🔖(minor) release 1.4.0

Added:
- ✨(backend) Add link public/authenticated/restricted
access with read/editor roles
- ✨(frontend) add copy link button
- 🛂(frontend) access public docs without being logged

Changed:
- ♻️(backend) Allow null titles on documents
for easier creation
- 🛂(backend) stop to list public doc to everyone
- 🚚(frontend) change visibility in share modal
- ⚡️(frontend) Improve summary

Fixed:
- 🐛(backend) Fix forcing ID when creating a
document via API endpoint
- 🐛 Rebuild frontend dev container from makefile

.github/workflows/impress-frontend.yml

@@ -149,6 +149,10 @@ jobs:
         run: |
           make run
 
+      - name: Start Nginx for the frontend
+        run: |
+          docker compose up --force-recreate -d nginx-front
+
       - name: Apply DRF migrations
         run: |
           make migrate
@@ -223,6 +227,10 @@ jobs:
         run: |
           make run
 
+      - name: Start Nginx for the frontend
+        run: |
+          docker compose up --force-recreate -d nginx-front
+
       - name: Apply DRF migrations
         run: |
           make migrate

CHANGELOG.md

@@ -9,6 +9,28 @@ and this project adheres to
 
 ## [Unreleased]
 
+
+## [1.4.0] - 2024-09-17
+
+## Added
+
+- ✨Add link public/authenticated/restricted access with read/editor roles #234
+- ✨(frontend) add copy link button #235
+- 🛂(frontend) access public docs without being logged #235
+
+## Changed
+
+- ♻️(backend) Allow null titles on documents for easier creation #234
+- 🛂(backend) stop to list public doc to everyone #234
+- 🚚(frontend) change visibility in share modal #235
+- ⚡️(frontend) Improve summary #244
+
+## Fixed
+
+- 🐛(backend) Fix forcing ID when creating a document via API endpoint #234
+- 🐛 Rebuild frontend dev container from makefile #248
+
+
 ## [1.3.0] - 2024-09-05
 
 ## Added
@@ -131,10 +153,11 @@ and this project adheres to
 - 🚀 Impress, project to manage your documents easily and collaboratively.
 
 
-[unreleased]: https://github.com/numerique-gouv/impress/compare/v1.3.0...main
+[unreleased]: https://github.com/numerique-gouv/impress/compare/v1.4.0...main
+[1.4.0]: https://github.com/numerique-gouv/impress/releases/v1.4.0
 [1.3.0]: https://github.com/numerique-gouv/impress/releases/v1.3.0
 [1.2.1]: https://github.com/numerique-gouv/impress/releases/v1.2.1
 [1.2.0]: https://github.com/numerique-gouv/impress/releases/v1.2.0
 [1.1.0]: https://github.com/numerique-gouv/impress/releases/v1.1.0
 [1.0.0]: https://github.com/numerique-gouv/impress/releases/v1.0.0
-[0.1.0]: https://github.com/numerique-gouv/impress/releases/v0.1.0
+[0.1.0]: https://github.com/numerique-gouv/impress/releases/v0.1.0

Makefile

@@ -92,6 +92,7 @@ bootstrap: \
 # -- Docker/compose
 build: ## build the app-dev container
 	@$(COMPOSE) build app-dev --no-cache
+	@$(COMPOSE) build frontend-dev --no-cache
 .PHONY: build
 
 down: ## stop and remove containers, networks, images, and volumes

docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   postgresql:
     image: postgres:16
@@ -121,6 +119,14 @@ services:
     depends_on:
       - keycloak
 
+  nginx-front:
+    image: nginx:1.25
+    ports:
+      - "3000:3000"
+    volumes:
+      - ./src/frontend/apps/impress/conf/default.conf:/etc/nginx/conf.d/default.conf
+      - ./src/frontend/apps/impress/out:/usr/share/nginx/html
+
   dockerize:
     image: jwilder/dockerize
 

src/backend/core/admin.py

@@ -92,6 +92,14 @@ class DocumentAdmin(admin.ModelAdmin):
     """Document admin interface declaration."""
 
     inlines = (DocumentAccessInline,)
+    list_display = (
+        "id",
+        "title",
+        "link_reach",
+        "link_role",
+        "created_at",
+        "updated_at",
+    )
 
 
 @admin.register(models.Invitation)

src/backend/core/api/permissions.py

@@ -62,6 +62,9 @@ class IsOwnedOrPublic(IsAuthenticated):
 class AccessPermission(permissions.BasePermission):
     """Permission class for access objects."""
 
+    def has_permission(self, request, view):
+        return request.user.is_authenticated or view.action != "create"
+
     def has_object_permission(self, request, view, obj):
         """Check permission for a given object."""
         abilities = obj.get_abilities(request.user)

src/backend/core/api/serializers.py

@@ -66,9 +66,8 @@ class BaseAccessSerializer(serializers.ModelSerializer):
                     "You must set a resource ID in kwargs to create a new access."
                 ) from exc
 
-            teams = user.get_teams()
             if not self.Meta.model.objects.filter(  # pylint: disable=no-member
-                Q(user=user) | Q(team__in=teams),
+                Q(user=user) | Q(team__in=user.teams),
                 role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
             ).exists():
                 raise exceptions.PermissionDenied(
@@ -78,7 +77,7 @@ class BaseAccessSerializer(serializers.ModelSerializer):
             if (
                 role == models.RoleChoices.OWNER
                 and not self.Meta.model.objects.filter(  # pylint: disable=no-member
-                    Q(user=user) | Q(team__in=teams),
+                    Q(user=user) | Q(team__in=user.teams),
                     role=models.RoleChoices.OWNER,
                     **{self.Meta.resource_field_name: resource_id},  # pylint: disable=no-member
                 ).exists()
@@ -149,11 +148,57 @@ class DocumentSerializer(BaseResourceSerializer):
             "title",
             "accesses",
             "abilities",
-            "is_public",
+            "link_role",
+            "link_reach",
             "created_at",
             "updated_at",
         ]
-        read_only_fields = ["id", "accesses", "abilities", "created_at", "updated_at"]
+        read_only_fields = [
+            "id",
+            "accesses",
+            "abilities",
+            "link_role",
+            "link_reach",
+            "created_at",
+            "updated_at",
+        ]
+
+    def get_fields(self):
+        """Dynamically make `id` read-only on PUT requests but writable on POST requests."""
+        fields = super().get_fields()
+
+        request = self.context.get("request")
+        if request and request.method == "POST":
+            fields["id"].read_only = False
+
+        return fields
+
+    def validate_id(self, value):
+        """Ensure the provided ID does not already exist when creating a new document."""
+        request = self.context.get("request")
+
+        # Only check this on POST (creation)
+        if request and request.method == "POST":
+            if models.Document.objects.filter(id=value).exists():
+                raise serializers.ValidationError(
+                    "A document with this ID already exists. You cannot override it."
+                )
+
+        return value
+
+
+class LinkDocumentSerializer(BaseResourceSerializer):
+    """
+    Serialize link configuration for documents.
+    We expose it separately from document in order to simplify and secure access control.
+    """
+
+    class Meta:
+        model = models.Document
+        fields = [
+            "link_role",
+            "link_reach",
+        ]
 
 
 # Suppress the warning about not implementing `create` and `update` methods
@@ -272,9 +317,8 @@ class InvitationSerializer(serializers.ModelSerializer):
                 "Anonymous users are not allowed to create invitations."
             )
 
-        teams = user.get_teams()
         if not models.DocumentAccess.objects.filter(
-            Q(user=user) | Q(team__in=teams),
+            Q(user=user) | Q(team__in=user.teams),
             document=document_id,
             role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
         ).exists():
@@ -285,7 +329,7 @@ class InvitationSerializer(serializers.ModelSerializer):
         if (
             role == models.RoleChoices.OWNER
             and not models.DocumentAccess.objects.filter(
-                Q(user=user) | Q(team__in=teams),
+                Q(user=user) | Q(team__in=user.teams),
                 document=document_id,
                 role=models.RoleChoices.OWNER,
             ).exists()

src/backend/core/api/viewsets.py

@@ -7,6 +7,7 @@ from urllib.parse import urlparse
 
 from django.conf import settings
 from django.contrib.postgres.aggregates import ArrayAgg
+from django.core.exceptions import ValidationError
 from django.core.files.storage import default_storage
 from django.db.models import (
     OuterRef,
@@ -185,28 +186,21 @@ class ResourceViewsetMixin:
     def get_queryset(self):
         """Custom queryset to get user related resources."""
         queryset = super().get_queryset()
-        if not self.request.user.is_authenticated:
-            return queryset.filter(is_public=True)
-
         user = self.request.user
-        teams = user.get_teams()
+
+        if not user.is_authenticated:
+            return queryset
 
         user_roles_query = (
             self.access_model_class.objects.filter(
-                Q(user=user) | Q(team__in=teams),
+                Q(user=user) | Q(team__in=user.teams),
                 **{self.resource_field_name: OuterRef("pk")},
             )
             .values(self.resource_field_name)
             .annotate(roles_array=ArrayAgg("role"))
             .values("roles_array")
         )
-        return (
-            queryset.filter(
-                Q(accesses__user=user) | Q(accesses__team__in=teams) | Q(is_public=True)
-            )
-            .annotate(user_roles=Subquery(user_roles_query))
-            .distinct()
-        )
+        return queryset.annotate(user_roles=Subquery(user_roles_query)).distinct()
 
     def perform_create(self, serializer):
         """Set the current user as owner of the newly created object."""
@@ -245,8 +239,7 @@ class ResourceAccessViewsetMixin:
 
         if self.action == "list":
             user = self.request.user
-            teams = user.get_teams()
-
+            teams = user.teams
             user_roles_query = (
                 queryset.filter(
                     Q(user=user) | Q(team__in=teams),
@@ -314,15 +307,12 @@ class DocumentViewSet(
     ResourceViewsetMixin,
     mixins.CreateModelMixin,
     mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
     mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
 ):
     """Document ViewSet"""
 
     permission_classes = [
-        permissions.IsAuthenticatedOrSafe,
         permissions.AccessPermission,
     ]
     serializer_class = serializers.DocumentSerializer
@@ -331,18 +321,52 @@ class DocumentViewSet(
     queryset = models.Document.objects.all()
     ordering = ["-updated_at"]
 
-    def perform_create(self, serializer):
-        """
-        Override perform_create to use the provided ID in the payload if it exists
-        """
-        document_id = self.request.data.get("id")
-        document = serializer.save(id=document_id) if document_id else serializer.save()
+    def list(self, request, *args, **kwargs):
+        """Restrict resources returned by the list endpoint"""
+        queryset = self.filter_queryset(self.get_queryset())
+        user = self.request.user
+        if user.is_authenticated:
+            queryset = queryset.filter(
+                Q(accesses__user=user)
+                | Q(accesses__team__in=user.teams)
+                | (
+                    Q(link_traces__user=user)
+                    & ~Q(link_reach=models.LinkReachChoices.RESTRICTED)
+                )
+            )
+        else:
+            queryset = queryset.none()
 
-        self.access_model_class.objects.create(
-            user=self.request.user,
-            role=models.RoleChoices.OWNER,
-            **{self.resource_field_name: document},
-        )
+        page = self.paginate_queryset(queryset)
+        if page is not None:
+            serializer = self.get_serializer(page, many=True)
+            return self.get_paginated_response(serializer.data)
+
+        serializer = self.get_serializer(queryset, many=True)
+        return drf_response.Response(serializer.data)
+
+    def retrieve(self, request, *args, **kwargs):
+        """
+        Add a trace that the document was accessed by a user. This is used to list documents
+        on a user's list view even though the user has no specific role in the document (link
+        access when the link reach configuration of the document allows it).
+        """
+        instance = self.get_object()
+        serializer = self.get_serializer(instance)
+
+        if self.request.user.is_authenticated:
+            try:
+                # Add a trace that the user visited the document (this is needed to include
+                # the document in the user's list view)
+                models.LinkTrace.objects.create(
+                    document=instance,
+                    user=self.request.user,
+                )
+            except ValidationError:
+                # The trace already exists, so we just pass without doing anything
+                pass
+
+        return drf_response.Response(serializer.data)
 
     @decorators.action(detail=True, methods=["get"], url_path="versions")
     def versions_list(self, request, *args, **kwargs):
@@ -350,11 +374,15 @@ class DocumentViewSet(
         Return the document's versions but only those created after the user got access
         to the document
         """
+        if not request.user.is_authenticated:
+            raise exceptions.PermissionDenied("Authentication required.")
+
         document = self.get_object()
+        user = request.user
         from_datetime = min(
             access.created_at
             for access in document.accesses.filter(
-                Q(user=request.user) | Q(team__in=request.user.get_teams()),
+                Q(user=user) | Q(team__in=user.teams),
             )
         )
 
@@ -386,10 +414,11 @@ class DocumentViewSet(
 
         # Don't let users access versions that were created before they were given access
         # to the document
+        user = request.user
         from_datetime = min(
             access.created_at
             for access in document.accesses.filter(
-                Q(user=request.user) | Q(team__in=request.user.get_teams()),
+                Q(user=user) | Q(team__in=user.teams),
             )
         )
         if response["LastModified"] < from_datetime:
@@ -409,6 +438,24 @@ class DocumentViewSet(
             }
         )
 
+    @decorators.action(detail=True, methods=["put"], url_path="link-configuration")
+    def link_configuration(self, request, *args, **kwargs):
+        """Update link configuration with specific rights (cf get_abilities)."""
+        # Check permissions first
+        document = self.get_object()
+
+        # Deserialize and validate the data
+        serializer = serializers.LinkDocumentSerializer(
+            document, data=request.data, partial=True
+        )
+        if not serializer.is_valid():
+            return drf_response.Response(
+                serializer.errors, status=status.HTTP_400_BAD_REQUEST
+            )
+
+        serializer.save()
+        return drf_response.Response(serializer.data, status=status.HTTP_200_OK)
+
     @decorators.action(detail=True, methods=["post"], url_path="attachment-upload")
     def attachment_upload(self, request, *args, **kwargs):
         """Upload a file related to a given document"""
@@ -529,7 +576,6 @@ class TemplateViewSet(
     ResourceViewsetMixin,
     mixins.CreateModelMixin,
     mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
     mixins.RetrieveModelMixin,
     mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
@@ -545,6 +591,27 @@ class TemplateViewSet(
     resource_field_name = "template"
     queryset = models.Template.objects.all()
 
+    def list(self, request, *args, **kwargs):
+        """Restrict templates returned by the list endpoint"""
+        queryset = self.filter_queryset(self.get_queryset())
+        user = self.request.user
+        if user.is_authenticated:
+            queryset = queryset.filter(
+                Q(accesses__user=user)
+                | Q(accesses__team__in=user.teams)
+                | Q(is_public=True)
+            )
+        else:
+            queryset = queryset.filter(is_public=True)
+
+        page = self.paginate_queryset(queryset)
+        if page is not None:
+            serializer = self.get_serializer(page, many=True)
+            return self.get_paginated_response(serializer.data)
+
+        serializer = self.get_serializer(queryset, many=True)
+        return drf_response.Response(serializer.data)
+
     @decorators.action(
         detail=True,
         methods=["post"],
@@ -671,7 +738,7 @@ class InvitationViewset(
 
         if self.action == "list":
             user = self.request.user
-            teams = user.get_teams()
+            teams = user.teams
 
             # Determine which role the logged-in user has in the document
             user_roles_query = (

src/backend/core/factories.py

@@ -35,8 +35,13 @@ class DocumentFactory(factory.django.DjangoModelFactory):
         skip_postgeneration_save = True
 
     title = factory.Sequence(lambda n: f"document{n}")
-    is_public = factory.Faker("boolean")
     content = factory.Sequence(lambda n: f"content{n}")
+    link_reach = factory.fuzzy.FuzzyChoice(
+        [a[0] for a in models.LinkReachChoices.choices]
+    )
+    link_role = factory.fuzzy.FuzzyChoice(
+        [r[0] for r in models.LinkRoleChoices.choices]
+    )
 
     @factory.post_generation
     def users(self, create, extracted, **kwargs):
@@ -48,6 +53,13 @@ class DocumentFactory(factory.django.DjangoModelFactory):
                 else:
                     UserDocumentAccessFactory(document=self, user=item[0], role=item[1])
 
+    @factory.post_generation
+    def link_traces(self, create, extracted, **kwargs):
+        """Add link traces to document from a given list of users."""
+        if create and extracted:
+            for item in extracted:
+                models.LinkTrace.objects.create(document=self, user=item)
+
 
 class UserDocumentAccessFactory(factory.django.DjangoModelFactory):
     """Create fake document user accesses for testing."""

src/backend/core/migrations/0003_document_link_reach_document_link_role_and_more.py

@@ -0,0 +1,52 @@
+# Generated by Django 5.1 on 2024-09-08 16:55
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0002_create_pg_trgm_extension'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='document',
+            name='link_reach',
+            field=models.CharField(choices=[('restricted', 'Restricted'), ('authenticated', 'Authenticated'), ('public', 'Public')], default='authenticated', max_length=20),
+        ),
+        migrations.AddField(
+            model_name='document',
+            name='link_role',
+            field=models.CharField(choices=[('reader', 'Reader'), ('editor', 'Editor')], default='reader', max_length=20),
+        ),
+        migrations.AlterField(
+            model_name='document',
+            name='is_public',
+            field=models.BooleanField(null=True),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='language',
+            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+        ),
+        migrations.CreateModel(
+            name='LinkTrace',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
+                ('document', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='link_traces', to='core.document')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='link_traces', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'verbose_name': 'Document/user link trace',
+                'verbose_name_plural': 'Document/user link traces',
+                'db_table': 'impress_link_trace',
+                'constraints': [models.UniqueConstraint(fields=('user', 'document'), name='unique_link_trace_document_user', violation_error_message='A link trace already exists for this document/user.')],
+            },
+        ),
+    ]

src/backend/core/migrations/0004_migrate_is_public_to_link_reach.py

@@ -0,0 +1,35 @@
+# Generated by Django 5.1 on 2024-09-08 17:04
+from django.db import migrations
+
+def migrate_is_public_to_link_reach(apps, schema_editor):
+    """
+    Forward migration: Migrate 'is_public' to 'link_reach'.
+    If is_public == True, set link_reach to 'public'
+    """
+    Document = apps.get_model('core', 'Document')
+    Document.objects.filter(is_public=True).update(link_reach='public')
+
+
+def reverse_migrate_link_reach_to_is_public(apps, schema_editor):
+    """
+    Reverse migration: Migrate 'link_reach' back to 'is_public'.
+    - If link_reach == 'public', set is_public to True
+    - Else set is_public to False
+    """
+    Document = apps.get_model('core', 'Document')
+    Document.objects.filter(link_reach='public').update(is_public=True)
+    Document.objects.filter(link_reach__in=['restricted', "authenticated"]).update(is_public=False)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0003_document_link_reach_document_link_role_and_more'),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            migrate_is_public_to_link_reach, 
+            reverse_migrate_link_reach_to_is_public
+        ),
+    ]

src/backend/core/migrations/0005_remove_document_is_public_alter_document_link_reach_and_more.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.1 on 2024-09-09 17:49
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0004_migrate_is_public_to_link_reach'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='document',
+            name='title',
+            field=models.CharField(blank=True, max_length=255, null=True, verbose_name='title'),
+        ),
+    ]

src/backend/core/models.py

@@ -21,7 +21,7 @@ from django.http import FileResponse
 from django.template.base import Template as DjangoTemplate
 from django.template.context import Context
 from django.utils import html, timezone
-from django.utils.functional import lazy
+from django.utils.functional import cached_property, lazy
 from django.utils.translation import gettext_lazy as _
 
 import frontmatter
@@ -42,18 +42,24 @@ def get_resource_roles(resource, user):
     try:
         roles = resource.user_roles or []
     except AttributeError:
-        teams = user.get_teams()
         try:
             roles = resource.accesses.filter(
-                models.Q(user=user) | models.Q(team__in=teams),
+                models.Q(user=user) | models.Q(team__in=user.teams),
             ).values_list("role", flat=True)
         except (models.ObjectDoesNotExist, IndexError):
             roles = []
     return roles
 
 
+class LinkRoleChoices(models.TextChoices):
+    """Defines the possible roles a link can offer on a document."""
+
+    READER = "reader", _("Reader")  # Can read
+    EDITOR = "editor", _("Editor")  # Can read and edit
+
+
 class RoleChoices(models.TextChoices):
-    """Defines the possible roles a user can have in a template."""
+    """Defines the possible roles a user can have in a resource."""
 
