📝(doc) change documentation folder name

It was called docs which is confusing as it contain the code of the app

Signed-off-by: virgile-deville <virgile.deville@beta.gouv.fr>

CHANGELOG.md

@@ -7,12 +7,17 @@ and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+- 📝(doc) change documentation folder name to "documentation" #876
+
+## Added
+
+- 🚩 add homepage feature flag #861
+
 
 ## [3.1.0] - 2025-04-07
 
 ## Added
 
-- ✨(backend) add ancestors links definitions to document abilities #846
 - 🚩(backend) add feature flag for the footer #841
 - 🔧(backend) add view to manage footer json #841
 - ✨(frontend) add custom css style #771
@@ -24,7 +29,6 @@ and this project adheres to
 
 ## Fixed
 
-- 🐛(backend) fix link definition select options linked to ancestors #846
 - 🐛(back) validate document content in serializer #822
 - 🐛(frontend) fix selection click past end of content #840
 

README.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://github.com/suitenumerique/docs">
-    <img alt="Docs" src="/docs/assets/docs-logo.png" width="300" />
+    <img alt="Docs" src="/documentation/assets/docs-logo-black-white.png" width="300" />
   </a>
 </p>
 
@@ -20,7 +20,7 @@ Welcome to Docs! The open source document editor where your notes can become kno
   </a>
 </p>
 
-<img src="/docs/assets/docs_live_collaboration_light.gif" width="100%" align="center"/>
+<img src="/documentation/assets/docs_live_collaboration_light.gif" width="100%" align="center"/>
 
 ## Why use Docs ❓
 
@@ -193,5 +193,5 @@ We are proud sponsors of [BlockNotejs](https://www.blocknotejs.org/) and [Yjs](h
 We are always looking for new public partners (we are currently onboarding the Netherlands 🇳🇱🧀), feel free to [reach out](mailto:docs@numerique.gouv.fr) if you are interested in using or contributing to Docs.
 
 <p align="center">
-  <img src="/docs/assets/europe_opensource.png" width="50%"/>
+  <img src="/documentation/assets/europe_opensource.png" width="50%"/>
 </p>

documentation/env.md

@@ -47,6 +47,11 @@ These are the environmental variables you can set for the impress-backend contai
 | COLLABORATION_API_URL                           | collaboration api host                                                                        |                                                         |
 | COLLABORATION_SERVER_SECRET                     | collaboration api secret                                                                      |                                                         |
 | COLLABORATION_WS_URL                            | collaboration websocket url                                                                   |                                                         |
+| FRONTEND_CSS_URL                                | To add a external css file to the app                                                         |                                                         |
+| FRONTEND_HOMEPAGE_FEATURE_ENABLED               | frontend feature flag to display the homepage                                                 | false                                                   |
+| FRONTEND_FOOTER_FEATURE_ENABLED                 | frontend feature flag to display the footer                                                   | false                                                   |
+| FRONTEND_FOOTER_VIEW_CACHE_TIMEOUT              | Cache duration of the json footer                                                             | 86400                                                   |
+| FRONTEND_URL_JSON_FOOTER                        | Url with a json to configure the footer                                                       |                                                         |
 | FRONTEND_THEME                                  | frontend theme to use                                                                         |                                                         |
 | POSTHOG_KEY                                     | posthog key for analytics                                                                     |                                                         |
 | CRISP_WEBSITE_ID                                | crisp website id for support                                                                  |                                                         |

env.d/development/common.dist

@@ -64,5 +64,6 @@ COLLABORATION_WS_URL=ws://localhost:4444/collaboration/ws/
 
 # Frontend
 FRONTEND_THEME=default
+FRONTEND_HOMEPAGE_FEATURE_ENABLED=True
 FRONTEND_FOOTER_FEATURE_ENABLED=True
 FRONTEND_URL_JSON_FOOTER=http://frontend:3000/contents/footer-demo.json

src/backend/core/api/filters.py

@@ -1,8 +1,5 @@
 """API filters for Impress' core application."""
 
-import unicodedata
-
-from django.db.models import CharField, Func
 from django.utils.translation import gettext_lazy as _
 
 import django_filters
@@ -10,64 +7,12 @@ import django_filters
 from core import models
 
 
-def remove_accents(value):
-    """Remove accents from a string (vélo -> velo)."""
-    return "".join(
-        c
-        for c in unicodedata.normalize("NFD", value)
-        if unicodedata.category(c) != "Mn"
-    )
-
-
-# pylint: disable=abstract-method
-class Unaccent(Func):
-    """
-    PostgreSQL unaccent function wrapper for use in Django ORM queries.
-
-    This allows you to annotate a field using the unaccented version of a
-    text column, enabling accent-insensitive filtering.
-    """
-
-    function = "unaccent"
-    template = "unaccent(%(expressions)s::text)"
-    output_field = CharField()
-
-
-class AccentInsensitiveCharFilter(django_filters.CharFilter):
-    """
-    A custom CharFilter that performs case-insensitive and accent-insensitive filtering.
-
-    This filter uses PostgreSQL's extension `unaccent` function to remove diacritics (accents)
-    from characters before applying the lookup expression (e.g., `icontains`).
-    """
-
-    def filter(self, qs, value):
-        """
-        Apply the filter to the queryset using the unaccented version of the field.
-
-        Args:
-            qs: The queryset to filter.
-            value: The value to search for in the unaccented field.
-
-        Returns:
-            A filtered queryset.
-        """
-        if value:
-            value = remove_accents(value)
-            field_name = self.field_name
-            annotated_field = f"unaccented_{field_name}"
-            return qs.annotate(**{annotated_field: Unaccent(field_name)}).filter(
-                **{f"{annotated_field}__{self.lookup_expr}": value}
-            )
-        return qs
-
-
 class DocumentFilter(django_filters.FilterSet):
     """
-    Custom filter for filtering documents on title (accent and case insensitive).
+    Custom filter for filtering documents.
     """
 
-    title = AccentInsensitiveCharFilter(
+    title = django_filters.CharFilter(
         field_name="title", lookup_expr="icontains", label=_("Title")
     )
 

src/backend/core/api/serializers.py

@@ -97,7 +97,7 @@ class BaseAccessSerializer(serializers.ModelSerializer):
 
             if not self.Meta.model.objects.filter(  # pylint: disable=no-member
                 Q(user=user) | Q(team__in=user.teams),
-                role__in=models.PRIVILEGED_ROLES,
+                role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
                 **{self.Meta.resource_field_name: resource_id},  # pylint: disable=no-member
             ).exists():
                 raise exceptions.PermissionDenied(
@@ -124,10 +124,6 @@ class BaseAccessSerializer(serializers.ModelSerializer):
 class DocumentAccessSerializer(BaseAccessSerializer):
     """Serialize document accesses."""
 
-    document_id = serializers.PrimaryKeyRelatedField(
-        read_only=True,
-        source="document",
-    )
     user_id = serializers.PrimaryKeyRelatedField(
         queryset=models.User.objects.all(),
         write_only=True,
@@ -140,11 +136,11 @@ class DocumentAccessSerializer(BaseAccessSerializer):
     class Meta:
         model = models.DocumentAccess
         resource_field_name = "document"
-        fields = ["id", "document_id", "user", "user_id", "team", "role", "abilities"]
-        read_only_fields = ["id", "document_id", "abilities"]
+        fields = ["id", "user", "user_id", "team", "role", "abilities"]
+        read_only_fields = ["id", "abilities"]
 
 
-class DocumentAccessLightSerializer(BaseAccessSerializer):
+class DocumentAccessLightSerializer(DocumentAccessSerializer):
     """Serialize document accesses with limited fields."""
 
     user = UserLightSerializer(read_only=True)

src/backend/core/api/viewsets.py

@@ -7,6 +7,7 @@ from urllib.parse import unquote, urlparse
 
 from django.conf import settings
 from django.contrib.postgres.aggregates import ArrayAgg
+from django.contrib.postgres.fields import ArrayField
 from django.contrib.postgres.search import TrigramSimilarity
 from django.core.exceptions import ValidationError
 from django.core.files.storage import default_storage
@@ -218,10 +219,14 @@ class UserViewSet(
 class ResourceAccessViewsetMixin:
     """Mixin with methods common to all access viewsets."""
 
