
             "descendants": True,
             "cors_proxy": True,
             "destroy": access.role == "owner",
+            "duplicate": True,
             "favorite": True,
             "invite_owner": access.role == "owner",
             "link_configuration": access.role in ["administrator", "owner"],
@@ -784,7 +789,7 @@ def test_api_documents_retrieve_user_roles(django_assert_max_num_queries):
     )
     expected_roles = {access.role for access in accesses}
 
-    with django_assert_max_num_queries(12):
+    with django_assert_max_num_queries(14):
         response = client.get(f"/api/v1.0/documents/{document.id!s}/")
 
     assert response.status_code == 200

src/backend/core/tests/documents/test_api_documents_trashbin.py

@@ -81,6 +81,7 @@ def test_api_documents_trashbin_format():
             "descendants": True,
             "cors_proxy": True,
             "destroy": True,
+            "duplicate": True,
             "favorite": True,
             "invite_owner": True,
             "link_configuration": True,

src/backend/core/tests/documents/test_api_documents_update_extract_attachments.py

@@ -0,0 +1,154 @@
+"""
+Test extract-attachments on document update in docs core app.
+"""
+
+import base64
+from uuid import uuid4
+
+import pycrdt
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+
+pytestmark = pytest.mark.django_db
+
+
+def get_ydoc_with_mages(image_keys):
+    """Return a ydoc from text for testing purposes."""
+    ydoc = pycrdt.Doc()
+    fragment = pycrdt.XmlFragment(
+        [
+            pycrdt.XmlElement("img", {"src": f"http://localhost/media/{key:s}"})
+            for key in image_keys
+        ]
+    )
+    ydoc["document-store"] = fragment
+    update = ydoc.get_update()
+    return base64.b64encode(update).decode("utf-8")
+
+
+def test_api_documents_update_new_attachment_keys_anonymous(django_assert_num_queries):
+    """
+    When an anonymous user updates a document, the attachment keys extracted from the
+    updated content should be added to the list of "attachments" ot the document if these
+    attachments are already readable by anonymous users.
+    """
+    image_keys = [f"{uuid4()!s}/attachments/{uuid4()!s}.png" for _ in range(4)]
+    document = factories.DocumentFactory(
+        content=get_ydoc_with_mages(image_keys[:1]),
+        attachments=[image_keys[0]],
+        link_reach="public",
+        link_role="editor",
+    )
+
+    factories.DocumentFactory(attachments=[image_keys[1]], link_reach="public")
+    factories.DocumentFactory(attachments=[image_keys[2]], link_reach="authenticated")
+    factories.DocumentFactory(attachments=[image_keys[3]], link_reach="restricted")
+    expected_keys = {image_keys[i] for i in [0, 1]}
+
+    with django_assert_num_queries(9):
+        response = APIClient().put(
+            f"/api/v1.0/documents/{document.id!s}/",
+            {"content": get_ydoc_with_mages(image_keys)},
+            format="json",
+        )
+    assert response.status_code == 200
+
+    document.refresh_from_db()
+    assert set(document.attachments) == expected_keys
+
+    # Check that the db query to check attachments readability for extracted
+    # keys is not done if the content changes but no new keys are found
+    with django_assert_num_queries(5):
+        response = APIClient().put(
+            f"/api/v1.0/documents/{document.id!s}/",
+            {"content": get_ydoc_with_mages(image_keys[:2])},
+            format="json",
+        )
+    assert response.status_code == 200
+
+    document.refresh_from_db()
+    assert len(document.attachments) == 2
+    assert set(document.attachments) == expected_keys
+
+
+def test_api_documents_update_new_attachment_keys_authenticated(
+    django_assert_num_queries,
+):
+    """
+    When an authenticated user updates a document, the attachment keys extracted from the
+    updated content should be added to the list of "attachments" ot the document if these
+    attachments are already readable by the editing user.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    image_keys = [f"{uuid4()!s}/attachments/{uuid4()!s}.png" for _ in range(5)]
+    document = factories.DocumentFactory(
+        content=get_ydoc_with_mages(image_keys[:1]),
+        attachments=[image_keys[0]],
+        users=[(user, "editor")],
+    )
+
+    factories.DocumentFactory(attachments=[image_keys[1]], link_reach="public")
+    factories.DocumentFactory(attachments=[image_keys[2]], link_reach="authenticated")
+    factories.DocumentFactory(attachments=[image_keys[3]], link_reach="restricted")
+    factories.DocumentFactory(attachments=[image_keys[4]], users=[user])
+    expected_keys = {image_keys[i] for i in [0, 1, 2, 4]}
+
+    with django_assert_num_queries(10):
+        response = client.put(
+            f"/api/v1.0/documents/{document.id!s}/",
+            {"content": get_ydoc_with_mages(image_keys)},
+            format="json",
+        )
+    assert response.status_code == 200
+
+    document.refresh_from_db()
+    assert set(document.attachments) == expected_keys
+
+    # Check that the db query to check attachments readability for extracted
+    # keys is not done if the content changes but no new keys are found
+    with django_assert_num_queries(6):
+        response = client.put(
+            f"/api/v1.0/documents/{document.id!s}/",
+            {"content": get_ydoc_with_mages(image_keys[:2])},
+            format="json",
+        )
+    assert response.status_code == 200
+
+    document.refresh_from_db()
+    assert len(document.attachments) == 4
+    assert set(document.attachments) == expected_keys
+
+
+def test_api_documents_update_new_attachment_keys_duplicate():
+    """
+    Duplicate keys in the content should not result in duplicates in the document's attachments.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    image_key1 = f"{uuid4()!s}/attachments/{uuid4()!s}.png"
+    image_key2 = f"{uuid4()!s}/attachments/{uuid4()!s}.png"
+    document = factories.DocumentFactory(
+        content=get_ydoc_with_mages([image_key1]),
+        attachments=[image_key1],
+        users=[(user, "editor")],
+    )
+
+    factories.DocumentFactory(attachments=[image_key2], users=[user])
+
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/",
+        {"content": get_ydoc_with_mages([image_key1, image_key2, image_key2])},
+        format="json",
+    )
+    assert response.status_code == 200
+
+    document.refresh_from_db()
+    assert len(document.attachments) == 2
+    assert set(document.attachments) == {image_key1, image_key2}

src/backend/core/tests/migrations/test_0018_update_blank_title.py

@@ -1,35 +0,0 @@
-import pytest
-
-from core import factories
-
-
-@pytest.mark.django_db
-def test_update_blank_title_migration(migrator):
-    """
-    Test that the migration fixes the titles of documents that are
-    "Untitled document", "Unbenanntes Dokument" or "Document sans titre"
-    """
-    migrator.apply_initial_migration(("core", "0017_add_fields_for_soft_delete"))
-
-    english_doc = factories.DocumentFactory(title="Untitled document")
-    german_doc = factories.DocumentFactory(title="Unbenanntes Dokument")
-    french_doc = factories.DocumentFactory(title="Document sans titre")
-    other_doc = factories.DocumentFactory(title="My document")
-
-    assert english_doc.title == "Untitled document"
-    assert german_doc.title == "Unbenanntes Dokument"
-    assert french_doc.title == "Document sans titre"
-    assert other_doc.title == "My document"
-
-    # Apply the migration
-    migrator.apply_tested_migration(("core", "0018_update_blank_title"))
-
-    english_doc.refresh_from_db()
-    german_doc.refresh_from_db()
-    french_doc.refresh_from_db()
-    other_doc.refresh_from_db()
-
-    assert english_doc.title == None
-    assert german_doc.title == None
-    assert french_doc.title == None
-    assert other_doc.title == "My document"

src/backend/core/tests/migrations/test_migrations_0018_update_blank_title.py

@@ -0,0 +1,47 @@
+import pytest
+
+from core import models
+
+
+@pytest.mark.django_db
+def test_update_blank_title_migration(migrator):
+    """
+    Test that the migration fixes the titles of documents that are
+    "Untitled document", "Unbenanntes Dokument" or "Document sans titre"
+    """
+    old_state = migrator.apply_initial_migration(
+        ("core", "0017_add_fields_for_soft_delete")
+    )
+    OldDocument = old_state.apps.get_model("core", "Document")
+
+    old_english_doc = OldDocument.objects.create(
+        title="Untitled document", depth=1, path="0000001"
+    )
+    old_german_doc = OldDocument.objects.create(
+        title="Unbenanntes Dokument", depth=1, path="0000002"
+    )
+    old_french_doc = OldDocument.objects.create(
+        title="Document sans titre", depth=1, path="0000003"
+    )
+    old_other_doc = OldDocument.objects.create(
+        title="My document", depth=1, path="0000004"
+    )
+
+    assert old_english_doc.title == "Untitled document"
+    assert old_german_doc.title == "Unbenanntes Dokument"
+    assert old_french_doc.title == "Document sans titre"
+    assert old_other_doc.title == "My document"
+
+    # Apply the migration
+    new_state = migrator.apply_tested_migration(("core", "0018_update_blank_title"))
+    NewDocument = new_state.apps.get_model("core", "Document")
+
+    new_english_doc = NewDocument.objects.get(pk=old_english_doc.pk)
+    new_german_doc = NewDocument.objects.get(pk=old_german_doc.pk)
+    new_french_doc = NewDocument.objects.get(pk=old_french_doc.pk)
+    new_other_doc = NewDocument.objects.get(pk=old_other_doc.pk)
+
+    assert new_english_doc.title == None
+    assert new_german_doc.title == None
+    assert new_french_doc.title == None
+    assert new_other_doc.title == "My document"

src/backend/core/tests/migrations/test_migrations_0020_remove_is_public_add_field_attachments_and_duplicated_from.py

@@ -0,0 +1,54 @@
+import base64
+import uuid
+
+from django.core.files.base import ContentFile
+from django.core.files.storage import default_storage
+
+import pycrdt
+import pytest
+
+from core import models
+
+
+@pytest.mark.django_db
+def test_populate_attachments_on_all_documents(migrator):
+    """Test that the migration populates attachments on existing documents."""
+    old_state = migrator.apply_initial_migration(
+        ("core", "0019_alter_user_language_default_to_null")
+    )
+    OldDocument = old_state.apps.get_model("core", "Document")
+
+    old_doc_without_attachments = OldDocument.objects.create(
+        title="Doc without attachments", depth=1, path="0000002"
+    )
+    old_doc_with_attachments = OldDocument.objects.create(
+        title="Doc with attachments", depth=1, path="0000001"
+    )
+
+    # Create document content with an image
+    file_key = f"{old_doc_with_attachments.id!s}/file"
+    image_key = f"{old_doc_with_attachments.id!s}/attachments/{uuid.uuid4()!s}.png"
+    ydoc = pycrdt.Doc()
+    fragment = pycrdt.XmlFragment(
+        [pycrdt.XmlElement("img", {"src": f"http://localhost/media/{image_key:s}"})]
+    )
+    ydoc["document-store"] = fragment
+    update = ydoc.get_update()
+    base64_content = base64.b64encode(update).decode("utf-8")
+    bytes_content = base64_content.encode("utf-8")
+    content_file = ContentFile(bytes_content)
+    default_storage.save(file_key, content_file)
+
+    # Apply the migration
+    new_state = migrator.apply_tested_migration(
+        ("core", "0020_remove_is_public_add_field_attachments_and_duplicated_from")
+    )
+    NewDocument = new_state.apps.get_model("core", "Document")
+
+    new_doc_with_attachments = NewDocument.objects.get(pk=old_doc_with_attachments.pk)
+    new_doc_without_attachments = NewDocument.objects.get(
+        pk=old_doc_without_attachments.pk
+    )
+
+    assert new_doc_without_attachments.attachments == []
+    assert new_doc_with_attachments.attachments == [image_key]

src/backend/core/tests/test_models_document_accesses.py

@@ -7,7 +7,7 @@ from django.core.exceptions import ValidationError
 
 import pytest
 
-from core import factories
+from core import factories, models
 
 pytestmark = pytest.mark.django_db
 
@@ -294,7 +294,7 @@ def test_models_document_access_get_abilities_for_editor_of_owner():
     abilities = access.get_abilities(user)
     assert abilities == {
         "destroy": False,
-        "retrieve": True,
+        "retrieve": False,
         "update": False,
         "partial_update": False,
         "set_role_to": [],
@@ -311,7 +311,7 @@ def test_models_document_access_get_abilities_for_editor_of_administrator():
     abilities = access.get_abilities(user)
     assert abilities == {
         "destroy": False,
-        "retrieve": True,
+        "retrieve": False,
         "update": False,
         "partial_update": False,
         "set_role_to": [],
@@ -333,7 +333,7 @@ def test_models_document_access_get_abilities_for_editor_of_editor_user(
 
     assert abilities == {
         "destroy": False,
-        "retrieve": True,
+        "retrieve": False,
         "update": False,
         "partial_update": False,
         "set_role_to": [],
@@ -353,7 +353,7 @@ def test_models_document_access_get_abilities_for_reader_of_owner():
     abilities = access.get_abilities(user)
     assert abilities == {
         "destroy": False,
-        "retrieve": True,
+        "retrieve": False,
         "update": False,
         "partial_update": False,
         "set_role_to": [],
@@ -370,7 +370,7 @@ def test_models_document_access_get_abilities_for_reader_of_administrator():
     abilities = access.get_abilities(user)
     assert abilities == {
         "destroy": False,
-        "retrieve": True,
+        "retrieve": False,
         "update": False,
         "partial_update": False,
         "set_role_to": [],
@@ -392,7 +392,7 @@ def test_models_document_access_get_abilities_for_reader_of_reader_user(
 
     assert abilities == {
         "destroy": False,
-        "retrieve": True,
+        "retrieve": False,
         "update": False,
         "partial_update": False,
         "set_role_to": [],
@@ -412,8 +412,16 @@ def test_models_document_access_get_abilities_preset_role(django_assert_num_quer
 
     assert abilities == {
         "destroy": False,
-        "retrieve": True,
+        "retrieve": False,
         "update": False,
         "partial_update": False,
         "set_role_to": [],
     }
+
+
+@pytest.mark.parametrize("role", models.RoleChoices)
+def test_models_document_access_get_abilities_retrieve_own_access(role):
+    """Check abilities of self access for the owner of a document."""
+    access = factories.UserDocumentAccessFactory(role=role)
+    abilities = access.get_abilities(access.user)
+    assert abilities["retrieve"] is True

src/backend/core/tests/test_models_documents.py

@@ -161,6 +161,7 @@ def test_models_documents_get_abilities_forbidden(
         "descendants": False,
         "cors_proxy": False,
         "destroy": False,
+        "duplicate": False,
         "favorite": False,
         "invite_owner": False,
         "media_auth": False,
@@ -220,6 +221,7 @@ def test_models_documents_get_abilities_reader(
         "descendants": True,
         "cors_proxy": True,
         "destroy": False,
+        "duplicate": True,
         "favorite": is_authenticated,
         "invite_owner": False,
         "link_configuration": False,
@@ -281,6 +283,7 @@ def test_models_documents_get_abilities_editor(
         "descendants": True,
         "cors_proxy": True,
         "destroy": False,
+        "duplicate": True,
         "favorite": is_authenticated,
         "invite_owner": False,
         "link_configuration": False,
@@ -331,6 +334,7 @@ def test_models_documents_get_abilities_owner(django_assert_num_queries):
         "descendants": True,
         "cors_proxy": True,
         "destroy": True,
+        "duplicate": True,
         "favorite": True,
         "invite_owner": True,
         "link_configuration": True,
@@ -378,6 +382,7 @@ def test_models_documents_get_abilities_administrator(django_assert_num_queries)
         "descendants": True,
         "cors_proxy": True,
         "destroy": False,
+        "duplicate": True,
         "favorite": True,
         "invite_owner": False,
         "link_configuration": True,
@@ -428,6 +433,7 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         "descendants": True,
         "cors_proxy": True,
         "destroy": False,
+        "duplicate": True,
         "favorite": True,
         "invite_owner": False,
         "link_configuration": False,
@@ -485,6 +491,7 @@ def test_models_documents_get_abilities_reader_user(
         "descendants": True,
         "cors_proxy": True,
         "destroy": False,
+        "duplicate": True,
         "favorite": True,
         "invite_owner": False,
         "link_configuration": False,
@@ -540,6 +547,7 @@ def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
         "descendants": True,
         "cors_proxy": True,
         "destroy": False,
+        "duplicate": True,
         "favorite": True,
         "invite_owner": False,
         "link_configuration": False,
@@ -1299,45 +1307,45 @@ def test_models_documents_get_select_options(ancestors_links, select_options):
     assert models.LinkReachChoices.get_select_options(ancestors_links) == select_options
 
 
-def test_models_documents_children_create_after_sibling_deletion():
-    """
-    It should be possible to create a new child after all children have been deleted.
-    """
-
-    root = factories.DocumentFactory()
-    assert root.numchild == 0
-    assert root.has_deleted_children is False
-    assert root.is_leaf() is True
-    child1 = factories.DocumentFactory(parent=root)
-    child2 = factories.DocumentFactory(parent=root)
-
-    root.refresh_from_db()
-    assert root.numchild == 2
-    assert root.has_deleted_children is False
-    assert root.is_leaf() is False
-
-    child1.soft_delete()
-    child2.soft_delete()
-    root.refresh_from_db()
-    assert root.numchild == 0
-    assert root.has_deleted_children is True
-    assert root.is_leaf() is False
-
-    factories.DocumentFactory(parent=root)
-    root.refresh_from_db()
-    assert root.numchild == 1
-    assert root.has_deleted_children is True
-    assert root.is_leaf() is False
+def test_models_documents_compute_ancestors_links_no_highest_readable():
+    """Test the compute_ancestors_links method."""
+    document = factories.DocumentFactory(link_reach="public")
+    assert document.compute_ancestors_links(user=AnonymousUser()) == []
 
 
-def test_models_documents_has_deleted_children():
-    """
-    A document should have its has_deleted_children attribute set to True if one of its children
-    has been solf deleted no matter if numchild is 0 or not.
-    """
-    root = factories.DocumentFactory()
-    child = factories.DocumentFactory(parent=root)
-    assert root.has_deleted_children is False
-    child.soft_delete()
-    root.refresh_from_db()
-    assert root.has_deleted_children is True
+def test_models_documents_compute_ancestors_links_highest_readable(
+    django_assert_num_queries,
+):
+    """Test the compute_ancestors_links method."""
+    user = factories.UserFactory()
+    other_user = factories.UserFactory()
+    root = factories.DocumentFactory(
+        link_reach="restricted", link_role="reader", users=[user]
+    )
+
+    factories.DocumentFactory(
+        parent=root, link_reach="public", link_role="reader", users=[user]
+    )
+    child2 = factories.DocumentFactory(
+        parent=root,
+        link_reach="authenticated",
+        link_role="editor",
+        users=[user, other_user],
+    )
+    child3 = factories.DocumentFactory(
+        parent=child2,
+        link_reach="authenticated",
+        link_role="reader",
+        users=[user, other_user],
+    )
+
+    with django_assert_num_queries(2):
+        assert child3.compute_ancestors_links(user=user) == [
+            {"link_reach": root.link_reach, "link_role": root.link_role},
+            {"link_reach": child2.link_reach, "link_role": child2.link_role},
+        ]
+
+    with django_assert_num_queries(2):
+        assert child3.compute_ancestors_links(user=other_user) == [
+            {"link_reach": child2.link_reach, "link_role": child2.link_role},
+        ]