     READER = "reader", _("Reader")  # Can read
     EDITOR = "editor", _("Editor")  # Can read and edit
@@ -61,6 +67,20 @@ class RoleChoices(models.TextChoices):
     OWNER = "owner", _("Owner")
 
 
+class LinkReachChoices(models.TextChoices):
+    """Defines types of access for links"""
+
+    RESTRICTED = (
+        "restricted",
+        _("Restricted"),
+    )  # Only users with a specific access can read/edit the document
+    AUTHENTICATED = (
+        "authenticated",
+        _("Authenticated"),
+    )  # Any authenticated user can access the document
+    PUBLIC = "public", _("Public")  # Even anonymous users can access the document
+
+
 class BaseModel(models.Model):
     """
     Serves as an abstract base model for other models, ensuring that records are validated
@@ -215,7 +235,8 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
             raise ValueError("User has no email address.")
         mail.send_mail(subject, message, from_email, [self.email], **kwargs)
 
-    def get_teams(self):
+    @cached_property
+    def teams(self):
         """
         Get list of teams in which the user is, as a list of strings.
         Must be cached if retrieved remotely.
@@ -247,7 +268,7 @@ class BaseAccess(BaseModel):
         """
         roles = []
         if user.is_authenticated:
-            teams = user.get_teams()
+            teams = user.teams
             try:
                 roles = self.user_roles or []
             except AttributeError:
@@ -299,11 +320,14 @@ class BaseAccess(BaseModel):
 class Document(BaseModel):
     """Pad document carrying the content."""
 
-    title = models.CharField(_("title"), max_length=255)
-    is_public = models.BooleanField(
-        _("public"),
-        default=False,
-        help_text=_("Whether this document is public for anyone to use."),
+    title = models.CharField(_("title"), max_length=255, null=True, blank=True)
+    link_reach = models.CharField(
+        max_length=20,
+        choices=LinkReachChoices.choices,
+        default=LinkReachChoices.AUTHENTICATED,
+    )
+    link_role = models.CharField(
+        max_length=20, choices=LinkRoleChoices.choices, default=LinkRoleChoices.READER
     )
 
     _content = None
@@ -315,7 +339,7 @@ class Document(BaseModel):
         verbose_name_plural = _("Documents")
 
     def __str__(self):
-        return self.title
+        return str(self.title) if self.title else str(_("Untitled Document"))
 
     def save(self, *args, **kwargs):
         """Write content to object storage only if _content has changed."""
@@ -466,17 +490,29 @@ class Document(BaseModel):
         """
         Compute and return abilities for a given user on the document.
         """
-        roles = get_resource_roles(self, user)
-        is_owner_or_admin = bool(
-            set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
-        )
-        is_editor = bool(RoleChoices.EDITOR in roles)
-        can_get = self.is_public or bool(roles)
+        roles = set(get_resource_roles(self, user))
+
+        # Compute version roles before adding link roles because we don't
+        # want anonymous users to access versions (we wouldn't know from
+        # which date to allow them anyway)
         can_get_versions = bool(roles)
 
+        # Add role provided by the document link
+        if self.link_reach == LinkReachChoices.PUBLIC or (
+            self.link_reach == LinkReachChoices.AUTHENTICATED and user.is_authenticated
+        ):
+            roles.add(self.link_role)
+
+        is_owner_or_admin = bool(
+            roles.intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
+        )
+        is_editor = bool(RoleChoices.EDITOR in roles)
+        can_get = bool(roles)
+
         return {
-            "destroy": RoleChoices.OWNER in roles,
             "attachment_upload": is_owner_or_admin or is_editor,
+            "destroy": RoleChoices.OWNER in roles,
+            "link_configuration": is_owner_or_admin,
             "manage_accesses": is_owner_or_admin,
             "partial_update": is_owner_or_admin or is_editor,
             "retrieve": can_get,
@@ -487,6 +523,38 @@ class Document(BaseModel):
         }
 
 
+class LinkTrace(BaseModel):
+    """
+    Relation model to trace accesses to a document via a link by a logged-in user.
+    This is necessary to show the document in the user's list of documents even
+    though the user does not have a role on the document.
+    """
+
+    document = models.ForeignKey(
+        Document,
+        on_delete=models.CASCADE,
+        related_name="link_traces",
+    )
+    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name="link_traces")
+
+    class Meta:
+        db_table = "impress_link_trace"
+        verbose_name = _("Document/user link trace")
+        verbose_name_plural = _("Document/user link traces")
+        constraints = [
+            models.UniqueConstraint(
+                fields=["user", "document"],
+                name="unique_link_trace_document_user",
+                violation_error_message=_(
+                    "A link trace already exists for this document/user."
+                ),
+            ),
+        ]
+
+    def __str__(self):
+        return f"{self.user!s} trace on document {self.document!s}"
+
+
 class DocumentAccess(BaseAccess):
     """Relation model to give access to a document for a user or a team with a role."""
 
@@ -778,7 +846,7 @@ class Invitation(BaseModel):
         roles = []
 
         if user.is_authenticated:
-            teams = user.get_teams()
+            teams = user.teams
             try:
                 roles = self.user_roles or []
             except AttributeError:

src/backend/core/tests/conftest.py

@@ -10,7 +10,9 @@ VIA = [USER, TEAM]
 
 
 @pytest.fixture
-def mock_user_get_teams():
-    """Mock for the "get_teams" method on the User model."""
-    with mock.patch("core.models.User.get_teams") as mock_get_teams:
-        yield mock_get_teams
+def mock_user_teams():
+    """Mock for the "teams" property on the User model."""
+    with mock.patch(
+        "core.models.User.teams", new_callable=mock.PropertyMock
+    ) as mock_teams:
+        yield mock_teams

src/backend/core/tests/documents/test_api_document_accesses.py

@@ -57,7 +57,7 @@ def test_api_document_accesses_list_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_list_authenticated_related(via, mock_user_get_teams):
+def test_api_document_accesses_list_authenticated_related(via, mock_user_teams):
     """
     Authenticated users should be able to list document accesses for a document
     to which they are directly related, whatever their role in the document.
@@ -76,7 +76,7 @@ def test_api_document_accesses_list_authenticated_related(via, mock_user_get_tea
             role=random.choice(models.RoleChoices.choices)[0],
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         user_access = models.DocumentAccess.objects.create(
             document=document,
             team="lasuite",
@@ -181,7 +181,7 @@ def test_api_document_accesses_retrieve_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_get_teams):
+def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_teams):
     """
     A user who is related to a document should be allowed to retrieve the
     associated document user accesses.
@@ -195,7 +195,7 @@ def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_get
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
     access = factories.UserDocumentAccessFactory(document=document)
@@ -276,7 +276,7 @@ def test_api_document_accesses_update_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_accesses_update_authenticated_reader_or_editor(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Readers or editors of a document should not be allowed to update its accesses."""
     user = factories.UserFactory()
@@ -288,7 +288,7 @@ def test_api_document_accesses_update_authenticated_reader_or_editor(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -316,9 +316,7 @@ def test_api_document_accesses_update_authenticated_reader_or_editor(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_administrator_except_owner(
-    via, mock_user_get_teams
-):
+def test_api_document_accesses_update_administrator_except_owner(via, mock_user_teams):
     """
     A user who is a direct administrator in a document should be allowed to update a user
     access for this document, as long as they don't try to set the role to owner.
@@ -334,7 +332,7 @@ def test_api_document_accesses_update_administrator_except_owner(
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -375,9 +373,7 @@ def test_api_document_accesses_update_administrator_except_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_administrator_from_owner(
-    via, mock_user_get_teams
-):
+def test_api_document_accesses_update_administrator_from_owner(via, mock_user_teams):
     """
     A user who is an administrator in a document, should not be allowed to update
     the user access of an "owner" for this document.
@@ -393,7 +389,7 @@ def test_api_document_accesses_update_administrator_from_owner(
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -424,7 +420,7 @@ def test_api_document_accesses_update_administrator_from_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_administrator_to_owner(via, mock_user_get_teams):
+def test_api_document_accesses_update_administrator_to_owner(via, mock_user_teams):
     """
     A user who is an administrator in a document, should not be allowed to update
     the user access of another user to grant document ownership.
@@ -440,7 +436,7 @@ def test_api_document_accesses_update_administrator_to_owner(via, mock_user_get_
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -478,7 +474,7 @@ def test_api_document_accesses_update_administrator_to_owner(via, mock_user_get_
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_owner(via, mock_user_get_teams):
+def test_api_document_accesses_update_owner(via, mock_user_teams):
     """
     A user who is an owner in a document should be allowed to update
     a user access for this document whatever the role.
@@ -492,7 +488,7 @@ def test_api_document_accesses_update_owner(via, mock_user_get_teams):
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )
@@ -534,7 +530,7 @@ def test_api_document_accesses_update_owner(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_owner_self(via, mock_user_get_teams):
+def test_api_document_accesses_update_owner_self(via, mock_user_teams):
     """
     A user who is owner of a document should be allowed to update
     their own user access provided there are other owners in the document.
@@ -551,7 +547,7 @@ def test_api_document_accesses_update_owner_self(via, mock_user_get_teams):
             document=document, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )
@@ -626,7 +622,7 @@ def test_api_document_accesses_delete_authenticated():
 
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_get_teams):
+def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_teams):
     """
     Authenticated users should not be allowed to delete a document access for a
     document in which they are a simple reader or editor.
@@ -640,7 +636,7 @@ def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_get_
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -660,7 +656,7 @@ def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_get_
 
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_accesses_delete_administrators_except_owners(
-    via, mock_user_get_teams
+    via, mock_user_teams
 ):
     """
     Users who are administrators in a document should be allowed to delete an access
@@ -677,7 +673,7 @@ def test_api_document_accesses_delete_administrators_except_owners(
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -698,7 +694,7 @@ def test_api_document_accesses_delete_administrators_except_owners(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_get_teams):
+def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_teams):
     """
     Users who are administrators in a document should not be allowed to delete an ownership
     access from the document.
@@ -714,7 +710,7 @@ def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_get
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -733,7 +729,7 @@ def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_get
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_owners(via, mock_user_get_teams):
+def test_api_document_accesses_delete_owners(via, mock_user_teams):
     """
     Users should be able to delete the document access of another user
     for a document of which they are owner.
@@ -747,7 +743,7 @@ def test_api_document_accesses_delete_owners(via, mock_user_get_teams):
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )
@@ -766,7 +762,7 @@ def test_api_document_accesses_delete_owners(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_owners_last_owner(via, mock_user_get_teams):
+def test_api_document_accesses_delete_owners_last_owner(via, mock_user_teams):
     """
     It should not be possible to delete the last owner access from a document
     """
@@ -782,7 +778,7 @@ def test_api_document_accesses_delete_owners_last_owner(via, mock_user_get_teams
             document=document, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )

src/backend/core/tests/documents/test_api_document_accesses_create.py

@@ -66,7 +66,7 @@ def test_api_document_accesses_create_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_accesses_create_authenticated_reader_or_editor(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Readers or editors of a document should not be allowed to create document accesses."""
     user = factories.UserFactory()
@@ -78,7 +78,7 @@ def test_api_document_accesses_create_authenticated_reader_or_editor(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -101,9 +101,7 @@ def test_api_document_accesses_create_authenticated_reader_or_editor(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_create_authenticated_administrator(
-    via, mock_user_get_teams
-):
+def test_api_document_accesses_create_authenticated_administrator(via, mock_user_teams):
     """
     Administrators of a document should be able to create document accesses
     except for the "owner" role.
@@ -120,7 +118,7 @@ def test_api_document_accesses_create_authenticated_administrator(
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -178,7 +176,7 @@ def test_api_document_accesses_create_authenticated_administrator(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_create_authenticated_owner(via, mock_user_get_teams):
+def test_api_document_accesses_create_authenticated_owner(via, mock_user_teams):
     """
     Owners of a document should be able to create document accesses whatever the role.
     An email should be sent to the accesses to notify them of the adding.
@@ -192,7 +190,7 @@ def test_api_document_accesses_create_authenticated_owner(via, mock_user_get_tea
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )

src/backend/core/tests/documents/test_api_document_invitations.py

@@ -80,7 +80,7 @@ def test_api_document_invitations__create__authenticated_outsider():
 )
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_invitations__create__privileged_members(
-    via, inviting, invited, is_allowed, mock_user_get_teams
+    via, inviting, invited, is_allowed, mock_user_teams
 ):
     """
     Only owners and administrators should be able to invite new users.
@@ -91,7 +91,7 @@ def test_api_document_invitations__create__privileged_members(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=inviting)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=inviting
         )
@@ -291,7 +291,7 @@ def test_api_document_invitations__list__anonymous_user():
 
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_invitations__list__authenticated(
-    via, mock_user_get_teams, django_assert_num_queries
+    via, mock_user_teams, django_assert_num_queries
 ):
     """
     Authenticated users should be able to list invitations for documents to which they are
@@ -304,7 +304,7 @@ def test_api_document_invitations__list__authenticated(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -432,7 +432,7 @@ def test_api_document_invitations__retrieve__unrelated_user():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_invitations__retrieve__document_member(via, mock_user_get_teams):
+def test_api_document_invitations__retrieve__document_member(via, mock_user_teams):
     """
     Authenticated users related to the document should be able to retrieve invitations
     whatever their role in the document.
@@ -445,7 +445,7 @@ def test_api_document_invitations__retrieve__document_member(via, mock_user_get_
             document=invitation.document, user=user, role=role
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=invitation.document, team="lasuite", role=role
         )
@@ -475,7 +475,7 @@ def test_api_document_invitations__retrieve__document_member(via, mock_user_get_
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_invitations__put_authenticated(via, mock_user_get_teams):
+def test_api_document_invitations__put_authenticated(via, mock_user_teams):
     """
     Authenticated user can put invitations.
     """
@@ -486,7 +486,7 @@ def test_api_document_invitations__put_authenticated(via, mock_user_get_teams):
             document=invitation.document, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=invitation.document, team="lasuite", role="owner"
         )
@@ -503,7 +503,7 @@ def test_api_document_invitations__put_authenticated(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_invitations__patch_authenticated(via, mock_user_get_teams):
+def test_api_document_invitations__patch_authenticated(via, mock_user_teams):
     """
     Authenticated user can patch invitations.
     """
@@ -514,7 +514,7 @@ def test_api_document_invitations__patch_authenticated(via, mock_user_get_teams)
             document=invitation.document, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=invitation.document, team="lasuite", role="owner"
         )
@@ -546,7 +546,7 @@ def test_api_document_invitations__patch_authenticated(via, mock_user_get_teams)
     ["editor", "reader"],
 )
 def test_api_document_invitations__update__forbidden__not_authenticated(
-    method, via, role, mock_user_get_teams
+    method, via, role, mock_user_teams
 ):
     """
     Update of invitations is currently forbidden.
@@ -558,7 +558,7 @@ def test_api_document_invitations__update__forbidden__not_authenticated(
             document=invitation.document, user=user, role=role
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=invitation.document, team="lasuite", role=role
         )
@@ -607,7 +607,7 @@ def test_api_document_invitations__delete__authenticated_outsider():
 @pytest.mark.parametrize("via", VIA)
 @pytest.mark.parametrize("role", ["owner", "administrator"])
 def test_api_document_invitations__delete__privileged_members(
-    role, via, mock_user_get_teams
+    role, via, mock_user_teams
 ):
     """Privileged member should be able to cancel invitation."""
     user = factories.UserFactory()
@@ -615,7 +615,7 @@ def test_api_document_invitations__delete__privileged_members(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -632,16 +632,14 @@ def test_api_document_invitations__delete__privileged_members(
 
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_invitations_delete_readers_or_editors(
-    via, role, mock_user_get_teams
-):
+def test_api_document_invitations_delete_readers_or_editors(via, role, mock_user_teams):
     """Readers or editors should not be able to cancel invitation."""
     user = factories.UserFactory()
     document = factories.DocumentFactory()
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )

src/backend/core/tests/documents/test_api_document_versions.py

@@ -14,37 +14,29 @@ from core.tests.conftest import TEAM, USER, VIA
 pytestmark = pytest.mark.django_db
 
 
-def test_api_document_versions_list_anonymous_public():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+def test_api_document_versions_list_anonymous(role, reach):
     """
-    Anonymous users should not be allowed to list document versions for a public document.
+    Anonymous users should not be allowed to list document versions for a document
+    whatever the reach and role.
     """
-    document = factories.DocumentFactory(is_public=True)
-    factories.UserDocumentAccessFactory.create_batch(2, document=document)
+    document = factories.DocumentFactory(link_role=role, link_reach=reach)
+
+    # Accesses and traces for other users should not interfere
+    factories.UserDocumentAccessFactory(document=document)
+    models.LinkTrace.objects.create(document=document, user=factories.UserFactory())
 
     response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/versions/")
 
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
+    assert response.status_code == 403
+    assert response.json() == {"detail": "Authentication required."}
 
 
-def test_api_document_versions_list_anonymous_private():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_list_authenticated_unrelated(reach):
     """
-    Anonymous users should not be allowed to find document versions for a private document.
-    """
-    document = factories.DocumentFactory(is_public=False)
-    factories.UserDocumentAccessFactory.create_batch(2, document=document)
-
-    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/versions/")
-
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
-def test_api_document_versions_list_authenticated_unrelated_public():
-    """
-    Authenticated users should not be allowed to list document versions for a public document
+    Authenticated users should not be allowed to list document versions for a document
     to which they are not related.
     """
     user = factories.UserFactory()
@@ -52,7 +44,7 @@ def test_api_document_versions_list_authenticated_unrelated_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
     factories.UserDocumentAccessFactory.create_batch(3, document=document)
 
     # The versions of another document to which the user is related should not be listed either
@@ -67,31 +59,8 @@ def test_api_document_versions_list_authenticated_unrelated_public():
     }
 
 
-def test_api_document_versions_list_authenticated_unrelated_private():
-    """
-    Authenticated users should not be allowed to find document versions for a private document
-    to which they are not related.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(is_public=False)
-    factories.UserDocumentAccessFactory.create_batch(3, document=document)
-
-    # The versions of another document to which the user is related should not be listed either
-    factories.UserDocumentAccessFactory(user=user)
-
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/versions/",
-    )
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_list_authenticated_related(via, mock_user_get_teams):
+def test_api_document_versions_list_authenticated_related(via, mock_user_teams):
     """
     Authenticated users should be able to list document versions for a document
     to which they are directly related, whatever their role in the document.
@@ -109,7 +78,7 @@ def test_api_document_versions_list_authenticated_related(via, mock_user_get_tea
             role=random.choice(models.RoleChoices.choices)[0],
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         models.DocumentAccess.objects.create(
             document=document,
             team="lasuite",
@@ -143,11 +112,13 @@ def test_api_document_versions_list_authenticated_related(via, mock_user_get_tea
     assert content["count"] == 1
 
 
-def test_api_document_versions_retrieve_anonymous_public():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_retrieve_anonymous(reach):
     """
-    Anonymous users should not be allowed to retrieve specific versions for a public document.
+    Anonymous users should not be allowed to find specific versions for a document with
+    restricted or authenticated link reach.
     """
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
     version_id = document.get_versions_slice()["versions"][0]["version_id"]
 
     url = f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/"
@@ -159,23 +130,10 @@ def test_api_document_versions_retrieve_anonymous_public():
     }
 
 
-def test_api_document_versions_retrieve_anonymous_private():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_retrieve_authenticated_unrelated(reach):
     """
-    Anonymous users should not be allowed to find specific versions for a private document.
-    """
-    document = factories.DocumentFactory(is_public=False)
-    version_id = document.get_versions_slice()["versions"][0]["version_id"]
-
-    url = f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/"
-    response = APIClient().get(url)
-
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
-def test_api_document_versions_retrieve_authenticated_unrelated_public():
-    """
-    Authenticated users should not be allowed to retrieve specific versions for a public
+    Authenticated users should not be allowed to retrieve specific versions for a
     document to which they are not related.
     """
     user = factories.UserFactory()
@@ -183,7 +141,7 @@ def test_api_document_versions_retrieve_authenticated_unrelated_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
     version_id = document.get_versions_slice()["versions"][0]["version_id"]
 
     response = client.get(
@@ -195,28 +153,8 @@ def test_api_document_versions_retrieve_authenticated_unrelated_public():
     }
 