-    def filter_queryset(self, queryset):
-        """Override to filter on related resource."""
-        queryset = super().filter_queryset(queryset)
-        return queryset.filter(**{self.resource_field_name: self.kwargs["resource_id"]})
+    def get_permissions(self):
+        """User only needs to be authenticated to list resource accesses"""
+        if self.action == "list":
+            permission_classes = [permissions.IsAuthenticated]
+        else:
+            return super().get_permissions()
+
+        return [permission() for permission in permission_classes]
 
     def get_serializer_context(self):
         """Extra context provided to the serializer class."""
@@ -229,6 +234,43 @@ class ResourceAccessViewsetMixin:
         context["resource_id"] = self.kwargs["resource_id"]
         return context
 
+    def get_queryset(self):
+        """Return the queryset according to the action."""
+        queryset = super().get_queryset()
+        queryset = queryset.filter(
+            **{self.resource_field_name: self.kwargs["resource_id"]}
+        )
+
+        if self.action == "list":
+            user = self.request.user
+            teams = user.teams
+            user_roles_query = (
+                queryset.filter(
+                    db.Q(user=user) | db.Q(team__in=teams),
+                    **{self.resource_field_name: self.kwargs["resource_id"]},
+                )
+                .values(self.resource_field_name)
+                .annotate(roles_array=ArrayAgg("role"))
+                .values("roles_array")
+            )
+
+            # Limit to resource access instances related to a resource THAT also has
+            # a resource access
+            # instance for the logged-in user (we don't want to list only the resource
+            # access instances pointing to the logged-in user)
+            queryset = (
+                queryset.filter(
+                    db.Q(**{f"{self.resource_field_name}__accesses__user": user})
+                    | db.Q(
+                        **{f"{self.resource_field_name}__accesses__team__in": teams}
+                    ),
+                    **{self.resource_field_name: self.kwargs["resource_id"]},
+                )
+                .annotate(user_roles=db.Subquery(user_roles_query))
+                .distinct()
+            )
+        return queryset
+
     def destroy(self, request, *args, **kwargs):
         """Forbid deleting the last owner access"""
         instance = self.get_object()
@@ -399,6 +441,44 @@ class DocumentViewSet(
     trashbin_serializer_class = serializers.ListDocumentSerializer
     tree_serializer_class = serializers.ListDocumentSerializer
 
+    def annotate_is_favorite(self, queryset):
+        """
+        Annotate document queryset with the favorite status for the current user.
+        """
+        user = self.request.user
+
+        if user.is_authenticated:
+            favorite_exists_subquery = models.DocumentFavorite.objects.filter(
+                document_id=db.OuterRef("pk"), user=user
+            )
+            return queryset.annotate(is_favorite=db.Exists(favorite_exists_subquery))
+
+        return queryset.annotate(is_favorite=db.Value(False))
+
+    def annotate_user_roles(self, queryset):
+        """
+        Annotate document queryset with the roles of the current user
+        on the document or its ancestors.
+        """
+        user = self.request.user
+        output_field = ArrayField(base_field=db.CharField())
+
+        if user.is_authenticated:
+            user_roles_subquery = models.DocumentAccess.objects.filter(
+                db.Q(user=user) | db.Q(team__in=user.teams),
+                document__path=Left(db.OuterRef("path"), Length("document__path")),
+            ).values_list("role", flat=True)
+
+            return queryset.annotate(
+                user_roles=db.Func(
+                    user_roles_subquery, function="ARRAY", output_field=output_field
+                )
+            )
+
+        return queryset.annotate(
+            user_roles=db.Value([], output_field=output_field),
+        )
+
     def get_queryset(self):
         """Get queryset performing all annotation and filtering on the document tree structure."""
         user = self.request.user
@@ -434,9 +514,8 @@ class DocumentViewSet(
     def filter_queryset(self, queryset):
         """Override to apply annotations to generic views."""
         queryset = super().filter_queryset(queryset)
-        user = self.request.user
-        queryset = queryset.annotate_is_favorite(user)
-        queryset = queryset.annotate_user_roles(user)
+        queryset = self.annotate_is_favorite(queryset)
+        queryset = self.annotate_user_roles(queryset)
         return queryset
 
     def get_response_for_queryset(self, queryset):
@@ -460,10 +539,9 @@ class DocumentViewSet(
         Additional annotations (e.g., `is_highest_ancestor_for_user`, favorite status) are
         applied before ordering and returning the response.
         """
-        user = self.request.user
-
-        # Not calling filter_queryset. We do our own cooking.
-        queryset = self.get_queryset()
+        queryset = (
+            self.get_queryset()
+        )  # Not calling filter_queryset. We do our own cooking.
 
         filterset = ListDocumentFilter(
             self.request.GET, queryset=queryset, request=self.request
@@ -476,7 +554,7 @@ class DocumentViewSet(
         for field in ["is_creator_me", "title"]:
             queryset = filterset.filters[field].filter(queryset, filter_data[field])
 
-        queryset = queryset.annotate_user_roles(user)
+        queryset = self.annotate_user_roles(queryset)
 
         # Among the results, we may have documents that are ancestors/descendants
         # of each other. In this case we want to keep only the highest ancestors.
@@ -493,7 +571,7 @@ class DocumentViewSet(
         )
 
         # Annotate favorite status and filter if applicable as late as possible
-        queryset = queryset.annotate_is_favorite(user)
+        queryset = self.annotate_is_favorite(queryset)
         queryset = filterset.filters["is_favorite"].filter(
             queryset, filter_data["is_favorite"]
         )
@@ -576,7 +654,7 @@ class DocumentViewSet(
             deleted_at__isnull=False,
             deleted_at__gte=models.get_trashbin_cutoff(),
         )
-        queryset = queryset.annotate_user_roles(self.request.user)
+        queryset = self.annotate_user_roles(queryset)
         queryset = queryset.filter(user_roles__contains=[models.RoleChoices.OWNER])
 
         return self.get_response_for_queryset(queryset)
@@ -756,8 +834,6 @@ class DocumentViewSet(
         List ancestors tree above the document.
         What we need to display is the tree structure opened for the current document.
         """
-        user = self.request.user
-
         try:
             current_document = self.queryset.only("depth", "path").get(pk=pk)
         except models.Document.DoesNotExist as excpt:
@@ -812,8 +888,8 @@ class DocumentViewSet(
                 output_field=db.BooleanField(),
             )
         )
-        queryset = queryset.annotate_user_roles(user)
-        queryset = queryset.annotate_is_favorite(user)
+        queryset = self.annotate_user_roles(queryset)
+        queryset = self.annotate_is_favorite(queryset)
 
         # Pass ancestors' links definitions to the serializer as a context variable
         # in order to allow saving time while computing abilities on the instance
@@ -1297,11 +1373,7 @@ class DocumentViewSet(
 
 class DocumentAccessViewSet(
     ResourceAccessViewsetMixin,
-    drf.mixins.CreateModelMixin,
-    drf.mixins.RetrieveModelMixin,
-    drf.mixins.UpdateModelMixin,
-    drf.mixins.DestroyModelMixin,
-    viewsets.GenericViewSet,
+    viewsets.ModelViewSet,
 ):
     """
     API ViewSet for all interactions with document accesses.
@@ -1328,52 +1400,37 @@ class DocumentAccessViewSet(
     """
 
     lookup_field = "pk"
+    pagination_class = Pagination
     permission_classes = [permissions.IsAuthenticated, permissions.AccessPermission]
     queryset = models.DocumentAccess.objects.select_related("user").all()
     resource_field_name = "document"
     serializer_class = serializers.DocumentAccessSerializer
+    is_current_user_owner_or_admin = False
 