src/backend/core/tests/test_utils.py

@@ -0,0 +1,77 @@
+"""Test util base64_yjs_to_text."""
+
+import base64
+import uuid
+
+import pycrdt
+
+from core import utils
+
+# This base64 string is an example of what is saved in the database.
+# This base64 is generated from the blocknote editor, it contains
+# the text \n# *Hello* \n- w**or**ld
+TEST_BASE64_STRING = (
+    "AR717vLVDgAHAQ5kb2N1bWVudC1zdG9yZQMKYmxvY2tHcm91cAcA9e7y1Q4AAw5ibG9ja0NvbnRh"
+    "aW5lcgcA9e7y1Q4BAwdoZWFkaW5nBwD17vLVDgIGBgD17vLVDgMGaXRhbGljAnt9hPXu8tUOBAVI"
+    "ZWxsb4b17vLVDgkGaXRhbGljBG51bGwoAPXu8tUOAg10ZXh0QWxpZ25tZW50AXcEbGVmdCgA9e7y"
+    "1Q4CBWxldmVsAX0BKAD17vLVDgECaWQBdyQwNGQ2MjM0MS04MzI2LTQyMzYtYTA4My00ODdlMjZm"
+    "YWQyMzAoAPXu8tUOAQl0ZXh0Q29sb3IBdwdkZWZhdWx0KAD17vLVDgEPYmFja2dyb3VuZENvbG9y"
+    "AXcHZGVmYXVsdIf17vLVDgEDDmJsb2NrQ29udGFpbmVyBwD17vLVDhADDmJ1bGxldExpc3RJdGVt"
+    "BwD17vLVDhEGBAD17vLVDhIBd4b17vLVDhMEYm9sZAJ7fYT17vLVDhQCb3KG9e7y1Q4WBGJvbGQE"
+    "bnVsbIT17vLVDhcCbGQoAPXu8tUOEQ10ZXh0QWxpZ25tZW50AXcEbGVmdCgA9e7y1Q4QAmlkAXck"
+    "ZDM1MWUwNjgtM2U1NS00MjI2LThlYTUtYWJiMjYzMTk4ZTJhKAD17vLVDhAJdGV4dENvbG9yAXcH"
+    "ZGVmYXVsdCgA9e7y1Q4QD2JhY2tncm91bmRDb2xvcgF3B2RlZmF1bHSH9e7y1Q4QAw5ibG9ja0Nv"
+    "bnRhaW5lcgcA9e7y1Q4eAwlwYXJhZ3JhcGgoAPXu8tUOHw10ZXh0QWxpZ25tZW50AXcEbGVmdCgA"
+    "9e7y1Q4eAmlkAXckODk3MDBjMDctZTBlMS00ZmUwLWFjYTItODQ5MzIwOWE3ZTQyKAD17vLVDh4J"
+    "dGV4dENvbG9yAXcHZGVmYXVsdCgA9e7y1Q4eD2JhY2tncm91bmRDb2xvcgF3B2RlZmF1bHQA"
+)
+
+
+def test_utils_base64_yjs_to_text():
+    """Test extract text from saved yjs document"""
+    assert utils.base64_yjs_to_text(TEST_BASE64_STRING) == "Hello w or ld"
+
+
+def test_utils_base64_yjs_to_xml():
+    """Test extract xml from saved yjs document"""
+    content = utils.base64_yjs_to_xml(TEST_BASE64_STRING)
+    assert (
+        '<heading textAlignment="left" level="1"><italic>Hello</italic></heading>'
+        in content
+        or '<heading level="1" textAlignment="left"><italic>Hello</italic></heading>'
+        in content
+    )
+    assert (
+        '<bulletListItem textAlignment="left">w<bold>or</bold>ld</bulletListItem>'
+        in content
+    )
+
+
+def test_utils_extract_attachments():
+    """
+    All attachment keys in the document content should be extracted.
+    """
+    document_id = uuid.uuid4()
+    image_key1 = f"{document_id!s}/attachments/{uuid.uuid4()!s}.png"
+    image_url1 = f"http://localhost/media/{image_key1:s}"
+
+    image_key2 = f"{uuid.uuid4()!s}/attachments/{uuid.uuid4()!s}.png"
+    image_url2 = f"http://localhost/{image_key2:s}"
+
+    image_key3 = f"{uuid.uuid4()!s}/attachments/{uuid.uuid4()!s}.png"
+    image_url3 = f"http://localhost/media/{image_key3:s}"
+
+    ydoc = pycrdt.Doc()
+    frag = pycrdt.XmlFragment(
+        [
+            pycrdt.XmlElement("img", {"src": image_url1}),
+            pycrdt.XmlElement("img", {"src": image_url2}),
+            pycrdt.XmlElement("p", {}, [pycrdt.XmlText(image_url3)]),
+        ]
+    )
+    ydoc["document-store"] = frag
+
+    update = ydoc.get_update()
+    base64_string = base64.b64encode(update).decode("utf-8")
+    # image_key2 is missing the "/media/" part and shouldn't get extracted
+    assert utils.extract_attachments(base64_string) == [image_key1, image_key3]

src/backend/core/tests/test_utils_filter_descendants.py

@@ -0,0 +1,163 @@
+"""
+Unit tests for the filter_root_paths utility function.
+"""
+
+from core.utils import filter_descendants
+
+
+def test_utils_filter_descendants_success():
+    """
+    The `filter_descendants` function should correctly identify descendant paths
+    from a given list of paths and root paths.
+
+    This test verifies that the function returns only the paths that have a prefix
+    matching one of the root paths.
+    """
+    paths = [
+        "0001",
+        "00010001",
+        "000100010001",
+        "000100010002",
+        "000100020001",
+        "000100020002",
+        "0002",
+        "00020001",
+        "00020002",
+        "00030001",
+        "000300010001",
+        "00030002",
+        "0004",
+        "000400010003",
+        "0004000100030001",
+        "000400010004",
+    ]
+    root_paths = [
+        "0001",
+        "0002",
+        "000400010003",
+    ]
+    filtered_paths = filter_descendants(paths, root_paths, skip_sorting=True)
+    assert filtered_paths == [
+        "0001",
+        "00010001",
+        "000100010001",
+        "000100010002",
+        "000100020001",
+        "000100020002",
+        "0002",
+        "00020001",
+        "00020002",
+        "000400010003",
+        "0004000100030001",
+    ]
+
+
+def test_utils_filter_descendants_sorting():
+    """
+    The `filter_descendants` function should handle unsorted input when sorting is enabled.
+
+    This test verifies that the function sorts the input if sorting is not skipped
+    and still correctly identifies accessible descendant paths.
+    """
+    paths = [
+        "000300010001",
+        "000100010002",
+        "0001",
+        "00010001",
+        "000100010001",
+        "000100020002",
+        "000100020001",
+        "0002",
+        "00020001",
+        "00020002",
+        "00030001",
+        "00030002",
+        "0004000100030001",
+        "0004",
+        "000400010003",
+        "000400010004",
+    ]
+    root_paths = [
+        "0002",
+        "000400010003",
+        "0001",
+    ]
+    filtered_paths = filter_descendants(paths, root_paths)
+    assert filtered_paths == [
+        "0001",
+        "00010001",
+        "000100010001",
+        "000100010002",
+        "000100020001",
+        "000100020002",
+        "0002",
+        "00020001",
+        "00020002",
+        "000400010003",
+        "0004000100030001",
+    ]
+
+    filtered_paths = filter_descendants(paths, root_paths, skip_sorting=True)
+    assert filtered_paths == [
+        "0001",
+        "00010001",
+        "000100010001",
+        "000100010002",
+        "000100020001",
+        "000100020002",
+        "0002",
+        "00020001",
+        "00020002",
+        "000400010003",
+        "0004000100030001",
+    ]
+
+
+def test_utils_filter_descendants_empty():
+    """
+    The function should return an empty list if one or both inputs are empty.
+    """
+    assert not filter_descendants([], ["0001"])
+    assert not filter_descendants(["0001"], [])
+    assert not filter_descendants([], [])
+
+
+def test_utils_filter_descendants_no_match():
+    """
+    The function should return an empty list if no path starts with any root path.
+    """
+    paths = ["0001", "0002", "0003"]
+    root_paths = ["0004", "0005"]
+    assert not filter_descendants(paths, root_paths, skip_sorting=True)
+
+
+def test_utils_filter_descendants_exact_match():
+    """
+    The function should include paths that exactly match a root path.
+    """
+    paths = ["0001", "0002", "0003"]
+    root_paths = ["0001", "0002"]
+    assert filter_descendants(paths, root_paths, skip_sorting=True) == ["0001", "0002"]
+
+
+def test_utils_filter_descendants_single_root_matches_all():
+    """
+    A single root path should match all its descendants.
+    """
+    paths = ["0001", "00010001", "000100010001", "00010002"]
+    root_paths = ["0001"]
+    assert filter_descendants(paths, root_paths) == [
+        "0001",
+        "00010001",
+        "000100010001",
+        "00010002",
+    ]
+
+
+def test_utils_filter_descendants_path_shorter_than_root():
+    """
+    A path shorter than any root path should not match.
+    """
+    paths = ["0001", "0002"]
+    root_paths = ["00010001"]
+    assert not filter_descendants(paths, root_paths)

src/backend/core/utils.py

@@ -0,0 +1,76 @@
+"""Utils for the core app."""
+
+import base64
+import re
+
+import pycrdt
+from bs4 import BeautifulSoup
+
+from core import enums
+
+
+def filter_descendants(paths, root_paths, skip_sorting=False):
+    """
+    Filters paths to keep only those that are descendants of any path in root_paths.
+
+    A path is considered a descendant of a root path if it starts with the root path.
+    If `skip_sorting` is not set to True, the function will sort both lists before
+    processing because both `paths` and `root_paths` need to be in lexicographic order
+    before going through the algorithm.
+
+    Args:
+        paths (iterable of str): List of paths to be filtered.
+        root_paths (iterable of str): List of paths to check as potential prefixes.
+        skip_sorting (bool): If True, assumes both `paths` and `root_paths` are already sorted.
+
+    Returns:
+        list of str: A list of sorted paths that are descendants of any path in `root_paths`.
+    """
+    results = []
+    i = 0
+    n = len(root_paths)
+
+    if not skip_sorting:
+        paths.sort()
+        root_paths.sort()
+
+    for path in paths:
+        # Try to find a matching prefix in the sorted accessible paths
+        while i < n:
+            if path.startswith(root_paths[i]):
+                results.append(path)
+                break
+            if root_paths[i] < path:
+                i += 1
+            else:
+                # If paths[i] > path, no need to keep searching
+                break
+    return results
+
+
+def base64_yjs_to_xml(base64_string):
+    """Extract xml from base64 yjs document."""
+
+    decoded_bytes = base64.b64decode(base64_string)
+    # uint8_array = bytearray(decoded_bytes)
+
+    doc = pycrdt.Doc()
+    doc.apply_update(decoded_bytes)
+    return str(doc.get("document-store", type=pycrdt.XmlFragment))
+
+
+def base64_yjs_to_text(base64_string):
+    """Extract text from base64 yjs document."""
+
+    blocknote_structure = base64_yjs_to_xml(base64_string)
+    soup = BeautifulSoup(blocknote_structure, "lxml-xml")
+    return soup.get_text(separator=" ", strip=True)
+
+
+def extract_attachments(content):
+    """Helper method to extract media paths from a document's content."""
+    if not content:
+        return []
+
+    xml_content = base64_yjs_to_xml(content)
+    return re.findall(enums.MEDIA_STORAGE_URL_EXTRACT, xml_content)

src/backend/impress/settings.py

@@ -586,14 +586,16 @@ class Base(Configuration):
     LOGGING = {
         "version": 1,
         "disable_existing_loggers": False,
+        "formatters": {
+            "simple": {
+                "format": "{asctime} {name} {levelname} {message}",
+                "style": "{",
+            },
+        },
         "handlers": {
             "console": {
                 "class": "logging.StreamHandler",
-                "level": values.Value(
-                    "ERROR",
-                    environ_name="LOGGING_LEVEL_HANDLERS_CONSOLE",
-                    environ_prefix=None,
-                ),
+                "formatter": "simple",
             },
         },
         # Override root logger to send it to console

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "impress"
-version = "2.6.0"
+version = "2.7.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -25,6 +25,7 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
+    "beautifulsoup4==4.12.3",
     "boto3==1.37.18",
     "Brotli==1.1.0",
     "celery[redis]==5.4.0",
@@ -46,17 +47,19 @@ dependencies = [
     "factory_boy==3.3.3",
     "gunicorn==23.0.0",
     "jsonschema==4.23.0",
+    "lxml==5.3.1",
     "markdown==3.7",
+    "mozilla-django-oidc==4.0.1",
     "nested-multipart-parser==1.5.0",
     "openai==1.68.2",
     "psycopg[binary]==3.2.6",
+    "pycrdt==0.12.10", 
     "PyJWT==2.10.1",
     "python-magic==0.4.27",
     "requests==2.32.3",
     "sentry-sdk==2.24.0",
     "url-normalize==1.4.3",
     "whitenoise==6.9.0",
-    "mozilla-django-oidc==4.0.1",
 ]
 
 [project.urls]

src/frontend/apps/e2e/__tests__/app-impress/common.ts

@@ -200,22 +200,6 @@ export const mockedDocument = async (page: Page, json: object) => {
   });
 };
 
-export const mockedListDocs = async (page: Page, data: object[] = []) => {
-  await page.route('**/documents/**/', async (route) => {
-    const request = route.request();
-    if (request.method().includes('GET') && request.url().includes('page=')) {
-      await route.fulfill({
-        json: {
-          count: data.length,
-          next: null,
-          previous: null,
-          results: data,
-        },
-      });
-    }
-  });
-};
-
 export const mockedInvitations = async (page: Page, json?: object) => {
   await page.route('**/invitations/**/', async (route) => {
     const request = route.request();

src/frontend/apps/e2e/__tests__/app-impress/config.spec.ts

@@ -6,7 +6,7 @@ import { createDoc, verifyDocName } from './common';
 
 const config = {
   CRISP_WEBSITE_ID: null,
-  COLLABORATION_WS_URL: 'ws://localhost:8083/collaboration/ws/',
+  COLLABORATION_WS_URL: 'ws://localhost:4444/collaboration/ws/',
   ENVIRONMENT: 'development',
   FRONTEND_THEME: 'default',
   MEDIA_BASE_URL: 'http://localhost:8083',
@@ -99,7 +99,7 @@ test.describe('Config', () => {
     browserName,
   }) => {
     const webSocketPromise = page.waitForEvent('websocket', (webSocket) => {
-      return webSocket.url().includes('ws://localhost:8083/collaboration/ws/');
+      return webSocket.url().includes('ws://localhost:4444/collaboration/ws/');
     });
 
     await page.goto('/');
@@ -114,7 +114,7 @@ test.describe('Config', () => {
     await verifyDocName(page, randomDoc[0]);
 
     const webSocket = await webSocketPromise;
-    expect(webSocket.url()).toContain('ws://localhost:8083/collaboration/ws/');
+    expect(webSocket.url()).toContain('ws://localhost:4444/collaboration/ws/');
   });
 
   test('it checks that Crisp is trying to init from config endpoint', async ({

src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts

@@ -65,7 +65,7 @@ test.describe('Doc Editor', () => {
     let webSocketPromise = page.waitForEvent('websocket', (webSocket) => {
       return webSocket
         .url()
-        .includes('ws://localhost:8083/collaboration/ws/?room=');
+        .includes('ws://localhost:4444/collaboration/ws/?room=');
     });
 
     const randomDoc = await createDoc(page, 'doc-editor', browserName, 1);
@@ -73,7 +73,7 @@ test.describe('Doc Editor', () => {
 
     let webSocket = await webSocketPromise;
     expect(webSocket.url()).toContain(
-      'ws://localhost:8083/collaboration/ws/?room=',
+      'ws://localhost:4444/collaboration/ws/?room=',
     );
 
     // Is connected
@@ -103,7 +103,7 @@ test.describe('Doc Editor', () => {
     webSocketPromise = page.waitForEvent('websocket', (webSocket) => {
       return webSocket
         .url()
-        .includes('ws://localhost:8083/collaboration/ws/?room=');
+        .includes('ws://localhost:4444/collaboration/ws/?room=');
     });
 
     webSocket = await webSocketPromise;

src/frontend/apps/e2e/__tests__/app-impress/doc-grid-dnd.spec.ts

@@ -1,309 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-import { createDoc, mockedListDocs } from './common';
-
-test.describe('Doc grid dnd', () => {
-  test('it creates a doc', async ({ page, browserName }) => {
-    await page.goto('/');
-    const header = page.locator('header').first();
-    await createDoc(page, 'Draggable doc', browserName, 1);
-    await header.locator('h2').getByText('Docs').click();
-    await createDoc(page, 'Droppable doc', browserName, 1);
-    await header.locator('h2').getByText('Docs').click();
-
-    const response = await page.waitForResponse(
-      (response) =>
-        response.url().endsWith('documents/?page=1') &&
-        response.status() === 200,
-    );
-    const responseJson = await response.json();
-
-    const items = responseJson.results;
-
-    const docsGrid = page.getByTestId('docs-grid');
-    await expect(docsGrid).toBeVisible();
-    await expect(page.getByTestId('grid-loader')).toBeHidden();
-    const draggableElement = page.getByTestId(`draggable-doc-${items[1].id}`);
-    const dropZone = page.getByTestId(`droppable-doc-${items[0].id}`);
-    await expect(draggableElement).toBeVisible();
-    await expect(dropZone).toBeVisible();
-
-    // Obtenir les positions des éléments
-    const draggableBoundingBox = await draggableElement.boundingBox();
-    const dropZoneBoundingBox = await dropZone.boundingBox();
-
-    expect(draggableBoundingBox).toBeDefined();
-    expect(dropZoneBoundingBox).toBeDefined();
-
-    // eslint-disable-next-line playwright/no-conditional-in-test
-    if (!draggableBoundingBox || !dropZoneBoundingBox) {
-      throw new Error('Impossible de déterminer la position des éléments');
-    }
-
-    await page.mouse.move(
-      draggableBoundingBox.x + draggableBoundingBox.width / 2,
-      draggableBoundingBox.y + draggableBoundingBox.height / 2,
-    );
-    await page.mouse.down();
-
-    // Déplacer vers la zone cible
-    await page.mouse.move(
-      dropZoneBoundingBox.x + dropZoneBoundingBox.width / 2,
-      dropZoneBoundingBox.y + dropZoneBoundingBox.height / 2,
-      { steps: 10 }, // Rendre le mouvement plus fluide
-    );
-
-    const dragOverlay = page.getByTestId('drag-doc-overlay');
-
-    await expect(dragOverlay).toBeVisible();
-    await expect(dragOverlay).toHaveText(items[1].title as string);
-    await page.mouse.up();
-
-    await expect(dragOverlay).toBeHidden();
-  });
-
-  test('it checks cant drop when we have not the minimum role', async ({
-    page,
-  }) => {
-    await mockedListDocs(page, data);
-    await page.goto('/');
-    const docsGrid = page.getByTestId('docs-grid');
-    await expect(docsGrid).toBeVisible();
-    await expect(page.getByTestId('grid-loader')).toBeHidden();
-
-    const canDropAndDrag = page.getByTestId('droppable-doc-can-drop-and-drag');
-
-    const noDropAndNoDrag = page.getByTestId(
-      'droppable-doc-no-drop-and-no-drag',
-    );
-
-    await expect(canDropAndDrag).toBeVisible();
-
-    await expect(noDropAndNoDrag).toBeVisible();
-
-    const canDropAndDragBoundigBox = await canDropAndDrag.boundingBox();
-
-    const noDropAndNoDragBoundigBox = await noDropAndNoDrag.boundingBox();
-
-    if (!canDropAndDragBoundigBox || !noDropAndNoDragBoundigBox) {
-      throw new Error('Impossible de déterminer la position des éléments');
-    }
-
-    await page.mouse.move(
-      canDropAndDragBoundigBox.x + canDropAndDragBoundigBox.width / 2,
-      canDropAndDragBoundigBox.y + canDropAndDragBoundigBox.height / 2,
-    );
-
-    await page.mouse.down();
-
-    await page.mouse.move(
-      noDropAndNoDragBoundigBox.x + noDropAndNoDragBoundigBox.width / 2,
-      noDropAndNoDragBoundigBox.y + noDropAndNoDragBoundigBox.height / 2,
-      { steps: 10 },
-    );
-
-    const dragOverlay = page.getByTestId('drag-doc-overlay');
-
-    await expect(dragOverlay).toBeVisible();
-    await expect(dragOverlay).toHaveText(
-      'You must be at least the editor of the target document',
-    );
-
-    await page.mouse.up();
-  });
-
-  test('it checks cant drag when we have not the minimum role', async ({
-    page,
-  }) => {
-    await mockedListDocs(page, data);
-    await page.goto('/');
-    const docsGrid = page.getByTestId('docs-grid');
-    await expect(docsGrid).toBeVisible();
-    await expect(page.getByTestId('grid-loader')).toBeHidden();
-
-    const canDropAndDrag = page.getByTestId('droppable-doc-can-drop-and-drag');
-
-    const noDropAndNoDrag = page.getByTestId(
-      'droppable-doc-no-drop-and-no-drag',
-    );
-
-    await expect(canDropAndDrag).toBeVisible();
-
-    await expect(noDropAndNoDrag).toBeVisible();
-
-    const canDropAndDragBoundigBox = await canDropAndDrag.boundingBox();
-
-    const noDropAndNoDragBoundigBox = await noDropAndNoDrag.boundingBox();
-
-    if (!canDropAndDragBoundigBox || !noDropAndNoDragBoundigBox) {
-      throw new Error('Impossible de déterminer la position des éléments');
-    }
-
-    await page.mouse.move(
-      noDropAndNoDragBoundigBox.x + noDropAndNoDragBoundigBox.width / 2,
-      noDropAndNoDragBoundigBox.y + noDropAndNoDragBoundigBox.height / 2,
-    );
-
-    await page.mouse.down();
-
-    await page.mouse.move(
-      canDropAndDragBoundigBox.x + canDropAndDragBoundigBox.width / 2,
-      canDropAndDragBoundigBox.y + canDropAndDragBoundigBox.height / 2,
-      { steps: 10 },
-    );
-
-    const dragOverlay = page.getByTestId('drag-doc-overlay');
-
-    await expect(dragOverlay).toBeVisible();
-    await expect(dragOverlay).toHaveText(
-      'You must be the owner to move the document',
-    );
-
-    await page.mouse.up();
-  });
-});
-
-const data = [
-  {
-    id: 'can-drop-and-drag',
-    abilities: {
-      accesses_manage: true,
-      accesses_view: true,
-      ai_transform: true,
-      ai_translate: true,
-      attachment_upload: true,
-      children_list: true,
-      children_create: true,
-      collaboration_auth: true,
-      descendants: true,
-      destroy: true,
-      favorite: true,
-      link_configuration: true,
-      invite_owner: true,
-      move: true,
-      partial_update: true,
-      restore: true,
-      retrieve: true,
-      media_auth: true,
-      link_select_options: {
-        restricted: ['reader', 'editor'],
-        authenticated: ['reader', 'editor'],
-        public: ['reader', 'editor'],
-      },
-      tree: true,
-      update: true,
-      versions_destroy: true,
-      versions_list: true,
-      versions_retrieve: true,
-    },
-    created_at: '2025-03-14T14:45:22.527221Z',
-    creator: 'bc6895e0-8f6d-4b00-827d-c143aa6b2ecb',
-    depth: 1,
-    excerpt: null,
-    is_favorite: false,
-    link_role: 'reader',
-    link_reach: 'restricted',
-    nb_accesses_ancestors: 1,
-    nb_accesses_direct: 1,
-    numchild: 5,
-    path: '000000o',
-    title: 'Can drop and drag',
-    updated_at: '2025-03-14T14:45:27.699542Z',
-    user_roles: ['owner'],
-  },
-  {
-    id: 'can-only-drop',
-    title: 'Can only drop',
-    abilities: {
-      accesses_manage: true,
-      accesses_view: true,
-      ai_transform: true,
-      ai_translate: true,
-      attachment_upload: true,
-      children_list: true,
-      children_create: true,
-      collaboration_auth: true,
-      descendants: true,
-      destroy: true,
-      favorite: true,
-      link_configuration: true,
-      invite_owner: true,
-      move: true,
-      partial_update: true,
-      restore: true,
-      retrieve: true,
-      media_auth: true,
-      link_select_options: {
-        restricted: ['reader', 'editor'],
-        authenticated: ['reader', 'editor'],
-        public: ['reader', 'editor'],
-      },
-      tree: true,
-      update: true,
-      versions_destroy: true,
-      versions_list: true,
-      versions_retrieve: true,
-    },
-    created_at: '2025-03-14T14:45:22.527221Z',
-    creator: 'bc6895e0-8f6d-4b00-827d-c143aa6b2ecb',
-    depth: 1,
-    excerpt: null,
-    is_favorite: false,
-    link_role: 'reader',
-    link_reach: 'restricted',
-    nb_accesses_ancestors: 1,
-    nb_accesses_direct: 1,
-    numchild: 5,
-    path: '000000o',
-
-    updated_at: '2025-03-14T14:45:27.699542Z',
-    user_roles: ['editor'],
-  },
-  {
-    id: 'no-drop-and-no-drag',
-    abilities: {
-      accesses_manage: false,
-      accesses_view: true,
-      ai_transform: false,
-      ai_translate: false,
-      attachment_upload: false,
-      children_list: true,
-      children_create: false,
-      collaboration_auth: true,
-      descendants: true,
-      destroy: false,
-      favorite: true,
-      link_configuration: false,
-      invite_owner: false,
-      move: false,
-      partial_update: false,
-      restore: false,
-      retrieve: true,
-      media_auth: true,
-      link_select_options: {
-        restricted: ['reader', 'editor'],
-        authenticated: ['reader', 'editor'],
-        public: ['reader', 'editor'],
-      },
-      tree: true,
-      update: false,
-      versions_destroy: false,
-      versions_list: true,
-      versions_retrieve: true,
-    },
-    created_at: '2025-03-14T14:44:16.032773Z',
-    creator: '9264f420-f018-4bd6-96ae-4788f41af56d',
-    depth: 1,
-    excerpt: null,
-    is_favorite: false,
-    link_role: 'reader',
-    link_reach: 'restricted',
-    nb_accesses_ancestors: 14,
-    nb_accesses_direct: 14,
-    numchild: 0,
-    path: '000000l',
-    title: 'No drop and no drag',
-    updated_at: '2025-03-14T14:44:16.032774Z',
-    user_roles: ['reader'],
-  },
-];