 
-def test_api_document_versions_retrieve_authenticated_unrelated_private():
-    """
-    Authenticated users should not be allowed to find specific versions for a private document
-    to which they are not related.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(is_public=False)
-    version_id = document.get_versions_slice()["versions"][0]["version_id"]
-
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
-    )
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_retrieve_authenticated_related(via, mock_user_get_teams):
+def test_api_document_versions_retrieve_authenticated_related(via, mock_user_teams):
     """
     A user who is related to a document should be allowed to retrieve the
     associated document user accesses.
@@ -232,10 +170,10 @@ def test_api_document_versions_retrieve_authenticated_related(via, mock_user_get
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
-    # Versions created before the document was shared should not be available to the user
+    # Versions created before the document was shared should not be seen by the user
     response = client.get(
         f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
     )
@@ -267,10 +205,8 @@ def test_api_document_versions_create_anonymous():
         format="json",
     )
 
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
+    assert response.status_code == 405
+    assert response.json() == {"detail": 'Method "POST" not allowed.'}
 
 
 def test_api_document_versions_create_authenticated_unrelated():
@@ -295,7 +231,7 @@ def test_api_document_versions_create_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_create_authenticated_related(via, mock_user_get_teams):
+def test_api_document_versions_create_authenticated_related(via, mock_user_teams):
     """
     Authenticated users related to a document should not be allowed to create document versions
     whatever their role.
@@ -309,7 +245,7 @@ def test_api_document_versions_create_authenticated_related(via, mock_user_get_t
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
     response = client.post(
@@ -331,7 +267,7 @@ def test_api_document_versions_update_anonymous():
         {"foo": "bar"},
         format="json",
     )
-    assert response.status_code == 401
+    assert response.status_code == 405
 
 
 def test_api_document_versions_update_authenticated_unrelated():
@@ -356,7 +292,7 @@ def test_api_document_versions_update_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_update_authenticated_related(via, mock_user_get_teams):
+def test_api_document_versions_update_authenticated_related(via, mock_user_teams):
     """
     Authenticated users with access to a document should not be able to update its versions
     whatever their role.
@@ -372,7 +308,7 @@ def test_api_document_versions_update_authenticated_related(via, mock_user_get_t
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
     response = client.put(
@@ -397,7 +333,8 @@ def test_api_document_versions_delete_anonymous():
     assert response.status_code == 401
 
 
-def test_api_document_versions_delete_authenticated_public():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_delete_authenticated(reach):
     """
     Authenticated users should not be allowed to delete a document version for a
     public document to which they are not related.
@@ -407,7 +344,7 @@ def test_api_document_versions_delete_authenticated_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
     version_id = document.get_versions_slice()["versions"][0]["version_id"]
 
     response = client.delete(
@@ -417,30 +354,9 @@ def test_api_document_versions_delete_authenticated_public():
     assert response.status_code == 403
 
 
-def test_api_document_versions_delete_authenticated_private():
-    """
-    Authenticated users should not be allowed to find a document version to delete it
-    for a private document to which they are not related.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(is_public=False)
-    version_id = document.get_versions_slice()["versions"][0]["version_id"]
-
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
-    )
-
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_get_teams):
+def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_teams):
     """
     Authenticated users should not be allowed to delete a document version for a
     document in which they are a simple reader or editor.
@@ -454,7 +370,7 @@ def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_get_
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -484,7 +400,7 @@ def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_get_
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_delete_administrator_or_owner(via, mock_user_get_teams):
+def test_api_document_versions_delete_administrator_or_owner(via, mock_user_teams):
     """
     Users who are administrator or owner of a document should be allowed to delete a version.
     """
@@ -498,7 +414,7 @@ def test_api_document_versions_delete_administrator_or_owner(via, mock_user_get_
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )

src/backend/core/tests/documents/test_api_documents_attachment_upload.py

@@ -17,9 +17,22 @@ from core.tests.conftest import TEAM, USER, VIA
 pytestmark = pytest.mark.django_db
 
 
-def test_api_documents_attachment_upload_anonymous():
-    """Anonymous users can't upload attachments to a document."""
-    document = factories.DocumentFactory()
+@pytest.mark.parametrize(
+    "reach, role",
+    [
+        ("restricted", "reader"),
+        ("restricted", "editor"),
+        ("authenticated", "reader"),
+        ("authenticated", "editor"),
+        ("public", "reader"),
+    ],
+)
+def test_api_documents_attachment_upload_anonymous_forbidden(reach, role):
+    """
+    Anonymous users should not be able to upload attachments if the link reach
+    and role don't allow it.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
     file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
@@ -31,16 +44,47 @@ def test_api_documents_attachment_upload_anonymous():
     }
 
 
-def test_api_documents_attachment_upload_authenticated_public():
+def test_api_documents_attachment_upload_anonymous_success():
     """
-    Users who are not related to a public document should not be allowed to upload an attachment.
+    Anonymous users should be able to upload attachments to a document
+    if the link reach and role permit it.
+    """
+    document = factories.DocumentFactory(link_reach="public", link_role="editor")
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
+
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+    response = APIClient().post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 201
+
+    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.jpg")
+    match = pattern.search(response.json()["file"])
+    file_id = match.group(1)
+
+    # Validate that file_id is a valid UUID
+    uuid.UUID(file_id)
+
+
+@pytest.mark.parametrize(
+    "reach, role",
+    [
+        ("restricted", "reader"),
+        ("restricted", "editor"),
+        ("authenticated", "reader"),
+        ("public", "reader"),
+    ],
+)
+def test_api_documents_attachment_upload_authenticated_forbidden(reach, role):
+    """
+    Users who are not related to a document can't upload attachments if the
+    link reach and role don't allow it.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
     file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
@@ -52,27 +96,41 @@ def test_api_documents_attachment_upload_authenticated_public():
     }
 
 
-def test_api_documents_attachment_upload_authenticated_private():
+@pytest.mark.parametrize(
+    "reach, role",
+    [
+        ("authenticated", "editor"),
+        ("public", "editor"),
+    ],
+)
+def test_api_documents_attachment_upload_authenticated_success(reach, role):
     """
-    Users who are not related to a private document should not be able to upload an attachment.
+    Autenticated who are not related to a document should be able to upload a file
+    if the link reach and role permit it.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
     file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
     response = client.post(url, {"file": file}, format="multipart")
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 201
+
+    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.jpg")
+    match = pattern.search(response.json()["file"])
+    file_id = match.group(1)
+
+    # Validate that file_id is a valid UUID
+    uuid.UUID(file_id)
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_attachment_upload_reader(via, mock_user_get_teams):
+def test_api_documents_attachment_upload_reader(via, mock_user_teams):
     """
     Users who are simple readers on a document should not be allowed to upload an attachment.
     """
@@ -81,11 +139,11 @@ def test_api_documents_attachment_upload_reader(via, mock_user_get_teams):
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory()
+    document = factories.DocumentFactory(link_role="reader")
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="reader"
         )
@@ -103,7 +161,7 @@ def test_api_documents_attachment_upload_reader(via, mock_user_get_teams):
 
 @pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_attachment_upload_success(via, role, mock_user_get_teams):
+def test_api_documents_attachment_upload_success(via, role, mock_user_teams):
     """
     Editors, administrators and owners of a document should be able to upload an attachment.
     """
@@ -116,7 +174,7 @@ def test_api_documents_attachment_upload_success(via, role, mock_user_get_teams)
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )

src/backend/core/tests/documents/test_api_documents_create.py

@@ -2,7 +2,7 @@
 Tests for Documents API endpoint in impress's core app: create
 """
 
-import uuid
+from uuid import uuid4
 
 import pytest
 from rest_framework.test import APIClient
@@ -26,7 +26,7 @@ def test_api_documents_create_anonymous():
     assert not Document.objects.exists()
 
 
-def test_api_documents_create_authenticated():
+def test_api_documents_create_authenticated_success():
     """
     Authenticated users should be able to create documents and should automatically be declared
     as the owner of the newly created document.
@@ -50,24 +50,64 @@ def test_api_documents_create_authenticated():
     assert document.accesses.filter(role="owner", user=user).exists()
 
 
-def test_api_documents_create_with_id_from_payload():
-    """
-    We should be able to create a document with an ID from the payload.
-    """
+def test_api_documents_create_authenticated_title_null():
+    """It should be possible to create several documents with a null title."""
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    doc_id = uuid.uuid4()
+    factories.DocumentFactory(title=None)
+
+    response = client.post("/api/v1.0/documents/", {}, format="json")
+
+    assert response.status_code == 201
+    assert Document.objects.filter(title__isnull=True).count() == 2
+
+
+def test_api_documents_create_force_id_success():
+    """It should be possible to force the document ID when creating a document."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    forced_id = uuid4()
+
     response = client.post(
         "/api/v1.0/documents/",
-        {"title": "my document", "id": str(doc_id)},
+        {
+            "id": str(forced_id),
+            "title": "my document",
+        },
         format="json",
     )
 
     assert response.status_code == 201
-    document = Document.objects.get()
-    assert document.title == "my document"
-    assert document.id == doc_id
-    assert document.accesses.filter(role="owner", user=user).exists()
+    documents = Document.objects.all()
+    assert len(documents) == 1
+    assert documents[0].id == forced_id
+
+
+def test_api_documents_create_force_id_existing():
+    """
+    It should not be possible to use the ID of an existing document when forcing ID on creation.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+
+    response = client.post(
+        "/api/v1.0/documents/",
+        {
+            "id": str(document.id),
+            "title": "my document",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "id": ["A document with this ID already exists. You cannot override it."]
+    }

src/backend/core/tests/documents/test_api_documents_delete.py

@@ -2,8 +2,6 @@
 Tests for Documents API endpoint in impress's core app: delete
 """
 
-import random
-
 import pytest
 from rest_framework.test import APIClient
 
@@ -25,30 +23,31 @@ def test_api_documents_delete_anonymous():
     assert models.Document.objects.count() == 1
 
 
-def test_api_documents_delete_authenticated_unrelated():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+def test_api_documents_delete_authenticated_unrelated(reach, role):
     """
-    Authenticated users should not be allowed to delete a document to which they are not
-    related.
+    Authenticated users should not be allowed to delete a document to which
+    they are not related.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    is_public = random.choice([True, False])
-    document = factories.DocumentFactory(is_public=is_public)
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
 
     response = client.delete(
         f"/api/v1.0/documents/{document.id!s}/",
     )
 
-    assert response.status_code == 403 if is_public else 404
+    assert response.status_code == 403
     assert models.Document.objects.count() == 1
 
 
 @pytest.mark.parametrize("role", ["reader", "editor", "administrator"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_get_teams):
+def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_teams):
     """
     Authenticated users should not be allowed to delete a document for which they are
     only a reader, editor or administrator.
@@ -62,7 +61,7 @@ def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_get_t
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -79,7 +78,7 @@ def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_get_t
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_delete_authenticated_owner(via, mock_user_get_teams):
+def test_api_documents_delete_authenticated_owner(via, mock_user_teams):
     """
     Authenticated users should be able to delete a document they own.
     """
@@ -92,7 +91,7 @@ def test_api_documents_delete_authenticated_owner(via, mock_user_get_teams):
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )

src/backend/core/tests/documents/test_api_documents_link_configuration.py

@@ -0,0 +1,152 @@
+"""Tests for link configuration of documents on API endpoint"""
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.api import serializers
+from core.tests.conftest import TEAM, USER, VIA
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_link_configuration_update_anonymous(reach, role):
+    """Anonymous users should not be allowed to update a link configuration."""
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    old_document_values = serializers.LinkDocumentSerializer(instance=document).data
+
+    new_document_values = serializers.LinkDocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = APIClient().put(
+        f"/api/v1.0/documents/{document.id!s}/link-configuration/",
+        new_document_values,
+        format="json",
+    )
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+    document.refresh_from_db()
+    document_values = serializers.LinkDocumentSerializer(instance=document).data
+    assert document_values == old_document_values
+
+
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_link_configuration_update_authenticated_unrelated(reach, role):
+    """
+    Authenticated users should not be allowed to update the link configuration for
+    a document to which they are not related.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    old_document_values = serializers.LinkDocumentSerializer(instance=document).data
+
+    new_document_values = serializers.LinkDocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/link-configuration/",
+        new_document_values,
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    document.refresh_from_db()
+    document_values = serializers.LinkDocumentSerializer(instance=document).data
+    assert document_values == old_document_values
+
+
+@pytest.mark.parametrize("role", ["editor", "reader"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_link_configuration_update_authenticated_related_forbidden(
+    via, role, mock_user_teams
+):
+    """
+    Users who are readers or editors of a document should not be allowed to update
+    the link configuration.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role=role
+        )
+
+    old_document_values = serializers.LinkDocumentSerializer(instance=document).data
+
+    new_document_values = serializers.LinkDocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/link-configuration/",
+        new_document_values,
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    document.refresh_from_db()
+    document_values = serializers.LinkDocumentSerializer(instance=document).data
+    assert document_values == old_document_values
+
+
+@pytest.mark.parametrize("role", ["administrator", "owner"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_link_configuration_update_authenticated_related_success(
+    via, role, mock_user_teams
+):
+    """
+    A user who is administrator or owner of a document should be allowed to update
+    the link configuration.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role=role
+        )
+
+    new_document_values = serializers.LinkDocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/link-configuration/",
+        new_document_values,
+        format="json",
+    )
+    assert response.status_code == 200
+
+    document = models.Document.objects.get(pk=document.pk)
+    document_values = serializers.LinkDocumentSerializer(instance=document).data
+    for key, value in document_values.items():
+        assert value == new_document_values[key]

src/backend/core/tests/documents/test_api_documents_list.py

@@ -2,68 +2,71 @@
 Tests for Documents API endpoint in impress's core app: list
 """
 
+import operator
 from unittest import mock
 
 import pytest
 from faker import Faker
 from rest_framework.pagination import PageNumberPagination
-from rest_framework.status import HTTP_200_OK
 from rest_framework.test import APIClient
 
-from core import factories
+from core import factories, models
 
 fake = Faker()
 pytestmark = pytest.mark.django_db
 
 
-def test_api_documents_list_anonymous():
-    """Anonymous users should only be able to list public documents."""
-    factories.DocumentFactory.create_batch(2, is_public=False)
-    documents = factories.DocumentFactory.create_batch(2, is_public=True)
-    expected_ids = {str(document.id) for document in documents}
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_list_anonymous(reach, role):
+    """
+    Anonymous users should not be allowed to list documents whatever the
+    link reach and the role
+    """
+    factories.DocumentFactory(link_reach=reach, link_role=role)
 
     response = APIClient().get("/api/v1.0/documents/")
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
-    assert len(results) == 2
-    results_id = {result["id"] for result in results}
-    assert expected_ids == results_id
+    assert len(results) == 0
 
 
 def test_api_documents_list_authenticated_direct():
     """
     Authenticated users should be able to list documents they are a direct
-    owner/administrator/member of.
+    owner/administrator/member of or documents that have a link reach other
+    than restricted.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    related_documents = [
+    documents = [
         access.document
-        for access in factories.UserDocumentAccessFactory.create_batch(5, user=user)
+        for access in factories.UserDocumentAccessFactory.create_batch(2, user=user)
     ]
-    public_documents = factories.DocumentFactory.create_batch(2, is_public=True)
-    factories.DocumentFactory.create_batch(2, is_public=False)
 
-    expected_ids = {
-        str(document.id) for document in related_documents + public_documents
-    }
+    # Unrelated and untraced documents
+    for reach in models.LinkReachChoices:
+        for role in models.LinkRoleChoices:
+            factories.DocumentFactory(link_reach=reach, link_role=role)
+
+    expected_ids = {str(document.id) for document in documents}
 
     response = client.get(
         "/api/v1.0/documents/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
-    assert len(results) == 7
+    assert len(results) == 2
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
 
 
-def test_api_documents_list_authenticated_via_team(mock_user_get_teams):
+def test_api_documents_list_authenticated_via_team(mock_user_teams):
     """
     Authenticated users should be able to list documents they are a
     owner/administrator/member of via a team.
@@ -73,7 +76,7 @@ def test_api_documents_list_authenticated_via_team(mock_user_get_teams):
     client = APIClient()
     client.force_login(user)
 
-    mock_user_get_teams.return_value = ["team1", "team2", "unknown"]
+    mock_user_teams.return_value = ["team1", "team2", "unknown"]
 
     documents_team1 = [
         access.document
@@ -83,19 +86,71 @@ def test_api_documents_list_authenticated_via_team(mock_user_get_teams):
         access.document
         for access in factories.TeamDocumentAccessFactory.create_batch(3, team="team2")
     ]
-    public_documents = factories.DocumentFactory.create_batch(2, is_public=True)
-    factories.DocumentFactory.create_batch(2, is_public=False)
 
-    expected_ids = {
-        str(document.id)
-        for document in documents_team1 + documents_team2 + public_documents
-    }
+    expected_ids = {str(document.id) for document in documents_team1 + documents_team2}
 
     response = client.get("/api/v1.0/documents/")
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
-    assert len(results) == 7
+    assert len(results) == 5
+    results_id = {result["id"] for result in results}
+    assert expected_ids == results_id
+
+
+def test_api_documents_list_authenticated_link_reach_restricted():
+    """
+    An authenticated user who has link traces to a document that is restricted should not
+    see it on the list view
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_traces=[user], link_reach="restricted")
+
+    # Link traces for other documents or other users should not interfere
+    models.LinkTrace.objects.create(document=document, user=factories.UserFactory())
+    other_document = factories.DocumentFactory(link_reach="public")
+    models.LinkTrace.objects.create(document=other_document, user=user)
+
+    response = client.get(
+        "/api/v1.0/documents/",
+    )
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    # Only the other document is returned but not the restricted document even though the user
+    # visited it earlier (probably b/c it previously had public or authenticated reach...)
+    assert len(results) == 1
+    assert results[0]["id"] == str(other_document.id)
+
+
+def test_api_documents_list_authenticated_link_reach_public_or_authenticated():
+    """
+    An authenticated user who has link traces to a document with public or authenticated
+    link reach should see it on the list view.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    documents = [
+        factories.DocumentFactory(link_traces=[user], link_reach=reach)
+        for reach in models.LinkReachChoices
+        if reach != "restricted"
+    ]
+    expected_ids = {str(document.id) for document in documents}
+
+    response = client.get(
+        "/api/v1.0/documents/",
+    )
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 2
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
 
@@ -120,7 +175,7 @@ def test_api_documents_list_pagination(
         "/api/v1.0/documents/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
 
     assert content["count"] == 3
@@ -136,7 +191,7 @@ def test_api_documents_list_pagination(
         "/api/v1.0/documents/?page=2",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
 
     assert content["count"] == 3
@@ -157,145 +212,63 @@ def test_api_documents_list_authenticated_distinct():
 
     other_user = factories.UserFactory()
 
-    document = factories.DocumentFactory(users=[user, other_user], is_public=True)
+    document = factories.DocumentFactory(users=[user, other_user])
 
     response = client.get(
         "/api/v1.0/documents/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
     assert len(content["results"]) == 1
     assert content["results"][0]["id"] == str(document.id)
 
 
-def test_api_documents_order_updated_at_desc_default():
-    """
-    Test that the endpoint GET documents is sorted in 'updated_at' descending order by default.
-    """
+def test_api_documents_list_ordering_default():
+    """Documents should be ordered by descending "updated_at" by default"""
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
-    # Updated at next year to ensure the order is correct
-    documents_updated = [
-        document.updated_at.isoformat().replace("+00:00", "Z")
-        for document in factories.DocumentFactory.create_batch(
-            5, is_public=True, updated_at=fake.date_time_this_year(before_now=False)
-        )
-    ]
+    factories.DocumentFactory.create_batch(5, users=[user])
 
-    documents_updated.sort(reverse=True)
+    response = client.get("/api/v1.0/documents/")
 
-    response = APIClient().get(
-        "/api/v1.0/documents/",
-    )
     assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 5
 