-    def list(self, request, *args, **kwargs):
-        """Return accesses for the current document with filters and annotations."""
-        user = self.request.user
+    def get_queryset(self):
+        """Return the queryset according to the action."""
+        queryset = super().get_queryset()
 
-        try:
-            document = models.Document.objects.get(pk=self.kwargs["resource_id"])
-        except models.Document.DoesNotExist:
-            return drf.response.Response([])
+        if self.action == "list":
+            try:
+                document = models.Document.objects.get(pk=self.kwargs["resource_id"])
+            except models.Document.DoesNotExist:
+                return queryset.none()
 
-        roles = set(document.get_roles(user))
-        if not roles:
-            return drf.response.Response([])
+            roles = set(document.get_roles(self.request.user))
+            is_owner_or_admin = bool(roles.intersection(set(models.PRIVILEGED_ROLES)))
+            self.is_current_user_owner_or_admin = is_owner_or_admin
+            if not is_owner_or_admin:
+                # Return only the document owner access
+                queryset = queryset.filter(role__in=models.PRIVILEGED_ROLES)
 
-        ancestors = (
-            (document.get_ancestors() | models.Document.objects.filter(pk=document.pk))
-            .filter(ancestors_deleted_at__isnull=True)
-            .order_by("path")
-        )
-        highest_readable = ancestors.readable_per_se(user).only("depth").first()
+        return queryset
 
-        if highest_readable is None:
-            return drf.response.Response([])
+    def get_serializer_class(self):
+        if self.action == "list" and not self.is_current_user_owner_or_admin:
+            return serializers.DocumentAccessLightSerializer
 
-        queryset = self.get_queryset()
-        queryset = queryset.filter(
-            document__in=ancestors.filter(depth__gte=highest_readable.depth)
-        )
-
-        is_privileged = bool(roles.intersection(set(models.PRIVILEGED_ROLES)))
-        if is_privileged:
-            serializer_class = serializers.DocumentAccessSerializer
-        else:
-            # Return only the document's privileged accesses
-            queryset = queryset.filter(role__in=models.PRIVILEGED_ROLES)
-            serializer_class = serializers.DocumentAccessLightSerializer
-
-        queryset = queryset.distinct()
-        serializer = serializer_class(
-            queryset, many=True, context=self.get_serializer_context()
-        )
-        return drf.response.Response(serializer.data)
+        return super().get_serializer_class()
 
     def perform_create(self, serializer):
         """Add a new access to the document and send an email to the new added user."""
@@ -1485,6 +1542,7 @@ class TemplateAccessViewSet(
     ResourceAccessViewsetMixin,
     drf.mixins.CreateModelMixin,
     drf.mixins.DestroyModelMixin,
+    drf.mixins.ListModelMixin,
     drf.mixins.RetrieveModelMixin,
     drf.mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
@@ -1514,28 +1572,12 @@ class TemplateAccessViewSet(
     """
 
     lookup_field = "pk"
+    pagination_class = Pagination
     permission_classes = [permissions.IsAuthenticated, permissions.AccessPermission]
     queryset = models.TemplateAccess.objects.select_related("user").all()
     resource_field_name = "template"
     serializer_class = serializers.TemplateAccessSerializer
 
-    def list(self, request, *args, **kwargs):
-        """Restrict templates returned by the list endpoint"""
-        user = self.request.user
-        teams = user.teams
-        queryset = self.filter_queryset(self.get_queryset())
-
-        # Limit to resource access instances related to a resource THAT also has
-        # a resource access instance for the logged-in user (we don't want to list
-        # only the resource access instances pointing to the logged-in user)
-        queryset = queryset.filter(
-            db.Q(template__accesses__user=user)
-            | db.Q(template__accesses__team__in=teams),
-        ).distinct()
-
-        serializer = self.get_serializer(queryset, many=True)
-        return drf.response.Response(serializer.data)
-
 
 class InvitationViewset(
     drf.mixins.CreateModelMixin,
@@ -1650,6 +1692,7 @@ class ConfigView(drf.views.APIView):
             "CRISP_WEBSITE_ID",
             "ENVIRONMENT",
             "FRONTEND_CSS_URL",
+            "FRONTEND_HOMEPAGE_FEATURE_ENABLED",
             "FRONTEND_FOOTER_FEATURE_ENABLED",
             "FRONTEND_THEME",
             "MEDIA_BASE_URL",

src/backend/core/migrations/0021_activate_unaccent_extension.py

@@ -1,14 +0,0 @@
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("core", "0020_remove_is_public_add_field_attachments_and_duplicated_from"),
-    ]
-
-    operations = [
-        migrations.RunSQL(
-            "CREATE EXTENSION IF NOT EXISTS unaccent;",
-            reverse_sql="DROP EXTENSION IF EXISTS unaccent;",
-        ),
-    ]

src/backend/core/models.py

@@ -87,61 +87,49 @@ class LinkReachChoices(models.TextChoices):
         """
         Determines the valid select options for link reach and link role depending on the
         list of ancestors' link reach/role.
+
         Args:
             ancestors_links: List of dictionaries, each with 'link_reach' and 'link_role' keys
                              representing the reach and role of ancestors links.
+
         Returns:
             Dictionary mapping possible reach levels to their corresponding possible roles.
         """
         # If no ancestors, return all options
         if not ancestors_links:
-            return {
-                reach: LinkRoleChoices.values if reach != cls.RESTRICTED else None
-                for reach in cls.values
-            }
+            return dict.fromkeys(cls.values, LinkRoleChoices.values)
 
         # Initialize result with all possible reaches and role options as sets
-        result = {
-            reach: set(LinkRoleChoices.values) if reach != cls.RESTRICTED else None
-            for reach in cls.values
-        }
+        result = {reach: set(LinkRoleChoices.values) for reach in cls.values}
 
         # Group roles by reach level
         reach_roles = defaultdict(set)
         for link in ancestors_links:
             reach_roles[link["link_reach"]].add(link["link_role"])
 
-        # Rule 1: public/editor → override everything
-        if LinkRoleChoices.EDITOR in reach_roles.get(cls.PUBLIC, set()):
-            return {cls.PUBLIC: [LinkRoleChoices.EDITOR]}
+        # Apply constraints based on ancestor links
+        if LinkRoleChoices.EDITOR in reach_roles[cls.RESTRICTED]:
+            result[cls.RESTRICTED].discard(LinkRoleChoices.READER)
 
-        # Rule 2: authenticated/editor
-        if LinkRoleChoices.EDITOR in reach_roles.get(cls.AUTHENTICATED, set()):
+        if LinkRoleChoices.EDITOR in reach_roles[cls.AUTHENTICATED]:
             result[cls.AUTHENTICATED].discard(LinkRoleChoices.READER)
             result.pop(cls.RESTRICTED, None)
+        elif LinkRoleChoices.READER in reach_roles[cls.AUTHENTICATED]:
+            result[cls.RESTRICTED].discard(LinkRoleChoices.READER)
 
-        # Rule 3: public/reader
-        if LinkRoleChoices.READER in reach_roles.get(cls.PUBLIC, set()):
+        if LinkRoleChoices.EDITOR in reach_roles[cls.PUBLIC]:
+            result[cls.PUBLIC].discard(LinkRoleChoices.READER)
             result.pop(cls.AUTHENTICATED, None)
             result.pop(cls.RESTRICTED, None)
+        elif LinkRoleChoices.READER in reach_roles[cls.PUBLIC]:
+            result[cls.AUTHENTICATED].discard(LinkRoleChoices.READER)
+            result.get(cls.RESTRICTED, set()).discard(LinkRoleChoices.READER)
 