src/frontend/apps/e2e/__tests__/app-impress/doc-tree-content.spec.ts

@@ -1,149 +0,0 @@
-/* eslint-disable playwright/no-conditional-in-test */
-import { expect, test } from '@playwright/test';
-
-import { createDoc } from './common';
-
-test.describe('Doc Tree', () => {
-  test('create new sub pages', async ({ page, browserName }) => {
-    await page.goto('/');
-    await createDoc(page, 'doc-tree-content', browserName, 1);
-    const addButton = page.getByRole('button', { name: 'New page' });
-    const docTree = page.getByTestId('doc-tree');
-
-    await expect(addButton).toBeVisible();
-
-    // Attendre et intercepter la requête POST pour créer une nouvelle page
-    const responsePromise = page.waitForResponse(
-      (response) =>
-        response.url().includes('/documents/') &&
-        response.url().includes('/children/') &&
-        response.request().method() === 'POST',
-    );
-
-    await addButton.click();
-    const response = await responsePromise;
-    expect(response.ok()).toBeTruthy();
-    const subPageJson = await response.json();
-
-    await expect(docTree).toBeVisible();
-    const subPageItem = docTree
-      .getByTestId(`doc-sub-page-item-${subPageJson.id}`)
-      .first();
-
-    await expect(subPageItem).toBeVisible();
-    await subPageItem.click();
-    const input = page.getByRole('textbox', { name: 'doc title input' });
-    await input.click();
-    await input.fill('Test');
-    await input.press('Enter');
-    await expect(subPageItem.getByText('Test')).toBeVisible();
-    await page.reload();
-    await expect(subPageItem.getByText('Test')).toBeVisible();
-  });
-
-  test('check the reorder of sub pages', async ({ page, browserName }) => {
-    await page.goto('/');
-    await createDoc(page, 'doc-tree-content', browserName, 1);
-    const addButton = page.getByRole('button', { name: 'New page' });
-    await expect(addButton).toBeVisible();
-
-    const docTree = page.getByTestId('doc-tree');
-
-    // Create first sub page
-    const firstResponsePromise = page.waitForResponse(
-      (response) =>
-        response.url().includes('/documents/') &&
-        response.url().includes('/children/') &&
-        response.request().method() === 'POST',
-    );
-
-    await addButton.click();
-    const firstResponse = await firstResponsePromise;
-    expect(firstResponse.ok()).toBeTruthy();
-
-    const secondResponsePromise = page.waitForResponse(
-      (response) =>
-        response.url().includes('/documents/') &&
-        response.url().includes('/children/') &&
-        response.request().method() === 'POST',
-    );
-
-    // Create second sub page
-    await addButton.click();
-    const secondResponse = await secondResponsePromise;
-    expect(secondResponse.ok()).toBeTruthy();
-
-    const secondSubPageJson = await secondResponse.json();
-    const firstSubPageJson = await firstResponse.json();
-
-    const firstSubPageItem = docTree
-      .getByTestId(`doc-sub-page-item-${firstSubPageJson.id}`)
-      .first();
-
-    const secondSubPageItem = docTree
-      .getByTestId(`doc-sub-page-item-${secondSubPageJson.id}`)
-      .first();
-
-    // check that the sub pages are visible in the tree
-    await expect(firstSubPageItem).toBeVisible();
-    await expect(secondSubPageItem).toBeVisible();
-
-    // get the bounding boxes of the sub pages
-    const firstSubPageBoundingBox = await firstSubPageItem.boundingBox();
-    const secondSubPageBoundingBox = await secondSubPageItem.boundingBox();
-
-    expect(firstSubPageBoundingBox).toBeDefined();
-    expect(secondSubPageBoundingBox).toBeDefined();
-
-    if (!firstSubPageBoundingBox || !secondSubPageBoundingBox) {
-      throw new Error('Impossible de déterminer la position des éléments');
-    }
-
-    // move the first sub page to the second position
-    await page.mouse.move(
-      firstSubPageBoundingBox.x + firstSubPageBoundingBox.width / 2,
-      firstSubPageBoundingBox.y + firstSubPageBoundingBox.height / 2,
-    );
-
-    await page.mouse.down();
-
-    await page.mouse.move(
-      secondSubPageBoundingBox.x + secondSubPageBoundingBox.width / 2,
-      secondSubPageBoundingBox.y + secondSubPageBoundingBox.height + 4,
-      { steps: 10 },
-    );
-
-    await page.mouse.up();
-
-    // check that the sub pages are visible in the tree
-    await expect(firstSubPageItem).toBeVisible();
-    await expect(secondSubPageItem).toBeVisible();
-
-    // reload the page
-    await page.reload();
-
-    // check that the sub pages are visible in the tree
-    await expect(firstSubPageItem).toBeVisible();
-    await expect(secondSubPageItem).toBeVisible();
-
-    // Check the position of the sub pages
-    const allSubPageItems = await docTree
-      .getByTestId(/^doc-sub-page-item/)
-      .all();
-
-    expect(allSubPageItems.length).toBe(2);
-
-    // Vérifier que le premier élément a l'ID de la deuxième sous-page après le drag and drop
-
-    await expect(allSubPageItems[0]).toHaveAttribute(
-      'data-testid',
-      `doc-sub-page-item-${secondSubPageJson.id}`,
-    );
-
-    // Vérifier que le deuxième élément a l'ID de la première sous-page après le drag and drop
-    await expect(allSubPageItems[1]).toHaveAttribute(
-      'data-testid',
-      `doc-sub-page-item-${firstSubPageJson.id}`,
-    );
-  });
-});

src/frontend/apps/e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-e2e",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "private": true,
   "scripts": {
     "lint": "eslint . --ext .ts",

src/frontend/apps/impress/cunningham.ts

@@ -1,8 +1,4 @@
-import { cunninghamConfig } from '@gouvfr-lasuite/ui-kit';
-
-const tokens = {
-  ...cunninghamConfig,
-};
+import { cunninghamConfig as tokens } from '@gouvfr-lasuite/ui-kit';
 
 const customColors = {
   'primary-action': '#1212FF',
@@ -38,6 +34,7 @@ const customColors = {
   'yellow-500': '#B7A73F',
   'yellow-600': '#66673D',
 };
+
 tokens.themes.default.theme.colors = {
   ...tokens.themes.default.theme.colors,
   ...customColors,

src/frontend/apps/impress/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-impress",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -21,18 +21,15 @@
     "@blocknote/react": "0.23.2-hotfix.0",
     "@blocknote/xl-docx-exporter": "0.23.2-hotfix.0",
     "@blocknote/xl-pdf-exporter": "0.23.2-hotfix.0",
-    "@dnd-kit/core": "6.3.1",
-    "@dnd-kit/modifiers": "9.0.0",
     "@fontsource/material-icons": "5.2.5",
     "@gouvfr-lasuite/integration": "1.0.2",
-    "@gouvfr-lasuite/ui-kit": "/Users/melde/Documents/societes/melde/clients/dinum/design-system",
+    "@gouvfr-lasuite/ui-kit": "0.1.3",
     "@hocuspocus/provider": "2.15.2",
     "@openfun/cunningham-react": "3.0.0",
     "@react-pdf/renderer": "4.1.6",
     "@sentry/nextjs": "9.3.0",
     "@tanstack/react-query": "5.67.1",
     "canvg": "4.0.3",
-    "clsx": "2.1.1",
     "cmdk": "1.0.4",
     "crisp-sdk-web": "1.0.25",
     "docx": "9.1.1",
@@ -41,7 +38,7 @@
     "idb": "8.0.2",
     "lodash": "4.17.21",
     "luxon": "3.5.0",
-    "next": "15.2.1",
+    "next": "15.2.3",
     "posthog-js": "1.227.0",
     "react": "*",
     "react-aria-components": "1.6.0",
@@ -49,7 +46,6 @@
     "react-i18next": "15.4.1",
     "react-intersection-observer": "9.15.1",
     "react-select": "5.10.1",
-    "react-stately": "3.36.1",
     "styled-components": "6.1.15",
     "use-debounce": "10.0.4",
     "y-protocols": "1.0.6",

src/frontend/apps/impress/src/components/DropdownMenu.tsx

@@ -8,7 +8,6 @@ export type DropdownMenuOption = {
   icon?: string;
   label: string;
   testId?: string;
-  value?: string;
   callback?: () => void | Promise<unknown>;
   danger?: boolean;
   isSelected?: boolean;
@@ -24,8 +23,6 @@ export type DropdownMenuProps = {
   buttonCss?: BoxProps['$css'];
   disabled?: boolean;
   topMessage?: string;
-  selectedValues?: string[];
-  afterOpenChange?: (isOpen: boolean) => void;
 };
 
 export const DropdownMenu = ({
@@ -37,8 +34,6 @@ export const DropdownMenu = ({
   buttonCss,
   label,
   topMessage,
-  afterOpenChange,
-  selectedValues,
 }: PropsWithChildren<DropdownMenuProps>) => {
   const theme = useCunninghamTheme();
   const spacings = theme.spacingsTokens();
@@ -48,7 +43,6 @@ export const DropdownMenu = ({
 
   const onOpenChange = (isOpen: boolean) => {
     setIsOpen(isOpen);
-    afterOpenChange?.(isOpen);
   };
 
   if (disabled) {
@@ -167,8 +161,7 @@ export const DropdownMenu = ({
                   {option.label}
                 </Text>
               </Box>
-              {(option.isSelected ||
-                selectedValues?.includes(option.value ?? '')) && (
+              {option.isSelected && (
                 <Icon iconName="check" $size="20px" $theme="greyscale" />
               )}
             </BoxButton>

src/frontend/apps/impress/src/components/Icon.tsx

@@ -8,7 +8,7 @@ type IconProps = TextType & {
 };
 export const Icon = ({ iconName, ...textProps }: IconProps) => {
   return (
-    <Text $isMaterialIcon={textProps.$isMaterialIcon ?? true} {...textProps}>
+    <Text $isMaterialIcon {...textProps}>
       {iconName}
     </Text>
   );
@@ -27,7 +27,7 @@ export const IconBG = ({ iconName, ...textProps }: IconBGProps) => {
       $size="36px"
       $theme="primary"
       $variation="600"
-      $background={colorsTokens()['greyscale-000']}
+      $background={colorsTokens()['primary-bg']}
       $css={`
         border: 1px solid ${colorsTokens()['primary-200']}; 
         user-select: none;

src/frontend/apps/impress/src/components/Text.tsx

@@ -1,4 +1,3 @@
-import clsx from 'clsx';
 import { CSSProperties, ComponentPropsWithRef, forwardRef } from 'react';
 import styled from 'styled-components';
 
@@ -12,7 +11,7 @@ type TextSizes = keyof typeof sizes;
 export interface TextProps extends BoxProps {
   as?: 'p' | 'span' | 'div' | 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6';
   $elipsis?: boolean;
-  $isMaterialIcon?: boolean | 'filled';
+  $isMaterialIcon?: boolean;
   $weight?: CSSProperties['fontWeight'];
   $textAlign?: CSSProperties['textAlign'];
   $size?: TextSizes | (string & {});
@@ -59,20 +58,13 @@ export const TextStyled = styled(Box)<TextProps>`
 
 const Text = forwardRef<HTMLElement, ComponentPropsWithRef<typeof TextStyled>>(
   ({ className, $isMaterialIcon, ...props }, ref) => {
-    const isFilled = $isMaterialIcon === 'filled';
-    const isMaterialIcon =
-      typeof $isMaterialIcon === 'boolean' && $isMaterialIcon;
-
     return (
       <TextStyled
         ref={ref}
         as="span"
         $theme="greyscale"
         $variation="text"
-        className={clsx(className || '', {
-          'material-icons': isMaterialIcon,
-          'material-icons-filled': isFilled,
-        })}
+        className={`${className || ''}${$isMaterialIcon ? ' material-icons' : ''}`}
         {...props}
       />
     );

src/frontend/apps/impress/src/components/filter/FilterDropdown.tsx

@@ -1,63 +0,0 @@
-import { css } from 'styled-components';
-
-import { Box } from '../Box';
-import { DropdownMenu, DropdownMenuOption } from '../DropdownMenu';
-import { Icon } from '../Icon';
-import { Text } from '../Text';
-
-export type FilterDropdownProps = {
-  options: DropdownMenuOption[];
-  selectedValue?: string;
-};
-
-export const FilterDropdown = ({
-  options,
-  selectedValue,
-}: FilterDropdownProps) => {
-  const selectedOption = options.find(
-    (option) => option.value === selectedValue,
-  );
-
-  if (options.length === 0) {
-    return null;
-  }
-
-  return (
-    <DropdownMenu
-      selectedValues={selectedValue ? [selectedValue] : undefined}
-      options={options}
-    >
-      <Box
-        $css={css`
-          border: 1px solid
-            ${selectedOption
-              ? 'var(--c--theme--colors--primary-500)'
-              : 'var(--c--theme--colors--greyscale-250)'};
-          border-radius: 4px;
-          background-color: ${selectedOption
-            ? 'var(--c--theme--colors--primary-100)'
-            : 'var(--c--theme--colors--greyscale-000)'};
-          gap: var(--c--theme--spacings--2xs);
-          padding: var(--c--theme--spacings--2xs) var(--c--theme--spacings--xs);
-        `}
-        color="secondary"
-        $direction="row"
-        $align="center"
-      >
-        <Text
-          $weight={400}
-          $variation={selectedOption ? '800' : '600'}
-          $theme={selectedOption ? 'primary' : 'greyscale'}
-        >
-          {selectedOption?.label ?? options[0].label}
-        </Text>
-        <Icon
-          $size="16px"
-          iconName="keyboard_arrow_down"
-          $variation={selectedOption ? '800' : '600'}
-          $theme={selectedOption ? 'primary' : 'greyscale'}
-        />
-      </Box>
-    </DropdownMenu>
-  );
-};

src/frontend/apps/impress/src/components/quick-search/QuickSearchInput.tsx

@@ -57,9 +57,6 @@ export const QuickSearchInput = ({
           /* eslint-disable-next-line jsx-a11y/no-autofocus */
           autoFocus={true}
           aria-label={t('Quick search input')}
-          onClick={(e) => {
-            e.stopPropagation();
-          }}
           value={inputValue}
           role="combobox"
           placeholder={placeholder ?? t('Search')}

src/frontend/apps/impress/src/features/docs/doc-export/components/ModalExport.tsx

@@ -161,6 +161,7 @@ export const ModalExport = ({ onClose, doc }: ModalExportProps) => {
         </Text>
         <Select
           clearable={false}
+          fullWidth
           label={t('Template')}
           options={templateOptions}
           value={templateSelected}

src/frontend/apps/impress/src/features/docs/doc-header/components/DocTitle.tsx

@@ -1,7 +1,10 @@
 /* eslint-disable jsx-a11y/click-events-have-key-events */
 /* eslint-disable jsx-a11y/no-noninteractive-element-interactions */
-import { Tooltip } from '@openfun/cunningham-react';
-import { useQueryClient } from '@tanstack/react-query';
+import {
+  Tooltip,
+  VariantType,
+  useToastProvider,
+} from '@openfun/cunningham-react';
 import React, { useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
@@ -12,13 +15,11 @@ import {
   Doc,
   KEY_DOC,
   KEY_LIST_DOC,
-  KEY_SUB_DOC,
   useTrans,
   useUpdateDoc,
 } from '@/docs/doc-management';
 import { useBroadcastStore, useResponsiveStore } from '@/stores';
 
-import { useDocTreeStore } from '../../doc-tree/context/DocTreeContext';
 interface DocTitleProps {
   doc: Doc;
 }
@@ -54,27 +55,20 @@ export const DocTitleText = ({ title }: DocTitleTextProps) => {
 const DocTitleInput = ({ doc }: DocTitleProps) => {
   const { isDesktop } = useResponsiveStore();
   const { t } = useTranslation();
-  const queryClient = useQueryClient();
   const { colorsTokens } = useCunninghamTheme();
-  const treeStore = useDocTreeStore();
   const [titleDisplay, setTitleDisplay] = useState(doc.title);
-
+  const { toast } = useToastProvider();
   const { untitledDocument } = useTrans();
 
   const { broadcast } = useBroadcastStore();
 
   const { mutate: updateDoc } = useUpdateDoc({
-    listInvalideQueries: [KEY_LIST_DOC],
-    onSuccess(updatedDoc) {
+    listInvalideQueries: [KEY_DOC, KEY_LIST_DOC],
+    onSuccess(data) {
+      toast(t('Document title updated successfully'), VariantType.SUCCESS);
+
       // Broadcast to every user connected to the document
-      broadcast(`${KEY_DOC}-${updatedDoc.id}`);
-      if (updatedDoc.id === treeStore.root?.id) {
-        treeStore.setRoot(updatedDoc);
-      }
-      queryClient.setQueryData(
-        [KEY_SUB_DOC, { id: updatedDoc.id }],
-        updatedDoc,
-      );
+      broadcast(`${KEY_DOC}-${data.id}`);
     },
   });
 

src/frontend/apps/impress/src/features/docs/doc-management/api/useDoc.tsx

@@ -6,7 +6,6 @@ import { Doc } from '../types';
 
 export type DocParams = {
   id: string;
-  isTree?: boolean;
 };
 
 export const getDoc = async ({ id }: DocParams): Promise<Doc> => {
@@ -20,15 +19,14 @@ export const getDoc = async ({ id }: DocParams): Promise<Doc> => {
 };
 
 export const KEY_DOC = 'doc';
-export const KEY_SUB_DOC = 'sub-doc';
 export const KEY_DOC_VISIBILITY = 'doc-visibility';
 
 export function useDoc(
   param: DocParams,
-  queryConfig?: Omit<UseQueryOptions<Doc, APIError, Doc>, 'queryFn'>,
+  queryConfig?: UseQueryOptions<Doc, APIError, Doc>,
 ) {
   return useQuery<Doc, APIError, Doc>({
-    queryKey: queryConfig?.queryKey ?? [KEY_DOC, param],
+    queryKey: [KEY_DOC, param],
     queryFn: () => getDoc(param),
     ...queryConfig,
   });

src/frontend/apps/impress/src/features/docs/doc-management/api/useDocs.tsx

@@ -8,7 +8,6 @@ import {
   useAPIInfiniteQuery,
 } from '@/api';
 