-    response_data = response.json()
-
-    response_document_updated = [
-        document["updated_at"] for document in response_data["results"]
-    ]
-
-    assert (
-        response_document_updated == documents_updated
-    ), "updated_at values are not sorted from newest to oldest"
+    # Check that results are sorted by descending "updated_at" as expected
+    for i in range(4):
+        assert operator.ge(results[i]["updated_at"], results[i + 1]["updated_at"])
 
 
-@pytest.mark.parametrize(
-    "ordering_field, factory_field",
-    [
-        ("-created_at", "created_at"),
-        ("-updated_at", "updated_at"),
-        ("-title", "title"),
-    ],
-)
-def test_api_documents_ordering_desc(ordering_field, factory_field):
-    """
-    Test that the specified field is sorted in descending order
-    when the 'ordering' query parameter is set.
-    """
+def test_api_documents_list_ordering_by_fields():
+    """It should be possible to order by several fields"""
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
-    if factory_field == "title":
-        documents_field_values = [
-            factories.DocumentFactory(
-                is_public=True, title=fake.sentence(nb_words=4)
-            ).title
-            for _ in range(5)
-        ]
-    else:
-        documents_field_values = [
-            getattr(document, factory_field).isoformat().replace("+00:00", "Z")
-            for document in factories.DocumentFactory.create_batch(5, is_public=True)
-        ]
+    factories.DocumentFactory.create_batch(5, users=[user])
 
-    documents_field_values.sort(reverse=True)
+    for parameter in [
+        "created_at",
+        "-created_at",
+        "updated_at",
+        "-updated_at",
+        "title",
+        "-title",
+    ]:
+        is_descending = parameter.startswith("-")
+        field = parameter.lstrip("-")
+        querystring = f"?ordering={parameter}"
 
-    response = client.get(
-        f"/api/v1.0/documents/?ordering={ordering_field}"
-        if ordering_field != "-created_at"
-        else "/api/v1.0/documents/",
-    )
-    assert response.status_code == 200
+        response = client.get(f"/api/v1.0/documents/{querystring:s}")
+        assert response.status_code == 200
+        results = response.json()["results"]
+        assert len(results) == 5
 
-    response_data = response.json()
-
-    response_documents_field_values = [
-        document[factory_field] for document in response_data["results"]
-    ]
-
-    assert (
-        response_documents_field_values == documents_field_values
-    ), f"{factory_field} values are not sorted as expected"
-
-
-@pytest.mark.parametrize(
-    "field",
-    [
-        ("updated_at"),
-        ("title"),
-        ("created_at"),
-    ],
-)
-def test_api_documents_ordering_asc(field):
-    """
-    Test that the specified field is sorted in ascending order
-    when the 'ordering' query parameter is set.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    if field == "title":
-        documents_field_values = [
-            factories.DocumentFactory(
-                is_public=True, title=fake.sentence(nb_words=4)
-            ).title
-            for _ in range(5)
-        ]
-    else:
-        documents_field_values = [
-            getattr(document, field).isoformat().replace("+00:00", "Z")
-            for document in factories.DocumentFactory.create_batch(5, is_public=True)
-        ]
-
-    documents_field_values.sort()
-
-    response = client.get(
-        f"/api/v1.0/documents/?ordering={field}",
-    )
-    assert response.status_code == 200
-
-    response_data = response.json()
-
-    response_documents_field_values = [
-        document[field] for document in response_data["results"]
-    ]
-
-    assert (
-        response_documents_field_values == documents_field_values
-    ), f"{field} values are not sorted as expected"
+        # Check that results are sorted by the field in querystring as expected
+        compare = operator.ge if is_descending else operator.le
+        for i in range(4):
+            assert compare(results[i][field], results[i + 1][field])

src/backend/core/tests/documents/test_api_documents_retrieve.py

@@ -5,7 +5,7 @@ Tests for Documents API endpoint in impress's core app: retrieve
 import pytest
 from rest_framework.test import APIClient
 
-from core import factories
+from core import factories, models
 from core.api import serializers
 
 pytestmark = pytest.mark.django_db
@@ -13,7 +13,7 @@ pytestmark = pytest.mark.django_db
 
 def test_api_documents_retrieve_anonymous_public():
     """Anonymous users should be allowed to retrieve public documents."""
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach="public")
 
     response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/")
 
@@ -21,36 +21,42 @@ def test_api_documents_retrieve_anonymous_public():
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
+            "attachment_upload": document.link_role == "editor",
             "destroy": False,
-            "attachment_upload": False,
+            "link_configuration": False,
             "manage_accesses": False,
-            "partial_update": False,
+            "partial_update": document.link_role == "editor",
             "retrieve": True,
-            "update": False,
+            "update": document.link_role == "editor",
             "versions_destroy": False,
             "versions_list": False,
             "versions_retrieve": False,
         },
         "accesses": [],
+        "link_reach": "public",
+        "link_role": document.link_role,
         "title": document.title,
-        "is_public": True,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
 
 
-def test_api_documents_retrieve_anonymous_not_public():
+@pytest.mark.parametrize("reach", ["restricted", "authenticated"])
+def test_api_documents_retrieve_anonymous_restricted_or_authenticated(reach):
     """Anonymous users should not be able to retrieve a document that is not public."""
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach=reach)
 
     response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/")
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
 
 
-def test_api_documents_retrieve_authenticated_unrelated_public():
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(reach):
     """
     Authenticated users should be able to retrieve a public document to which they are
     not related.
@@ -60,7 +66,7 @@ def test_api_documents_retrieve_authenticated_unrelated_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
 
     response = client.get(
         f"/api/v1.0/documents/{document.id!s}/",
@@ -69,28 +75,62 @@ def test_api_documents_retrieve_authenticated_unrelated_public():
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
+            "attachment_upload": document.link_role == "editor",
+            "link_configuration": False,
             "destroy": False,
-            "attachment_upload": False,
             "manage_accesses": False,
-            "partial_update": False,
+            "partial_update": document.link_role == "editor",
             "retrieve": True,
-            "update": False,
+            "update": document.link_role == "editor",
             "versions_destroy": False,
             "versions_list": False,
             "versions_retrieve": False,
         },
         "accesses": [],
+        "link_reach": reach,
+        "link_role": document.link_role,
         "title": document.title,
-        "is_public": True,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
+    assert (
+        models.LinkTrace.objects.filter(document=document, user=user).exists() is True
+    )
 
 
-def test_api_documents_retrieve_authenticated_unrelated_not_public():
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_retrieve_authenticated_trace_twice(reach):
     """
-    Authenticated users should not be allowed to retrieve a document that is not public and
+    Accessing a document several times should not raise any error even though the
+    trace already exists for this document and user.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach=reach)
+    assert (
+        models.LinkTrace.objects.filter(document=document, user=user).exists() is False
+    )
+
+    client.get(
+        f"/api/v1.0/documents/{document.id!s}/",
+    )
+    assert (
+        models.LinkTrace.objects.filter(document=document, user=user).exists() is True
+    )
+
+    # A second visit should not raise any error
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 200
+
+
+def test_api_documents_retrieve_authenticated_unrelated_restricted():
+    """
+    Authenticated users should not be allowed to retrieve a document that is restricted and
     to which they are not related.
     """
     user = factories.UserFactory()
@@ -98,13 +138,15 @@ def test_api_documents_retrieve_authenticated_unrelated_not_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     response = client.get(
         f"/api/v1.0/documents/{document.id!s}/",
     )
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 def test_api_documents_retrieve_authenticated_related_direct():
@@ -152,25 +194,26 @@ def test_api_documents_retrieve_authenticated_related_direct():
         "title": document.title,
         "content": document.content,
         "abilities": document.get_abilities(user),
-        "is_public": document.is_public,
+        "link_reach": document.link_reach,
+        "link_role": document.link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
 
 
-def test_api_documents_retrieve_authenticated_related_team_none(mock_user_get_teams):
+def test_api_documents_retrieve_authenticated_related_team_none(mock_user_teams):
     """
-    Authenticated users should not be able to retrieve a document related to teams in
-    which the user is not.
+    Authenticated users should not be able to retrieve a restricted document related to
+    teams in which the user is not.
     """
-    mock_user_get_teams.return_value = []
+    mock_user_teams.return_value = []
 
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     factories.TeamDocumentAccessFactory(
         document=document, team="readers", role="reader"
@@ -186,8 +229,10 @@ def test_api_documents_retrieve_authenticated_related_team_none(mock_user_get_te
     factories.TeamDocumentAccessFactory()
 
     response = client.get(f"/api/v1.0/documents/{document.id!s}/")
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 @pytest.mark.parametrize(
@@ -200,20 +245,20 @@ def test_api_documents_retrieve_authenticated_related_team_none(mock_user_get_te
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_members(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a document to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     access_reader = factories.TeamDocumentAccessFactory(
         document=document, team="readers", role="reader"
@@ -287,7 +332,8 @@ def test_api_documents_retrieve_authenticated_related_team_members(
         "title": document.title,
         "content": document.content,
         "abilities": document.get_abilities(user),
-        "is_public": False,
+        "link_reach": "restricted",
+        "link_role": document.link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
@@ -302,20 +348,20 @@ def test_api_documents_retrieve_authenticated_related_team_members(
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_administrators(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a document to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     access_reader = factories.TeamDocumentAccessFactory(
         document=document, team="readers", role="reader"
@@ -406,7 +452,8 @@ def test_api_documents_retrieve_authenticated_related_team_administrators(
         "title": document.title,
         "content": document.content,
         "abilities": document.get_abilities(user),
-        "is_public": False,
+        "link_reach": "restricted",
+        "link_role": document.link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
@@ -422,20 +469,20 @@ def test_api_documents_retrieve_authenticated_related_team_administrators(
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_owners(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
-    Authenticated users should be allowed to retrieve a document to which they
-    are related via a team whatever the role and see all its accesses.
+    Authenticated users should be allowed to retrieve a restricted document to which
+    they are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     access_reader = factories.TeamDocumentAccessFactory(
         document=document, team="readers", role="reader"
@@ -529,7 +576,8 @@ def test_api_documents_retrieve_authenticated_related_team_owners(
         "title": document.title,
         "content": document.content,
         "abilities": document.get_abilities(user),
-        "is_public": False,
+        "link_reach": "restricted",
+        "link_role": document.link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }

src/backend/core/tests/documents/test_api_documents_retrieve_auth.py

@@ -22,7 +22,7 @@ pytestmark = pytest.mark.django_db
 
 def test_api_documents_retrieve_auth_anonymous_public():
     """Anonymous users should be able to retrieve attachments linked to a public document"""
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach="public")
 
     filename = f"{uuid.uuid4()!s}.jpg"
     key = f"{document.pk!s}/attachments/{filename:s}"
@@ -64,12 +64,13 @@ def test_api_documents_retrieve_auth_anonymous_public():
     assert response.content.decode("utf-8") == "my prose"
 
 
-def test_api_documents_retrieve_auth_anonymous_not_public():
+@pytest.mark.parametrize("reach", ["authenticated", "restricted"])
+def test_api_documents_retrieve_auth_anonymous_authenticated_or_restricted(reach):
     """
     Anonymous users should not be allowed to retrieve attachments linked to a document
-    that is not public.
+    with link reach set to authenticated or restricted.
     """
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach=reach)
 
     filename = f"{uuid.uuid4()!s}.jpg"
     media_url = f"http://localhost/media/{document.pk!s}/attachments/{filename:s}"
@@ -82,12 +83,13 @@ def test_api_documents_retrieve_auth_anonymous_not_public():
     assert "Authorization" not in response
 
 
-def test_api_documents_retrieve_auth_authenticated_public():
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_retrieve_auth_authenticated_public_or_authenticated(reach):
     """
-    Authenticated users who are not related to a document should be able to
-    retrieve attachments linked to a public document.
+    Authenticated users who are not related to a document should be able to retrieve
+    attachments related to a document with public or authenticated link reach.
     """
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
 
     user = factories.UserFactory()
     client = APIClient()
@@ -104,7 +106,7 @@ def test_api_documents_retrieve_auth_authenticated_public():
     )
 
     original_url = f"http://localhost/media/{key:s}"
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/documents/retrieve-auth/", HTTP_X_ORIGINAL_URL=original_url
     )
 
@@ -133,12 +135,12 @@ def test_api_documents_retrieve_auth_authenticated_public():
     assert response.content.decode("utf-8") == "my prose"
 
 
-def test_api_documents_retrieve_auth_authenticated_not_public():
+def test_api_documents_retrieve_auth_authenticated_restricted():
     """
     Authenticated users who are not related to a document should not be allowed to
-    retrieve attachments linked to a document that is not public.
+    retrieve attachments linked to a document that is restricted.
     """
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     user = factories.UserFactory()
     client = APIClient()
@@ -147,7 +149,7 @@ def test_api_documents_retrieve_auth_authenticated_not_public():
     filename = f"{uuid.uuid4()!s}.jpg"
     media_url = f"http://localhost/media/{document.pk!s}/attachments/{filename:s}"
 
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/documents/retrieve-auth/", HTTP_X_ORIGINAL_URL=media_url
     )
 
@@ -155,22 +157,21 @@ def test_api_documents_retrieve_auth_authenticated_not_public():
     assert "Authorization" not in response
 
 
-@pytest.mark.parametrize("is_public", [True, False])
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_retrieve_auth_related(via, is_public, mock_user_get_teams):
+def test_api_documents_retrieve_auth_related(via, mock_user_teams):
     """
-    Users who have a role on a document, whatever the role, should be able to
+    Users who have a specific access to a document, whatever the role, should be able to
     retrieve related attachments.
     """
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=is_public)
+    document = factories.DocumentFactory()
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
     filename = f"{uuid.uuid4()!s}.jpg"

src/backend/core/tests/documents/test_api_documents_update.py

@@ -4,6 +4,8 @@ Tests for Documents API endpoint in impress's core app: update
 
 import random
 
+from django.contrib.auth.models import AnonymousUser
+
 import pytest
 from rest_framework.test import APIClient
 
@@ -14,9 +16,22 @@ from core.tests.conftest import TEAM, USER, VIA
 pytestmark = pytest.mark.django_db
 
 
-def test_api_documents_update_anonymous():
-    """Anonymous users should not be allowed to update a document."""
-    document = factories.DocumentFactory()
+@pytest.mark.parametrize(
+    "reach, role",
+    [
+        ("restricted", "reader"),
+        ("restricted", "editor"),
+        ("authenticated", "reader"),
+        ("authenticated", "editor"),
+        ("public", "reader"),
+    ],
+)
+def test_api_documents_update_anonymous_forbidden(reach, role):
+    """
+    Anonymous users should not be allowed to update a document when link
+    configuration does not allow it.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
     old_document_values = serializers.DocumentSerializer(instance=document).data
 
     new_document_values = serializers.DocumentSerializer(
@@ -37,16 +52,26 @@ def test_api_documents_update_anonymous():
     assert document_values == old_document_values
 
 
-def test_api_documents_update_authenticated_unrelated():
+@pytest.mark.parametrize(
+    "reach,role",
+    [
+        ("public", "reader"),
+        ("authenticated", "reader"),
+        ("restricted", "reader"),
+        ("restricted", "editor"),
+    ],
+)
+def test_api_documents_update_authenticated_unrelated_forbidden(reach, role):
     """
-    Authenticated users should not be allowed to update a document to which they are not related.
+    Authenticated users should not be allowed to update a document to which
+    they are not related if the link configuration does not allow it.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
     old_document_values = serializers.DocumentSerializer(instance=document).data
 
     new_document_values = serializers.DocumentSerializer(
@@ -58,18 +83,67 @@ def test_api_documents_update_authenticated_unrelated():
         format="json",
     )
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
     document.refresh_from_db()
     document_values = serializers.DocumentSerializer(instance=document).data
     assert document_values == old_document_values
 
 
-@pytest.mark.parametrize("via", VIA)
-def test_api_documents_update_authenticated_reader(via, mock_user_get_teams):
+@pytest.mark.parametrize(
+    "is_authenticated,reach,role",
+    [
+        (False, "public", "editor"),
+        (True, "public", "editor"),
+        (True, "authenticated", "editor"),
+    ],
+)
+def test_api_documents_update_anonymous_or_authenticated_unrelated(
+    is_authenticated, reach, role
+):
     """
-    Users who are editors or reader of a document but not administrators should
+    Authenticated users should be able to update a document to which
+    they are not related if the link configuration allows it.
+    """
+    client = APIClient()
+
+    if is_authenticated:
+        user = factories.UserFactory()
+        client.force_login(user)
+    else:
+        user = AnonymousUser()
+
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    old_document_values = serializers.DocumentSerializer(instance=document).data
+
+    new_document_values = serializers.DocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/",
+        new_document_values,
+        format="json",
+    )
+    assert response.status_code == 200
+
+    document = models.Document.objects.get(pk=document.pk)
+    document_values = serializers.DocumentSerializer(instance=document).data
+    for key, value in document_values.items():
+        if key in ["id", "accesses", "created_at", "link_reach", "link_role"]:
+            assert value == old_document_values[key]
+        elif key == "updated_at":
+            assert value > old_document_values[key]
+        else:
+            assert value == new_document_values[key]
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_update_authenticated_reader(via, mock_user_teams):
+    """
+    Users who are reader of a document but not administrators should
     not be allowed to update it.
     """
     user = factories.UserFactory()
@@ -77,11 +151,11 @@ def test_api_documents_update_authenticated_reader(via, mock_user_get_teams):
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory()
+    document = factories.DocumentFactory(link_role="reader")
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="reader"
         )
@@ -110,7 +184,7 @@ def test_api_documents_update_authenticated_reader(via, mock_user_get_teams):
 @pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_documents_update_authenticated_editor_administrator_or_owner(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """A user who is editor, administrator or owner of a document should be allowed to update it."""
     user = factories.UserFactory()
@@ -122,7 +196,7 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -142,7 +216,7 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
     document = models.Document.objects.get(pk=document.pk)
     document_values = serializers.DocumentSerializer(instance=document).data
     for key, value in document_values.items():
-        if key in ["id", "accesses", "created_at"]:
+        if key in ["id", "accesses", "created_at", "link_reach", "link_role"]:
             assert value == old_document_values[key]
         elif key == "updated_at":
             assert value > old_document_values[key]
@@ -151,7 +225,7 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_update_authenticated_owners(via, mock_user_get_teams):
+def test_api_documents_update_authenticated_owners(via, mock_user_teams):
     """Administrators of a document should be allowed to update it."""
     user = factories.UserFactory()
 
@@ -162,7 +236,7 @@ def test_api_documents_update_authenticated_owners(via, mock_user_get_teams):
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )
@@ -181,7 +255,7 @@ def test_api_documents_update_authenticated_owners(via, mock_user_get_teams):
     document = models.Document.objects.get(pk=document.pk)
     document_values = serializers.DocumentSerializer(instance=document).data
     for key, value in document_values.items():
-        if key in ["id", "accesses", "created_at"]:
+        if key in ["id", "accesses", "created_at", "link_reach", "link_role"]:
             assert value == old_document_values[key]
         elif key == "updated_at":
             assert value > old_document_values[key]
@@ -190,9 +264,7 @@ def test_api_documents_update_authenticated_owners(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_update_administrator_or_owner_of_another(
-    via, mock_user_get_teams
-):
+def test_api_documents_update_administrator_or_owner_of_another(via, mock_user_teams):
     """
     Being administrator or owner of a document should not grant authorization to update
     another document.
@@ -208,28 +280,27 @@ def test_api_documents_update_administrator_or_owner_of_another(
             document=document, user=user, role=random.choice(["administrator", "owner"])
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document,
             team="lasuite",
             role=random.choice(["administrator", "owner"]),
         )
 
-    is_public = random.choice([True, False])
-    document = factories.DocumentFactory(title="Old title", is_public=is_public)
-    old_document_values = serializers.DocumentSerializer(instance=document).data
+    other_document = factories.DocumentFactory(title="Old title", link_role="reader")
+    old_document_values = serializers.DocumentSerializer(instance=other_document).data
 
     new_document_values = serializers.DocumentSerializer(
         instance=factories.DocumentFactory()
     ).data
     response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/",
+        f"/api/v1.0/documents/{other_document.id!s}/",
         new_document_values,
         format="json",
     )
 
-    assert response.status_code == 403 if is_public else 404
+    assert response.status_code == 403
 