-        # Rule 4: authenticated/reader
-        if LinkRoleChoices.READER in reach_roles.get(cls.AUTHENTICATED, set()):
-            result.pop(cls.RESTRICTED, None)
+        # Convert roles sets to lists while maintaining the order from LinkRoleChoices
+        for reach, roles in result.items():
+            result[reach] = [role for role in LinkRoleChoices.values if role in roles]
 
-        # Clean up: remove empty entries and convert sets to ordered lists
-        cleaned = {}
-        for reach in cls.values:
-            if reach in result:
-                if result[reach]:
-                    cleaned[reach] = [
-                        r for r in LinkRoleChoices.values if r in result[reach]
-                    ]
-                else:
-                    # Could be [] or None (for RESTRICTED reach)
-                    cleaned[reach] = result[reach]
-
-        return cleaned
+        return result
 
 
 class DuplicateEmailError(Exception):
@@ -464,41 +452,6 @@ class DocumentQuerySet(MP_NodeQuerySet):
 
         return self.filter(link_reach=LinkReachChoices.PUBLIC)
 
-    def annotate_is_favorite(self, user):
-        """
-        Annotate document queryset with the favorite status for the current user.
-        """
-        if user.is_authenticated:
-            favorite_exists_subquery = DocumentFavorite.objects.filter(
-                document_id=models.OuterRef("pk"), user=user
-            )
-            return self.annotate(is_favorite=models.Exists(favorite_exists_subquery))
-
-        return self.annotate(is_favorite=models.Value(False))
-
-    def annotate_user_roles(self, user):
-        """
-        Annotate document queryset with the roles of the current user
-        on the document or its ancestors.
-        """
-        output_field = ArrayField(base_field=models.CharField())
-
-        if user.is_authenticated:
-            user_roles_subquery = DocumentAccess.objects.filter(
-                models.Q(user=user) | models.Q(team__in=user.teams),
-                document__path=Left(models.OuterRef("path"), Length("document__path")),
-            ).values_list("role", flat=True)
-
-            return self.annotate(
-                user_roles=models.Func(
-                    user_roles_subquery, function="ARRAY", output_field=output_field
-                )
-            )
-
-        return self.annotate(
-            user_roles=models.Value([], output_field=output_field),
-        )
-
 
 class DocumentManager(MP_NodeManager.from_queryset(DocumentQuerySet)):
     """
@@ -784,16 +737,17 @@ class Document(MP_Node, BaseModel):
                 roles = []
         return roles
 
-    def get_ancestors_links_definitions(self, ancestors_links):
-        """Get links reach/role definitions for ancestors of the current document."""
+    def get_links_definitions(self, ancestors_links):
+        """Get links reach/role definitions for the current document and its ancestors."""
 
-        ancestors_links_definitions = defaultdict(set)
+        links_definitions = defaultdict(set)
+        links_definitions[self.link_reach].add(self.link_role)
+
+        # Merge ancestor link definitions
         for ancestor in ancestors_links:
-            ancestors_links_definitions[ancestor["link_reach"]].add(
-                ancestor["link_role"]
-            )
+            links_definitions[ancestor["link_reach"]].add(ancestor["link_role"])
 
-        return ancestors_links_definitions
+        return dict(links_definitions)  # Convert defaultdict back to a normal dict
 
     def compute_ancestors_links(self, user):
         """
@@ -849,20 +803,10 @@ class Document(MP_Node, BaseModel):
         ) and not is_deleted
 
         # Add roles provided by the document link, taking into account its ancestors
-        ancestors_links_definitions = self.get_ancestors_links_definitions(
-            ancestors_links
-        )
-
-        public_roles = ancestors_links_definitions.get(
-            LinkReachChoices.PUBLIC, set()
-        ) | ({self.link_role} if self.link_reach == LinkReachChoices.PUBLIC else set())
+        links_definitions = self.get_links_definitions(ancestors_links)
+        public_roles = links_definitions.get(LinkReachChoices.PUBLIC, set())
         authenticated_roles = (
-            ancestors_links_definitions.get(LinkReachChoices.AUTHENTICATED, set())
-            | (
-                {self.link_role}
-                if self.link_reach == LinkReachChoices.AUTHENTICATED
-                else set()
-            )
+            links_definitions.get(LinkReachChoices.AUTHENTICATED, set())
             if user.is_authenticated
             else set()
         )
@@ -906,9 +850,6 @@ class Document(MP_Node, BaseModel):
             "restore": is_owner,
             "retrieve": can_get,
             "media_auth": can_get,
-            "ancestors_links_definitions": {
-                k: list(v) for k, v in ancestors_links_definitions.items()
-            },
             "link_select_options": LinkReachChoices.get_select_options(ancestors_links),
             "tree": can_get,
             "update": can_update,

src/backend/core/tests/documents/test_api_document_accesses.py

@@ -51,7 +51,12 @@ def test_api_document_accesses_list_authenticated_unrelated():
         f"/api/v1.0/documents/{document.id!s}/accesses/",
     )
     assert response.status_code == 200
-    assert response.json() == []
+    assert response.json() == {
+        "count": 0,
+        "next": None,
+        "previous": None,
+        "results": [],
+    }
 
 
 def test_api_document_accesses_list_unexisting_document():
@@ -65,7 +70,12 @@ def test_api_document_accesses_list_unexisting_document():
 
     response = client.get(f"/api/v1.0/documents/{uuid4()!s}/accesses/")
     assert response.status_code == 200
-    assert response.json() == []
+    assert response.json() == {
+        "count": 0,
+        "next": None,
+        "previous": None,
+        "results": [],
+    }
 
 
 @pytest.mark.parametrize("via", VIA)
@@ -76,30 +86,22 @@ def test_api_document_accesses_list_authenticated_related_non_privileged(
     via, role, mock_user_teams
 ):
     """
-    Authenticated users with no privileged role should only be able to list document
-    accesses associated with privileged roles for a document, including from ancestors.
+    Authenticated users should be able to list document accesses for a document
+    to which they are directly related, whatever their role in the document.
     """
     user = factories.UserFactory()
+
     client = APIClient()
     client.force_login(user)
 
-    # Create documents structured as a tree
-    unreadable_ancestor = factories.DocumentFactory(link_reach="restricted")
-    # make all documents below the grand parent readable without a specific access for the user
-    grand_parent = factories.DocumentFactory(
-        parent=unreadable_ancestor, link_reach="authenticated"
+    owner = factories.UserFactory()
+    accesses = []
+
+    document_access = factories.UserDocumentAccessFactory(
+        user=owner, role=models.RoleChoices.OWNER
     )
-    parent = factories.DocumentFactory(parent=grand_parent)
-    document = factories.DocumentFactory(parent=parent)
-    child = factories.DocumentFactory(parent=document)
-
-    # Create accesses related to each document
-    factories.UserDocumentAccessFactory(document=unreadable_ancestor)
-    grand_parent_access = factories.UserDocumentAccessFactory(document=grand_parent)
-    parent_access = factories.UserDocumentAccessFactory(document=parent)
-    document_access = factories.UserDocumentAccessFactory(document=document)
-    factories.UserDocumentAccessFactory(document=child)
-
+    accesses.append(document_access)
+    document = document_access.document
     if via == USER:
         models.DocumentAccess.objects.create(
             document=document,
@@ -116,6 +118,8 @@ def test_api_document_accesses_list_authenticated_related_non_privileged(
 
     access1 = factories.TeamDocumentAccessFactory(document=document)
     access2 = factories.UserDocumentAccessFactory(document=document)
+    accesses.append(access1)
+    accesses.append(access2)
 