-import { DocSearchTarget } from '../../doc-search/components/DocSearchFilters';
 import { Doc } from '../types';
 
 export const isDocsOrdering = (data: string): data is DocsOrdering => {
@@ -32,8 +31,6 @@ export type DocsParams = {
   is_creator_me?: boolean;
   title?: string;
   is_favorite?: boolean;
-  target?: DocSearchTarget;
-  parent_id?: string;
 };
 
 export type DocsResponse = APIList<Doc>;
@@ -56,14 +53,8 @@ export const getDocs = async (params: DocsParams): Promise<DocsResponse> => {
   if (params.is_favorite !== undefined) {
     searchParams.set('is_favorite', params.is_favorite.toString());
   }
-  let response: Response;
-  if (params.parent_id && params.target === DocSearchTarget.CURRENT) {
-    response = await fetchAPI(
-      `documents/${params.parent_id}/descendants/?${searchParams.toString()}`,
-    );
-  } else {
-    response = await fetchAPI(`documents/?${searchParams.toString()}`);
-  }
+
+  const response = await fetchAPI(`documents/?${searchParams.toString()}`);
 
   if (!response.ok) {
     throw new APIError('Failed to get the docs', await errorCauses(response));

src/frontend/apps/impress/src/features/docs/doc-management/components/ModalRemoveDoc.tsx

@@ -17,20 +17,16 @@ import { Doc } from '../types';
 interface ModalRemoveDocProps {
   onClose: () => void;
   doc: Doc;
-  afterDelete?: (doc: Doc) => void;
 }
 
-export const ModalRemoveDoc = ({
-  onClose,
-  doc,
-  afterDelete,
-}: ModalRemoveDocProps) => {
+export const ModalRemoveDoc = ({ onClose, doc }: ModalRemoveDocProps) => {
   const { toast } = useToastProvider();
   const { push } = useRouter();
   const pathname = usePathname();
 
   const {
     mutate: removeDoc,
+
     isError,
     error,
   } = useRemoveDoc({
@@ -38,11 +34,6 @@ export const ModalRemoveDoc = ({
       toast(t('The document has been deleted.'), VariantType.SUCCESS, {
         duration: 4000,
       });
-      if (afterDelete) {
-        afterDelete(doc);
-        return;
-      }
-
       if (pathname === '/') {
         onClose();
       } else {
@@ -96,9 +87,7 @@ export const ModalRemoveDoc = ({
       <Box aria-label={t('Content modal to delete document')}>
         {!isError && (
           <Text $size="sm" $variation="600">
-            {t('Are you sure you want to delete the document "{{title}}"?', {
-              title: doc.title ?? t('Untitled document'),
-            })}
+            {t('Are you sure you want to delete this document ?')}
           </Text>
         )}
 

src/frontend/apps/impress/src/features/docs/doc-management/types.tsx

@@ -42,14 +42,10 @@ export interface Doc {
   is_favorite: boolean;
   link_reach: LinkReach;
   link_role: LinkRole;
-  user_roles: Role[];
+  nb_accesses_ancestors: number;
+  nb_accesses_direct: number;
   created_at: string;
   updated_at: string;
-  nb_accesses_direct: number;
-  nb_accesses_ancestors: number;
-  children?: Doc[];
-  childrenCount?: number;
-  numchild: number;
   abilities: {
     accesses_manage: boolean;
     accesses_view: boolean;

src/frontend/apps/impress/src/features/docs/doc-search/components/DocSearchFilters.tsx

@@ -1,66 +0,0 @@
-import { Button } from '@openfun/cunningham-react';
-import { useTranslation } from 'react-i18next';
-
-import { Box } from '@/components';
-import { FilterDropdown } from '@/components/filter/FilterDropdown';
-
-export enum DocSearchTarget {
-  ALL = 'all',
-  CURRENT = 'current',
-}
-
-export type DocSearchFiltersValues = {
-  target?: DocSearchTarget;
-};
-
-export type DocSearchFiltersProps = {
-  values?: DocSearchFiltersValues;
-  onValuesChange?: (values: DocSearchFiltersValues) => void;
-  onReset?: () => void;
-};
-
-export const DocSearchFilters = ({
-  values,
-  onValuesChange,
-  onReset,
-}: DocSearchFiltersProps) => {
-  const { t } = useTranslation();
-  const hasFilters = Object.keys(values ?? {}).length > 0;
-  const handleTargetChange = (target: DocSearchTarget) => {
-    onValuesChange?.({ ...values, target });
-  };
-
-  return (
-    <Box
-      $direction="row"
-      $align="center"
-      $height="35px"
-      $justify="space-between"
-      $gap="10px"
-      $margin={{ vertical: 'base' }}
-    >
-      <Box $direction="row" $align="center" $gap="10px">
-        <FilterDropdown
-          selectedValue={values?.target}
-          options={[
-            {
-              label: t('All docs'),
-              value: DocSearchTarget.ALL,
-              callback: () => handleTargetChange(DocSearchTarget.ALL),
-            },
-            {
-              label: t('Current doc'),
-              value: DocSearchTarget.CURRENT,
-              callback: () => handleTargetChange(DocSearchTarget.CURRENT),
-            },
-          ]}
-        />
-      </Box>
-      {hasFilters && (
-        <Button color="primary-text" size="small" onClick={onReset}>
-          {t('Reset')}
-        </Button>
-      )}
-    </Box>
-  );
-};

src/frontend/apps/impress/src/features/docs/doc-search/components/DocSearchModal.tsx

@@ -15,37 +15,17 @@ import {
 import { Doc, useInfiniteDocs } from '@/docs/doc-management';
 import { useResponsiveStore } from '@/stores';
 
-import { useDocTreeStore } from '../../doc-tree/context/DocTreeContext';
 import EmptySearchIcon from '../assets/illustration-docs-empty.png';
 
-import {
-  DocSearchFilters,
-  DocSearchFiltersValues,
-  DocSearchTarget,
-} from './DocSearchFilters';
 import { DocSearchItem } from './DocSearchItem';
 
-type DocSearchModalProps = ModalProps & {
-  showFilters?: boolean;
-  defaultFilters?: DocSearchFiltersValues;
-};
+type DocSearchModalProps = ModalProps & {};
 
-export const DocSearchModal = ({
-  showFilters = false,
-  defaultFilters,
-  ...modalProps
-}: DocSearchModalProps) => {
+export const DocSearchModal = ({ ...modalProps }: DocSearchModalProps) => {
   const { t } = useTranslation();
-
   const router = useRouter();
-  const treeStore = useDocTreeStore();
-
   const [search, setSearch] = useState('');
-  const [filters, setFilters] = useState<DocSearchFiltersValues>(
-    defaultFilters ?? {},
-  );
   const { isDesktop } = useResponsiveStore();
-
   const {
     data,
     isFetching,
@@ -56,41 +36,27 @@ export const DocSearchModal = ({
   } = useInfiniteDocs({
     page: 1,
     title: search,
-    ...filters,
-    parent_id: treeStore?.root?.id,
   });
   const loading = isFetching || isRefetching || isLoading;
   const handleInputSearch = useDebouncedCallback(setSearch, 300);
 
   const handleSelect = (doc: Doc) => {
-    if (treeStore?.initialRootId !== doc.id) {
-      treeStore.setSelectedNode(doc);
-      treeStore.setRoot(doc);
-      treeStore.setInitialTargetId(doc.id);
-    }
     router.push(`/docs/${doc.id}`);
     modalProps.onClose?.();
   };
 
-  const handleResetFilters = () => {
-    setFilters({});
-  };
-
   const docsData: QuickSearchData<Doc> = useMemo(() => {
     const docs = data?.pages.flatMap((page) => page.results) || [];
-    const groupName =
-      filters.target === DocSearchTarget.CURRENT
-        ? t('Select a page')
-        : t('Select a document');
+
     return {
-      groupName: docs.length > 0 ? groupName : '',
+      groupName: docs.length > 0 ? t('Select a document') : '',
       elements: search ? docs : [],
       emptyString: t('No document found'),
       endActions: hasNextPage
         ? [{ content: <InView onChange={() => void fetchNextPage()} /> }]
         : [],
     };
-  }, [data, hasNextPage, fetchNextPage, t, search, filters.target]);
+  }, [data, hasNextPage, fetchNextPage, t, search]);
 
   return (
     <Modal
@@ -109,13 +75,6 @@ export const DocSearchModal = ({
           onFilter={handleInputSearch}
         >
           <Box $height={isDesktop ? '500px' : 'calc(100vh - 68px - 1rem)'}>
-            {showFilters && (
-              <DocSearchFilters
-                values={filters}
-                onValuesChange={setFilters}
-                onReset={handleResetFilters}
-              />
-            )}
             {search.length === 0 && (
               <Box
                 $direction="column"

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareAddMemberList.tsx

@@ -3,7 +3,6 @@ import {
   VariantType,
   useToastProvider,
 } from '@openfun/cunningham-react';
-import { useQueryClient } from '@tanstack/react-query';
 import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
@@ -12,7 +11,7 @@ import { APIError } from '@/api';
 import { Box } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
 import { User } from '@/features/auth';
-import { Doc, KEY_SUB_DOC, Role } from '@/features/docs';
+import { Doc, Role } from '@/features/docs';
 
 import { useCreateDocAccess, useCreateDocInvitation } from '../api';
 import { OptionType } from '../types';
@@ -40,7 +39,6 @@ export const DocShareAddMemberList = ({
 }: Props) => {
   const { t } = useTranslation();
   const { toast } = useToastProvider();
-  const queryClient = useQueryClient();
   const [isLoading, setIsLoading] = useState(false);
   const { spacingsTokens, colorsTokens } = useCunninghamTheme();
   const [invitationRole, setInvitationRole] = useState<Role>(Role.EDITOR);
@@ -93,32 +91,14 @@ export const DocShareAddMemberList = ({
       };
 
       return isInvitationMode
-        ? createInvitation(
-            {
-              ...payload,
-              email: user.email,
-            },
-            {
-              onSuccess: () => {
-                void queryClient.invalidateQueries({
-                  queryKey: [KEY_SUB_DOC, { id: doc.id }],
-                });
-              },
-            },
-          )
-        : createDocAccess(
-            {
-              ...payload,
-              memberId: user.id,
-            },
-            {
-              onSuccess: () => {
-                void queryClient.invalidateQueries({
-                  queryKey: [KEY_SUB_DOC, { id: doc.id }],
-                });
-              },
-            },
-          );
+        ? createInvitation({
+            ...payload,
+            email: user.email,
+          })
+        : createDocAccess({
+            ...payload,
+            memberId: user.id,
+          });
     });
 
     const settledPromises = await Promise.allSettled(promises);

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareInvitationItem.tsx

@@ -1,5 +1,4 @@
 import { VariantType, useToastProvider } from '@openfun/cunningham-react';
-import { useQueryClient } from '@tanstack/react-query';
 import { useTranslation } from 'react-i18next';
 
 import {
@@ -9,7 +8,7 @@ import {
   IconOptions,
 } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
-import { Doc, KEY_SUB_DOC, Role } from '@/docs/doc-management';
+import { Doc, Role } from '@/docs/doc-management';
 import { User } from '@/features/auth';
 
 import { useDeleteDocInvitation, useUpdateDocInvitation } from '../api';
@@ -24,7 +23,6 @@ type Props = {
 };
 export const DocShareInvitationItem = ({ doc, invitation }: Props) => {
   const { t } = useTranslation();
-  const queryClient = useQueryClient();
   const { spacingsTokens } = useCunninghamTheme();
   const spacing = spacingsTokens();
   const fakeUser: User = {
@@ -39,11 +37,6 @@ export const DocShareInvitationItem = ({ doc, invitation }: Props) => {
   const canUpdate = doc.abilities.accesses_manage;
 
   const { mutate: updateDocInvitation } = useUpdateDocInvitation({
-    onSuccess: () => {
-      void queryClient.invalidateQueries({
-        queryKey: [KEY_SUB_DOC, { id: doc.id }],
-      });
-    },
     onError: (error) => {
       toast(
         error?.data?.role?.[0] ?? t('Error during update invitation'),
@@ -56,11 +49,6 @@ export const DocShareInvitationItem = ({ doc, invitation }: Props) => {
   });
 
   const { mutate: removeDocInvitation } = useDeleteDocInvitation({
-    onSuccess: () => {
-      void queryClient.invalidateQueries({
-        queryKey: [KEY_SUB_DOC, { id: doc.id }],
-      });
-    },
     onError: (error) => {
       toast(
         error?.data?.role?.[0] ?? t('Error during delete invitation'),

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareMemberItem.tsx

@@ -1,5 +1,4 @@
 import { VariantType, useToastProvider } from '@openfun/cunningham-react';
-import { useQueryClient } from '@tanstack/react-query';
 import { useTranslation } from 'react-i18next';
 
 import {
@@ -9,7 +8,7 @@ import {
   IconOptions,
 } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
-import { Access, Doc, KEY_SUB_DOC, Role } from '@/docs/doc-management/';
+import { Access, Doc, Role } from '@/docs/doc-management/';
 import { useResponsiveStore } from '@/stores';
 
 import { useDeleteDocAccess, useUpdateDocAccess } from '../api';
@@ -26,20 +25,13 @@ export const DocShareMemberItem = ({ doc, access }: Props) => {
   const { t } = useTranslation();
   const { isLastOwner, isOtherOwner } = useWhoAmI(access);
   const { toast } = useToastProvider();
-
   const { isDesktop } = useResponsiveStore();
   const { spacingsTokens } = useCunninghamTheme();
-  const queryClient = useQueryClient();
   const spacing = spacingsTokens();
   const isNotAllowed =
     isOtherOwner || !!isLastOwner || !doc.abilities.accesses_manage;
 
   const { mutate: updateDocAccess } = useUpdateDocAccess({
-    onSuccess: () => {
-      void queryClient.invalidateQueries({
-        queryKey: [KEY_SUB_DOC, { id: doc.id }],
-      });
-    },
     onError: () => {
       toast(t('Error during invitation update'), VariantType.ERROR, {
         duration: 4000,
@@ -48,11 +40,6 @@ export const DocShareMemberItem = ({ doc, access }: Props) => {
   });
 
   const { mutate: removeDocAccess } = useDeleteDocAccess({
-    onSuccess: () => {
-      void queryClient.invalidateQueries({
-        queryKey: [KEY_SUB_DOC, { id: doc.id }],
-      });
-    },
     onError: () => {
       toast(t('Error while deleting invitation'), VariantType.ERROR, {
         duration: 4000,

src/frontend/apps/impress/src/features/docs/doc-tree/api/useCreateChildren.tsx

@@ -1,44 +0,0 @@
-import { useMutation, useQueryClient } from '@tanstack/react-query';
-
-import { APIError, errorCauses, fetchAPI } from '@/api';
-
-import { Doc, KEY_LIST_DOC } from '../../doc-management';
-
-export type CreateDocParam = Pick<Doc, 'title'> & {
-  parentId: string;
-};
-
-export const createDocChildren = async ({
-  title,
-  parentId,
-}: CreateDocParam): Promise<Doc> => {
-  const response = await fetchAPI(`documents/${parentId}/children/`, {
-    method: 'POST',
-    body: JSON.stringify({
-      title,
-    }),
-  });
-
-  if (!response.ok) {
-    throw new APIError('Failed to create the doc', await errorCauses(response));
-  }
-
-  return response.json() as Promise<Doc>;
-};
-
-interface CreateDocProps {
-  onSuccess: (data: Doc) => void;
-}
-
-export function useCreateChildrenDoc({ onSuccess }: CreateDocProps) {
-  const queryClient = useQueryClient();
-  return useMutation<Doc, APIError, CreateDocParam>({
-    mutationFn: createDocChildren,
-    onSuccess: (data) => {
-      void queryClient.resetQueries({
-        queryKey: [KEY_LIST_DOC],
-      });
-      onSuccess(data);
-    },
-  });
-}

src/frontend/apps/impress/src/features/docs/doc-tree/api/useDocChildren.tsx

@@ -1,58 +0,0 @@
-import { UseQueryOptions, useQuery } from '@tanstack/react-query';
-
-import { APIError, errorCauses, fetchAPI, useAPIInfiniteQuery } from '@/api';
-
-import { DocsResponse } from '../../doc-management';
-
-export type DocsChildrenParams = {
-  docId: string;
-  page?: number;
-  page_size?: number;
-};
-
-export const getDocChildren = async (
-  params: DocsChildrenParams,
-): Promise<DocsResponse> => {
-  const { docId, page, page_size } = params;
-  const searchParams = new URLSearchParams();
-
-  if (page) {
-    searchParams.set('page', page.toString());
-  }
-  if (page_size) {
-    searchParams.set('page_size', page_size.toString());
-  }
-
-  const response = await fetchAPI(
-    `documents/${docId}/children/?${searchParams.toString()}`,
-  );
-
-  if (!response.ok) {
-    throw new APIError(
-      'Failed to get the doc children',
-      await errorCauses(response),
-    );
-  }
-
-  return response.json() as Promise<DocsResponse>;
-};
-
-export const KEY_LIST_DOC_CHILDREN = 'doc-children';
-
-export function useDocChildren(
-  params: DocsChildrenParams,
-  queryConfig?: Omit<
-    UseQueryOptions<DocsResponse, APIError, DocsResponse>,
-    'queryKey' | 'queryFn'
-  >,
-) {
-  return useQuery<DocsResponse, APIError, DocsResponse>({
-    queryKey: [KEY_LIST_DOC_CHILDREN, params],
-    queryFn: () => getDocChildren(params),
-    ...queryConfig,
-  });
-}
-
-export const useInfiniteDocChildren = (params: DocsChildrenParams) => {
-  return useAPIInfiniteQuery(KEY_LIST_DOC_CHILDREN, getDocChildren, params);
-};

src/frontend/apps/impress/src/features/docs/doc-tree/api/useDocTree.tsx

@@ -1,45 +0,0 @@
-import { UseQueryOptions, useQuery } from '@tanstack/react-query';
-
-import { APIError, errorCauses, fetchAPI } from '@/api';
-
-import { Doc } from '../../doc-management';
-
-export type DocsTreeParams = {
-  docId: string;
-};
-
-export const getDocTree = async (params: DocsTreeParams): Promise<Doc> => {
-  const { docId } = params;
-  const searchParams = new URLSearchParams();
-
-  const response = await fetchAPI(
-    `documents/${docId}/tree/?${searchParams.toString()}`,
-  );
-
-  if (!response.ok) {
-    throw new APIError(
-      'Failed to get the doc tree',
-      await errorCauses(response),
-    );
-  }
-
-  return response.json() as Promise<Doc>;
-};
-
-export const KEY_LIST_DOC_CHILDREN = 'doc-tree';
-
-export function useDocTree(
-  params: DocsTreeParams,
-  queryConfig?: Omit<
-    UseQueryOptions<Doc, APIError, Doc>,
-    'queryKey' | 'queryFn'
-  >,
-) {
-  return useQuery<Doc, APIError, Doc>({
-    queryKey: [KEY_LIST_DOC_CHILDREN, params],
-    queryFn: () => getDocTree(params),
-    staleTime: 0,
-    refetchOnWindowFocus: false,
-    ...queryConfig,
-  });
-}

src/frontend/apps/impress/src/features/docs/doc-tree/api/useMove.tsx

@@ -1,36 +0,0 @@
-import { TreeViewMoveModeEnum } from '@gouvfr-lasuite/ui-kit';
-import { useMutation } from '@tanstack/react-query';
-
-import { APIError, errorCauses, fetchAPI } from '@/api';
-
-export type MoveDocParam = {
-  sourceDocumentId: string;
-  targetDocumentId: string;
-  position: TreeViewMoveModeEnum;
-};
-
-export const moveDoc = async ({
-  sourceDocumentId,
-  targetDocumentId,
-  position,
-}: MoveDocParam): Promise<void> => {
-  const response = await fetchAPI(`documents/${sourceDocumentId}/move/`, {
-    method: 'POST',
-    body: JSON.stringify({
-      target_document_id: targetDocumentId,
-      position,
-    }),
-  });
-
-  if (!response.ok) {
-    throw new APIError('Failed to move the doc', await errorCauses(response));
-  }
-
-  return response.json() as Promise<void>;
-};
-
-export function useMoveDoc() {
-  return useMutation<void, APIError, MoveDocParam>({
-    mutationFn: moveDoc,
-  });
-}

src/frontend/apps/impress/src/features/docs/doc-tree/assets/sub-page-logo.svg

@@ -1,3 +0,0 @@
-<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M5.40918 4.69434C5.28613 4.69434 5.18359 4.65332 5.10156 4.57129C5.02409 4.48926 4.98535 4.389 4.98535 4.27051C4.98535 4.15202 5.02409 4.05404 5.10156 3.97656C5.18359 3.89453 5.28613 3.85352 5.40918 3.85352H10.5977C10.7161 3.85352 10.8141 3.89453 10.8916 3.97656C10.9736 4.05404 11.0146 4.15202 11.0146 4.27051C11.0146 4.389 10.9736 4.48926 10.8916 4.57129C10.8141 4.65332 10.7161 4.69434 10.5977 4.69434H5.40918ZM5.40918 7.08008C5.28613 7.08008 5.18359 7.03906 5.10156 6.95703C5.02409 6.875 4.98535 6.77474 4.98535 6.65625C4.98535 6.53776 5.02409 6.43978 5.10156 6.3623C5.18359 6.28027 5.28613 6.23926 5.40918 6.23926H10.5977C10.7161 6.23926 10.8141 6.28027 10.8916 6.3623C10.9736 6.43978 11.0146 6.53776 11.0146 6.65625C11.0146 6.77474 10.9736 6.875 10.8916 6.95703C10.8141 7.03906 10.7161 7.08008 10.5977 7.08008H5.40918ZM5.40918 9.46582C5.28613 9.46582 5.18359 9.42708 5.10156 9.34961C5.02409 9.26758 4.98535 9.1696 4.98535 9.05566C4.98535 8.93262 5.02409 8.83008 5.10156 8.74805C5.18359 8.66602 5.28613 8.625 5.40918 8.625H7.86328C7.98633 8.625 8.08659 8.66602 8.16406 8.74805C8.24609 8.83008 8.28711 8.93262 8.28711 9.05566C8.28711 9.1696 8.24609 9.26758 8.16406 9.34961C8.08659 9.42708 7.98633 9.46582 7.86328 9.46582H5.40918ZM2.25098 13.2529V2.88281C2.25098 2.17188 2.42643 1.63639 2.77734 1.27637C3.13281 0.916341 3.66374 0.736328 4.37012 0.736328H11.6299C12.3363 0.736328 12.8649 0.916341 13.2158 1.27637C13.5713 1.63639 13.749 2.17188 13.749 2.88281V13.2529C13.749 13.9684 13.5713 14.5039 13.2158 14.8594C12.8649 15.2148 12.3363 15.3926 11.6299 15.3926H4.37012C3.66374 15.3926 3.13281 15.2148 2.77734 14.8594C2.42643 14.5039 2.25098 13.9684 2.25098 13.2529ZM3.35156 13.2324C3.35156 13.5742 3.44043 13.8363 3.61816 14.0186C3.80046 14.2008 4.06934 14.292 4.4248 14.292H11.5752C11.9307 14.292 12.1973 14.2008 12.375 14.0186C12.5573 13.8363 12.6484 13.5742 12.6484 13.2324V2.90332C12.6484 2.56152 12.5573 2.29948 12.375 2.11719C12.1973 1.93034 11.9307 1.83691 11.5752 1.83691H4.4248C4.06934 1.83691 3.80046 1.93034 3.61816 2.11719C3.44043 2.29948 3.35156 2.56152 3.35156 2.90332V13.2324Z" fill="#8585F6"/>
-</svg>

src/frontend/apps/impress/src/features/docs/doc-tree/components/DocSubPageItem.tsx