-    document.refresh_from_db()
-    document_values = serializers.DocumentSerializer(instance=document).data
-    assert document_values == old_document_values
+    other_document.refresh_from_db()
+    other_document_values = serializers.DocumentSerializer(instance=other_document).data
+    assert other_document_values == old_document_values

src/backend/core/tests/templates/test_api_templates_delete.py

@@ -49,7 +49,7 @@ def test_api_templates_delete_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor", "administrator"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_templates_delete_authenticated_member_or_administrator(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """
     Authenticated users should not be allowed to delete a template for which they are
@@ -64,7 +64,7 @@ def test_api_templates_delete_authenticated_member_or_administrator(
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -81,7 +81,7 @@ def test_api_templates_delete_authenticated_member_or_administrator(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_delete_authenticated_owner(via, mock_user_get_teams):
+def test_api_templates_delete_authenticated_owner(via, mock_user_teams):
     """
     Authenticated users should be able to delete a template they own.
     """
@@ -94,7 +94,7 @@ def test_api_templates_delete_authenticated_owner(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )

src/backend/core/tests/templates/test_api_templates_generate_document.py

@@ -44,8 +44,10 @@ def test_api_templates_generate_document_anonymous_not_public():
         format="json",
     )
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
 
 
 def test_api_templates_generate_document_authenticated_public():
@@ -87,12 +89,14 @@ def test_api_templates_generate_document_authenticated_not_public():
         format="json",
     )
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_generate_document_related(via, mock_user_get_teams):
+def test_api_templates_generate_document_related(via, mock_user_teams):
     """Users related to a template can generate pdf document."""
     user = factories.UserFactory()
 
@@ -102,7 +106,7 @@ def test_api_templates_generate_document_related(via, mock_user_get_teams):
     if via == USER:
         access = factories.UserTemplateAccessFactory(user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamTemplateAccessFactory(team="lasuite")
 
     data = {"body": "# Test markdown body"}

src/backend/core/tests/templates/test_api_templates_list.py

@@ -6,7 +6,6 @@ from unittest import mock
 
 import pytest
 from rest_framework.pagination import PageNumberPagination
-from rest_framework.status import HTTP_200_OK
 from rest_framework.test import APIClient
 
 from core import factories
@@ -17,12 +16,12 @@ pytestmark = pytest.mark.django_db
 def test_api_templates_list_anonymous():
     """Anonymous users should only be able to list public templates."""
     factories.TemplateFactory.create_batch(2, is_public=False)
-    templates = factories.TemplateFactory.create_batch(2, is_public=True)
-    expected_ids = {str(template.id) for template in templates}
+    public_templates = factories.TemplateFactory.create_batch(2, is_public=True)
+    expected_ids = {str(template.id) for template in public_templates}
 
     response = APIClient().get("/api/v1.0/templates/")
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
     assert len(results) == 2
     results_id = {result["id"] for result in results}
@@ -32,7 +31,7 @@ def test_api_templates_list_anonymous():
 def test_api_templates_list_authenticated_direct():
     """
     Authenticated users should be able to list templates they are a direct
-    owner/administrator/member of.
+    owner/administrator/member of or that are public.
     """
     user = factories.UserFactory()
 
@@ -54,24 +53,24 @@ def test_api_templates_list_authenticated_direct():
         "/api/v1.0/templates/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
     assert len(results) == 7
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
 
 
-def test_api_templates_list_authenticated_via_team(mock_user_get_teams):
+def test_api_templates_list_authenticated_via_team(mock_user_teams):
     """
     Authenticated users should be able to list templates they are a
-    owner/administrator/member of via a team.
+    owner/administrator/member of via a team or that are public.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    mock_user_get_teams.return_value = ["team1", "team2", "unknown"]
+    mock_user_teams.return_value = ["team1", "team2", "unknown"]
 
     templates_team1 = [
         access.template
@@ -91,7 +90,7 @@ def test_api_templates_list_authenticated_via_team(mock_user_get_teams):
 
     response = client.get("/api/v1.0/templates/")
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
     assert len(results) == 7
     results_id = {result["id"] for result in results}
@@ -118,7 +117,7 @@ def test_api_templates_list_pagination(
         "/api/v1.0/templates/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
 
     assert content["count"] == 3
@@ -134,7 +133,7 @@ def test_api_templates_list_pagination(
         "/api/v1.0/templates/?page=2",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
 
     assert content["count"] == 3
@@ -161,26 +160,24 @@ def test_api_templates_list_authenticated_distinct():
         "/api/v1.0/templates/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
     assert len(content["results"]) == 1
     assert content["results"][0]["id"] == str(template.id)
 
 
-def test_api_templates_order():
-    """
-    Test that the endpoint GET templates is sorted in 'created_at' descending order by default.
-    """
+def test_api_templates_list_order_default():
+    """The templates list should be sorted by 'created_at' in descending order by default."""
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
     template_ids = [
-        str(template.id)
-        for template in factories.TemplateFactory.create_batch(5, is_public=True)
+        str(access.template.id)
+        for access in factories.UserTemplateAccessFactory.create_batch(5, user=user)
     ]
 
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/templates/",
     )
 
@@ -195,21 +192,21 @@ def test_api_templates_order():
     ), "created_at values are not sorted from newest to oldest"
 
 
-def test_api_templates_order_param():
+def test_api_templates_list_order_param():
     """
-    Test that the 'created_at' field is sorted in ascending order
-    when the 'ordering' query parameter is set.
+    The templates list is sorted by 'created_at' in ascending order when setting
+    the "ordering" query parameter.
     """
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
     templates_ids = [
-        str(template.id)
-        for template in factories.TemplateFactory.create_batch(5, is_public=True)
+        str(access.template.id)
+        for access in factories.UserTemplateAccessFactory.create_batch(5, user=user)
     ]
 
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/templates/?ordering=created_at",
     )
     assert response.status_code == 200

src/backend/core/tests/templates/test_api_templates_retrieve.py

@@ -41,8 +41,10 @@ def test_api_templates_retrieve_anonymous_not_public():
 
     response = APIClient().get(f"/api/v1.0/templates/{template.id!s}/")
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
 
 
 def test_api_templates_retrieve_authenticated_unrelated_public():
@@ -94,8 +96,10 @@ def test_api_templates_retrieve_authenticated_unrelated_not_public():
     response = client.get(
         f"/api/v1.0/templates/{template.id!s}/",
     )
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 def test_api_templates_retrieve_authenticated_related_direct():
@@ -146,12 +150,12 @@ def test_api_templates_retrieve_authenticated_related_direct():
     }
 
 
-def test_api_templates_retrieve_authenticated_related_team_none(mock_user_get_teams):
+def test_api_templates_retrieve_authenticated_related_team_none(mock_user_teams):
     """
     Authenticated users should not be able to retrieve a template related to teams in
     which the user is not.
     """
-    mock_user_get_teams.return_value = []
+    mock_user_teams.return_value = []
 
     user = factories.UserFactory()
 
@@ -174,8 +178,10 @@ def test_api_templates_retrieve_authenticated_related_team_none(mock_user_get_te
     factories.TeamTemplateAccessFactory()
 
     response = client.get(f"/api/v1.0/templates/{template.id!s}/")
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 @pytest.mark.parametrize(
@@ -188,13 +194,13 @@ def test_api_templates_retrieve_authenticated_related_team_none(mock_user_get_te
     ],
 )
 def test_api_templates_retrieve_authenticated_related_team_readers_or_editors(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a template to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
@@ -287,13 +293,13 @@ def test_api_templates_retrieve_authenticated_related_team_readers_or_editors(
     ],
 )
 def test_api_templates_retrieve_authenticated_related_team_administrators(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a template to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
@@ -405,13 +411,13 @@ def test_api_templates_retrieve_authenticated_related_team_administrators(
     ],
 )
 def test_api_templates_retrieve_authenticated_related_team_owners(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a template to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 

src/backend/core/tests/templates/test_api_templates_update.py

@@ -58,8 +58,10 @@ def test_api_templates_update_authenticated_unrelated():
         format="json",
     )
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
     template.refresh_from_db()
     template_values = serializers.TemplateSerializer(instance=template).data
@@ -67,7 +69,7 @@ def test_api_templates_update_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_update_authenticated_readers(via, mock_user_get_teams):
+def test_api_templates_update_authenticated_readers(via, mock_user_teams):
     """
     Users who are readers of a template should not be allowed to update it.
     """
@@ -80,7 +82,7 @@ def test_api_templates_update_authenticated_readers(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="reader")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="reader"
         )
@@ -109,7 +111,7 @@ def test_api_templates_update_authenticated_readers(via, mock_user_get_teams):
 @pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_templates_update_authenticated_editor_or_administrator_or_owner(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Administrator or owner of a template should be allowed to update it."""
     user = factories.UserFactory()
@@ -121,7 +123,7 @@ def test_api_templates_update_authenticated_editor_or_administrator_or_owner(
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -148,7 +150,7 @@ def test_api_templates_update_authenticated_editor_or_administrator_or_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_update_authenticated_owners(via, mock_user_get_teams):
+def test_api_templates_update_authenticated_owners(via, mock_user_teams):
     """Administrators of a template should be allowed to update it."""
     user = factories.UserFactory()
 
@@ -159,7 +161,7 @@ def test_api_templates_update_authenticated_owners(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -185,9 +187,7 @@ def test_api_templates_update_authenticated_owners(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_update_administrator_or_owner_of_another(
-    via, mock_user_get_teams
-):
+def test_api_templates_update_administrator_or_owner_of_another(via, mock_user_teams):
     """
     Being administrator or owner of a template should not grant authorization to update
     another template.
@@ -203,7 +203,7 @@ def test_api_templates_update_administrator_or_owner_of_another(
             template=template, user=user, role=random.choice(["administrator", "owner"])
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template,
             team="lasuite",

src/backend/core/tests/test_api_template_accesses.py

@@ -57,7 +57,7 @@ def test_api_template_accesses_list_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_list_authenticated_related(via, mock_user_get_teams):
+def test_api_template_accesses_list_authenticated_related(via, mock_user_teams):
     """
     Authenticated users should be able to list template accesses for a template
     to which they are directly related, whatever their role in the template.
@@ -76,7 +76,7 @@ def test_api_template_accesses_list_authenticated_related(via, mock_user_get_tea
             role=random.choice(models.RoleChoices.choices)[0],
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         user_access = models.TemplateAccess.objects.create(
             template=template,
             team="lasuite",
@@ -178,7 +178,7 @@ def test_api_template_accesses_retrieve_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_get_teams):
+def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_teams):
     """
     A user who is related to a template should be allowed to retrieve the
     associated template user accesses.
@@ -192,7 +192,7 @@ def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_get
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(template=template, team="lasuite")
 
     access = factories.UserTemplateAccessFactory(template=template)
@@ -261,7 +261,7 @@ def test_api_template_accesses_create_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_template_accesses_create_authenticated_editor_or_reader(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Editors or readers of a template should not be allowed to create template accesses."""
     user = factories.UserFactory()
@@ -273,7 +273,7 @@ def test_api_template_accesses_create_authenticated_editor_or_reader(
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -296,9 +296,7 @@ def test_api_template_accesses_create_authenticated_editor_or_reader(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_create_authenticated_administrator(
-    via, mock_user_get_teams
-):
+def test_api_template_accesses_create_authenticated_administrator(via, mock_user_teams):
     """
     Administrators of a template should be able to create template accesses
     except for the "owner" role.
@@ -314,7 +312,7 @@ def test_api_template_accesses_create_authenticated_administrator(
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -363,7 +361,7 @@ def test_api_template_accesses_create_authenticated_administrator(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_create_authenticated_owner(via, mock_user_get_teams):
+def test_api_template_accesses_create_authenticated_owner(via, mock_user_teams):
     """
     Owners of a template should be able to create template accesses whatever the role.
     """
@@ -376,7 +374,7 @@ def test_api_template_accesses_create_authenticated_owner(via, mock_user_get_tea
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -466,7 +464,7 @@ def test_api_template_accesses_update_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_template_accesses_update_authenticated_editor_or_reader(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Editors or readers of a template should not be allowed to update its accesses."""
     user = factories.UserFactory()
@@ -478,7 +476,7 @@ def test_api_template_accesses_update_authenticated_editor_or_reader(
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -506,9 +504,7 @@ def test_api_template_accesses_update_authenticated_editor_or_reader(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_administrator_except_owner(
-    via, mock_user_get_teams
-):
+def test_api_template_accesses_update_administrator_except_owner(via, mock_user_teams):
     """
     A user who is a direct administrator in a template should be allowed to update a user
     access for this template, as long as they don't try to set the role to owner.
@@ -524,7 +520,7 @@ def test_api_template_accesses_update_administrator_except_owner(
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -565,9 +561,7 @@ def test_api_template_accesses_update_administrator_except_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_administrator_from_owner(
-    via, mock_user_get_teams
-):
+def test_api_template_accesses_update_administrator_from_owner(via, mock_user_teams):
     """
     A user who is an administrator in a template, should not be allowed to update
     the user access of an "owner" for this template.
@@ -583,7 +577,7 @@ def test_api_template_accesses_update_administrator_from_owner(
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -614,7 +608,7 @@ def test_api_template_accesses_update_administrator_from_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_administrator_to_owner(via, mock_user_get_teams):
+def test_api_template_accesses_update_administrator_to_owner(via, mock_user_teams):
     """
     A user who is an administrator in a template, should not be allowed to update
     the user access of another user to grant template ownership.
@@ -630,7 +624,7 @@ def test_api_template_accesses_update_administrator_to_owner(via, mock_user_get_
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -668,7 +662,7 @@ def test_api_template_accesses_update_administrator_to_owner(via, mock_user_get_
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_owner(via, mock_user_get_teams):
+def test_api_template_accesses_update_owner(via, mock_user_teams):
     """
     A user who is an owner in a template should be allowed to update
     a user access for this template whatever the role.
@@ -682,7 +676,7 @@ def test_api_template_accesses_update_owner(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -724,7 +718,7 @@ def test_api_template_accesses_update_owner(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_owner_self(via, mock_user_get_teams):
+def test_api_template_accesses_update_owner_self(via, mock_user_teams):
     """
     A user who is owner of a template should be allowed to update
     their own user access provided there are other owners in the template.
@@ -741,7 +735,7 @@ def test_api_template_accesses_update_owner_self(via, mock_user_get_teams):
             template=template, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -810,7 +804,7 @@ def test_api_template_accesses_delete_authenticated():
 
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_get_teams):
+def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_teams):
     """
     Authenticated users should not be allowed to delete a template access for a
     template in which they are a simple editor or reader.
@@ -824,7 +818,7 @@ def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_get_
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -844,7 +838,7 @@ def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_get_
 
 @pytest.mark.parametrize("via", VIA)
 def test_api_template_accesses_delete_administrators_except_owners(
-    via, mock_user_get_teams
+    via, mock_user_teams
 ):
     """
     Users who are administrators in a template should be allowed to delete an access
@@ -861,7 +855,7 @@ def test_api_template_accesses_delete_administrators_except_owners(
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -882,7 +876,7 @@ def test_api_template_accesses_delete_administrators_except_owners(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_get_teams):
+def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_teams):
     """
     Users who are administrators in a template should not be allowed to delete an ownership
     access from the template.
@@ -898,7 +892,7 @@ def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_get
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -917,7 +911,7 @@ def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_get
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_delete_owners(via, mock_user_get_teams):
+def test_api_template_accesses_delete_owners(via, mock_user_teams):
     """
     Users should be able to delete the template access of another user
     for a template of which they are owner.
@@ -931,7 +925,7 @@ def test_api_template_accesses_delete_owners(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -950,7 +944,7 @@ def test_api_template_accesses_delete_owners(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_delete_owners_last_owner(via, mock_user_get_teams):
+def test_api_template_accesses_delete_owners_last_owner(via, mock_user_teams):
     """
     It should not be possible to delete the last owner access from a template
     """
@@ -966,7 +960,7 @@ def test_api_template_accesses_delete_owners_last_owner(via, mock_user_get_teams
             template=template, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )

src/backend/core/tests/test_models_documents.py

@@ -27,15 +27,15 @@ def test_models_documents_id_unique():
 
 
 def test_models_documents_title_null():
-    """The "title" field should not be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null."):
-        models.Document.objects.create(title=None)
+    """The "title" field can be null."""
+    document = models.Document.objects.create(title=None)
+    assert document.title is None
 
 
 def test_models_documents_title_empty():
-    """The "title" field should not be empty."""
-    with pytest.raises(ValidationError, match="This field cannot be blank."):
-        models.Document.objects.create(title="")
+    """The "title" field can be empty."""
+    document = models.Document.objects.create(title="")
+    assert document.title == ""
 
 
 def test_models_documents_title_max_length():
@@ -57,30 +57,29 @@ def test_models_documents_file_key():
 # get_abilities
 
 
-def test_models_documents_get_abilities_anonymous_public():
-    """Check abilities returned for an anonymous user if the document is public."""
-    document = factories.DocumentFactory(is_public=True)
-    abilities = document.get_abilities(AnonymousUser())
+@pytest.mark.parametrize(
+    "is_authenticated,reach,role",
+    [
+        (True, "restricted", "reader"),
+        (True, "restricted", "editor"),
+        (False, "restricted", "reader"),
+        (False, "restricted", "editor"),
+        (False, "authenticated", "reader"),
+        (False, "authenticated", "editor"),
+    ],
+)
+def test_models_documents_get_abilities_forbidden(is_authenticated, reach, role):
+    """
+    Check abilities returned for a document giving insufficient roles to link holders
+    i.e anonymous users or authenticated users who have no specific role on the document.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    user = factories.UserFactory() if is_authenticated else AnonymousUser()
+    abilities = document.get_abilities(user)
     assert abilities == {
-        "destroy": False,
         "attachment_upload": False,
-        "manage_accesses": False,
-        "partial_update": False,
-        "retrieve": True,
-        "update": False,
-        "versions_destroy": False,
-        "versions_list": False,
-        "versions_retrieve": False,
-    }
-
-
-def test_models_documents_get_abilities_anonymous_not_public():
-    """Check abilities returned for an anonymous user if the document is private."""
-    document = factories.DocumentFactory(is_public=False)
-    abilities = document.get_abilities(AnonymousUser())
-    assert abilities == {
+        "link_configuration": False,
         "destroy": False,
-        "attachment_upload": False,
         "manage_accesses": False,
         "partial_update": False,
         "retrieve": False,
@@ -91,13 +90,26 @@ def test_models_documents_get_abilities_anonymous_not_public():
     }
 
 
-def test_models_documents_get_abilities_authenticated_unrelated_public():
-    """Check abilities returned for an authenticated user if the user is public."""
-    document = factories.DocumentFactory(is_public=True)
-    abilities = document.get_abilities(factories.UserFactory())
+@pytest.mark.parametrize(
+    "is_authenticated,reach",
+    [
+        (True, "public"),
+        (False, "public"),
+        (True, "authenticated"),
+    ],
+)
+def test_models_documents_get_abilities_reader(is_authenticated, reach):
+    """
+    Check abilities returned for a document giving reader role to link holders
+    i.e anonymous users or authenticated users who have no specific role on the document.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role="reader")
+    user = factories.UserFactory() if is_authenticated else AnonymousUser()
+    abilities = document.get_abilities(user)
     assert abilities == {
-        "destroy": False,
         "attachment_upload": False,
+        "destroy": False,
+        "link_configuration": False,
         "manage_accesses": False,
         "partial_update": False,
         "retrieve": True,
@@ -108,17 +120,30 @@ def test_models_documents_get_abilities_authenticated_unrelated_public():
     }
 
 
-def test_models_documents_get_abilities_authenticated_unrelated_not_public():
-    """Check abilities returned for an authenticated user if the document is private."""
-    document = factories.DocumentFactory(is_public=False)
-    abilities = document.get_abilities(factories.UserFactory())
+@pytest.mark.parametrize(
+    "is_authenticated,reach",
+    [
+        (True, "public"),
+        (False, "public"),
+        (True, "authenticated"),
+    ],
+)
+def test_models_documents_get_abilities_editor(is_authenticated, reach):
+    """
+    Check abilities returned for a document giving editor role to link holders
+    i.e anonymous users or authenticated users who have no specific role on the document.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role="editor")
+    user = factories.UserFactory() if is_authenticated else AnonymousUser()
+    abilities = document.get_abilities(user)
     assert abilities == {
+        "attachment_upload": True,
         "destroy": False,
-        "attachment_upload": False,
+        "link_configuration": False,
         "manage_accesses": False,
-        "partial_update": False,
-        "retrieve": False,
-        "update": False,
+        "partial_update": True,
+        "retrieve": True,
+        "update": True,
         "versions_destroy": False,
         "versions_list": False,
         "versions_retrieve": False,
@@ -131,8 +156,9 @@ def test_models_documents_get_abilities_owner():
     access = factories.UserDocumentAccessFactory(role="owner", user=user)
     abilities = access.document.get_abilities(access.user)
     assert abilities == {
-        "destroy": True,
         "attachment_upload": True,
+        "destroy": True,
+        "link_configuration": True,
         "manage_accesses": True,
         "partial_update": True,
         "retrieve": True,
@@ -148,8 +174,9 @@ def test_models_documents_get_abilities_administrator():
     access = factories.UserDocumentAccessFactory(role="administrator")
     abilities = access.document.get_abilities(access.user)
     assert abilities == {
-        "destroy": False,
         "attachment_upload": True,
+        "destroy": False,
+        "link_configuration": True,
         "manage_accesses": True,
         "partial_update": True,
         "retrieve": True,
@@ -168,8 +195,9 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
-        "destroy": False,
         "attachment_upload": True,
+        "destroy": False,
+        "link_configuration": False,
         "manage_accesses": False,
         "partial_update": True,
         "retrieve": True,
@@ -182,14 +210,17 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
 
 def test_models_documents_get_abilities_reader_user(django_assert_num_queries):
     """Check abilities returned for the reader of a document."""
-    access = factories.UserDocumentAccessFactory(role="reader")
+    access = factories.UserDocumentAccessFactory(
+        role="reader", document__link_role="reader"
+    )
 
     with django_assert_num_queries(1):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
-        "destroy": False,
         "attachment_upload": False,
+        "destroy": False,
+        "link_configuration": False,
         "manage_accesses": False,
         "partial_update": False,
         "retrieve": True,
@@ -202,15 +233,18 @@ def test_models_documents_get_abilities_reader_user(django_assert_num_queries):
 
 def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
     """No query is done if the role is preset e.g. with query annotation."""
-    access = factories.UserDocumentAccessFactory(role="reader")
+    access = factories.UserDocumentAccessFactory(
+        role="reader", document__link_role="reader"
+    )
     access.document.user_roles = ["reader"]
 
     with django_assert_num_queries(0):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
-        "destroy": False,
         "attachment_upload": False,
+        "destroy": False,
+        "link_configuration": False,
         "manage_accesses": False,
         "partial_update": False,
         "retrieve": True,

src/backend/core/tests/test_models_invitations.py

@@ -189,7 +189,7 @@ def test_models_document_invitations_get_abilities_authenticated():
 @pytest.mark.parametrize("via", VIA)
 @pytest.mark.parametrize("role", ["administrator", "owner"])
 def test_models_document_invitations_get_abilities_privileged_member(
-    role, via, mock_user_get_teams
+    role, via, mock_user_teams
 ):
     """Check abilities for a document member with a privileged role."""
 