     # Accesses for other documents to which the user is related should not be listed either
     other_access = factories.UserDocumentAccessFactory(user=user)
@@ -125,17 +129,14 @@ def test_api_document_accesses_list_authenticated_related_non_privileged(
         f"/api/v1.0/documents/{document.id!s}/accesses/",
     )
 
+    # Return only owners
+    owners_accesses = [
+        access for access in accesses if access.role in models.PRIVILEGED_ROLES
+    ]
     assert response.status_code == 200
     content = response.json()
-
-    # Make sure only privileged roles are returned
-    accesses = [grand_parent_access, parent_access, document_access, access1, access2]
-    privileged_accesses = [
-        acc for acc in accesses if acc.role in models.PRIVILEGED_ROLES
-    ]
-    assert len(content) == len(privileged_accesses)
-
-    assert sorted(content, key=lambda x: x["id"]) == sorted(
+    assert content["count"] == len(owners_accesses)
+    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
         [
             {
                 "id": str(access.id),
@@ -151,44 +152,38 @@ def test_api_document_accesses_list_authenticated_related_non_privileged(
                 "role": access.role,
                 "abilities": access.get_abilities(user),
             }
-            for access in privileged_accesses
+            for access in owners_accesses
         ],
         key=lambda x: x["id"],
     )
 
+    for access in content["results"]:
+        assert access["role"] in models.PRIVILEGED_ROLES
+
 
 @pytest.mark.parametrize("via", VIA)
-@pytest.mark.parametrize(
-    "role", [role for role in models.RoleChoices if role in models.PRIVILEGED_ROLES]
-)
-def test_api_document_accesses_list_authenticated_related_privileged(
+@pytest.mark.parametrize("role", models.PRIVILEGED_ROLES)
+def test_api_document_accesses_list_authenticated_related_privileged_roles(
     via, role, mock_user_teams
 ):
     """
-    Authenticated users with a privileged role should be able to list all
-    document accesses whatever the role, including from ancestors.
+    Authenticated users should be able to list document accesses for a document
+    to which they are directly related, whatever their role in the document.
     """
     user = factories.UserFactory()
+
     client = APIClient()
     client.force_login(user)
 
-    # Create documents structured as a tree
-    unreadable_ancestor = factories.DocumentFactory(link_reach="restricted")
-    # make all documents below the grand parent readable without a specific access for the user
-    grand_parent = factories.DocumentFactory(
-        parent=unreadable_ancestor, link_reach="authenticated"
+    owner = factories.UserFactory()
+    accesses = []
+
+    document_access = factories.UserDocumentAccessFactory(
+        user=owner, role=models.RoleChoices.OWNER
     )
-    parent = factories.DocumentFactory(parent=grand_parent)
-    document = factories.DocumentFactory(parent=parent)
-    child = factories.DocumentFactory(parent=document)
-
-    # Create accesses related to each document
-    factories.UserDocumentAccessFactory(document=unreadable_ancestor)
-    grand_parent_access = factories.UserDocumentAccessFactory(document=grand_parent)
-    parent_access = factories.UserDocumentAccessFactory(document=parent)
-    document_access = factories.UserDocumentAccessFactory(document=document)
-    factories.UserDocumentAccessFactory(document=child)
-
+    accesses.append(document_access)
+    document = document_access.document
+    user_access = None
     if via == USER:
         user_access = models.DocumentAccess.objects.create(
             document=document,
@@ -202,11 +197,11 @@ def test_api_document_accesses_list_authenticated_related_privileged(
             team="lasuite",
             role=role,
         )
-    else:
-        raise RuntimeError()
 
     access1 = factories.TeamDocumentAccessFactory(document=document)
     access2 = factories.UserDocumentAccessFactory(document=document)
+    accesses.append(access1)
+    accesses.append(access2)
 
     # Accesses for other documents to which the user is related should not be listed either
     other_access = factories.UserDocumentAccessFactory(user=user)
@@ -216,39 +211,42 @@ def test_api_document_accesses_list_authenticated_related_privileged(
         f"/api/v1.0/documents/{document.id!s}/accesses/",
     )
 
+    access2_user = serializers.UserSerializer(instance=access2.user).data
+    base_user = serializers.UserSerializer(instance=user).data
+
     assert response.status_code == 200
     content = response.json()
-
-    # Make sure all expected accesses are returned
-    accesses = [
-        user_access,
-        grand_parent_access,
-        parent_access,
-        document_access,
-        access1,
-        access2,
-    ]
-    assert len(content) == 6
-
-    assert sorted(content, key=lambda x: x["id"]) == sorted(
+    assert len(content["results"]) == 4
+    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
         [
             {
-                "id": str(access.id),
-                "document_id": str(access.document_id),
-                "user": {
-                    "id": str(access.user.id),
-                    "email": access.user.email,
-                    "language": access.user.language,
-                    "full_name": access.user.full_name,
-                    "short_name": access.user.short_name,
-                }
-                if access.user
-                else None,
-                "team": access.team,
-                "role": access.role,
-                "abilities": access.get_abilities(user),
-            }
-            for access in accesses
+                "id": str(user_access.id),
+                "user": base_user if via == "user" else None,
+                "team": "lasuite" if via == "team" else "",
+                "role": user_access.role,
+                "abilities": user_access.get_abilities(user),
+            },
+            {
+                "id": str(access1.id),
+                "user": None,
+                "team": access1.team,
+                "role": access1.role,
+                "abilities": access1.get_abilities(user),
+            },
+            {
+                "id": str(access2.id),
+                "user": access2_user,
+                "team": "",
+                "role": access2.role,
+                "abilities": access2.get_abilities(user),
+            },
+            {
+                "id": str(document_access.id),
+                "user": serializers.UserSerializer(instance=owner).data,
+                "team": "",
+                "role": models.RoleChoices.OWNER,
+                "abilities": document_access.get_abilities(user),
+            },
         ],
         key=lambda x: x["id"],
     )
@@ -343,7 +341,6 @@ def test_api_document_accesses_retrieve_authenticated_related(
         assert response.status_code == 200
         assert response.json() == {
             "id": str(access.id),
-            "document_id": str(access.document_id),
             "user": access_user,
             "team": "",
             "role": access.role,

src/backend/core/tests/documents/test_api_document_accesses_create.py

@@ -165,7 +165,6 @@ def test_api_document_accesses_create_authenticated_administrator(via, mock_user
     other_user = serializers.UserSerializer(instance=other_user).data
     assert response.json() == {
         "abilities": new_document_access.get_abilities(user),
-        "document_id": str(new_document_access.document_id),
         "id": str(new_document_access.id),
         "team": "",
         "role": role,
@@ -223,7 +222,6 @@ def test_api_document_accesses_create_authenticated_owner(via, mock_user_teams):
     new_document_access = models.DocumentAccess.objects.filter(user=other_user).get()
     other_user = serializers.UserSerializer(instance=other_user).data
     assert response.json() == {
-        "document_id": str(new_document_access.document_id),
         "id": str(new_document_access.id),
         "user": other_user,
         "team": "",
@@ -288,7 +286,6 @@ def test_api_document_accesses_create_email_in_receivers_language(via, mock_user
         ).get()
         other_user_data = serializers.UserSerializer(instance=other_user).data
         assert response.json() == {
-            "document_id": str(new_document_access.document_id),
             "id": str(new_document_access.id),
             "user": other_user_data,
             "team": "",

src/backend/core/tests/documents/test_api_documents_descendants_filters.py

@@ -7,7 +7,6 @@ from faker import Faker
 from rest_framework.test import APIClient
 