@@ -1,178 +0,0 @@
-import {
-  TreeViewItem,
-  TreeViewNodeProps,
-  useTree,
-} from '@gouvfr-lasuite/ui-kit';
-import { useRouter } from 'next/navigation';
-import { useEffect, useRef } from 'react';
-import { css } from 'styled-components';
-
-import { Box, Icon, Text } from '@/components';
-import { useCunninghamTheme } from '@/cunningham';
-import { Doc, KEY_SUB_DOC, useDoc } from '@/features/docs/doc-management';
-import { useLeftPanelStore } from '@/features/left-panel';
-
-import Logo from './../assets/sub-page-logo.svg';
-import { DocTreeItemActions } from './DocTreeItemActions';
-
-const ItemTextCss = css`
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: initial;
-  display: -webkit-box;
-  line-clamp: 1;
-  /* width: 100%; */
-  -webkit-line-clamp: 1;
-  -webkit-box-orient: vertical;
-`;
-
-type Props = TreeViewNodeProps<Doc> & {
-  treeData: ReturnType<typeof useTree<Doc>>;
-  doc: Doc;
-  setSelectedNode: (node: Doc) => void;
-};
-
-export const DocSubPageItem = ({
-  doc,
-  setSelectedNode,
-  treeData,
-  ...props
-}: Props) => {
-  const { loadChildren, node } = props;
-  const isInitialLoad = useRef(false);
-  const { spacingsTokens } = useCunninghamTheme();
-  const spacing = spacingsTokens();
-  const router = useRouter();
-  const { togglePanel } = useLeftPanelStore();
-
-  const { data: docQuery } = useDoc(
-    { isTree: true, id: doc.id },
-    {
-      initialData: doc,
-      queryKey: [KEY_SUB_DOC, { id: doc.id }],
-      refetchOnMount: false,
-      refetchOnWindowFocus: false,
-    },
-  );
-
-  useEffect(() => {
-    if (docQuery && isInitialLoad.current === true) {
-      console.log('docQuery', docQuery);
-      treeData?.updateNode(docQuery.id, docQuery);
-    }
-    if (docQuery) {
-      isInitialLoad.current = true;
-    }
-  }, [docQuery, treeData]);
-
-  const afterCreate = (createdDoc: Doc) => {
-    const actualChildren = node.data.children ?? [];
-
-    if (actualChildren.length === 0 && loadChildren) {
-      loadChildren(node?.data.value)
-        .then((allChildren) => {
-          node.open();
-
-          router.push(`/docs/${doc.id}`);
-          treeData?.setChildren(node.data.value.id, allChildren);
-          togglePanel();
-        })
-        .catch(console.error);
-    } else {
-      const newDoc = {
-        ...createdDoc,
-        children: [],
-        childrenCount: 0,
-        parentId: node.id,
-      };
-      treeData?.addChild(node.data.value.id, newDoc);
-      node.open();
-      router.push(`/docs/${createdDoc.id}`);
-      togglePanel();
-    }
-  };
-
-  if (!treeData) {
-    return null;
-  }
-
-  return (
-    <TreeViewItem
-      {...props}
-      loadChildren={() =>
-        treeData?.handleLoadChildren(props.node.data.value.id)
-      }
-      onClick={() => {
-        setSelectedNode(props.node.data.value as Doc);
-        router.push(`/docs/${props.node.data.value.id}`);
-      }}
-    >
-      <Box
-        data-testid={`doc-sub-page-item-${props.node.data.value.id}`}
-        $width="100%"
-        $direction="row"
-        $gap={spacing['xs']}
-        role="button"
-        tabIndex={0}
-        $align="center"
-        $css={css`
-          .light-doc-item-actions {
-            display: 'flex';
-            opacity: 0;
-
-            &:has(.isOpen) {
-              opacity: 1;
-            }
-          }
-          &:hover {
-            .light-doc-item-actions {
-              opacity: 1;
-            }
-          }
-        `}
-      >
-        <Box $width={16} $height={16}>
-          <Logo />
-        </Box>
-
-        <Box
-          $direction="row"
-          $align="center"
-          $css={css`
-            display: flex;
-            flex-direction: row;
-            width: 100%;
-            gap: 0.5rem;
-            align-items: center;
-          `}
-        >
-          <Text $css={ItemTextCss} $size="sm">
-            {doc.title}
-          </Text>
-          {doc.nb_accesses_direct > 1 && (
-            <Icon
-              $isMaterialIcon="filled"
-              iconName="group"
-              $size="16px"
-              $variation="400"
-            />
-          )}
-        </Box>
-
-        <Box
-          $direction="row"
-          $gap={spacing['xs']}
-          $align="center"
-          className="light-doc-item-actions"
-        >
-          <DocTreeItemActions
-            doc={doc}
-            treeData={treeData}
-            parentId={node.data.parentKey}
-            onCreateSuccess={afterCreate}
-          />
-        </Box>
-      </Box>
-    </TreeViewItem>
-  );
-};

src/frontend/apps/impress/src/features/docs/doc-tree/components/DocTree.tsx

@@ -1,238 +0,0 @@
-import {
-  OpenMap,
-  TreeView,
-  TreeViewMoveResult,
-  useTree,
-} from '@gouvfr-lasuite/ui-kit';
-import { useQueryClient } from '@tanstack/react-query';
-import { useRouter } from 'next/navigation';
-import { useEffect, useState } from 'react';
-import { css } from 'styled-components';
-
-import { Box, SeparatedSection, StyledLink } from '@/components';
-import { useCunninghamTheme } from '@/cunningham';
-
-import {
-  Doc,
-  KEY_DOC,
-  LinkReach,
-  LinkRole,
-  getDoc,
-} from '../../doc-management';
-import { SimpleDocItem } from '../../docs-grid';
-import { getDocChildren } from '../api/useDocChildren';
-import { useDocTree } from '../api/useDocTree';
-import { useMoveDoc } from '../api/useMove';
-import { subPageToTree, useDocTreeStore } from '../context/DocTreeContext';
-
-import { DocSubPageItem } from './DocSubPageItem';
-import { DocTreeItemActions } from './DocTreeItemActions';
-
-type DocTreeProps = {
-  initialTargetId: string;
-};
-export const DocTree = ({ initialTargetId }: DocTreeProps) => {
-  const { spacingsTokens } = useCunninghamTheme();
-  const queryClient = useQueryClient();
-  const store = useDocTreeStore();
-
-  const spacing = spacingsTokens();
-
-  const treeData = useTree(
-    [],
-    async (docId) => {
-      const doc = await getDoc({ id: docId });
-      const newDoc = { ...doc, childrenCount: doc.numchild };
-      void queryClient.setQueryData([KEY_DOC, { id: docId }], newDoc);
-      return newDoc;
-    },
-    async (docId) => {
-      const doc = await getDocChildren({ docId: docId });
-      return subPageToTree(doc.results ?? []);
-    },
-  );
-  const router = useRouter();
-  const [initialOpenState, setInitialOpenState] = useState<OpenMap | undefined>(
-    undefined,
-  );
-
-  const { mutate: moveDoc } = useMoveDoc();
-
-  const { data } = useDocTree({
-    docId: initialTargetId,
-  });
-
-  const handleMove = (result: TreeViewMoveResult) => {
-    moveDoc({
-      sourceDocumentId: result.sourceId,
-      targetDocumentId: result.targetModeId,
-      position: result.mode,
-    });
-    treeData?.handleMove(result);
-  };
-
-  const buildDocTree = (data?: Doc) => {
-    if (!data) {
-      return;
-    }
-    const { children: rootChildren, ...root } = data;
-    const children = rootChildren ?? [];
-    store.setRoot(root);
-    const initialOpenState: OpenMap = {};
-    initialOpenState[root.id] = true;
-    subPageToTree(children, (child) => {
-      if (child?.children?.length && child?.children?.length > 0) {
-        initialOpenState[child.id] = true;
-      }
-    });
-
-    treeData.resetTree(children);
-    setInitialOpenState(initialOpenState);
-    if (initialTargetId === root.id) {
-      treeData?.setSelectedNode(root);
-    } else {
-      treeData?.selectNodeById(initialTargetId);
-    }
-  };
-
-  useEffect(() => {
-    if (treeData?.selectedNode?.id !== store.selectedNode?.id) {
-      store.setSelectedNode(treeData?.selectedNode ?? null);
-    }
-  }, [store, treeData?.selectedNode]);
-
-  useEffect(() => {
-    buildDocTree(data);
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [data]);
-
-  const rootIsSelected = treeData?.selectedNode?.id === store.root?.id;
-
-  if (!initialTargetId) {
-    return null;
-  }
-
-  return (
-    <Box data-testid="doc-tree" $height="100%">
-      <SeparatedSection showSeparator={false}>
-        <Box $padding={{ horizontal: 'sm' }}>
-          <Box
-            $css={css`
-              padding: ${spacing['2xs']};
-              border-radius: 4px;
-              width: 100%;
-              background-color: ${rootIsSelected
-                ? 'var(--c--theme--colors--greyscale-100)'
-                : 'transparent'};
-
-              &:hover {
-                background-color: var(--c--theme--colors--greyscale-100);
-              }
-
-              .doc-tree-root-item-actions {
-                display: 'flex';
-                opacity: 0;
-
-                &:has(.isOpen) {
-                  opacity: 1;
-                }
-              }
-              &:hover {
-                .doc-tree-root-item-actions {
-                  opacity: 1;
-                }
-              }
-            `}
-          >
-            {store.root !== null && (
-              <StyledLink
-                $css={css`
-                  width: 100%;
-                `}
-                href={`/docs/${store.root.id}`}
-                onClick={(e) => {
-                  e.stopPropagation();
-                  e.preventDefault();
-                  treeData?.setSelectedNode(store.root ?? undefined);
-                  router.push(`/docs/${store.root?.id}`);
-                }}
-              >
-                <Box $direction="row" $align="center" $width="100%">
-                  <SimpleDocItem doc={store.root} showAccesses={true} />
-                  <div className="doc-tree-root-item-actions">
-                    <DocTreeItemActions
-                      doc={store.root}
-                      treeData={treeData}
-                      onCreateSuccess={(createdDoc) => {
-                        const newDoc = {
-                          ...createdDoc,
-                          children: [],
-                          childrenCount: 0,
-                          parentId: store.root?.id ?? undefined,
-                        };
-                        treeData?.addChild(null, newDoc);
-                      }}
-                    />
-                  </div>
-                </Box>
-              </StyledLink>
-            )}
-          </Box>
-        </Box>
-      </SeparatedSection>
-      <button
-        onClick={() => {
-          const children = data?.children ?? [];
-          const newDoc = {
-            id: '1',
-            children: [],
-            childrenCount: 0,
-            title: 'TITI',
-            creator: 'test',
-            is_favorite: false,
-          };
-
-          // Ajout des propriétés manquantes pour correspondre au type Doc
-          const completeDoc = {
-            ...newDoc,
-            link_reach: LinkReach.PUBLIC,
-            link_role: LinkRole.EDITOR,
-            user_roles: [],
-            // Ajoutez ici les autres propriétés requises par le type Doc
-          };
-
-          children.push(completeDoc);
-          buildDocTree(data);
-        }}
-      >
-        Refresh
-      </button>
-
-      {initialOpenState && treeData.nodes.length > 0 && (
-        <TreeView
-          handleMove={handleMove}
-          initialOpenState={initialOpenState}
-          selectedNodeId={
-            treeData.selectedNode?.id ?? store.initialTargetId ?? undefined
-          }
-          treeData={treeData.nodes ?? []}
-          rootNodeId={store.root?.id ?? ''}
-          renderNode={(props) => {
-            if (treeData === undefined) {
-              return null;
-            }
-            return (
-              <DocSubPageItem
-                {...props}
-                treeData={treeData}
-                doc={props.node.data.value as Doc}
-                loadChildren={(node) => treeData.handleLoadChildren(node.id)}
-                setSelectedNode={(node) => treeData.setSelectedNode(node)}
-              />
-            );
-          }}
-        />
-      )}
-    </Box>
-  );
-};

src/frontend/apps/impress/src/features/docs/doc-tree/components/DocTreeItemActions.tsx

@@ -1,129 +0,0 @@
-import {
-  DropdownMenu,
-  DropdownMenuOption,
-  useTree,
-} from '@gouvfr-lasuite/ui-kit';
-import { useModal } from '@openfun/cunningham-react';
-import { useRouter } from 'next/navigation';
-import { Fragment, useState } from 'react';
-import { useTranslation } from 'react-i18next';
-import { css } from 'styled-components';
-
-import { Box, BoxButton, Icon } from '@/components';
-import { useLeftPanelStore } from '@/features/left-panel';
-
-import { Doc, ModalRemoveDoc } from '../../doc-management';
-import { useCreateChildrenDoc } from '../api/useCreateChildren';
-import { useDocTreeStore } from '../context/DocTreeContext';
-
-type DocTreeItemActionsProps = {
-  doc: Doc;
-  parentId?: string | null;
-  treeData: ReturnType<typeof useTree<Doc>>;
-  onCreateSuccess?: (newDoc: Doc) => void;
-};
-
-export const DocTreeItemActions = ({
-  doc,
-  parentId,
-  onCreateSuccess,
-  treeData,
-}: DocTreeItemActionsProps) => {
-  const [isOpen, setIsOpen] = useState(false);
-  const router = useRouter();
-
-  const treeStore = useDocTreeStore();
-  const { t } = useTranslation();
-  const deleteModal = useModal();
-  const { togglePanel } = useLeftPanelStore();
-
-  const options: DropdownMenuOption[] = [
-    {
-      label: t('Delete'),
-      icon: <Icon iconName="delete" />,
-      callback: deleteModal.open,
-    },
-  ];
-
-  const { mutate: createChildrenDoc } = useCreateChildrenDoc({
-    onSuccess: (doc) => {
-      onCreateSuccess?.(doc);
-
-      togglePanel();
-      treeData.setSelectedNode(doc);
-      router.push(`/docs/${doc.id}`);
-    },
-  });
-
-  const afterDelete = () => {
-    if (parentId) {
-      router.push(`/docs/${parentId}`);
-      treeData?.selectNodeById(parentId);
-      treeData?.deleteNode(doc.id);
-      void treeData?.refreshNode(parentId);
-    } else if (doc.id === treeStore.root?.id && !parentId) {
-      router.push(`/docs/`);
-    } else if (treeStore.root) {
-      router.push(`/docs/${treeStore.root.id}`);
-      treeData?.deleteNode(doc.id);
-      treeData?.setSelectedNode(treeStore.root);
-    }
-  };
-
-  return (
-    <Fragment>
-      <Box
-        $direction="row"
-        $align="center"
-        className={` ${isOpen ? 'isOpen' : ''}`}
-        $css={css`
-          gap: var(--c--theme----c--theme--spacings--xs);
-        `}
-      >
-        <DropdownMenu
-          options={options}
-          isOpen={isOpen}
-          onOpenChange={setIsOpen}
-        >
-          <Icon
-            onClick={(e) => {
-              e.stopPropagation();
-              e.preventDefault();
-              setIsOpen(!isOpen);
-            }}
-            iconName="more_horiz"
-            $isMaterialIcon="filled"
-            $theme="primary"
-            $variation="600"
-          />
-        </DropdownMenu>
-        <BoxButton
-          onClick={(e) => {
-            e.stopPropagation();
-            e.preventDefault();
-
-            createChildrenDoc({
-              title: t('Untitled page'),
-              parentId: doc.id,
-            });
-          }}
-          color="primary"
-        >
-          <Icon
-            $variation="800"
-            $theme="primary"
-            $isMaterialIcon="filled"
-            iconName="add_box"
-          />
-        </BoxButton>
-      </Box>
-      {deleteModal.isOpen && (
-        <ModalRemoveDoc
-          onClose={deleteModal.onClose}
-          doc={doc}
-          afterDelete={afterDelete}
-        />
-      )}
-    </Fragment>
-  );
-};

src/frontend/apps/impress/src/features/docs/doc-tree/context/DocTreeContext.tsx

@@ -1,37 +0,0 @@
-import { TreeViewDataType } from '@gouvfr-lasuite/ui-kit';
-import { create } from 'zustand';
-
-import { Doc } from '../../doc-management';
-
-export const subPageToTree = (
-  children: Doc[],
-  callback?: (doc: Doc) => void,
-): TreeViewDataType<Doc>[] => {
-  children.forEach((child) => {
-    child.childrenCount = child.numchild ?? 0;
-    callback?.(child);
-    subPageToTree(child.children ?? [], callback);
-  });
-  return children;
-};
-
-interface DocTreeStore {
-  initialTargetId?: string | null;
-  initialRootId?: string | null;
-  setRoot: (doc: Doc | null) => void;
-  root: Doc | null;
-  setInitialTargetId: (id: string) => void;
-  setSelectedNode: (node: Doc | null) => void;
-  selectedNode: Doc | null;
-}
-
-export const useDocTreeStore = create<DocTreeStore>((set) => ({
-  root: null,
-  selectedNode: null,
-  initialTargetId: undefined,
-  initialRootId: undefined,
-
-  setRoot: (doc) => set({ root: doc }),
-  setInitialTargetId: (id) => set({ initialTargetId: id }),
-  setSelectedNode: (node) => set({ selectedNode: node }),
-}));