@@ -198,7 +198,7 @@ def test_models_document_invitations_get_abilities_privileged_member(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -217,7 +217,7 @@ def test_models_document_invitations_get_abilities_privileged_member(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_models_document_invitations_get_abilities_reader(via, mock_user_get_teams):
+def test_models_document_invitations_get_abilities_reader(via, mock_user_teams):
     """Check abilities for a document reader with 'reader' role."""
 
     user = factories.UserFactory()
@@ -225,7 +225,7 @@ def test_models_document_invitations_get_abilities_reader(via, mock_user_get_tea
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="reader"
         )
@@ -242,7 +242,7 @@ def test_models_document_invitations_get_abilities_reader(via, mock_user_get_tea
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_models_document_invitations_get_abilities_editor(via, mock_user_get_teams):
+def test_models_document_invitations_get_abilities_editor(via, mock_user_teams):
     """Check abilities for a document editor with 'editor' role."""
 
     user = factories.UserFactory()
@@ -250,7 +250,7 @@ def test_models_document_invitations_get_abilities_editor(via, mock_user_get_tea
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="editor")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="editor"
         )

src/backend/demo/management/commands/create_demo.py

@@ -130,7 +130,9 @@ def create_demo(stdout):
             queue.push(
                 models.Document(
                     title=fake.sentence(nb_words=4),
-                    is_public=random_true_with_probability(0.5),
+                    link_reach=models.LinkReachChoices.AUTHENTICATED
+                    if random_true_with_probability(0.5)
+                    else random.choice(models.LinkReachChoices.values),
                 )
             )
 

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "impress"
-version = "1.3.0"
+version = "1.4.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",

src/frontend/apps/e2e/__tests__/app-impress/common.ts

@@ -55,14 +55,25 @@ export const createDoc = async (
       })
       .fill(randomDocs[i]);
 
-    if (isPublic) {
-      await page.getByText('Is it public ?').click();
-    }
-
     await expect(buttonCreate).toBeEnabled();
     await buttonCreate.click();
 
     await expect(page.locator('h2').getByText(randomDocs[i])).toBeVisible();
+
+    if (isPublic) {
+      await page.getByRole('button', { name: 'Share' }).click();
+      await page.getByText('Doc private').click();
+
+      await page.locator('.c__modal__backdrop').click({
+        position: { x: 0, y: 0 },
+      });
+
+      await expect(
+        page
+          .getByLabel('It is the card information about the document.')
+          .getByText('Public'),
+      ).toBeVisible();
+    }
   }
 
   return randomDocs;
@@ -153,6 +164,7 @@ export const mockedDocument = async (page: Page, json: object) => {
           accesses: [],
           abilities: {
             destroy: false, // Means not owner
+            link_configuration: false,
             versions_destroy: false,
             versions_list: true,
             versions_retrieve: true,
@@ -161,7 +173,7 @@ export const mockedDocument = async (page: Page, json: object) => {
             partial_update: false, // Means not editor
             retrieve: true,
           },
-          is_public: false,
+          link_reach: 'restricted',
           created_at: '2021-09-01T09:00:00Z',
           ...json,
         },

src/frontend/apps/e2e/__tests__/app-impress/doc-create.spec.ts

@@ -21,8 +21,6 @@ test.describe('Doc Create', () => {
     ).toBeVisible();
     await expect(card.getByLabel('Document name')).toBeVisible();
 
-    await expect(card.getByText('Is it public ?')).toBeVisible();
-
     await expect(
       card.getByRole('button', {
         name: 'Create the document',
@@ -46,14 +44,8 @@ test.describe('Doc Create', () => {
     await expect(buttonCreateHomepage).toBeVisible();
   });
 
-  test('create a new public doc', async ({ page, browserName }) => {
-    const [docTitle] = await createDoc(
-      page,
-      'My new doc',
-      browserName,
-      1,
-      true,
-    );
+  test('it creates a doc', async ({ page, browserName }) => {
+    const [docTitle] = await createDoc(page, 'My new doc', browserName, 1);
 
     expect(await page.locator('title').textContent()).toMatch(
       /My new doc - Docs/,
@@ -69,11 +61,5 @@ test.describe('Doc Create', () => {
     await expect(datagrid.getByLabel('Loading data')).toBeHidden();
 
     await expect(datagrid.getByText(docTitle)).toBeVisible();
-
-    const row = datagrid.getByRole('row').filter({
-      hasText: docTitle,
-    });
-
-    await expect(row.getByRole('cell').nth(0)).toHaveText('Public');
   });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts

@@ -136,6 +136,7 @@ test.describe('Doc Editor', () => {
     await mockedDocument(page, {
       abilities: {
         destroy: false, // Means not owner
+        link_configuration: false,
         versions_destroy: false,
         versions_list: true,
         versions_retrieve: true,

src/frontend/apps/e2e/__tests__/app-impress/doc-header.spec.ts

@@ -34,6 +34,7 @@ test.describe('Doc Header', () => {
       ],
       abilities: {
         destroy: true, // Means owner
+        link_configuration: true,
         versions_destroy: true,
         versions_list: true,
         versions_retrieve: true,
@@ -42,7 +43,7 @@ test.describe('Doc Header', () => {
         partial_update: true,
         retrieve: true,
       },
-      is_public: true,
+      link_reach: 'public',
       created_at: '2021-09-01T09:00:00Z',
     });
 
@@ -65,13 +66,7 @@ test.describe('Doc Header', () => {
   });
 
   test('it updates the doc', async ({ page, browserName }) => {
-    const [randomDoc] = await createDoc(
-      page,
-      'doc-update',
-      browserName,
-      1,
-      true,
-    );
+    const [randomDoc] = await createDoc(page, 'doc-update', browserName, 1);
     await expect(page.locator('h2').getByText(randomDoc)).toBeVisible();
 
     await page.getByLabel('Open the document options').click();
@@ -85,12 +80,7 @@ test.describe('Doc Header', () => {
       page.locator('h2').getByText(`Update document "${randomDoc}"`),
     ).toBeVisible();
 
-    await expect(
-      page.getByRole('checkbox', { name: 'Is it public ?' }),
-    ).toBeChecked();
-
     await page.getByText('Document name').fill(`${randomDoc}-updated`);
-    await page.getByText('Is it public ?').click();
 
     await page
       .getByRole('button', {
@@ -116,8 +106,8 @@ test.describe('Doc Header', () => {
       .click();
 
     await expect(
-      page.getByRole('checkbox', { name: 'Is it public ?' }),
-    ).not.toBeChecked();
+      page.getByRole('textbox', { name: 'Document name' }),
+    ).toHaveValue(`${randomDoc}-updated`);
   });
 
   test('it deletes the doc', async ({ page, browserName }) => {
@@ -164,6 +154,7 @@ test.describe('Doc Header', () => {
     await mockedDocument(page, {
       abilities: {
         destroy: false, // Means not owner
+        link_configuration: true,
         versions_destroy: true,
         versions_list: true,
         versions_retrieve: true,
@@ -195,6 +186,7 @@ test.describe('Doc Header', () => {
     await mockedDocument(page, {
       abilities: {
         destroy: false, // Means not owner
+        link_configuration: false,
         versions_destroy: true,
         versions_list: true,
         versions_retrieve: true,
@@ -226,6 +218,7 @@ test.describe('Doc Header', () => {
     await mockedDocument(page, {
       abilities: {
         destroy: false, // Means not owner
+        link_configuration: false,
         versions_destroy: false,
         versions_list: true,
         versions_retrieve: true,

src/frontend/apps/e2e/__tests__/app-impress/doc-routing.spec.ts

@@ -47,4 +47,13 @@ test.describe('Doc Routing: Not loggued', () => {
     await keyCloakSignIn(page, browserName);
     await expect(page).toHaveURL(/\/docs\/mocked-document-id\/$/);
   });
+
+  test('The homepage redirects to login.', async ({ page }) => {
+    await page.goto('/');
+    await expect(
+      page.getByRole('button', {
+        name: 'Sign In',
+      }),
+    ).toBeVisible();
+  });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-summary.spec.ts

@@ -1,64 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-import { createDoc } from './common';
-
-test.beforeEach(async ({ page }) => {
-  await page.goto('/');
-});
-
-test.describe('Doc Summary', () => {
-  test('it checks the doc summary', async ({ page, browserName }) => {
-    const [randomDoc] = await createDoc(page, 'doc-summary', browserName, 1);
-
-    await expect(page.locator('h2').getByText(randomDoc)).toBeVisible();
-
-    await page.getByLabel('Open the document options').click();
-    await page
-      .getByRole('button', {
-        name: 'Summary',
-      })
-      .click();
-
-    const panel = page.getByLabel('Document panel');
-    const editor = page.locator('.ProseMirror');
-
-    await editor.locator('.bn-block-outer').last().fill('/');
-    await page.getByText('Heading 1').click();
-    await page.keyboard.type('Hello World');
-
-    await page.locator('.bn-block-outer').last().click();
-
-    // Create space to fill the viewport
-    for (let i = 0; i < 6; i++) {
-      await page.keyboard.press('Enter');
-    }
-
-    await editor.locator('.bn-block-outer').last().fill('/');
-    await page.getByText('Heading 2').click();
-    await page.keyboard.type('Super World');
-
-    await page.locator('.bn-block-outer').last().click();
-
-    // Create space to fill the viewport
-    for (let i = 0; i < 4; i++) {
-      await page.keyboard.press('Enter');
-    }
-
-    await editor.locator('.bn-block-outer').last().fill('/');
-    await page.getByText('Heading 3').click();
-    await page.keyboard.type('Another World');
-
-    await expect(panel.getByText('Hello World')).toBeVisible();
-    await expect(panel.getByText('Super World')).toBeVisible();
-
-    await panel.getByText('Another World').click();
-
-    await expect(editor.getByText('Hello World')).not.toBeInViewport();
-
-    await panel.getByText('Back to top').click();
-    await expect(editor.getByText('Hello World')).toBeInViewport();
-
-    await panel.getByText('Go to bottom').click();
-    await expect(editor.getByText('Hello World')).not.toBeInViewport();
-  });
-});

src/frontend/apps/e2e/__tests__/app-impress/doc-table-content.spec.ts

@@ -0,0 +1,95 @@
+import { expect, test } from '@playwright/test';
+
+import { createDoc } from './common';
+
+test.beforeEach(async ({ page }) => {
+  await page.goto('/');
+});
+
+test.describe('Doc Table Content', () => {
+  test('it checks the doc table content', async ({ page, browserName }) => {
+    const [randomDoc] = await createDoc(
+      page,
+      'doc-table-content',
+      browserName,
+      1,
+    );
+
+    await expect(page.locator('h2').getByText(randomDoc)).toBeVisible();
+
+    await page.getByLabel('Open the document options').click();
+    await page
+      .getByRole('button', {
+        name: 'Table of contents',
+      })
+      .click();
+
+    const panel = page.getByLabel('Document panel');
+    const editor = page.locator('.ProseMirror');
+
+    await editor.locator('.bn-block-outer').last().fill('/');
+    await page.getByText('Heading 1').click();
+    await page.keyboard.type('Hello World');
+    await editor.getByText('Hello').dblclick();
+    await page.getByRole('button', { name: 'Strike' }).click();
+
+    await page.locator('.bn-block-outer').last().click();
+
+    // Create space to fill the viewport
+    for (let i = 0; i < 5; i++) {
+      await page.keyboard.press('Enter');
+    }
+
+    await editor.locator('.bn-block-outer').last().fill('/');
+    await page.getByText('Heading 2').click();
+    await page.keyboard.type('Super World', { delay: 100 });
+
+    await page.locator('.bn-block-outer').last().click();
+
+    // Create space to fill the viewport
+    for (let i = 0; i < 5; i++) {
+      await page.keyboard.press('Enter');
+    }
+
+    await editor.locator('.bn-block-outer').last().fill('/');
+    await page.getByText('Heading 3').click();
+    await page.keyboard.type('Another World');
+
+    const hello = panel.getByText('Hello World');
+    const superW = panel.getByText('Super World');
+    const another = panel.getByText('Another World');
+
+    await expect(hello).toBeVisible();
+    await expect(hello).toHaveCSS('font-size', /19/);
+    await expect(hello).toHaveAttribute('aria-selected', 'true');
+
+    await expect(superW).toBeVisible();
+    await expect(superW).toHaveCSS('font-size', /16/);
+    await expect(superW).toHaveAttribute('aria-selected', 'false');
+
+    await expect(another).toBeVisible();
+    await expect(another).toHaveCSS('font-size', /12/);
+    await expect(another).toHaveAttribute('aria-selected', 'false');
+
+    await hello.click();
+
+    await expect(editor.getByText('Hello World')).toBeInViewport();
+    await expect(hello).toHaveAttribute('aria-selected', 'true');
+    await expect(superW).toHaveAttribute('aria-selected', 'false');
+
+    await another.click();
+
+    await expect(editor.getByText('Hello World')).not.toBeInViewport();
+    await expect(hello).toHaveAttribute('aria-selected', 'false');
+    await expect(superW).toHaveAttribute('aria-selected', 'true');
+
+    await panel.getByText('Back to top').click();
+    await expect(editor.getByText('Hello World')).toBeInViewport();
+    await expect(hello).toHaveAttribute('aria-selected', 'true');
+    await expect(superW).toHaveAttribute('aria-selected', 'false');
+
+    await panel.getByText('Go to bottom').click();
+    await expect(editor.getByText('Hello World')).not.toBeInViewport();
+    await expect(superW).toHaveAttribute('aria-selected', 'true');
+  });
+});

src/frontend/apps/e2e/__tests__/app-impress/doc-visibility.spec.ts

@@ -0,0 +1,96 @@
+import { expect, test } from '@playwright/test';
+
+import { createDoc, keyCloakSignIn } from './common';
+
+test.describe('Doc Visibility', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.goto('/');
+  });
+
+  test('Make a public doc', async ({ page, browserName }) => {
+    const [docTitle] = await createDoc(
+      page,
+      'My new doc',
+      browserName,
+      1,
+      true,
+    );
+
+    const header = page.locator('header').first();
+    await header.locator('h2').getByText('Docs').click();
+
+    const datagrid = page
+      .getByLabel('Datagrid of the documents page 1')
+      .getByRole('table');
+
+    await expect(datagrid.getByLabel('Loading data')).toBeHidden();
+
+    await expect(datagrid.getByText(docTitle)).toBeVisible();
+
+    const row = datagrid.getByRole('row').filter({
+      hasText: docTitle,
+    });
+
+    await expect(row.getByRole('cell').nth(0)).toHaveText('Public');
+  });
+
+  test('It checks the copy link button', async ({ page, browserName }) => {
+    // eslint-disable-next-line playwright/no-skipped-test
+    test.skip(
+      browserName === 'webkit',
+      'navigator.clipboard is not working with webkit and playwright',
+    );
+
+    await createDoc(page, 'My button copy doc', browserName, 1);
+
+    await page.getByRole('button', { name: 'Share' }).click();
+    await page.getByRole('button', { name: 'Copy link' }).click();
+
+    await expect(page.getByText('Link Copied !')).toBeVisible();
+
+    const handle = await page.evaluateHandle(() =>
+      navigator.clipboard.readText(),
+    );
+    const clipboardContent = await handle.jsonValue();
+
+    expect(clipboardContent).toMatch(page.url());
+  });
+});
+
+test.describe('Doc Visibility: Not loggued', () => {
+  test.use({ storageState: { cookies: [], origins: [] } });
+
+  test('A public doc is accessible even when not authentified.', async ({
+    page,
+    browserName,
+  }) => {
+    await page.goto('/');
+    await keyCloakSignIn(page, browserName);
+
+    const [docTitle] = await createDoc(
+      page,
+      'My new doc',
+      browserName,
+      1,
+      true,
+    );
+
+    await expect(
+      page.getByText('The document visiblitity has been updated.'),
+    ).toBeVisible();
+
+    const urlDoc = page.url();
+
+    await page
+      .getByRole('button', {
+        name: 'Logout',
+      })
+      .click();
+
+    await expect(page.getByRole('button', { name: 'Sign in' })).toBeVisible();
+
+    await page.goto(urlDoc);
+
+    await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
+  });
+});

src/frontend/apps/e2e/__tests__/app-impress/header.spec.ts

@@ -22,6 +22,12 @@ test.describe('Header', () => {
       /Marianne/i,
     );
 
+    await expect(
+      header.getByRole('button', {
+        name: 'Logout',
+      }),
+    ).toBeVisible();
+
     await expect(header.getByAltText('Language Icon')).toBeVisible();
 
     await expect(
@@ -68,12 +74,6 @@ test.describe('Header: Log out', () => {
     await page.goto('/');
     await keyCloakSignIn(page, browserName);
 
-    await page
-      .getByRole('button', {
-        name: 'My account',
-      })
-      .click();
-
     await page
       .getByRole('button', {
         name: 'Logout',

src/frontend/apps/e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-e2e",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "private": true,
   "scripts": {
     "lint": "eslint . --ext .ts",
@@ -12,7 +12,7 @@
     "test:ui::chromium": "yarn test:ui --project=chromium"
   },
   "devDependencies": {
-    "@playwright/test": "1.46.1",
+    "@playwright/test": "1.47.1",
     "@types/node": "*",
     "@types/pdf-parse": "1.1.4",
     "eslint-config-impress": "*",

src/frontend/apps/e2e/playwright.config.ts

@@ -32,12 +32,10 @@ export default defineConfig({
   },
 
   webServer: {
-    command: `cd ../.. && yarn app:${
-      process.env.CI ? 'start -p ' : 'dev --port '
-    } ${PORT}`,
+    command: !process.env.CI ? `cd ../.. && yarn app:dev --port ${PORT}` : '',
     url: baseURL,
     timeout: 120 * 1000,
-    reuseExistingServer: !process.env.CI,
+    reuseExistingServer: true,
   },
 