 from core import factories
-from core.api.filters import remove_accents
 
 fake = Faker()
 pytestmark = pytest.mark.django_db
@@ -50,16 +49,14 @@ def test_api_documents_descendants_filter_unknown_field():
     [
         ("Project Alpha", 1),  # Exact match
         ("project", 2),  # Partial match (case-insensitive)
-        ("Guide", 2),  # Word match within a title
+        ("Guide", 1),  # Word match within a title
         ("Special", 0),  # No match (nonexistent keyword)
         ("2024", 2),  # Match by numeric keyword
-        ("", 6),  # Empty string
-        ("velo", 1),  # Accent-insensitive match (velo vs vélo)
-        ("bêta", 1),  # Accent-insensitive match (bêta vs beta)
+        ("", 5),  # Empty string
     ],
 )
 def test_api_documents_descendants_filter_title(query, nb_results):
-    """Authenticated users should be able to search documents by their unaccented title."""
+    """Authenticated users should be able to search documents by their title."""
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
@@ -73,7 +70,6 @@ def test_api_documents_descendants_filter_title(query, nb_results):
         "User Guide",
         "Financial Report 2024",
         "Annual Review 2024",
-        "Guide du vélo urbain",  # <-- Title with accent for accent-insensitive test
     ]
     for title in titles:
         factories.DocumentFactory(title=title, parent=document)
@@ -89,7 +85,4 @@ def test_api_documents_descendants_filter_title(query, nb_results):
 
     # Ensure all results contain the query in their title
     for result in results:
-        assert (
-            remove_accents(query).lower().strip()
-            in remove_accents(result["title"]).lower()
-        )
+        assert query.lower().strip() in result["title"].lower()

src/backend/core/tests/documents/test_api_documents_retrieve.py

@@ -42,11 +42,10 @@ def test_api_documents_retrieve_anonymous_public_standalone():
             "favorite": False,
             "invite_owner": False,
             "link_configuration": False,
-            "ancestors_links_definitions": {},
             "link_select_options": {
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
-                "restricted": None,
+                "restricted": ["reader", "editor"],
             },
             "media_auth": True,
             "move": False,
@@ -98,10 +97,6 @@ def test_api_documents_retrieve_anonymous_public_parent():
             "accesses_view": False,
             "ai_transform": False,
             "ai_translate": False,
-            "ancestors_links_definitions": {
-                "public": [grand_parent.link_role],
-                parent.link_reach: [parent.link_role],
-            },
             "attachment_upload": grand_parent.link_role == "editor",
             "children_create": False,
             "children_list": True,
@@ -198,7 +193,6 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
             "accesses_view": False,
             "ai_transform": document.link_role == "editor",
             "ai_translate": document.link_role == "editor",
-            "ancestors_links_definitions": {},
             "attachment_upload": document.link_role == "editor",
             "children_create": document.link_role == "editor",
             "children_list": True,
@@ -213,7 +207,7 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
             "link_select_options": {
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
-                "restricted": None,
+                "restricted": ["reader", "editor"],
             },
             "media_auth": True,
             "move": False,
@@ -273,10 +267,6 @@ def test_api_documents_retrieve_authenticated_public_or_authenticated_parent(rea
             "accesses_view": False,
             "ai_transform": grand_parent.link_role == "editor",
             "ai_translate": grand_parent.link_role == "editor",
-            "ancestors_links_definitions": {
-                grand_parent.link_reach: [grand_parent.link_role],
-                "restricted": [parent.link_role],
-            },
             "attachment_upload": grand_parent.link_role == "editor",
             "children_create": grand_parent.link_role == "editor",
             "children_list": True,
@@ -450,7 +440,6 @@ def test_api_documents_retrieve_authenticated_related_parent():
     )
     assert response.status_code == 200
     links = document.get_ancestors().values("link_reach", "link_role")
-    ancestors_roles = list({grand_parent.link_role, parent.link_role})
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
@@ -458,7 +447,6 @@ def test_api_documents_retrieve_authenticated_related_parent():
             "accesses_view": True,
             "ai_transform": access.role != "reader",
             "ai_translate": access.role != "reader",
-            "ancestors_links_definitions": {"restricted": ancestors_roles},
             "attachment_upload": access.role != "reader",
             "children_create": access.role != "reader",
             "children_list": True,

src/backend/core/tests/documents/test_api_documents_trashbin.py

@@ -74,7 +74,6 @@ def test_api_documents_trashbin_format():
             "accesses_view": True,
             "ai_transform": True,
             "ai_translate": True,
-            "ancestors_links_definitions": {},
             "attachment_upload": True,
             "children_create": True,
             "children_list": True,
@@ -89,7 +88,7 @@ def test_api_documents_trashbin_format():
             "link_select_options": {
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
-                "restricted": None,
+                "restricted": ["reader", "editor"],
             },
             "media_auth": True,
             "move": False,  # Can't move a deleted document

src/backend/core/tests/templates/test_api_template_accesses.py

@@ -48,7 +48,12 @@ def test_api_template_accesses_list_authenticated_unrelated():
         f"/api/v1.0/templates/{template.id!s}/accesses/",
     )
     assert response.status_code == 200
-    assert response.json() == []
+    assert response.json() == {
+        "count": 0,
+        "next": None,
+        "previous": None,
+        "results": [],
+    }
 
 
 @pytest.mark.parametrize("via", VIA)
@@ -91,8 +96,8 @@ def test_api_template_accesses_list_authenticated_related(via, mock_user_teams):
 
     assert response.status_code == 200
     content = response.json()
-    assert len(content) == 3
-    assert sorted(content, key=lambda x: x["id"]) == sorted(
+    assert len(content["results"]) == 3
+    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
         [
             {
                 "id": str(user_access.id),

src/backend/core/tests/test_api_config.py

@@ -19,6 +19,7 @@ pytestmark = pytest.mark.django_db
     COLLABORATION_WS_URL="http://testcollab/",
     CRISP_WEBSITE_ID="123",
     FRONTEND_CSS_URL="http://testcss/",
+    FRONTEND_HOMEPAGE_FEATURE_ENABLED=True,
     FRONTEND_FOOTER_FEATURE_ENABLED=True,
     FRONTEND_THEME="test-theme",
     MEDIA_BASE_URL="http://testserver/",
@@ -41,6 +42,7 @@ def test_api_config(is_authenticated):
         "CRISP_WEBSITE_ID": "123",
         "ENVIRONMENT": "test",
         "FRONTEND_CSS_URL": "http://testcss/",
+        "FRONTEND_HOMEPAGE_FEATURE_ENABLED": True,
         "FRONTEND_FOOTER_FEATURE_ENABLED": True,
         "FRONTEND_THEME": "test-theme",
         "LANGUAGES": [

src/backend/core/tests/test_models_documents.py

@@ -154,7 +154,6 @@ def test_models_documents_get_abilities_forbidden(
         "accesses_view": False,
         "ai_transform": False,
         "ai_translate": False,
-        "ancestors_links_definitions": {},
         "attachment_upload": False,
         "children_create": False,
         "children_list": False,
@@ -171,7 +170,7 @@ def test_models_documents_get_abilities_forbidden(
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": None,
+            "restricted": ["reader", "editor"],
         },
         "partial_update": False,
         "restore": False,
@@ -215,7 +214,6 @@ def test_models_documents_get_abilities_reader(
         "accesses_view": False,
         "ai_transform": False,
         "ai_translate": False,
-        "ancestors_links_definitions": {},
         "attachment_upload": False,
         "children_create": False,
         "children_list": True,
@@ -230,7 +228,7 @@ def test_models_documents_get_abilities_reader(
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": None,
+            "restricted": ["reader", "editor"],
         },
         "media_auth": True,
         "move": False,
@@ -252,7 +250,7 @@ def test_models_documents_get_abilities_reader(
     assert all(
         value is False
         for key, value in document.get_abilities(user).items()
-        if key not in ["link_select_options", "ancestors_links_definitions"]
+        if key != "link_select_options"
     )
 