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocGridContentList.tsx

@@ -1,189 +0,0 @@
-import {
-  DndContext,
-  DragEndEvent,
-  DragOverlay,
-  DragStartEvent,
-  KeyboardSensor,
-  Modifier,
-  MouseSensor,
-  TouchSensor,
-  useSensor,
-  useSensors,
-} from '@dnd-kit/core';
-import { getEventCoordinates } from '@dnd-kit/utilities';
-import { TreeViewMoveModeEnum } from '@gouvfr-lasuite/ui-kit';
-import { useQueryClient } from '@tanstack/react-query';
-import { useMemo, useState } from 'react';
-import { useTranslation } from 'react-i18next';
-
-import { Box, Text } from '@/components';
-
-import { Doc, KEY_LIST_DOC, Role } from '../../doc-management';
-import { useMoveDoc } from '../../doc-tree/api/useMove';
-
-import { DocsGridItem } from './DocsGridItem';
-import { Draggable } from './dnd/Draggable';
-import { Droppable } from './dnd/Droppable';
-
-const activationConstraint = {
-  distance: 20,
-};
-
-type DocGridContentListProps = {
-  docs: Doc[];
-};
-
-export const DocGridContentList = ({ docs }: DocGridContentListProps) => {
-  const queryClient = useQueryClient();
-  const { t } = useTranslation();
-  const [selectedDoc, setSelectedDoc] = useState<Doc>();
-  const canDrag = selectedDoc?.user_roles.some((role) => role === Role.OWNER);
-  const [canDrop, setCanDrop] = useState<boolean>();
-  const { mutate: handleMove } = useMoveDoc();
-
-  const mouseSensor = useSensor(MouseSensor, {
-    activationConstraint,
-  });
-
-  const touchSensor = useSensor(TouchSensor, {
-    activationConstraint,
-  });
-  const keyboardSensor = useSensor(KeyboardSensor, {});
-
-  const sensors = useSensors(mouseSensor, touchSensor, keyboardSensor);
-
-  const handleDragStart = (e: DragStartEvent) => {
-    document.body.style.cursor = 'grabbing';
-    if (e.active.data.current) {
-      setSelectedDoc(e.active.data.current as Doc);
-    }
-  };
-
-  const handleDragEnd = (e: DragEndEvent) => {
-    setSelectedDoc(undefined);
-    setCanDrop(undefined);
-    document.body.style.cursor = 'default';
-    if (!canDrag || !canDrop) {
-      return;
-    }
-
-    const { active, over } = e;
-
-    if (!over?.id || active.id === over?.id) {
-      return;
-    }
-
-    handleMove(
-      {
-        sourceDocumentId: active.id as string,
-        targetDocumentId: over.id as string,
-        position: TreeViewMoveModeEnum.FIRST_CHILD,
-      },
-      {
-        onSuccess: () => {
-          void queryClient.invalidateQueries({
-            queryKey: [KEY_LIST_DOC],
-          });
-        },
-      },
-    );
-  };
-
-  const overlayText = useMemo(() => {
-    if (!canDrag) {
-      return t('You must be the owner to move the document');
-    }
-    if (!canDrop) {
-      return t('You must be at least the editor of the target document');
-    }
-
-    return selectedDoc?.title || t('Unnamed document');
-  }, [canDrag, canDrop, selectedDoc, t]);
-
-  const overlayBgColor = useMemo(() => {
-    if (!canDrag) {
-      return 'var(--c--theme--colors--danger-600)';
-    }
-    if (canDrop !== undefined && !canDrop) {
-      return 'var(--c--theme--colors--danger-600)';
-    }
-    return '#5858D3';
-  }, [canDrag, canDrop]);
-
-  if (docs.length === 0) {
-    return null;
-  }
-
-  return (
-    <DndContext
-      sensors={sensors}
-      modifiers={[snapToTopLeft]}
-      onDragStart={handleDragStart}
-      onDragEnd={handleDragEnd}
-    >
-      {docs.map((doc) => {
-        const canDropItem = doc.user_roles.some(
-          (role) =>
-            role === Role.ADMIN || role === Role.OWNER || role === Role.EDITOR,
-        );
-        return (
-          <Droppable
-            enabledDrop={canDrag}
-            canDrop={canDrag && canDropItem}
-            onOver={(isOver) => {
-              if (isOver) {
-                setCanDrop(canDropItem);
-              }
-            }}
-            key={doc.id}
-            id={doc.id}
-            data={doc}
-          >
-            <Draggable key={doc.id} id={doc.id} data={doc}>
-              <DocsGridItem dragMode={!!selectedDoc} doc={doc} key={doc.id} />
-            </Draggable>
-          </Droppable>
-        );
-      })}
-      <DragOverlay dropAnimation={null}>
-        <Box
-          $width="fit-content"
-          $padding={{ horizontal: 'xs', vertical: '3xs' }}
-          $radius="12px"
-          $background={overlayBgColor}
-          data-testid="drag-doc-overlay"
-          $height="auto"
-        >
-          <Text $size="xs" $variation="000" $weight="500">
-            {overlayText}
-          </Text>
-        </Box>
-      </DragOverlay>
-    </DndContext>
-  );
-};
-
-export const snapToTopLeft: Modifier = ({
-  activatorEvent,
-  draggingNodeRect,
-  transform,
-}) => {
-  if (draggingNodeRect && activatorEvent) {
-    const activatorCoordinates = getEventCoordinates(activatorEvent);
-
-    if (!activatorCoordinates) {
-      return transform;
-    }
-
-    const offsetX = activatorCoordinates.x - draggingNodeRect.left;
-    const offsetY = activatorCoordinates.y - draggingNodeRect.top;
-
-    return {
-      ...transform,
-      x: transform.x + offsetX - 3,
-      y: transform.y + offsetY - 3,
-    };
-  }
-
-  return transform;
-};

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGrid.tsx

@@ -9,7 +9,7 @@ import { useResponsiveStore } from '@/stores';
 
 import { useResponsiveDocGrid } from '../hooks/useResponsiveDocGrid';
 
-import { DocGridContentList } from './DocGridContentList';
+import { DocsGridItem } from './DocsGridItem';
 import { DocsGridLoader } from './DocsGridLoader';
 
 type DocsGridProps = {
@@ -37,9 +37,6 @@ export const DocsGrid = ({
         is_creator_me: target === DocDefaultFilter.MY_DOCS,
       }),
   });
-
-  const docs = data?.pages.flatMap((page) => page.results) ?? [];
-
   const loading = isFetching || isLoading;
   const hasDocs = data?.pages.some((page) => page.results.length > 0);
   const loadMore = (inView: boolean) => {
@@ -117,7 +114,11 @@ export const DocsGrid = ({
               )}
             </Box>
 
-            <DocGridContentList docs={docs} />
+            {data?.pages.map((currentPage) => {
+              return currentPage.results.map((doc) => (
+                <DocsGridItem doc={doc} key={doc.id} />
+              ));
+            })}
 
             {hasNextPage && !loading && (
               <InView

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGridItem.tsx

@@ -16,9 +16,8 @@ import { DocsGridItemSharedButton } from './DocsGridItemSharedButton';
 import { SimpleDocItem } from './SimpleDocItem';
 type DocsGridItemProps = {
   doc: Doc;
-  dragMode?: boolean;
 };
-export const DocsGridItem = ({ doc, dragMode = false }: DocsGridItemProps) => {
+export const DocsGridItem = ({ doc }: DocsGridItemProps) => {
   const { t } = useTranslation();
   const { isDesktop } = useResponsiveStore();
   const { flexLeft, flexRight } = useResponsiveDocGrid();
@@ -47,9 +46,7 @@ export const DocsGridItem = ({ doc, dragMode = false }: DocsGridItemProps) => {
           cursor: pointer;
           border-radius: 4px;
           &:hover {
-            background-color: ${dragMode
-              ? 'none'
-              : 'var(--c--theme--colors--greyscale-100)'};
+            background-color: var(--c--theme--colors--greyscale-100);
           }
         `}
       >
@@ -82,35 +79,25 @@ export const DocsGridItem = ({ doc, dragMode = false }: DocsGridItemProps) => {
                     : undefined
                 }
               >
-                {dragMode && (
-                  <Icon
-                    $theme="greyscale"
-                    $variation="600"
-                    $size="14px"
-                    iconName={isPublic ? 'public' : 'vpn_lock'}
-                  />
-                )}
-                {!dragMode && (
-                  <Tooltip
-                    content={
-                      <Text $textAlign="center" $variation="000">
-                        {isPublic
-                          ? t('Accessible to anyone')
-                          : t('Accessible to authenticated users')}
-                      </Text>
-                    }
-                    placement="top"
-                  >
-                    <div>
-                      <Icon
-                        $theme="greyscale"
-                        $variation="600"
-                        $size="14px"
-                        iconName={isPublic ? 'public' : 'vpn_lock'}
-                      />
-                    </div>
-                  </Tooltip>
-                )}
+                <Tooltip
+                  content={
+                    <Text $textAlign="center" $variation="000">
+                      {isPublic
+                        ? t('Accessible to anyone')
+                        : t('Accessible to authenticated users')}
+                    </Text>
+                  }
+                  placement="top"
+                >
+                  <div>
+                    <Icon
+                      $theme="greyscale"
+                      $variation="600"
+                      $size="14px"
+                      iconName={isPublic ? 'public' : 'vpn_lock'}
+                    />
+                  </div>
+                </Tooltip>
               </Box>
             )}
           </Box>

src/frontend/apps/impress/src/features/docs/docs-grid/components/SimpleDocItem.tsx

@@ -38,7 +38,7 @@ export const SimpleDocItem = ({
   const { untitledDocument } = useTrans();
 
   return (
-    <Box $direction="row" $gap={spacings.sm} $overflow="auto" $width="100%">
+    <Box $direction="row" $gap={spacings.sm} $overflow="auto">
       <Box
         $direction="row"
         $align="center"

src/frontend/apps/impress/src/features/docs/docs-grid/components/dnd/Draggable.tsx

@@ -1,25 +0,0 @@
-import { Data, useDraggable } from '@dnd-kit/core';
-
-type DraggableProps<T> = {
-  id: string;
-  data?: Data<T>;
-  children: React.ReactNode;
-};
-
-export const Draggable = <T,>(props: DraggableProps<T>) => {
-  const { attributes, listeners, setNodeRef } = useDraggable({
-    id: props.id,
-    data: props.data,
-  });
-
-  return (
-    <div
-      ref={setNodeRef}
-      {...listeners}
-      {...attributes}
-      data-testid={`draggable-doc-${props.id}`}
-    >
-      {props.children}
-    </div>
-  );
-};

src/frontend/apps/impress/src/features/docs/docs-grid/components/dnd/Droppable.tsx

@@ -1,48 +0,0 @@
-/* eslint-disable react-hooks/exhaustive-deps */
-import { Data, useDroppable } from '@dnd-kit/core';
-import { useEffect } from 'react';
-import { css } from 'styled-components';
-
-import { Box } from '@/components';
-import { Doc } from '@/features/docs/doc-management';
-
-type DroppableProps = {
-  id: string;
-  onOver?: (isOver: boolean, data?: Data<Doc>) => void;
-  data?: Data<Doc>;
-  children: React.ReactNode;
-  enabledDrop?: boolean;
-  canDrop?: boolean;
-};
-
-export const Droppable = (props: DroppableProps) => {
-  const { isOver, setNodeRef } = useDroppable({
-    id: props.id,
-    data: props.data,
-  });
-
-  const enableHover = props.canDrop && isOver;
-
-  useEffect(() => {
-    props.onOver?.(isOver, props.data);
-  }, [isOver, props.data, props.onOver]);
-
-  return (
-    <Box
-      ref={setNodeRef}
-      data-testid={`droppable-doc-${props.id}`}
-      $css={css`
-        border-radius: 4px;
-        background-color: ${enableHover
-          ? 'var(--c--theme--colors--primary-100)'
-          : 'transparent'};
-        border: 1.5px solid
-          ${enableHover
-            ? 'var(--c--theme--colors--primary-500)'
-            : 'transparent'};
-      `}
-    >
-      {props.children}
-    </Box>
-  );
-};

src/frontend/apps/impress/src/features/left-panel/components/LeftPanelDocContent.tsx

@@ -1,14 +1,15 @@
-import { Box } from '@/components';
+import { css } from 'styled-components';
+
+import { Box, SeparatedSection } from '@/components';
+import { useCunninghamTheme } from '@/cunningham';
 import { useDocStore } from '@/docs/doc-management';
-import { DocTree } from '@/features/docs/doc-tree/components/DocTree';
-import { useDocTreeStore } from '@/features/docs/doc-tree/context/DocTreeContext';
+import { SimpleDocItem } from '@/docs/docs-grid';
 
 export const LeftPanelDocContent = () => {
   const { currentDoc } = useDocStore();
-
-  const treeStore = useDocTreeStore();
-
-  if (!currentDoc || !treeStore.initialTargetId) {
+  const { spacingsTokens } = useCunninghamTheme();
+  const spacing = spacingsTokens();
+  if (!currentDoc) {
     return null;
   }
 
@@ -18,9 +19,19 @@ export const LeftPanelDocContent = () => {
       $width="100%"
       $css="width: 100%; overflow-y: auto; overflow-x: hidden;"
     >
-      {treeStore.initialTargetId && (
-        <DocTree initialTargetId={treeStore.initialTargetId} />
-      )}
+      <SeparatedSection showSeparator={false}>
+        <Box $padding={{ horizontal: 'sm' }}>
+          <Box
+            $css={css`
+              padding: ${spacing['2xs']};
+              border-radius: 4px;
+              background-color: var(--c--theme--colors--greyscale-100);
+            `}
+          >
+            <SimpleDocItem doc={currentDoc} showAccesses={true} />
+          </Box>
+        </Box>
+      </SeparatedSection>
     </Box>
   );
 };

src/frontend/apps/impress/src/features/left-panel/components/LeftPanelHeader.tsx

@@ -1,15 +1,12 @@
 import { Button, ModalSize, useModal } from '@openfun/cunningham-react';
 import { t } from 'i18next';
-import { useRouter } from 'next/router';
+import { useRouter } from 'next/navigation';
 import { PropsWithChildren } from 'react';
 
 import { Box, Icon, SeparatedSection } from '@/components';
+import { useCreateDoc } from '@/docs/doc-management';
 import { DocSearchModal } from '@/docs/doc-search';
 import { useAuth } from '@/features/auth';
-import { useCreateDoc, useDocStore } from '@/features/docs/doc-management';
-import { DocSearchTarget } from '@/features/docs/doc-search/components/DocSearchFilters';
-import { useCreateChildrenDoc } from '@/features/docs/doc-tree/api/useCreateChildren';
-import { useDocTreeStore } from '@/features/docs/doc-tree/context/DocTreeContext';
 import { useCmdK } from '@/hook/useCmdK';
 
 import { useLeftPanelStore } from '../stores';
@@ -18,11 +15,6 @@ export const LeftPanelHeader = ({ children }: PropsWithChildren) => {
   const router = useRouter();
   const searchModal = useModal();
   const { authenticated } = useAuth();
-  const treeStore = useDocTreeStore();
-
-  const { currentDoc } = useDocStore();
-  const isDoc = router.pathname === '/docs/[id]';
-
   useCmdK(() => {
     const isEditorToolbarOpen =
       document.getElementsByClassName('bn-formatting-toolbar').length > 0;
@@ -36,34 +28,18 @@ export const LeftPanelHeader = ({ children }: PropsWithChildren) => {
 
   const { mutate: createDoc } = useCreateDoc({
     onSuccess: (doc) => {
-      void router.push(`/docs/${doc.id}`);
-      togglePanel();
-    },
-  });
-
-  const { mutate: createChildrenDoc } = useCreateChildrenDoc({
-    onSuccess: (doc) => {
-      treeStore.treeData?.addRootNode(doc);
-      treeStore.treeData?.selectNodeById(doc.id);
-      void router.push(`/docs/${doc.id}`);
+      router.push(`/docs/${doc.id}`);
       togglePanel();
     },
   });
 
   const goToHome = () => {
-    void router.push('/');
+    router.push('/');
     togglePanel();
   };
 
   const createNewDoc = () => {
-    if (treeStore.root && isDoc) {
-      createChildrenDoc({
-        title: t('Untitled page'),
-        parentId: treeStore.root.id,
-      });
-    } else {
-      createDoc();
-    }
+    createDoc();
   };
 
   return (
@@ -97,29 +73,15 @@ export const LeftPanelHeader = ({ children }: PropsWithChildren) => {
                 />
               )}
             </Box>
-
             {authenticated && (
-              <Button
-                color={!isDoc ? 'primary' : 'tertiary'}
-                onClick={createNewDoc}
-                disabled={currentDoc && !currentDoc.abilities.update}
-              >
-                {t(isDoc ? 'New page' : 'New doc')}
-              </Button>
+              <Button onClick={createNewDoc}>{t('New doc')}</Button>
             )}
           </Box>
         </SeparatedSection>
         {children}
       </Box>
       {searchModal.isOpen && (
-        <DocSearchModal
-          {...searchModal}
-          size={ModalSize.LARGE}
-          showFilters={isDoc}
-          defaultFilters={{
-            target: isDoc ? DocSearchTarget.CURRENT : undefined,
-          }}
-        />
+        <DocSearchModal {...searchModal} size={ModalSize.LARGE} />
       )}
     </>
   );

src/frontend/apps/impress/src/features/service-worker/ApiPlugin.ts

@@ -175,7 +175,6 @@ export class ApiPlugin implements WorkboxPlugin {
       is_favorite: false,
       nb_accesses_direct: 1,
       nb_accesses_ancestors: 1,
-      numchild: 0,
       updated_at: new Date().toISOString(),
       abilities: {
         accesses_manage: true,
@@ -202,7 +201,6 @@ export class ApiPlugin implements WorkboxPlugin {
       },
       link_reach: LinkReach.RESTRICTED,
       link_role: LinkRole.READER,
-      user_roles: [],
     };
 
     await DocsDB.cacheResponse(

src/frontend/apps/impress/src/pages/_app.tsx

@@ -1,5 +1,6 @@
 import type { AppProps } from 'next/app';
 import Head from 'next/head';
+import { useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import { AppProvider } from '@/core/';
@@ -18,6 +19,14 @@ export default function App({ Component, pageProps }: AppPropsWithLayout) {
   const getLayout = Component.getLayout ?? ((page) => page);
   const { t } = useTranslation();
 
+  useEffect(() => {
+    console.log(
+      `%c
+                                                                                                                                                \r\n \u2588\u2588\u2557    \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557    \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557     \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557    \u2588\u2588\u2557    \u2588\u2588\u2557    \u2588\u2588\u2557 \r\n \u2588\u2588\u2551    \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D    \u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557    \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D    \u2588\u2588\u2551    \u2588\u2588\u2551    \u2588\u2588\u2551 \r\n \u2588\u2588\u2551 \u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551     \u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2588\u2588\u2554\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2557         \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551    \u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557    \u2588\u2588\u2551    \u2588\u2588\u2551    \u2588\u2588\u2551 \r\n \u2588\u2588\u2551\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u255D  \u2588\u2588\u2551     \u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2554\u255D\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u255D         \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551    \u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551    \u255A\u2550\u255D    \u255A\u2550\u255D    \u255A\u2550\u255D \r\n \u255A\u2588\u2588\u2588\u2554\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551 \u255A\u2550\u255D \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557       \u2588\u2588\u2551   \u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D    \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551    \u2588\u2588\u2557    \u2588\u2588\u2557    \u2588\u2588\u2557 \r\n  \u255A\u2550\u2550\u255D\u255A\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D     \u255A\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D       \u255A\u2550\u255D    \u255A\u2550\u2550\u2550\u2550\u2550\u255D     \u255A\u2550\u2550\u2550\u2550\u2550\u255D  \u255A\u2550\u2550\u2550\u2550\u2550\u255D  \u255A\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D    \u255A\u2550\u255D    \u255A\u2550\u255D    \u255A\u2550\u255D \r\n                                                                                                                                                \r`,
+      'font-size: 11px;line-height:15px;background-image: linear-gradient(#000091, #005f91);color: transparent;background-clip: text;',
+    );
+  }, []);
+
   return (
     <>
       <Head>

src/frontend/apps/impress/src/pages/docs/[id]/index.tsx

@@ -7,15 +7,14 @@ import { useTranslation } from 'react-i18next';
 
 import { Box, Text, TextErrors } from '@/components';
 import { DocEditor } from '@/docs/doc-editor';
-import { KEY_AUTH, setAuthUrl } from '@/features/auth';
 import {
   Doc,
   KEY_DOC,
   useCollaboration,
   useDoc,
   useDocStore,
-} from '@/features/docs/doc-management/';
-import { useDocTreeStore } from '@/features/docs/doc-tree/context/DocTreeContext';
+} from '@/docs/doc-management/';
+import { KEY_AUTH, setAuthUrl } from '@/features/auth';
 import { MainLayout } from '@/layouts';
 import { useBroadcastStore } from '@/stores';
 import { NextPageWithLayout } from '@/types/next';
@@ -25,14 +24,6 @@ export function DocLayout() {
     query: { id },
   } = useRouter();
 
-  const treeStore = useDocTreeStore();
-
-  useEffect(() => {
-    if (typeof id === 'string' && !treeStore.initialTargetId) {
-      treeStore.setInitialTargetId(id);
-    }
-  }, [id, treeStore]);
-
   if (typeof id !== 'string') {
     return null;
   }
@@ -44,7 +35,7 @@ export function DocLayout() {
       </Head>
 
       <MainLayout>
-        {treeStore.initialTargetId && <DocPage id={id} />}
+        <DocPage id={id} />
       </MainLayout>
     </>
   );
@@ -65,8 +56,6 @@ const DocPage = ({ id }: DocProps) => {
     {
       staleTime: 0,
       queryKey: [KEY_DOC, { id }],
-      refetchOnMount: false,
-      refetchOnWindowFocus: false,
     },
   );
 
@@ -95,13 +84,6 @@ const DocPage = ({ id }: DocProps) => {
     setCurrentDoc(docQuery);
   }, [docQuery, setCurrentDoc, isFetching]);
 
-  useEffect(() => {
-    return () => {
-      setCurrentDoc(undefined);
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
   /**
    * We add a broadcast task to reset the query cache
    * when the document visibility changes.

src/frontend/apps/impress/src/pages/globals.css

@@ -70,3 +70,11 @@ main ::-webkit-scrollbar-thumb:hover,
   /* Support for IE. */
   font-feature-settings: 'liga';
 }
+
+[data-nextjs-dialog-overlay] {
+  display: none !important;
+}
+
+nextjs-portal {
+  display: none;
+}

src/frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impress",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "private": true,
   "workspaces": {
     "packages": [

src/frontend/packages/eslint-config-impress/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-config-impress",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "license": "MIT",
   "scripts": {
     "lint": "eslint --ext .js ."

src/frontend/packages/i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packages-i18n",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "private": true,
   "scripts": {
     "extract-translation": "yarn extract-translation:impress",

src/frontend/servers/y-provider/__tests__/hocusPocusWS.test.ts

@@ -2,6 +2,7 @@ import {
   HocuspocusProvider,
   HocuspocusProviderWebsocket,
 } from '@hocuspocus/provider';
+import { v1 as uuidv1, v4 as uuidv4 } from 'uuid';
 import WebSocket from 'ws';
 
 const port = 5559;
@@ -13,11 +14,22 @@ jest.mock('../src/env', () => {
     PORT: port,
     COLLABORATION_SERVER_ORIGIN: origin,
     COLLABORATION_SERVER_SECRET: 'test-secret-api-key',
+    COLLABORATION_BACKEND_BASE_URL: 'http://app-dev:8000',
   };
 });
 
 console.error = jest.fn();
 
+const mockDocFetch = jest.fn();
+jest.mock('@/api/getDoc', () => ({
+  fetchDocument: mockDocFetch,
+}));
+
+const mockGetMe = jest.fn();
+jest.mock('@/api/getMe', () => ({
+  getMe: mockGetMe,
+}));
+
 import { hocusPocusServer } from '@/servers/hocusPocusServer';
 
 import { promiseDone } from '../src/helpers';
@@ -30,45 +42,20 @@ describe('Server Tests', () => {
     await hocusPocusServer.configure({ port: portWS }).listen();
   });
 