   /* Configure projects for major browsers */
@@ -50,6 +48,9 @@ export default defineConfig({
         locale: 'en-US',
         timezoneId: 'Europe/Paris',
         storageState: 'playwright/.auth/user-chromium.json',
+        contextOptions: {
+          permissions: ['clipboard-read', 'clipboard-write'],
+        },
       },
       dependencies: ['setup'],
     },
@@ -70,6 +71,12 @@ export default defineConfig({
         locale: 'en-US',
         timezoneId: 'Europe/Paris',
         storageState: 'playwright/.auth/user-firefox.json',
+        launchOptions: {
+          firefoxUserPrefs: {
+            'dom.events.asyncClipboard.readText': true,
+            'dom.events.testing.asyncClipboard': true,
+          },
+        },
       },
       dependencies: ['setup'],
     },

src/frontend/apps/impress/conf/default.conf

@@ -1,5 +1,6 @@
 server {
   listen 8080;
+  listen 3000;
   server_name localhost;
 
   root /usr/share/nginx/html;

src/frontend/apps/impress/cunningham.ts

@@ -340,6 +340,10 @@ const config = {
         'forms-checkbox': {
           'border-radius': '0',
           color: 'var(--c--theme--colors--primary-text)',
+          text: {
+            color: 'var(--c--theme--colors--greyscale-text)',
+            size: 'var(--c--theme--font--sizes--t)',
+          },
         },
         'forms-datepicker': {
           'border-radius': '0',

src/frontend/apps/impress/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/basic-features/typescript for more information.
+// see https://nextjs.org/docs/pages/building-your-application/configuring/typescript for more information.

src/frontend/apps/impress/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-impress",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -21,33 +21,34 @@
     "@gouvfr-lasuite/integration": "1.0.2",
     "@hocuspocus/provider": "2.13.5",
     "@openfun/cunningham-react": "2.9.4",
-    "@tanstack/react-query": "5.53.2",
-    "i18next": "23.14.0",
+    "@tanstack/react-query": "5.56.2",
+    "i18next": "23.15.1",
     "idb": "8.0.0",
     "lodash": "4.17.21",
     "luxon": "3.5.0",
-    "next": "14.2.7",
+    "next": "14.2.11",
     "react": "*",
     "react-aria-components": "1.3.3",
     "react-dom": "*",
-    "react-i18next": "15.0.1",
+    "react-i18next": "15.0.2",
     "react-select": "5.8.0",
     "styled-components": "6.1.13",
+    "y-protocols": "1.0.6",
     "yjs": "*",
     "zustand": "4.5.5"
   },
   "devDependencies": {
     "@svgr/webpack": "8.1.0",
-    "@tanstack/react-query-devtools": "5.53.2",
+    "@tanstack/react-query-devtools": "5.56.2",
     "@testing-library/dom": "10.4.0",
     "@testing-library/jest-dom": "6.5.0",
     "@testing-library/react": "16.0.1",
     "@testing-library/user-event": "14.5.2",
-    "@types/jest": "29.5.12",
+    "@types/jest": "29.5.13",
     "@types/lodash": "4.17.7",
     "@types/luxon": "3.4.2",
     "@types/node": "*",
-    "@types/react": "18.3.5",
+    "@types/react": "18.3.6",
     "@types/react-dom": "*",
     "cross-env": "*",
     "dotenv": "16.4.5",
@@ -61,6 +62,7 @@
     "stylelint-config-standard": "36.0.1",
     "stylelint-prettier": "5.0.2",
     "typescript": "*",
+    "webpack": "5.94.0",
     "workbox-webpack-plugin": "7.1.0"
   }
 }

src/frontend/apps/impress/src/api/__tests__/fetchApi.test.tsx

@@ -1,7 +1,6 @@
 import fetchMock from 'fetch-mock';
 
 import { fetchAPI } from '@/api';
-import { useAuthStore } from '@/core/auth';
 
 describe('fetchAPI', () => {
   beforeEach(() => {
@@ -30,19 +29,6 @@ describe('fetchAPI', () => {
     });
   });
 
-  it('logout if 401 response', async () => {
-    const logoutMock = jest.fn();
-    jest
-      .spyOn(useAuthStore.getState(), 'logout')
-      .mockImplementation(logoutMock);
-
-    fetchMock.mock('http://test.jest/api/v1.0/some/url', 401);
-
-    await fetchAPI('some/url');
-
-    expect(logoutMock).toHaveBeenCalled();
-  });
-
   it('check the versionning', () => {
     fetchMock.mock('http://test.jest/api/v2.0/some/url', 200);
 

src/frontend/apps/impress/src/api/fetchApi.ts

@@ -1,4 +1,4 @@
-import { baseApiUrl, useAuthStore } from '@/core';
+import { baseApiUrl } from '@/core';
 
 import { getCSRFToken } from './utils';
 
@@ -30,10 +30,5 @@ export const fetchAPI = async (
     headers,
   });
 
-  if (response.status === 401) {
-    const { logout } = useAuthStore.getState();
-    logout();
-  }
-
   return response;
 };

src/frontend/apps/impress/src/components/Panel.tsx

@@ -5,7 +5,7 @@ import { Box, Card, IconBG, Text } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
 
 interface PanelProps {
-  title: string;
+  title?: string;
   setIsPanelOpen: (isOpen: boolean) => void;
 }
 
@@ -36,10 +36,10 @@ export const Panel = ({
       $width="100%"
       $maxWidth="20rem"
       $position="sticky"
-      $maxHeight="96vh"
+      $maxHeight="99vh"
       $height="100%"
       $css={`
-        top: 2vh;
+        top: 0vh;
         transition: ${transition};
         ${
           !isOpen &&
@@ -53,11 +53,14 @@ export const Panel = ({
       {...closedOverridingStyles}
     >
       <Box
-        $overflow="hidden"
+        $overflow="inherit"
+        $position="sticky"
         $css={`
+          top: 0;
           opacity: ${isOpen ? '1' : '0'};
           transition: ${transition};
         `}
+        $maxHeight="100%"
       >
         <Box
           $padding={{ all: 'small' }}
@@ -90,9 +93,11 @@ export const Panel = ({
             }}
             $radius="2px"
           />
-          <Text $weight="bold" $size="l" $theme="primary">
-            {title}
-          </Text>
+          {title && (
+            <Text $weight="bold" $size="l" $theme="primary">
+              {title}
+            </Text>
+          )}
         </Box>
         {children}
       </Box>

src/frontend/apps/impress/src/core/AppProvider.tsx

@@ -4,7 +4,7 @@ import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { useCunninghamTheme } from '@/cunningham';
 import '@/i18n/initI18n';
 
-import { Auth } from './auth/Auth';
+import { Auth } from './auth/';
 
 /**
  * QueryClient:

src/frontend/apps/impress/src/core/auth/AccountDropdown.tsx

@@ -0,0 +1,34 @@
+import { Button } from '@openfun/cunningham-react';
+import React from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { useAuthStore } from '@/core/auth';
+
+export const AccountDropdown = () => {
+  const { t } = useTranslation();
+  const { logout, authenticated, login } = useAuthStore();
+
+  if (!authenticated) {
+    return (
+      <Button
+        onClick={login}
+        color="primary-text"
+        icon={<span className="material-icons">login</span>}
+        aria-label={t('Login')}
+      >
+        {t('Login')}
+      </Button>
+    );
+  }
+
+  return (
+    <Button
+      onClick={logout}
+      color="primary-text"
+      icon={<span className="material-icons">logout</span>}
+      aria-label={t('Logout')}
+    >
+      {t('Logout')}
+    </Button>
+  );
+};

src/frontend/apps/impress/src/core/auth/Auth.tsx

@@ -1,18 +1,47 @@
 import { Loader } from '@openfun/cunningham-react';
-import { PropsWithChildren, useEffect } from 'react';
+import { useRouter } from 'next/router';
+import { PropsWithChildren, useEffect, useState } from 'react';
 
 import { Box } from '@/components';
 
 import { useAuthStore } from './useAuthStore';
 
+/**
+ * TODO: Remove this restriction when we will have a homepage design for non-authenticated users.
+ *
+ * We define the paths that are not allowed without authentication.
+ * Actually, only the home page and the docs page are not allowed without authentication.
+ * When we will have a homepage design for non-authenticated users, we will remove this restriction to have
+ * the full website accessible without authentication.
+ */
+const regexpUrlsAuth = [/\/docs\/$/g, /^\/$/g];
+
 export const Auth = ({ children }: PropsWithChildren) => {
-  const { authenticated, initAuth } = useAuthStore();
+  const { initAuth, initiated, authenticated, login } = useAuthStore();
+  const { asPath } = useRouter();
+
+  const [pathAllowed, setPathAllowed] = useState<boolean>(
+    !regexpUrlsAuth.some((regexp) => !!asPath.match(regexp)),
+  );
 
   useEffect(() => {
     initAuth();
   }, [initAuth]);
 
-  if (!authenticated) {
+  useEffect(() => {
+    setPathAllowed(!regexpUrlsAuth.some((regexp) => !!asPath.match(regexp)));
+  }, [asPath]);
+
+  // We force to login except on allowed paths
+  useEffect(() => {
+    if (!initiated || authenticated || pathAllowed) {
+      return;
+    }
+
+    login();
+  }, [authenticated, pathAllowed, login, initiated]);
+
+  if ((!initiated && pathAllowed) || (!authenticated && !pathAllowed)) {
     return (
       <Box $height="100vh" $width="100vw" $align="center" $justify="center">
         <Loader />

src/frontend/apps/impress/src/core/auth/index.ts

@@ -1,3 +1,4 @@
+export * from './AccountDropdown';
+export * from './api/types';
 export * from './Auth';
 export * from './useAuthStore';
-export * from './api/types';

src/frontend/apps/impress/src/core/auth/useAuthStore.tsx

@@ -6,18 +6,22 @@ import { User, getMe } from './api';
 import { PATH_AUTH_LOCAL_STORAGE } from './conf';
 
 interface AuthStore {
+  initiated: boolean;
   authenticated: boolean;
   initAuth: () => void;
   logout: () => void;
+  login: () => void;
   userData?: User;
 }
 
 const initialState = {
+  initiated: false,
   authenticated: false,
   userData: undefined,
 };
 
 export const useAuthStore = create<AuthStore>((set) => ({
+  initiated: initialState.initiated,
   authenticated: initialState.authenticated,
   userData: initialState.userData,
 
@@ -34,20 +38,21 @@ export const useAuthStore = create<AuthStore>((set) => ({
 
         set({ authenticated: true, userData: data });
       })
-      .catch(() => {
-        // If we try to access a specific page and we are not authenticated
-        // we store the path in the local storage to redirect to it after login
-        if (window.location.pathname !== '/') {
-          localStorage.setItem(
-            PATH_AUTH_LOCAL_STORAGE,
-            window.location.pathname,
-          );
-        }
-
-        window.location.replace(new URL('authenticate/', baseApiUrl()).href);
+      .catch(() => {})
+      .finally(() => {
+        set({ initiated: true });
       });
   },
+  login: () => {
+    // If we try to access a specific page and we are not authenticated
+    // we store the path in the local storage to redirect to it after login
+    if (window.location.pathname !== '/') {
+      localStorage.setItem(PATH_AUTH_LOCAL_STORAGE, window.location.pathname);
+    }
+
+    window.location.replace(`${baseApiUrl()}authenticate/`);
+  },
   logout: () => {
-    window.location.replace(new URL('logout/', baseApiUrl()).href);
+    window.location.replace(`${baseApiUrl()}logout/`);
   },
 }));

src/frontend/apps/impress/src/cunningham/cunningham-style.css

@@ -308,6 +308,11 @@ input:-webkit-autofill:focus {
   transition: all 0.8s ease-in-out;
 }
 
+.c__checkbox .c__field__text {
+  color: var(--c--components--forms-checkbox--text--color);
+  font-size: var(--c--components--forms-checkbox--text--size);
+}
+
 /**
  * Button
 */

src/frontend/apps/impress/src/cunningham/cunningham-tokens.css

@@ -463,6 +463,10 @@
   );
   --c--components--forms-checkbox--border-radius: 0;
   --c--components--forms-checkbox--color: var(--c--theme--colors--primary-text);
+  --c--components--forms-checkbox--text--color: var(
+    --c--theme--colors--greyscale-text
+  );
+  --c--components--forms-checkbox--text--size: var(--c--theme--font--sizes--t);
   --c--components--forms-datepicker--border-radius: 0;
   --c--components--forms-fileuploader--border-radius: 0;
   --c--components--forms-field--color: var(--c--theme--colors--primary-text);

src/frontend/apps/impress/src/cunningham/cunningham-tokens.ts

@@ -469,6 +469,10 @@ export const tokens = {
         'forms-checkbox': {
           'border-radius': '0',
           color: 'var(--c--theme--colors--primary-text)',
+          text: {
+            color: 'var(--c--theme--colors--greyscale-text)',
+            size: 'var(--c--theme--font--sizes--t)',
+          },
         },
         'forms-datepicker': { 'border-radius': '0' },
         'forms-fileuploader': { 'border-radius': '0' },

src/frontend/apps/impress/src/features/docs/doc-editor/components/DocEditor.tsx

@@ -9,7 +9,7 @@ import { Panel } from '@/components/Panel';
 import { useCunninghamTheme } from '@/cunningham';
 import { DocHeader } from '@/features/docs/doc-header';
 import { Doc } from '@/features/docs/doc-management';
-import { Summary, useDocSummaryStore } from '@/features/docs/doc-summary';
+import { TableContent } from '@/features/docs/doc-table-content';
 import {
   VersionList,
   Versions,
@@ -28,8 +28,6 @@ export const DocEditor = ({ doc }: DocEditorProps) => {
     query: { versionId },
   } = useRouter();
   const { isPanelVersionOpen, setIsPanelVersionOpen } = useDocVersionStore();
-  const { isPanelSummaryOpen, setIsPanelSummaryOpen } = useDocSummaryStore();
-
   const { t } = useTranslation();
 
   const isVersion = versionId && typeof versionId === 'string';
@@ -72,11 +70,7 @@ export const DocEditor = ({ doc }: DocEditorProps) => {
             <VersionList doc={doc} />
           </Panel>
         )}
-        {isPanelSummaryOpen && (
-          <Panel title={t('SUMMARY')} setIsPanelOpen={setIsPanelSummaryOpen}>
-            <Summary doc={doc} />
-          </Panel>
-        )}
+        <TableContent doc={doc} />
       </Box>
     </>
   );

src/frontend/apps/impress/src/features/docs/doc-header/components/DocHeader.tsx

@@ -13,6 +13,7 @@ import {
 import { ModalVersion, Versions } from '@/features/docs/doc-versioning';
 import { useDate } from '@/hook';
 
+import { DocTagPublic } from './DocTagPublic';
 import { DocToolBox } from './DocToolBox';
 
 interface DocHeaderProps {
@@ -84,18 +85,7 @@ export const DocHeader = ({ doc, versionId }: DocHeaderProps) => {
           $wrap="wrap"
         >
           <Box $direction="row" $align="center" $gap="0.5rem 2rem" $wrap="wrap">
-            {doc.is_public && (
-              <Text
-                $weight="bold"
-                $background={colorsTokens()['primary-600']}
-                $color="white"
-                $padding="xtiny"
-                $radius="3px"
-                $size="s"
-              >
-                {t('Public')}
-              </Text>
-            )}
+            <DocTagPublic doc={doc} />
             <Text $size="s" $display="inline">
               {t('Created at')} <strong>{formatDate(doc.created_at)}</strong>
             </Text>

src/frontend/apps/impress/src/features/docs/doc-header/components/DocTagPublic.tsx

@@ -0,0 +1,31 @@
+import { useTranslation } from 'react-i18next';
+
+import { Text } from '@/components';
+import { useCunninghamTheme } from '@/cunningham';
+import { Doc, LinkReach } from '@/features/docs/doc-management';
+
+interface DocTagPublicProps {
+  doc: Doc;
+}
+
+export const DocTagPublic = ({ doc }: DocTagPublicProps) => {
+  const { colorsTokens } = useCunninghamTheme();
+  const { t } = useTranslation();
+
+  if (doc?.link_reach !== LinkReach.PUBLIC) {
+    return null;
+  }
+
+  return (
+    <Text
+      $weight="bold"
+      $background={colorsTokens()['primary-600']}
+      $color="white"
+      $padding="xtiny"
+      $radius="3px"
+      $size="s"
+    >
+      {t('Public')}
+    </Text>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-header/components/DocToolBox.tsx

@@ -9,7 +9,7 @@ import {
   ModalShare,
   ModalUpdateDoc,
 } from '@/features/docs/doc-management';
-import { useDocSummaryStore } from '@/features/docs/doc-summary';
+import { useDocTableContentStore } from '@/features/docs/doc-table-content';
 import { useDocVersionStore } from '@/features/docs/doc-versioning';
 
 import { ModalPDF } from './ModalExport';
@@ -26,7 +26,7 @@ export const DocToolBox = ({ doc }: DocToolBoxProps) => {
   const [isModalPDFOpen, setIsModalPDFOpen] = useState(false);
   const [isDropOpen, setIsDropOpen] = useState(false);
   const { setIsPanelVersionOpen } = useDocVersionStore();
-  const { setIsPanelSummaryOpen } = useDocSummaryStore();
+  const { setIsPanelTableContentOpen } = useDocTableContentStore();
 
   return (
     <Box
@@ -83,7 +83,7 @@ export const DocToolBox = ({ doc }: DocToolBoxProps) => {
           )}
           <Button
             onClick={() => {
-              setIsPanelSummaryOpen(true);
+              setIsPanelTableContentOpen(true);
               setIsPanelVersionOpen(false);
               setIsDropOpen(false);
             }}
@@ -91,7 +91,7 @@ export const DocToolBox = ({ doc }: DocToolBoxProps) => {
             icon={<span className="material-icons">summarize</span>}
             size="small"
           >
-            <Text $theme="primary">{t('Summary')}</Text>
+            <Text $theme="primary">{t('Table of contents')}</Text>
           </Button>
           <Button
             onClick={() => {

src/frontend/apps/impress/src/features/docs/doc-management/api/index.ts

@@ -1,3 +1,4 @@
 export * from './useDoc';
 export * from './useDocs';
 export * from './useUpdateDoc';
+export * from './useUpdateDocLink';

src/frontend/apps/impress/src/features/docs/doc-management/api/useCreateDoc.tsx

@@ -6,17 +6,13 @@ import { Doc } from '../types';
 
 import { KEY_LIST_DOC } from './useDocs';
 
-export type CreateDocParam = Pick<Doc, 'title' | 'is_public'>;
+export type CreateDocParam = Pick<Doc, 'title'>;
 
-export const createDoc = async ({
-  title,
-  is_public,
-}: CreateDocParam): Promise<Doc> => {
+export const createDoc = async ({ title }: CreateDocParam): Promise<Doc> => {
   const response = await fetchAPI(`documents/`, {
     method: 'POST',
     body: JSON.stringify({
       title,
-      is_public,
     }),
   });
 

src/frontend/apps/impress/src/features/docs/doc-management/api/useDoc.tsx

@@ -19,6 +19,7 @@ export const getDoc = async ({ id }: DocParams): Promise<Doc> => {
 };
 
 export const KEY_DOC = 'doc';
+export const KEY_DOC_VISIBILITY = 'doc-visibility';
 
 export function useDoc(
   param: DocParams,

src/frontend/apps/impress/src/features/docs/doc-management/api/useUpdateDoc.tsx

@@ -4,7 +4,7 @@ import { APIError, errorCauses, fetchAPI } from '@/api';
 import { Doc } from '@/features/docs';
 
 export type UpdateDocParams = Pick<Doc, 'id'> &
-  Partial<Pick<Doc, 'content' | 'title' | 'is_public'>>;
+  Partial<Pick<Doc, 'content' | 'title'>>;
 
 export const updateDoc = async ({
   id,

src/frontend/apps/impress/src/features/docs/doc-management/api/useUpdateDocLink.tsx