 
@@ -278,7 +276,6 @@ def test_models_documents_get_abilities_editor(
         "accesses_view": False,
         "ai_transform": is_authenticated,
         "ai_translate": is_authenticated,
-        "ancestors_links_definitions": {},
         "attachment_upload": True,
         "children_create": is_authenticated,
         "children_list": True,
@@ -293,7 +290,7 @@ def test_models_documents_get_abilities_editor(
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": None,
+            "restricted": ["reader", "editor"],
         },
         "media_auth": True,
         "move": False,
@@ -314,7 +311,7 @@ def test_models_documents_get_abilities_editor(
     assert all(
         value is False
         for key, value in document.get_abilities(user).items()
-        if key not in ["link_select_options", "ancestors_links_definitions"]
+        if key != "link_select_options"
     )
 
 
@@ -330,7 +327,6 @@ def test_models_documents_get_abilities_owner(django_assert_num_queries):
         "accesses_view": True,
         "ai_transform": True,
         "ai_translate": True,
-        "ancestors_links_definitions": {},
         "attachment_upload": True,
         "children_create": True,
         "children_list": True,
@@ -345,7 +341,7 @@ def test_models_documents_get_abilities_owner(django_assert_num_queries):
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": None,
+            "restricted": ["reader", "editor"],
         },
         "media_auth": True,
         "move": True,
@@ -379,7 +375,6 @@ def test_models_documents_get_abilities_administrator(django_assert_num_queries)
         "accesses_view": True,
         "ai_transform": True,
         "ai_translate": True,
-        "ancestors_links_definitions": {},
         "attachment_upload": True,
         "children_create": True,
         "children_list": True,
@@ -394,7 +389,7 @@ def test_models_documents_get_abilities_administrator(django_assert_num_queries)
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": None,
+            "restricted": ["reader", "editor"],
         },
         "media_auth": True,
         "move": True,
@@ -415,7 +410,7 @@ def test_models_documents_get_abilities_administrator(django_assert_num_queries)
     assert all(
         value is False
         for key, value in document.get_abilities(user).items()
-        if key not in ["link_select_options", "ancestors_links_definitions"]
+        if key != "link_select_options"
     )
 
 
@@ -431,7 +426,6 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         "accesses_view": True,
         "ai_transform": True,
         "ai_translate": True,
-        "ancestors_links_definitions": {},
         "attachment_upload": True,
         "children_create": True,
         "children_list": True,
@@ -446,7 +440,7 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": None,
+            "restricted": ["reader", "editor"],
         },
         "media_auth": True,
         "move": False,
@@ -467,7 +461,7 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
     assert all(
         value is False
         for key, value in document.get_abilities(user).items()
-        if key not in ["link_select_options", "ancestors_links_definitions"]
+        if key != "link_select_options"
     )
 
 
@@ -490,7 +484,6 @@ def test_models_documents_get_abilities_reader_user(
         # You should not access AI if it's restricted to users with specific access
         "ai_transform": access_from_link and ai_access_setting != "restricted",
         "ai_translate": access_from_link and ai_access_setting != "restricted",
-        "ancestors_links_definitions": {},
         "attachment_upload": access_from_link,
         "children_create": access_from_link,
         "children_list": True,
@@ -505,7 +498,7 @@ def test_models_documents_get_abilities_reader_user(
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": None,
+            "restricted": ["reader", "editor"],
         },
         "media_auth": True,
         "move": False,
@@ -528,7 +521,7 @@ def test_models_documents_get_abilities_reader_user(
         assert all(
             value is False
             for key, value in document.get_abilities(user).items()
-            if key not in ["link_select_options", "ancestors_links_definitions"]
+            if key != "link_select_options"
         )
 
 
@@ -547,7 +540,6 @@ def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
         "accesses_view": True,
         "ai_transform": False,
         "ai_translate": False,
-        "ancestors_links_definitions": {},
         "attachment_upload": False,
         "children_create": False,
         "children_list": True,
@@ -562,7 +554,7 @@ def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": None,
+            "restricted": ["reader", "editor"],
         },
         "media_auth": True,
         "move": False,
@@ -1182,6 +1174,8 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
         (
             [{"link_reach": "public", "link_role": "reader"}],
             {
+                "restricted": ["editor"],
+                "authenticated": ["editor"],
                 "public": ["reader", "editor"],
             },
         ),
@@ -1189,6 +1183,7 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
         (
             [{"link_reach": "authenticated", "link_role": "reader"}],
             {
+                "restricted": ["editor"],
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
             },
@@ -1200,7 +1195,7 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
         (
             [{"link_reach": "restricted", "link_role": "reader"}],
             {
-                "restricted": None,
+                "restricted": ["reader", "editor"],
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
             },
@@ -1208,7 +1203,7 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
         (
             [{"link_reach": "restricted", "link_role": "editor"}],
             {
-                "restricted": None,
+                "restricted": ["editor"],
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
             },
@@ -1234,7 +1229,7 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
                 {"link_reach": "restricted", "link_role": "editor"},
             ],
             {
-                "restricted": None,
+                "restricted": ["editor"],
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
             },
@@ -1246,6 +1241,8 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
                 {"link_reach": "public", "link_role": "reader"},
             ],
             {
+                "restricted": ["editor"],
+                "authenticated": ["editor"],
                 "public": ["reader", "editor"],
             },
         ),
@@ -1256,6 +1253,8 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
                 {"link_reach": "public", "link_role": "reader"},
             ],
             {
+                "restricted": ["editor"],
+                "authenticated": ["editor"],
                 "public": ["reader", "editor"],
             },
         ),
@@ -1265,7 +1264,7 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
                 {"link_reach": "authenticated", "link_role": "editor"},
                 {"link_reach": "public", "link_role": "reader"},
             ],
-            {"public": ["reader", "editor"]},
+            {"authenticated": ["editor"], "public": ["reader", "editor"]},
         ),
         (
             [
@@ -1280,6 +1279,7 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
                 {"link_reach": "authenticated", "link_role": "reader"},
             ],
             {
+                "restricted": ["editor"],
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
             },
@@ -1297,7 +1297,7 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
             {
                 "public": ["reader", "editor"],
                 "authenticated": ["reader", "editor"],
-                "restricted": None,
+                "restricted": ["reader", "editor"],
             },
         ),
     ],

src/backend/impress/settings.py

@@ -410,6 +410,11 @@ class Base(Configuration):
     FRONTEND_THEME = values.Value(
         None, environ_name="FRONTEND_THEME", environ_prefix=None
     )
+    FRONTEND_HOMEPAGE_FEATURE_ENABLED = values.BooleanValue(
+        default=False,
+        environ_name="FRONTEND_HOMEPAGE_FEATURE_ENABLED",
+        environ_prefix=None,
+    )
     FRONTEND_URL_JSON_FOOTER = values.Value(
         None, environ_name="FRONTEND_URL_JSON_FOOTER", environ_prefix=None
     )

src/frontend/apps/e2e/__tests__/app-impress/common.ts

@@ -1,5 +1,26 @@
 import { Page, expect } from '@playwright/test';
 