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
   afterAll(() => {
     server.close();
     void hocusPocusServer.destroy();
   });
 
-  test('WebSocket connection with correct API key can connect', () => {
-    const { promise, done } = promiseDone();
-
-    // eslint-disable-next-line jest/unbound-method
-    const { handleConnection } = hocusPocusServer;
-    const mockHandleConnection = jest.fn();
-    (hocusPocusServer.handleConnection as jest.Mock) = mockHandleConnection;
-
-    const clientWS = new WebSocket(
-      `ws://localhost:${port}/collaboration/ws/?room=test-room`,
-      {
-        headers: {
-          authorization: 'test-secret-api-key',
-          Origin: origin,
-        },
-      },
-    );
-
-    clientWS.on('open', () => {
-      expect(mockHandleConnection).toHaveBeenCalled();
-      clientWS.close();
-      mockHandleConnection.mockClear();
-      hocusPocusServer.handleConnection = handleConnection;
-      done();
-    });
-
-    return promise;
-  });
-
   test('WebSocket connection with bad origin should be closed', () => {
     const { promise, done } = promiseDone();
-
+    const room = uuidv4();
     const ws = new WebSocket(
-      `ws://localhost:${port}/collaboration/ws/?room=test-room`,
+      `ws://localhost:${port}/collaboration/ws/?room=${room}`,
       {
         headers: {
           Origin: 'http://bad-origin.com',
@@ -84,13 +71,13 @@ describe('Server Tests', () => {
     return promise;
   });
 
-  test('WebSocket connection with incorrect API key should be closed', () => {
+  test('WebSocket connection without cookies header should be closed', () => {
     const { promise, done } = promiseDone();
+    const room = uuidv4();
     const ws = new WebSocket(
-      `ws://localhost:${port}/collaboration/ws/?room=test-room`,
+      `ws://localhost:${port}/collaboration/ws/?room=${room}`,
       {
         headers: {
-          Authorization: 'wrong-api-key',
           Origin: origin,
         },
       },
@@ -106,21 +93,28 @@ describe('Server Tests', () => {
 
   test('WebSocket connection not allowed if room not matching provider name', () => {
     const { promise, done } = promiseDone();
-
+    const room = uuidv4();
     const wsHocus = new HocuspocusProviderWebsocket({
-      url: `ws://localhost:${portWS}/?room=my-test`,
+      url: `ws://localhost:${portWS}/?room=${room}`,
       WebSocketPolyfill: WebSocket,
       maxAttempts: 1,
       quiet: true,
     });
 
+    const providerName = uuidv4();
     const provider = new HocuspocusProvider({
       websocketProvider: wsHocus,
-      name: 'hocuspocus-test',
+      name: providerName,
       broadcast: false,
       quiet: true,
       preserveConnection: false,
       onClose: (data) => {
+        expect(console.error).toHaveBeenCalledWith(
+          'Invalid room name - Probable hacking attempt:',
+          providerName,
+          room,
+        );
+
         wsHocus.stopConnectionAttempt();
         expect(data.event.reason).toBe('Forbidden');
         wsHocus.webSocket?.close();
@@ -134,30 +128,32 @@ describe('Server Tests', () => {
     return promise;
   });
 
-  test('WebSocket connection read-only', () => {
+  test('WebSocket connection not allowed if room is not a valid uuid v4', () => {
     const { promise, done } = promiseDone();
-
+    const room = uuidv1();
     const wsHocus = new HocuspocusProviderWebsocket({
-      url: `ws://localhost:${portWS}/?room=hocuspocus-test`,
+      url: `ws://localhost:${portWS}/?room=${room}`,
       WebSocketPolyfill: WebSocket,
+      maxAttempts: 1,
+      quiet: true,
     });
 
     const provider = new HocuspocusProvider({
       websocketProvider: wsHocus,
-      name: 'hocuspocus-test',
+      name: room,
       broadcast: false,
       quiet: true,
-      onConnect: () => {
-        void hocusPocusServer
-          .openDirectConnection('hocuspocus-test')
-          .then((connection) => {
-            connection.document?.getConnections().forEach((connection) => {
-              expect(connection.readOnly).toBe(true);
-            });
-
-            void connection.disconnect();
-          });
+      preserveConnection: false,
+      onClose: (data) => {
+        expect(console.error).toHaveBeenCalledWith(
+          'Room name is not a valid uuid:',
+          room,
+        );
 
+        wsHocus.stopConnectionAttempt();
+        expect(data.event.reason).toBe('Forbidden');
+        wsHocus.webSocket?.close();
+        wsHocus.disconnect();
         provider.destroy();
         wsHocus.destroy();
         done();
@@ -166,4 +162,206 @@ describe('Server Tests', () => {
 
     return promise;
   });
+
+  test('WebSocket connection not allowed if room is not a valid uuid', () => {
+    const { promise, done } = promiseDone();
+    const room = 'not-a-valid-uuid';
+    const wsHocus = new HocuspocusProviderWebsocket({
+      url: `ws://localhost:${portWS}/?room=${room}`,
+      WebSocketPolyfill: WebSocket,
+      maxAttempts: 1,
+      quiet: true,
+    });
+
+    const provider = new HocuspocusProvider({
+      websocketProvider: wsHocus,
+      name: room,
+      broadcast: false,
+      quiet: true,
+      preserveConnection: false,
+      onClose: (data) => {
+        expect(console.error).toHaveBeenCalledWith(
+          'Room name is not a valid uuid:',
+          room,
+        );
+
+        wsHocus.stopConnectionAttempt();
+        expect(data.event.reason).toBe('Forbidden');
+        wsHocus.webSocket?.close();
+        wsHocus.disconnect();
+        provider.destroy();
+        wsHocus.destroy();
+        done();
+      },
+    });
+
+    return promise;
+  });
+
+  test('WebSocket connection fails if user can not access document', () => {
+    const { promise, done } = promiseDone();
+
+    mockDocFetch.mockRejectedValue('');
+
+    const room = uuidv4();
+    const wsHocus = new HocuspocusProviderWebsocket({
+      url: `ws://localhost:${portWS}/?room=${room}`,
+      WebSocketPolyfill: WebSocket,
+      maxAttempts: 1,
+      quiet: true,
+    });
+
+    const provider = new HocuspocusProvider({
+      websocketProvider: wsHocus,
+      name: room,
+      broadcast: false,
+      quiet: true,
+      preserveConnection: false,
+      onClose: (data) => {
+        expect(console.error).toHaveBeenCalledWith(
+          '[onConnect]',
+          'Backend error: Unauthorized',
+        );
+
+        wsHocus.stopConnectionAttempt();
+        expect(data.event.reason).toBe('Forbidden');
+        expect(mockDocFetch).toHaveBeenCalledTimes(1);
+        wsHocus.webSocket?.close();
+        wsHocus.disconnect();
+        provider.destroy();
+        wsHocus.destroy();
+        done();
+      },
+    });
+
+    return promise;
+  });
+
+  test('WebSocket connection fails if user do not have correct retrieve ability', () => {
+    const { promise, done } = promiseDone();
+
+    const room = uuidv4();
+    mockDocFetch.mockResolvedValue({
+      abilities: {
+        retrieve: false,
+      },
+    });
+
+    const wsHocus = new HocuspocusProviderWebsocket({
+      url: `ws://localhost:${portWS}/?room=${room}`,
+      WebSocketPolyfill: WebSocket,
+      maxAttempts: 1,
+      quiet: true,
+    });
+
+    const provider = new HocuspocusProvider({
+      websocketProvider: wsHocus,
+      name: room,
+      broadcast: false,
+      quiet: true,
+      preserveConnection: false,
+      onClose: (data) => {
+        expect(console.error).toHaveBeenCalledWith(
+          'onConnect: Unauthorized to retrieve this document',
+          room,
+        );
+
+        wsHocus.stopConnectionAttempt();
+        expect(data.event.reason).toBe('Forbidden');
+        expect(mockDocFetch).toHaveBeenCalledTimes(1);
+        wsHocus.webSocket?.close();
+        wsHocus.disconnect();
+        provider.destroy();
+        wsHocus.destroy();
+        done();
+      },
+    });
+
+    return promise;
+  });
+
+  [true, false].forEach((canEdit) => {
+    test(`WebSocket connection ${canEdit ? 'can' : 'can not'} edit document`, () => {
+      const { promise, done } = promiseDone();
+
+      mockDocFetch.mockResolvedValue({
+        abilities: {
+          retrieve: true,
+          update: canEdit,
+        },
+      });
+
+      const room = uuidv4();
+      const wsHocus = new HocuspocusProviderWebsocket({
+        url: `ws://localhost:${portWS}/?room=${room}`,
+        WebSocketPolyfill: WebSocket,
+      });
+
+      const provider = new HocuspocusProvider({
+        websocketProvider: wsHocus,
+        name: room,
+        broadcast: false,
+        quiet: true,
+        onConnect: () => {
+          void hocusPocusServer
+            .openDirectConnection(room)
+            .then((connection) => {
+              connection.document?.getConnections().forEach((connection) => {
+                expect(connection.readOnly).toBe(!canEdit);
+              });
+
+              void connection.disconnect();
+
+              provider.destroy();
+              wsHocus.destroy();
+              done();
+            });
+        },
+      });
+
+      return promise;
+    });
+  });
+
+  test('Add request header x-user-id if found', () => {
+    const { promise, done } = promiseDone();
+
+    mockDocFetch.mockResolvedValue({
+      abilities: {
+        retrieve: true,
+        update: true,
+      },
+    });
+
+    mockGetMe.mockResolvedValue({
+      id: 'test-user-id',
+    });
+
+    const room = uuidv4();
+    const wsHocus = new HocuspocusProviderWebsocket({
+      url: `ws://localhost:${portWS}/?room=${room}`,
+      WebSocketPolyfill: WebSocket,
+    });
+
+    const provider = new HocuspocusProvider({
+      websocketProvider: wsHocus,
+      name: room,
+      broadcast: false,
+      quiet: true,
+      onConnect: () => {
+        void hocusPocusServer.openDirectConnection(room).then((connection) => {
+          connection.document?.getConnections().forEach((connection) => {
+            expect(connection.context.userId).toBe('test-user-id');
+          });
+
+          void connection.disconnect();
+          provider.destroy();
+          wsHocus.destroy();
+          done();
+        });
+      },
+    });
+
+    return promise;
+  });
 });

src/frontend/servers/y-provider/package.json

@@ -1,6 +1,6 @@
 {
   "name": "server-y-provider",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "Y.js provider for docs",
   "repository": "https://github.com/numerique-gouv/impress",
   "license": "MIT",
@@ -20,9 +20,11 @@
     "@hocuspocus/server": "2.15.2",
     "@sentry/node": "9.3.0",
     "@sentry/profiling-node": "9.3.0",
+    "axios": "1.8.2",
     "cors": "2.8.5",
     "express": "4.21.2",
     "express-ws": "5.0.2",
+    "uuid": "11.1.0",
     "y-protocols": "1.0.6",
     "yjs": "*"
   },

src/frontend/servers/y-provider/src/api/getDoc.ts

@@ -0,0 +1,76 @@
+import { IncomingHttpHeaders } from 'http';
+
+import axios from 'axios';
+
+import { COLLABORATION_BACKEND_BASE_URL } from '@/env';
+
+enum LinkReach {
+  RESTRICTED = 'restricted',
+  PUBLIC = 'public',
+  AUTHENTICATED = 'authenticated',
+}
+
+enum LinkRole {
+  READER = 'reader',
+  EDITOR = 'editor',
+}
+
+type Base64 = string;
+
+interface Doc {
+  id: string;
+  title?: string;
+  content: Base64;
+  creator: string;
+  is_favorite: boolean;
+  link_reach: LinkReach;
+  link_role: LinkRole;
+  nb_accesses_ancestors: number;
+  nb_accesses_direct: number;
+  created_at: string;
+  updated_at: string;
+  abilities: {
+    accesses_manage: boolean;
+    accesses_view: boolean;
+    ai_transform: boolean;
+    ai_translate: boolean;
+    attachment_upload: boolean;
+    children_create: boolean;
+    children_list: boolean;
+    collaboration_auth: boolean;
+    destroy: boolean;
+    favorite: boolean;
+    invite_owner: boolean;
+    link_configuration: boolean;
+    media_auth: boolean;
+    move: boolean;
+    partial_update: boolean;
+    restore: boolean;
+    retrieve: boolean;
+    update: boolean;
+    versions_destroy: boolean;
+    versions_list: boolean;
+    versions_retrieve: boolean;
+  };
+}
+
+export const fetchDocument = async (
+  documentName: string,
+  requestHeaders: IncomingHttpHeaders,
+) => {
+  const response = await axios.get<Doc>(
+    `${COLLABORATION_BACKEND_BASE_URL}/api/v1.0/documents/${documentName}/`,
+    {
+      headers: {
+        Cookie: requestHeaders['cookie'],
+        Origin: requestHeaders['origin'],
+      },
+    },
+  );
+
+  if (response.status !== 200) {
+    throw new Error(`Failed to fetch document: ${response.statusText}`);
+  }
+
+  return response.data;
+};

src/frontend/servers/y-provider/src/api/getMe.ts

@@ -0,0 +1,31 @@
+import { IncomingHttpHeaders } from 'http';
+
+import axios from 'axios';
+
+import { COLLABORATION_BACKEND_BASE_URL } from '@/env';
+
+export interface User {
+  id: string;
+  email: string;
+  full_name: string;
+  short_name: string;
+  language: string;
+}
+
+export const getMe = async (requestHeaders: IncomingHttpHeaders) => {
+  const response = await axios.get<User>(
+    `${COLLABORATION_BACKEND_BASE_URL}/api/v1.0/users/me/`,
+    {
+      headers: {
+        Cookie: requestHeaders['cookie'],
+        Origin: requestHeaders['origin'],
+      },
+    },
+  );
+
+  if (response.status !== 200) {
+    throw new Error(`Failed to fetch user: ${response.statusText}`);
+  }
+
+  return response.data;
+};

src/frontend/servers/y-provider/src/env.ts

@@ -8,3 +8,5 @@ export const Y_PROVIDER_API_KEY =
   process.env.Y_PROVIDER_API_KEY || 'yprovider-api-key';
 export const PORT = Number(process.env.PORT || 4444);
 export const SENTRY_DSN = process.env.SENTRY_DSN || '';
+export const COLLABORATION_BACKEND_BASE_URL =
+  process.env.COLLABORATION_BACKEND_BASE_URL || 'http://app-dev:8000';

src/frontend/servers/y-provider/src/handlers/collaborationResetConnectionsHandler.ts

@@ -14,14 +14,7 @@ export const collaborationResetConnectionsHandler = (
   const room = req.query.room;
   const userId = req.headers['x-user-id'];
 
-  logger(
-    'Resetting connections in room:',
-    room,
-    'for user:',
-    userId,
-    'room:',
-    room,
-  );
+  logger('Resetting connections in room:', room, 'for user:', userId);
 
   if (!room) {
     res.status(400).json({ error: 'Room name not provided' });
@@ -43,8 +36,8 @@ export const collaborationResetConnectionsHandler = (
       }
 
       doc.getConnections().forEach((connection) => {
-        const connectionUserId = connection.request.headers['x-user-id'];
-        if (connectionUserId === userId) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+        if (connection.context.userId === userId) {
           connection.close();
         }
       });

src/frontend/servers/y-provider/src/middlewares.ts

@@ -40,17 +40,16 @@ export const wsSecurity = (
 ): void => {
   // Origin check
   const origin = req.headers['origin'];
-  if (origin && !allowedOrigins.includes(origin)) {
+  if (!origin || !allowedOrigins.includes(origin)) {
     ws.close(4001, 'Origin not allowed');
     console.error('CORS policy violation: Invalid Origin', origin);
     return;
   }
 
-  // Secret API Key check
-  const apiKey = req.headers['authorization'];
-  if (apiKey !== COLLABORATION_SERVER_SECRET) {
-    console.error('Forbidden: Invalid API Key');
-    ws.close();
+  const cookies = req.headers['cookie'];
+  if (!cookies) {
+    ws.close(4001, 'No cookies');
+    console.error('CORS policy violation: No cookies');
     return;
   }
 

src/frontend/servers/y-provider/src/servers/hocusPocusServer.ts

@@ -1,41 +1,81 @@
 import { Server } from '@hocuspocus/server';
+import { validate as uuidValidate, version as uuidVersion } from 'uuid';
 
+import { fetchDocument } from '@/api/getDoc';
+import { getMe } from '@/api/getMe';
 import { logger } from '@/utils';
 
 export const hocusPocusServer = Server.configure({
   name: 'docs-collaboration',
   timeout: 30000,
   quiet: true,
-  onConnect({ requestHeaders, connection, documentName, requestParameters }) {
+  async onConnect({
+    requestHeaders,
+    connection,
+    documentName,
+    requestParameters,
+    context,
+  }) {
     const roomParam = requestParameters.get('room');
-    const canEdit = requestHeaders['x-can-edit'] === 'True';
-
-    if (!canEdit) {
-      connection.readOnly = true;
-    }
-
-    logger(
-      'Connection established:',
-      documentName,
-      'userId:',
-      requestHeaders['x-user-id'],
-      'canEdit:',
-      canEdit,
-      'room:',
-      requestParameters.get('room'),
-    );
 
     if (documentName !== roomParam) {
       console.error(
         'Invalid room name - Probable hacking attempt:',
         documentName,
         requestParameters.get('room'),
-        requestHeaders['x-user-id'],
       );
 
-      return Promise.reject(new Error('Unauthorized'));
+      return Promise.reject(new Error('Wrong room name: Unauthorized'));
     }
 
+    if (!uuidValidate(documentName) || uuidVersion(documentName) !== 4) {
+      console.error('Room name is not a valid uuid:', documentName);
+
+      return Promise.reject(new Error('Wrong room name: Unauthorized'));
+    }
+
+    let can_edit = false;
+
+    try {
+      const document = await fetchDocument(documentName, requestHeaders);
+
+      if (!document.abilities.retrieve) {
+        console.error(
+          'onConnect: Unauthorized to retrieve this document',
+          documentName,
+        );
+        return Promise.reject(new Error('Wrong abilities:Unauthorized'));
+      }
+
+      can_edit = document.abilities.update;
+    } catch (error: unknown) {
+      if (error instanceof Error) {
+        console.error('onConnect: backend error', error.message);
+      }
+
+      return Promise.reject(new Error('Backend error: Unauthorized'));
+    }
+
+    connection.readOnly = !can_edit;
+
+    /*
+     * Unauthenticated users can be allowed to connect
+     * so we flag only authenticated users
+     */
+    try {
+      const user = await getMe(requestHeaders);
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      context.userId = user.id;
+    } catch {}
+
+    logger(
+      'Connection established:',
+      documentName,
+      'canEdit:',
+      can_edit,
+      'room:',
+      requestParameters.get('room'),
+    );
     return Promise.resolve();
   },
 });

src/frontend/yarn.lock

@@ -1640,8 +1640,10 @@
   resolved "https://registry.yarnpkg.com/@gouvfr-lasuite/integration/-/integration-1.0.2.tgz#ed0000f4b738c5a19bb60f5b80a9a2f5d9414234"
   integrity sha512-npOotZQSyu6SffHiPP+jQVOkJ3qW2KE2cANhEK92sNLX9uZqQaCqljO5GhzsBmh0lB76fiXnrr9i8SIpnDUSZg==
 
-"@gouvfr-lasuite/ui-kit@file:../../../design-system":
+"@gouvfr-lasuite/ui-kit@0.1.3":
   version "0.1.3"
+  resolved "https://registry.yarnpkg.com/@gouvfr-lasuite/ui-kit/-/ui-kit-0.1.3.tgz#1be7f1bdf12e7428e630d6ce11fbc77c4c9b9b21"
+  integrity sha512-ba3ZrAIhX84cofa2IwiWhgE0wzz85+ySbOTvB1lP9jeWYvWn/N5HsnxphA9bEMIrx1Yi91upzmYLvjHRoDq1Ww==
   dependencies:
     "@dnd-kit/core" "6.3.1"
     "@dnd-kit/modifiers" "9.0.0"
@@ -2151,10 +2153,10 @@
   resolved "https://registry.yarnpkg.com/@mantine/utils/-/utils-6.0.22.tgz#7eace697084e2bc5a831eb0fd7cbbc04cc1b0354"
   integrity sha512-RSKlNZvxhMCkOFZ6slbYvZYbWjHUM+PxDQnupIOxIdsTZQQjx/BFfrfJ7kQFOP+g7MtpOds8weAetEs5obwMOQ==
 
-"@next/env@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/env/-/env-15.2.1.tgz#4b5baade67031fb4cc3c1841c661dde3db24bde4"
-  integrity sha512-JmY0qvnPuS2NCWOz2bbby3Pe0VzdAQ7XpEB6uLIHmtXNfAsAO0KLQLkuAoc42Bxbo3/jMC3dcn9cdf+piCcG2Q==
+"@next/env@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/env/-/env-15.2.3.tgz#037ee37c4d61fcbdbb212694cc33d7dcf6c7975a"
+  integrity sha512-a26KnbW9DFEUsSxAxKBORR/uD9THoYoKbkpFywMN/AFvboTt94b8+g/07T8J6ACsdLag8/PDU60ov4rPxRAixw==
 
 "@next/eslint-plugin-next@15.2.1":
   version "15.2.1"
@@ -2163,45 +2165,45 @@
   dependencies:
     fast-glob "3.3.1"
 