+export const CONFIG = {
+  AI_FEATURE_ENABLED: true,
+  CRISP_WEBSITE_ID: null,
+  COLLABORATION_WS_URL: 'ws://localhost:4444/collaboration/ws/',
+  ENVIRONMENT: 'development',
+  FRONTEND_CSS_URL: null,
+  FRONTEND_HOMEPAGE_FEATURE_ENABLED: true,
+  FRONTEND_FOOTER_FEATURE_ENABLED: true,
+  FRONTEND_THEME: 'default',
+  MEDIA_BASE_URL: 'http://localhost:8083',
+  LANGUAGES: [
+    ['en-us', 'English'],
+    ['fr-fr', 'Français'],
+    ['de-de', 'Deutsch'],
+    ['nl-nl', 'Nederlands'],
+  ],
+  LANGUAGE_CODE: 'en-us',
+  POSTHOG_KEY: {},
+  SENTRY_DSN: null,
+};
+
 export const keyCloakSignIn = async (
   page: Page,
   browserName: string,

src/frontend/apps/e2e/__tests__/app-impress/config.spec.ts

@@ -2,27 +2,7 @@ import path from 'path';
 
 import { expect, test } from '@playwright/test';
 
-import { createDoc } from './common';
-
-const config = {
-  AI_FEATURE_ENABLED: true,
-  CRISP_WEBSITE_ID: null,
-  COLLABORATION_WS_URL: 'ws://localhost:4444/collaboration/ws/',
-  ENVIRONMENT: 'development',
-  FRONTEND_CSS_URL: null,
-  FRONTEND_FOOTER_FEATURE_ENABLED: true,
-  FRONTEND_THEME: 'default',
-  MEDIA_BASE_URL: 'http://localhost:8083',
-  LANGUAGES: [
-    ['en-us', 'English'],
-    ['fr-fr', 'Français'],
-    ['de-de', 'Deutsch'],
-    ['nl-nl', 'Nederlands'],
-  ],
-  LANGUAGE_CODE: 'en-us',
-  POSTHOG_KEY: {},
-  SENTRY_DSN: null,
-};
+import { CONFIG, createDoc } from './common';
 
 test.describe('Config', () => {
   test('it checks the config api is called', async ({ page }) => {
@@ -36,7 +16,7 @@ test.describe('Config', () => {
     const response = await responsePromise;
     expect(response.ok()).toBeTruthy();
 
-    expect(await response.json()).toStrictEqual(config);
+    expect(await response.json()).toStrictEqual(CONFIG);
   });
 
   test('it checks that sentry is trying to init from config endpoint', async ({
@@ -47,7 +27,7 @@ test.describe('Config', () => {
       if (request.method().includes('GET')) {
         await route.fulfill({
           json: {
-            ...config,
+            ...CONFIG,
             SENTRY_DSN: 'https://sentry.io/123',
           },
         });
@@ -120,7 +100,7 @@ test.describe('Config', () => {
       if (request.method().includes('GET')) {
         await route.fulfill({
           json: {
-            ...config,
+            ...CONFIG,
             AI_FEATURE_ENABLED: false,
           },
         });
@@ -151,7 +131,7 @@ test.describe('Config', () => {
       if (request.method().includes('GET')) {
         await route.fulfill({
           json: {
-            ...config,
+            ...CONFIG,
             CRISP_WEBSITE_ID: '1234',
           },
         });
@@ -173,7 +153,7 @@ test.describe('Config', () => {
       if (request.method().includes('GET')) {
         await route.fulfill({
           json: {
-            ...config,
+            ...CONFIG,
             FRONTEND_CSS_URL: 'http://localhost:123465/css/style.css',
           },
         });

src/frontend/apps/e2e/__tests__/app-impress/home.spec.ts

@@ -1,5 +1,7 @@
 import { expect, test } from '@playwright/test';
 
+import { CONFIG } from './common';
+
 test.beforeEach(async ({ page }) => {
   await page.goto('/docs/');
 });
@@ -50,4 +52,27 @@ test.describe('Home page', () => {
 
     await expect(footer).toBeVisible();
   });
+
+  test('it checks the homepage feature flag', async ({ page }) => {
+    await page.route('**/api/v1.0/config/', async (route) => {
+      const request = route.request();
+      if (request.method().includes('GET')) {
+        await route.fulfill({
+          json: {
+            ...CONFIG,
+            FRONTEND_HOMEPAGE_FEATURE_ENABLED: false,
+          },
+        });
+      } else {
+        await route.continue();
+      }
+    });
+
+    await page.goto('/');
+
+    // Keyclock login page
+    await expect(
+      page.locator('.login-pf-page-header').getByText('impress'),
+    ).toBeVisible();
+  });
 });

src/frontend/apps/impress/src/core/config/api/useConfig.tsx

@@ -5,17 +5,18 @@ import { Theme } from '@/cunningham/';
 import { PostHogConf } from '@/services';
 
 interface ConfigResponse {
-  LANGUAGES: [string, string][];
-  LANGUAGE_CODE: string;
-  ENVIRONMENT: string;
+  AI_FEATURE_ENABLED?: boolean;
   COLLABORATION_WS_URL?: string;
   CRISP_WEBSITE_ID?: string;
-  FRONTEND_THEME?: Theme;
+  ENVIRONMENT: string;
   FRONTEND_CSS_URL?: string;
+  FRONTEND_HOMEPAGE_FEATURE_ENABLED?: boolean;
+  FRONTEND_THEME?: Theme;
+  LANGUAGES: [string, string][];
+  LANGUAGE_CODE: string;
   MEDIA_BASE_URL?: string;
   POSTHOG_KEY?: PostHogConf;
   SENTRY_DSN?: string;
-  AI_FEATURE_ENABLED?: boolean;
 }
 
 export const getConfig = async (): Promise<ConfigResponse> => {

src/frontend/apps/impress/src/features/auth/components/Auth.tsx

@@ -3,14 +3,16 @@ import { useRouter } from 'next/router';
 import { PropsWithChildren } from 'react';
 
 import { Box } from '@/components';
+import { useConfig } from '@/core';
 
 import { useAuth } from '../hooks';
-import { getAuthUrl } from '../utils';
+import { getAuthUrl, gotoLogin } from '../utils';
 
 export const Auth = ({ children }: PropsWithChildren) => {
   const { isLoading, pathAllowed, isFetchedAfterMount, authenticated } =
     useAuth();
   const { replace, pathname } = useRouter();
+  const { data: config } = useConfig();
 
   if (isLoading && !isFetchedAfterMount) {
     return (
@@ -40,7 +42,11 @@ export const Auth = ({ children }: PropsWithChildren) => {
    * If the user is not authenticated and the path is not allowed, we redirect to the login page.
    */
   if (!authenticated && !pathAllowed) {
-    void replace('/login');
+    if (config?.FRONTEND_HOMEPAGE_FEATURE_ENABLED) {
+      void replace('/home');
+    } else {
+      gotoLogin();
+    }
     return (
       <Box $height="100vh" $width="100vw" $align="center" $justify="center">
         <Loader />
@@ -49,9 +55,9 @@ export const Auth = ({ children }: PropsWithChildren) => {
   }
 
   /**
-   * If the user is authenticated and the path is the login page, we redirect to the home page.
+   * If the user is authenticated and the path is the home page, we redirect to the index.
    */
-  if (pathname === '/login' && authenticated) {
+  if (pathname === '/home' && authenticated) {
     void replace('/');
     return (
       <Box $height="100vh" $width="100vw" $align="center" $justify="center">

src/frontend/apps/impress/src/pages/home/index.tsx

@@ -0,0 +1,8 @@
+import { HomeContent } from '@/features/home';
+import { NextPageWithLayout } from '@/types/next';
+
+const Page: NextPageWithLayout = () => {
+  return <HomeContent />;
+};
+
+export default Page;

src/helm/env.d/dev/values.impress.yaml.gotmpl

@@ -50,6 +50,7 @@ backend:
     DB_USER: dinum
     DB_PASSWORD: pass
     DB_PORT: 5432
+    FRONTEND_HOMEPAGE_FEATURE_ENABLED: true
     FRONTEND_FOOTER_FEATURE_ENABLED: true
     FRONTEND_URL_JSON_FOOTER: https://impress.127.0.0.1.nip.io/contents/footer-demo.json
     POSTGRES_DB: impress