-"@next/swc-darwin-arm64@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.2.1.tgz#bfca841bb7cfbb9f9e05f63ffe3e574ac6679308"
-  integrity sha512-aWXT+5KEREoy3K5AKtiKwioeblmOvFFjd+F3dVleLvvLiQ/mD//jOOuUcx5hzcO9ISSw4lrqtUPntTpK32uXXQ==
+"@next/swc-darwin-arm64@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.2.3.tgz#2688c185651ef7a16e5642c85048cc4e151159fa"
+  integrity sha512-uaBhA8aLbXLqwjnsHSkxs353WrRgQgiFjduDpc7YXEU0B54IKx3vU+cxQlYwPCyC8uYEEX7THhtQQsfHnvv8dw==
 
-"@next/swc-darwin-x64@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-15.2.1.tgz#4949a51c74e3ed657c4fda17e1f408f8cb5cdda4"
-  integrity sha512-E/w8ervu4fcG5SkLhvn1NE/2POuDCDEy5gFbfhmnYXkyONZR68qbUlJlZwuN82o7BrBVAw+tkR8nTIjGiMW1jQ==
+"@next/swc-darwin-x64@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-15.2.3.tgz#3e802259b2c9a4e2ad55ff827f41f775b726fc7d"
+  integrity sha512-pVwKvJ4Zk7h+4hwhqOUuMx7Ib02u3gDX3HXPKIShBi9JlYllI0nU6TWLbPT94dt7FSi6mSBhfc2JrHViwqbOdw==
 
-"@next/swc-linux-arm64-gnu@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.2.1.tgz#449b08825e2e034408878ca9b0974786cc98cc45"
-  integrity sha512-gXDX5lIboebbjhiMT6kFgu4svQyjoSed6dHyjx5uZsjlvTwOAnZpn13w9XDaIMFFHw7K8CpBK7HfDKw0VZvUXQ==
+"@next/swc-linux-arm64-gnu@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.2.3.tgz#315d7b54b89153f125bdc3e40bcb7ccf94ef124b"
+  integrity sha512-50ibWdn2RuFFkOEUmo9NCcQbbV9ViQOrUfG48zHBCONciHjaUKtHcYFiCwBVuzD08fzvzkWuuZkd4AqbvKO7UQ==
 
-"@next/swc-linux-arm64-musl@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.2.1.tgz#4f4d325c3ede762cdf5c2b34bfd1d5fa7d95a0d1"
-  integrity sha512-3v0pF/adKZkBWfUffmB/ROa+QcNTrnmYG4/SS+r52HPwAK479XcWoES2I+7F7lcbqc7mTeVXrIvb4h6rR/iDKg==
+"@next/swc-linux-arm64-musl@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.2.3.tgz#a1a458eb7cf19c59d2014ee388a7305e9a77973f"
+  integrity sha512-2gAPA7P652D3HzR4cLyAuVYwYqjG0mt/3pHSWTCyKZq/N/dJcUAEoNQMyUmwTZWCJRKofB+JPuDVP2aD8w2J6Q==
 
-"@next/swc-linux-x64-gnu@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.2.1.tgz#9ab4f4d5f3d9e28d56fa0e0933aef3282caff6c8"
-  integrity sha512-RbsVq2iB6KFJRZ2cHrU67jLVLKeuOIhnQB05ygu5fCNgg8oTewxweJE8XlLV+Ii6Y6u4EHwETdUiRNXIAfpBww==
+"@next/swc-linux-x64-gnu@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.2.3.tgz#a3cf22eda7601536ccd68e8ba4c1bfb4a1a33460"
+  integrity sha512-ODSKvrdMgAJOVU4qElflYy1KSZRM3M45JVbeZu42TINCMG3anp7YCBn80RkISV6bhzKwcUqLBAmOiWkaGtBA9w==
 
-"@next/swc-linux-x64-musl@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.2.1.tgz#51ed130f5b44150d85197a90c471f19339ac2e67"
-  integrity sha512-QHsMLAyAIu6/fWjHmkN/F78EFPKmhQlyX5C8pRIS2RwVA7z+t9cTb0IaYWC3EHLOTjsU7MNQW+n2xGXr11QPpg==
+"@next/swc-linux-x64-musl@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.2.3.tgz#0e33c1224c76aa3078cc2249c80ef583f9d7a943"
+  integrity sha512-ZR9kLwCWrlYxwEoytqPi1jhPd1TlsSJWAc+H/CJHmHkf2nD92MQpSRIURR1iNgA/kuFSdxB8xIPt4p/T78kwsg==
 
-"@next/swc-win32-arm64-msvc@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.2.1.tgz#180c9c1dde48df749768b19af35f1118aa334bd8"
-  integrity sha512-Gk42XZXo1cE89i3hPLa/9KZ8OuupTjkDmhLaMKFohjf9brOeZVEa3BQy1J9s9TWUqPhgAEbwv6B2+ciGfe54Vw==
+"@next/swc-win32-arm64-msvc@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.2.3.tgz#4e0583fb981b931915a9ad22e579f9c9d5b803dd"
+  integrity sha512-+G2FrDcfm2YDbhDiObDU/qPriWeiz/9cRR0yMWJeTLGGX6/x8oryO3tt7HhodA1vZ8r2ddJPCjtLcpaVl7TE2Q==
 
-"@next/swc-win32-x64-msvc@15.2.1":
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.2.1.tgz#0448f9fcddc035969b21c83da4c62d0fbbb5cec8"
-  integrity sha512-YjqXCl8QGhVlMR8uBftWk0iTmvtntr41PhG1kvzGp0sUP/5ehTM+cwx25hKE54J0CRnHYjSGjSH3gkHEaHIN9g==
+"@next/swc-win32-x64-msvc@15.2.3":
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.2.3.tgz#727b90c7dcc2279344115a94b99d93d452956f02"
+  integrity sha512-gHYS9tc+G2W0ZC8rBL+H6RdtXIyk40uLiaos0yj5US85FNhbFEndMA2nW3z47nzOWiSvXTZ5kBClc3rD0zJg0w==
 
 "@nodelib/fs.scandir@2.1.5":
   version "2.1.5"
@@ -6332,13 +6334,20 @@
   dependencies:
     "@types/node" "*"
 
-"@types/node@*", "@types/node@22.10.7", "@types/node@22.13.9", "@types/node@^22.7.5":
+"@types/node@*", "@types/node@^22.7.5":
   version "22.13.9"
   resolved "https://registry.yarnpkg.com/@types/node/-/node-22.13.9.tgz#5d9a8f7a975a5bd3ef267352deb96fb13ec02eca"
   integrity sha512-acBjXdRJ3A6Pb3tqnw9HZmyR3Fiol3aGxRCK1x3d+6CDAMjl7I649wpSd+yNURCjbOUGu9tqtLKnTGxmK6CyGw==
   dependencies:
     undici-types "~6.20.0"
 
+"@types/node@22.10.7":
+  version "22.10.7"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-22.10.7.tgz#14a1ca33fd0ebdd9d63593ed8d3fbc882a6d28d7"
+  integrity sha512-V09KvXxFiutGp6B7XkpaDXlNadZxrzajcY50EuoLIpQ6WWYCSvf19lVIazzfIzQvhUN2HjX12spLojTnhuKlGg==
+  dependencies:
+    undici-types "~6.20.0"
+
 "@types/parse-json@^4.0.0":
   version "4.0.2"
   resolved "https://registry.yarnpkg.com/@types/parse-json/-/parse-json-4.0.2.tgz#5950e50960793055845e956c427fc2b0d70c5239"
@@ -6394,7 +6403,7 @@
   resolved "https://registry.yarnpkg.com/@types/range-parser/-/range-parser-1.2.7.tgz#50ae4353eaaddc04044279812f52c8c65857dbcb"
   integrity sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==
 
-"@types/react-dom@*", "@types/react-dom@19.0.0":
+"@types/react-dom@*":
   version "19.0.0"
   resolved "https://registry.yarnpkg.com/@types/react-dom/-/react-dom-19.0.0.tgz#e7f5d618a080486eaf9952246dbf59eaa2c64130"
   integrity sha512-1KfiQKsH1o00p9m5ag12axHQSb3FOU9H20UTrujVSkNhuCrRHiQWFqgEnTNK5ZNfnzZv8UWrnXVqCmCF9fgY3w==
@@ -6413,7 +6422,7 @@
   resolved "https://registry.yarnpkg.com/@types/react-transition-group/-/react-transition-group-4.4.12.tgz#b5d76568485b02a307238270bfe96cb51ee2a044"
   integrity sha512-8TV6R3h2j7a91c+1DXdJi3Syo69zzIZbz7Lg5tORM5LEJG7X/E6a1V3drRyBRZq7/utz7A+c4OgYLiLcYGHG6w==
 
-"@types/react@*", "@types/react@19.0.0":
+"@types/react@*":
   version "19.0.0"
   resolved "https://registry.yarnpkg.com/@types/react/-/react-19.0.0.tgz#fbbb53ce223f4e2b750ad5dd09580b2c43522bbf"
   integrity sha512-MY3oPudxvMYyesqs/kW1Bh8y9VqSmf+tzqw3ae8a9DZW68pUe3zAdHeI1jc6iAysuRdACnVknHP8AhwD4/dxtg==
@@ -6531,7 +6540,7 @@
   dependencies:
     "@types/yargs-parser" "*"
 
-"@typescript-eslint/eslint-plugin@*", "@typescript-eslint/eslint-plugin@8.26.0", "@typescript-eslint/eslint-plugin@^5.4.2 || ^6.0.0 || ^7.0.0 || ^8.0.0":
+"@typescript-eslint/eslint-plugin@*", "@typescript-eslint/eslint-plugin@^5.4.2 || ^6.0.0 || ^7.0.0 || ^8.0.0":
   version "8.26.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.26.0.tgz#7e880faf91f89471c30c141951e15f0eb3a0599e"
   integrity sha512-cLr1J6pe56zjKYajK6SSSre6nl1Gj6xDp1TY0trpgPzjVbgDwd09v2Ws37LABxzkicmUjhEeg/fAUjPJJB1v5Q==
@@ -6546,7 +6555,7 @@
     natural-compare "^1.4.0"
     ts-api-utils "^2.0.1"
 
-"@typescript-eslint/parser@*", "@typescript-eslint/parser@8.26.0", "@typescript-eslint/parser@^5.4.2 || ^6.0.0 || ^7.0.0 || ^8.0.0":
+"@typescript-eslint/parser@*", "@typescript-eslint/parser@^5.4.2 || ^6.0.0 || ^7.0.0 || ^8.0.0":
   version "8.26.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.26.0.tgz#9b4d2198e89f64fb81e83167eedd89a827d843a9"
   integrity sha512-mNtXP9LTVBy14ZF3o7JG69gRPBK/2QWtQd0j0oH26HcY/foyJJau6pNUez7QrM5UHnSvwlQcJXKsk0I99B9pOA==
@@ -7105,6 +7114,15 @@ axe-core@^4.10.0:
   resolved "https://registry.yarnpkg.com/axe-core/-/axe-core-4.10.2.tgz#85228e3e1d8b8532a27659b332e39b7fa0e022df"
   integrity sha512-RE3mdQ7P3FRSe7eqCWoeQ/Z9QXrtniSjp1wUjt5nRC3WIpz5rSCve6o3fsZ2aCpJtrZjSZgjwXAoTO5k4tEI0w==
 
+axios@1.8.2:
+  version "1.8.2"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.8.2.tgz#fabe06e241dfe83071d4edfbcaa7b1c3a40f7979"
+  integrity sha512-ls4GYBm5aig9vWx8AWDSGLpnpDQRtWAfrjU+EuytuODrFBkqesN2RkOQCBzrA1RQNHw1SmRMSDDDSwzNAYQ6Rg==
+  dependencies:
+    follow-redirects "^1.15.6"
+    form-data "^4.0.0"
+    proxy-from-env "^1.1.0"
+
 axobject-query@^4.1.0:
   version "4.1.0"
   resolved "https://registry.yarnpkg.com/axobject-query/-/axobject-query-4.1.0.tgz#28768c76d0e3cff21bc62a9e2d0b6ac30042a1ee"
@@ -8782,7 +8800,7 @@ eslint-visitor-keys@^4.2.0:
   resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz#687bacb2af884fcdda8a6e7d65c606f46a14cd45"
   integrity sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==
 
-eslint@*, eslint@8.57.0:
+eslint@*:
   version "8.57.0"
   resolved "https://registry.yarnpkg.com/eslint/-/eslint-8.57.0.tgz#c786a6fd0e0b68941aaf624596fb987089195668"
   integrity sha512-dZ6+mexnaTIbSBZWgou51U6OmzIhYM2VcNdtiTtI7qPNZm35Akpr0f6vtw3w1Kmn5PYo+tZVfh13WrhpS6oLqQ==
@@ -9178,6 +9196,11 @@ flatted@^3.3.3:
   resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.3.3.tgz#67c8fad95454a7c7abebf74bb78ee74a44023358"
   integrity sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==
 
+follow-redirects@^1.15.6:
+  version "1.15.9"
+  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.9.tgz#a604fa10e443bf98ca94228d9eebcc2e8a2c8ee1"
+  integrity sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==
+
 fontkit@^2.0.2:
   version "2.0.4"
   resolved "https://registry.yarnpkg.com/fontkit/-/fontkit-2.0.4.tgz#4765d664c68b49b5d6feb6bd1051ee49d8ec5ab0"
@@ -12035,12 +12058,12 @@ neo-async@^2.6.2:
   resolved "https://registry.yarnpkg.com/neo-async/-/neo-async-2.6.2.tgz#b4aafb93e3aeb2d8174ca53cf163ab7d7308305f"
   integrity sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==
 
-next@15.2.1:
-  version "15.2.1"
-  resolved "https://registry.yarnpkg.com/next/-/next-15.2.1.tgz#84276e5422ef0daa574a38f1a9db94084dc73b54"
-  integrity sha512-zxbsdQv3OqWXybK5tMkPCBKyhIz63RstJ+NvlfkaLMc/m5MwXgz2e92k+hSKcyBpyADhMk2C31RIiaDjUZae7g==
+next@15.2.3:
+  version "15.2.3"
+  resolved "https://registry.yarnpkg.com/next/-/next-15.2.3.tgz#1ac803c08076d47eb5b431cb625135616c6bec7e"
+  integrity sha512-x6eDkZxk2rPpu46E1ZVUWIBhYCLszmUY6fvHBFcbzJ9dD+qRX6vcHusaqqDlnY+VngKzKbAiG2iRCkPbmi8f7w==
   dependencies:
-    "@next/env" "15.2.1"
+    "@next/env" "15.2.3"
     "@swc/counter" "0.1.3"
     "@swc/helpers" "0.5.15"
     busboy "1.6.0"
@@ -12048,14 +12071,14 @@ next@15.2.1:
     postcss "8.4.31"
     styled-jsx "5.1.6"
   optionalDependencies:
-    "@next/swc-darwin-arm64" "15.2.1"
-    "@next/swc-darwin-x64" "15.2.1"
-    "@next/swc-linux-arm64-gnu" "15.2.1"
-    "@next/swc-linux-arm64-musl" "15.2.1"
-    "@next/swc-linux-x64-gnu" "15.2.1"
-    "@next/swc-linux-x64-musl" "15.2.1"
-    "@next/swc-win32-arm64-msvc" "15.2.1"
-    "@next/swc-win32-x64-msvc" "15.2.1"
+    "@next/swc-darwin-arm64" "15.2.3"
+    "@next/swc-darwin-x64" "15.2.3"
+    "@next/swc-linux-arm64-gnu" "15.2.3"
+    "@next/swc-linux-arm64-musl" "15.2.3"
+    "@next/swc-linux-x64-gnu" "15.2.3"
+    "@next/swc-linux-x64-musl" "15.2.3"
+    "@next/swc-win32-arm64-msvc" "15.2.3"
+    "@next/swc-win32-x64-msvc" "15.2.3"
     sharp "^0.33.5"
 
 no-case@^3.0.4:
@@ -13414,38 +13437,6 @@ react-stately@3.35.0, react-stately@^3.35.0:
     "@react-stately/tree" "^3.8.7"
     "@react-types/shared" "^3.27.0"
 
-react-stately@3.36.1:
-  version "3.36.1"
-  resolved "https://registry.yarnpkg.com/react-stately/-/react-stately-3.36.1.tgz#605c18e6aa7a900f19b066699b5b35b7800cb759"
-  integrity sha512-H9kiGAylNec/iE5qk7qQLV1cvtSAIVq3mgt87zx2EA+f+/sYy2oBtchFPaDiBf/m7xMEKf0Fr9zSLU6G99xQ8g==
-  dependencies:
-    "@react-stately/calendar" "^3.7.1"
-    "@react-stately/checkbox" "^3.6.12"
-    "@react-stately/collections" "^3.12.2"
-    "@react-stately/color" "^3.8.3"
-    "@react-stately/combobox" "^3.10.3"
-    "@react-stately/data" "^3.12.2"
-    "@react-stately/datepicker" "^3.13.0"
-    "@react-stately/disclosure" "^3.0.2"
-    "@react-stately/dnd" "^3.5.2"
-    "@react-stately/form" "^3.1.2"
-    "@react-stately/list" "^3.12.0"
-    "@react-stately/menu" "^3.9.2"
-    "@react-stately/numberfield" "^3.9.10"
-    "@react-stately/overlays" "^3.6.14"
-    "@react-stately/radio" "^3.10.11"
-    "@react-stately/searchfield" "^3.5.10"
-    "@react-stately/select" "^3.6.11"
-    "@react-stately/selection" "^3.20.0"
-    "@react-stately/slider" "^3.6.2"
-    "@react-stately/table" "^3.14.0"
-    "@react-stately/tabs" "^3.8.0"
-    "@react-stately/toast" "^3.0.0"
-    "@react-stately/toggle" "^3.8.2"
-    "@react-stately/tooltip" "^3.5.2"
-    "@react-stately/tree" "^3.8.8"
-    "@react-types/shared" "^3.28.0"
-
 react-stately@^3.34.0:
   version "3.36.0"
   resolved "https://registry.yarnpkg.com/react-stately/-/react-stately-3.36.0.tgz#1544f0a742145d9bc2d67a8c76af3648a9982fd6"
@@ -15102,7 +15093,7 @@ typed-array-length@^1.0.7:
     possible-typed-array-names "^1.0.0"
     reflect.getprototypeof "^1.0.6"
 
-typescript@*, typescript@5.8.2, typescript@^5.0.4:
+typescript@*, typescript@^5.0.4:
   version "5.8.2"
   resolved "https://registry.yarnpkg.com/typescript/-/typescript-5.8.2.tgz#8170b3702f74b79db2e5a96207c15e65807999e4"
   integrity sha512-aJn6wq13/afZp/jT9QZmwEjDqqvSGp1VT5GVg+f/t6/oVyrgXM6BY1h9BRh/O5p3PlUPAe+WuiEZOmb/49RqoQ==
@@ -15403,6 +15394,11 @@ utils-merge@1.0.1:
   resolved "https://registry.yarnpkg.com/utils-merge/-/utils-merge-1.0.1.tgz#9f95710f50a267947b2ccc124741c1028427e713"
   integrity sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==
 
+uuid@11.1.0:
+  version "11.1.0"
+  resolved "https://registry.yarnpkg.com/uuid/-/uuid-11.1.0.tgz#9549028be1753bb934fc96e2bca09bb4105ae912"
+  integrity sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==
+
 uuid@^11.0.3:
   version "11.0.5"
   resolved "https://registry.yarnpkg.com/uuid/-/uuid-11.0.5.tgz#07b46bdfa6310c92c3fb3953a8720f170427fc62"
@@ -16119,7 +16115,7 @@ yargs@17.7.2, yargs@^17.3.1:
     y18n "^5.0.5"
     yargs-parser "^21.1.1"
 
-yjs@*, yjs@13.6.23, yjs@^13.6.15:
+yjs@*, yjs@^13.6.15:
   version "13.6.23"
   resolved "https://registry.yarnpkg.com/yjs/-/yjs-13.6.23.tgz#62358dfa52e92dc870b8a0bedcf0d4cbd4c5ffa8"
   integrity sha512-ExtnT5WIOVpkL56bhLeisG/N5c4fmzKn4k0ROVfJa5TY2QHbH7F0Wu2T5ZhR7ErsFWQEFafyrnSI8TPKVF9Few==

src/helm/helmfile.yaml

@@ -1,7 +1,7 @@
 environments:
   dev:
     values:
-      - version: 2.6.0
+      - version: 2.7.0
 ---
 repositories:
 - name: bitnami

src/helm/impress/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
 type: application
 name: docs
-version: 2.6.0
+version: 2.7.0
 appVersion: latest

src/helm/impress/values.yaml

@@ -75,15 +75,11 @@ ingressCollaborationWS:
   ## @param ingressCollaborationWS.customBackends Add custom backends to ingress
   customBackends: []
 
-  ## @param ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/auth-response-headers
-  ## @param ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/auth-url
   ## @param ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/enable-websocket
   ## @param ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/proxy-read-timeout
   ## @param ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/proxy-send-timeout
   ## @param ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/upstream-hash-by
   annotations:
-    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Can-Edit, X-User-Id"
-    nginx.ingress.kubernetes.io/auth-url: https://impress.example.com/api/v1.0/documents/collaboration-auth/
     nginx.ingress.kubernetes.io/enable-websocket: "true"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "86400"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "86400"

src/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mail_mjml",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "An util to generate html and text django's templates from mjml templates",
   "type": "module",
   "dependencies": {