@@ -0,0 +1,51 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+import { Doc } from '@/features/docs';
+
+export type UpdateDocLinkParams = Pick<Doc, 'id'> &
+  Partial<Pick<Doc, 'link_role' | 'link_reach'>>;
+
+export const updateDocLink = async ({
+  id,
+  ...params
+}: UpdateDocLinkParams): Promise<Doc> => {
+  const response = await fetchAPI(`documents/${id}/link-configuration/`, {
+    method: 'PUT',
+    body: JSON.stringify({
+      ...params,
+    }),
+  });
+
+  if (!response.ok) {
+    throw new APIError(
+      'Failed to update the doc link',
+      await errorCauses(response),
+    );
+  }
+
+  return response.json() as Promise<Doc>;
+};
+
+interface UpdateDocLinkProps {
+  onSuccess?: (data: Doc) => void;
+  listInvalideQueries?: string[];
+}
+
+export function useUpdateDocLink({
+  onSuccess,
+  listInvalideQueries,
+}: UpdateDocLinkProps = {}) {
+  const queryClient = useQueryClient();
+  return useMutation<Doc, APIError, UpdateDocLinkParams>({
+    mutationFn: updateDocLink,
+    onSuccess: (data) => {
+      listInvalideQueries?.forEach((queryKey) => {
+        void queryClient.resetQueries({
+          queryKey: [queryKey],
+        });
+      });
+      onSuccess?.(data);
+    },
+  });
+}

src/frontend/apps/impress/src/features/docs/doc-management/components/DocVisibility.tsx

@@ -0,0 +1,90 @@
+import {
+  Button,
+  Switch,
+  VariantType,
+  useToastProvider,
+} from '@openfun/cunningham-react';
+import { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { Box, Card, IconBG } from '@/components';
+
+import { KEY_DOC, KEY_LIST_DOC, useUpdateDocLink } from '../api';
+import { Doc, LinkReach } from '../types';
+
+interface DocVisibilityProps {
+  doc: Doc;
+}
+
+export const DocVisibility = ({ doc }: DocVisibilityProps) => {
+  const { t } = useTranslation();
+  const [docPublic, setDocPublic] = useState(
+    doc.link_reach === LinkReach.PUBLIC,
+  );
+  const { toast } = useToastProvider();
+  const api = useUpdateDocLink({
+    onSuccess: () => {
+      toast(
+        t('The document visiblitity has been updated.'),
+        VariantType.SUCCESS,
+        {
+          duration: 4000,
+        },
+      );
+    },
+    listInvalideQueries: [KEY_LIST_DOC, KEY_DOC],
+  });
+
+  return (
+    <Card
+      $margin="tiny"
+      $padding={{ horizontal: 'small', vertical: 'tiny' }}
+      aria-label={t('Doc visibility card')}
+      $direction="row"
+      $align="center"
+      $justify="space-between"
+    >
+      <Box $direction="row" $gap="1rem">
+        <IconBG iconName="public" $margin="none" />
+        <Switch
+          label={t(docPublic ? 'Doc public' : 'Doc private')}
+          defaultChecked={docPublic}
+          onChange={() => {
+            api.mutate({
+              id: doc.id,
+              link_reach: docPublic ? LinkReach.RESTRICTED : LinkReach.PUBLIC,
+              link_role: 'reader',
+            });
+            setDocPublic(!docPublic);
+          }}
+          disabled={!doc.abilities.link_configuration}
+          text={t(
+            docPublic
+              ? 'Anyone on the internet with the link can view'
+              : 'Only for people with access',
+          )}
+        />
+      </Box>
+      <Button
+        onClick={() => {
+          navigator.clipboard
+            .writeText(window.location.href)
+            .then(() => {
+              toast(t('Link Copied !'), VariantType.SUCCESS, {
+                duration: 3000,
+              });
+            })
+            .catch(() => {
+              toast(t('Failed to copy link'), VariantType.ERROR, {
+                duration: 3000,
+              });
+            });
+        }}
+        color="primary"
+        icon={<span className="material-icons">copy</span>}
+      >
+        {t('Copy link')}
+      </Button>
+    </Card>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-management/components/ModalCreateUpdateDoc.tsx

@@ -3,7 +3,6 @@ import {
   Button,
   Modal,
   ModalSize,
-  Switch,
   VariantType,
   useToastProvider,
 } from '@openfun/cunningham-react';
@@ -44,9 +43,8 @@ export const ModalCreateDoc = ({ onClose }: ModalCreateDocProps) => {
         onClose,
         isPublic: false,
         titleModal: t('Create a new document'),
-        validate: (title, is_public) =>
+        validate: (title) =>
           api.mutate({
-            is_public,
             title,
           }),
         ...api,
@@ -80,14 +78,12 @@ export const ModalUpdateDoc = ({ onClose, doc }: ModalUpdateDocProps) => {
         buttonText: t('Validate the modification'),
         onClose,
         initialTitle: doc.title,
-        isPublic: doc.is_public,
         infoText: t('Enter the new name of the selected document.'),
         titleModal: t('Update document "{{documentTitle}}"', {
           documentTitle: doc.title,
         }),
-        validate: (title, is_public) =>
+        validate: (title) =>
           api.mutate({
-            is_public,
             title,
             id: doc.id,
           }),
@@ -99,10 +95,9 @@ export const ModalUpdateDoc = ({ onClose, doc }: ModalUpdateDocProps) => {
 
 type ModalDoc<T> = {
   buttonText: string;
-  isPublic: boolean;
   onClose: () => void;
   titleModal: string;
-  validate: (title: string, is_public: boolean) => void;
+  validate: (title: string) => void;
   initialTitle?: string;
   infoText?: string;
 } & UseMutationResult<Doc, APIError<unknown>, T, unknown>;
@@ -111,7 +106,6 @@ const ModalDoc = <T,>({
   buttonText,
   infoText,
   initialTitle,
-  isPublic,
   onClose,
   titleModal,
   validate,
@@ -121,8 +115,6 @@ const ModalDoc = <T,>({
   const { t } = useTranslation();
   const [title, setTitle] = useState(initialTitle || '');
 
-  const [docPublic, setDocPublic] = useState(isPublic);
-
   return (
     <Modal
       isOpen
@@ -144,7 +136,7 @@ const ModalDoc = <T,>({
           aria-label={buttonText}
           color="primary"
           fullWidth
-          onClick={() => validate(title, docPublic)}
+          onClick={() => validate(title)}
         >
           {buttonText}
         </Button>
@@ -177,12 +169,6 @@ const ModalDoc = <T,>({
               setDocName: setTitle,
             }}
           />
-          <Switch
-            label={t('Is it public ?')}
-            labelSide="right"
-            defaultChecked={docPublic}
-            onChange={() => setDocPublic(!docPublic)}
-          />
         </Box>
       </Box>
     </Modal>

src/frontend/apps/impress/src/features/docs/doc-management/components/ModalShare.tsx

@@ -10,6 +10,8 @@ import { MemberList } from '@/features/docs/members/members-list';
 import { Doc } from '../types';
 import { currentDocRole } from '../utils';
 
+import { DocVisibility } from './DocVisibility';
+
 const ModalShareStyle = createGlobalStyle`
   & .c__modal__scroller{
     background: #FAFAFA;
@@ -44,28 +46,27 @@ export const ModalShare = ({ onClose, doc }: ModalShareProps) => {
         onClose={onClose}
         width="70vw"
         $css="min-width: 320px;max-width: 777px;"
-        title={
-          <Card
-            $direction="row"
-            $align="center"
-            $margin={{ horizontal: 'tiny', top: 'none', bottom: 'big' }}
-            $padding="tiny"
-            $gap="1rem"
-          >
-            <Text $isMaterialIcon $size="48px" $theme="primary">
-              share
-            </Text>
-            <Box $align="flex-start">
-              <Text as="h3" $size="26px" $margin="none">
-                {t('Share')}
-              </Text>
-              <Text $size="small" $weight="normal" $textAlign="left">
-                {doc.title}
-              </Text>
-            </Box>
-          </Card>
-        }
       >
+        <Card
+          $direction="row"
+          $align="center"
+          $margin={{ horizontal: 'tiny', top: 'none', bottom: 'big' }}
+          $padding="tiny"
+          $gap="1rem"
+        >
+          <Text $isMaterialIcon $size="48px" $theme="primary">
+            share
+          </Text>
+          <Box $align="flex-start">
+            <Text as="h3" $size="26px" $margin="none">
+              {t('Share')}
+            </Text>
+            <Text $size="small" $weight="normal" $textAlign="left">
+              {doc.title}
+            </Text>
+          </Box>
+        </Card>
+        <DocVisibility doc={doc} />
         <AddMembers doc={doc} currentRole={currentDocRole(doc.abilities)} />
         <InvitationList doc={doc} />
         <MemberList doc={doc} />

src/frontend/apps/impress/src/features/docs/doc-management/types.tsx

@@ -20,18 +20,26 @@ export enum Role {
   OWNER = 'owner',
 }
 
+export enum LinkReach {
+  RESTRICTED = 'restricted',
+  PUBLIC = 'public',
+  AUTHENTICATED = 'authenticated',
+}
+
 export type Base64 = string;
 
 export interface Doc {
   id: string;
   title: string;
   content: Base64;
-  is_public: boolean;
+  link_reach: LinkReach;
+  link_role: 'reader' | 'editor';
   accesses: Access[];
   created_at: string;
   updated_at: string;
   abilities: {
     destroy: boolean;
+    link_configuration: boolean;
     manage_accesses: boolean;
     partial_update: boolean;
     retrieve: boolean;

src/frontend/apps/impress/src/features/docs/doc-summary/components/Summary.tsx

@@ -1,104 +0,0 @@
-import React, { useCallback, useEffect, useState } from 'react';
-import { useTranslation } from 'react-i18next';
-
-import { Box, BoxButton, Text } from '@/components';
-
-import { useDocStore } from '../../doc-editor';
-import { Doc } from '../../doc-management';
-import { useDocSummaryStore } from '../stores';
-
-interface SummaryProps {
-  doc: Doc;
-}
-
-export const Summary = ({ doc }: SummaryProps) => {
-  const { docsStore } = useDocStore();
-  const { t } = useTranslation();
-
-  const editor = docsStore?.[doc.id]?.editor;
-  const headingFiltering = useCallback(
-    () => editor?.document.filter((block) => block.type === 'heading'),
-    [editor?.document],
-  );
-
-  const [headings, setHeadings] = useState(headingFiltering());
-  const { setIsPanelSummaryOpen } = useDocSummaryStore();
-
-  useEffect(() => {
-    return () => {
-      setIsPanelSummaryOpen(false);
-    };
-  }, [setIsPanelSummaryOpen]);
-
-  if (!editor) {
-    return null;
-  }
-
-  editor.onEditorContentChange(() => {
-    setHeadings(headingFiltering());
-  });
-
-  return (
-    <Box $overflow="auto" $padding="small">
-      {headings?.map((heading) => (
-        <BoxButton
-          key={heading.id}
-          onClick={() => {
-            editor.focus();
-            editor?.setTextCursorPosition(heading.id, 'end');
-            document
-              .querySelector(`[data-id="${heading.id}"]`)
-              ?.scrollIntoView({
-                behavior: 'smooth',
-                block: 'start',
-              });
-          }}
-          style={{ textAlign: 'left' }}
-        >
-          <Text $theme="primary" $padding={{ vertical: 'xtiny' }}>
-            {heading.content?.[0]?.type === 'text' && heading.content?.[0]?.text
-              ? `- ${heading.content[0].text}`
-              : ''}
-          </Text>
-        </BoxButton>
-      ))}
-      <Box
-        $height="1px"
-        $width="auto"
-        $background="#e5e5e5"
-        $margin={{ vertical: 'small' }}
-        $css="flex: none;"
-      />
-      <BoxButton
-        onClick={() => {
-          editor.focus();
-          document.querySelector(`.bn-editor`)?.scrollIntoView({
-            behavior: 'smooth',
-            block: 'start',
-          });
-        }}
-      >
-        <Text $theme="primary" $padding={{ vertical: 'xtiny' }}>
-          {t('Back to top')}
-        </Text>
-      </BoxButton>
-      <BoxButton
-        onClick={() => {
-          editor.focus();
-          document
-            .querySelector(
-              `.bn-editor > .bn-block-group > .bn-block-outer:last-child`,
-            )
-            ?.scrollIntoView({
-              behavior: 'smooth',
-              block: 'start',
-            });
-        }}
-      >
-        <Text $theme="primary" $padding={{ vertical: 'xtiny' }}>
-          {t('Go to bottom')}
-        </Text>
-      </BoxButton>
-    </Box>
-  );
-};

src/frontend/apps/impress/src/features/docs/doc-summary/components/index.ts

@@ -1 +0,0 @@
-export * from './Summary';

src/frontend/apps/impress/src/features/docs/doc-summary/stores/index.ts

@@ -1 +0,0 @@
-export * from './useDocSummaryStore';

src/frontend/apps/impress/src/features/docs/doc-summary/stores/useDocSummaryStore.tsx

@@ -1,13 +0,0 @@
-import { create } from 'zustand';
-
-export interface UseDocSummaryStore {
-  isPanelSummaryOpen: boolean;
-  setIsPanelSummaryOpen: (isOpen: boolean) => void;
-}
-
-export const useDocSummaryStore = create<UseDocSummaryStore>((set) => ({
-  isPanelSummaryOpen: false,
-  setIsPanelSummaryOpen: (isPanelSummaryOpen) => {
-    set(() => ({ isPanelSummaryOpen }));
-  },
-}));

src/frontend/apps/impress/src/features/docs/doc-table-content/components/Heading.tsx

@@ -0,0 +1,67 @@
+import { BlockNoteEditor } from '@blocknote/core';
+import { useState } from 'react';
+
+import { BoxButton, Text } from '@/components';
+import { useCunninghamTheme } from '@/cunningham';
+
+const sizeMap: { [key: number]: string } = {
+  1: '1.2rem',
+  2: '1rem',
+  3: '0.8rem',
+};
+
+export type HeadingsHighlight = {
+  headingId: string;
+  isVisible: boolean;
+}[];
+
+interface HeadingProps {
+  editor: BlockNoteEditor;
+  level: number;
+  text: string;
+  headingId: string;
+  isHighlight: boolean;
+}
+
+export const Heading = ({
+  headingId,
+  editor,
+  isHighlight,
+  level,
+  text,
+}: HeadingProps) => {
+  const [isHover, setIsHover] = useState(isHighlight);
+  const { colorsTokens } = useCunninghamTheme();
+
+  return (
+    <BoxButton
+      key={headingId}
+      onMouseOver={() => setIsHover(true)}
+      onMouseLeave={() => setIsHover(false)}
+      onClick={() => {
+        editor.focus();
+        editor.setTextCursorPosition(headingId, 'end');
+        document.querySelector(`[data-id="${headingId}"]`)?.scrollIntoView({
+          behavior: 'smooth',
+          block: 'start',
+        });
+      }}
+      $css="text-align: left;"
+    >
+      <Text
+        $theme="primary"
+        $padding={{ vertical: 'xtiny', left: 'tiny' }}
+        $size={sizeMap[level]}
+        $hasTransition
+        $css={
+          isHover || isHighlight
+            ? `box-shadow: -2px 0px 0px ${colorsTokens()[isHighlight ? 'primary-500' : 'primary-400']};`
+            : ''
+        }
+        aria-selected={isHighlight}
+      >
+        {text}
+      </Text>
+    </BoxButton>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-table-content/components/TableContent.tsx

@@ -0,0 +1,197 @@
+import React, { useCallback, useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { Box, BoxButton, Text } from '@/components';
+import { Panel } from '@/components/Panel';
+import { useDocStore } from '@/features/docs/doc-editor';
+import { Doc } from '@/features/docs/doc-management';
+
+import { useDocTableContentStore } from '../stores';
+
+import { Heading } from './Heading';
+
+const recursiveTextContent = (content: HeadingBlock['content']): string => {
+  if (!content) {
+    return '';
+  }
+
+  return content.reduce((acc, content) => {
+    if (content.type === 'text') {
+      return acc + content.text;
+    } else if (content.type === 'link') {
+      return acc + recursiveTextContent(content.content);
+    }
+
+    return acc;
+  }, '');
+};
+
+type HeadingBlock = {
+  id: string;
+  type: string;
+  text: string;
+  content: HeadingBlock[];
+  contentText: string;
+  props: {
+    level: number;
+  };
+};
+
+interface TableContentProps {
+  doc: Doc;
+}
+
+export const TableContent = ({ doc }: TableContentProps) => {
+  const { docsStore } = useDocStore();
+  const { t } = useTranslation();
+
+  const editor = docsStore?.[doc.id]?.editor;
+  const headingFiltering = useCallback(
+    () =>
+      editor?.document
+        .filter((block) => block.type === 'heading')
+        .map((block) => ({
+          ...block,
+          contentText: recursiveTextContent(
+            block.content as unknown as HeadingBlock['content'],
+          ),
+        })) as unknown as HeadingBlock[],
+    [editor?.document],
+  );
+
+  const [headings, setHeadings] = useState<HeadingBlock[]>();
+  const { setIsPanelTableContentOpen, isPanelTableContentOpen } =
+    useDocTableContentStore();
+  const [hasBeenClose, setHasBeenClose] = useState(false);
+  const setClosePanel = () => {
+    setHasBeenClose(true);
+    setIsPanelTableContentOpen(false);
+  };
+
+  const [headingIdHighlight, setHeadingIdHighlight] = useState<string>();
+
+  // Open the panel if there are more than 1 heading
+  useEffect(() => {
+    if (headings?.length && headings.length > 1 && !hasBeenClose) {
+      setIsPanelTableContentOpen(true);
+    }
+  }, [setIsPanelTableContentOpen, headings, hasBeenClose]);
+
+  // Close the panel unmount
+  useEffect(() => {
+    return () => {
+      setIsPanelTableContentOpen(false);
+    };
+  }, [setIsPanelTableContentOpen]);
+
+  // To highlight the first heading in the viewport
+  useEffect(() => {
+    const handleScroll = () => {
+      if (!headings) {
+        return;
+      }
+
+      for (const heading of headings) {
+        const elHeading = document.body.querySelector(
+          `.bn-block-outer[data-id="${heading.id}"] [data-content-type="heading"]:first-child`,
+        );
+
+        if (!elHeading) {
+          return;
+        }
+
+        const rect = elHeading.getBoundingClientRect();
+        const isVisible =
+          rect.top + rect.height >= 1 &&
+          rect.bottom <=
+            (window.innerHeight || document.documentElement.clientHeight);
+
+        if (isVisible) {
+          setHeadingIdHighlight(heading.id);
+          break;
+        }
+      }
+    };
+
+    window.addEventListener('scroll', () => {
+      setTimeout(() => {
+        handleScroll();
+      }, 300);
+    });
+
+    handleScroll();
+
+    return () => {
+      window.removeEventListener('scroll', handleScroll);
+    };
+  }, [headings, setHeadingIdHighlight]);
+
+  if (!editor) {
+    return null;
+  }
+
+  // Update the headings when the editor content changes
+  editor?.onEditorContentChange(() => {
+    setHeadings(headingFiltering());
+  });
+
+  if (!isPanelTableContentOpen) {
+    return null;
+  }
+
+  return (
+    <Panel setIsPanelOpen={setClosePanel}>
+      <Box $padding="small" $maxHeight="95%">
+        <Box $overflow="auto">
+          {headings?.map((heading) => (
+            <Heading
+              editor={editor}
+              headingId={heading.id}
+              level={heading.props.level}
+              text={heading.contentText}
+              key={heading.id}
+              isHighlight={headingIdHighlight === heading.id}
+            />
+          ))}
+        </Box>
+        <Box
+          $height="1px"
+          $width="auto"
+          $background="#e5e5e5"
+          $margin={{ vertical: 'small' }}
+          $css="flex: none;"
+        />
+        <BoxButton
+          onClick={() => {
+            editor.focus();
+            document.querySelector(`.bn-editor`)?.scrollIntoView({
+              behavior: 'smooth',
+              block: 'start',
+            });
+          }}
+        >
+          <Text $theme="primary" $padding={{ vertical: 'xtiny' }}>
+            {t('Back to top')}
+          </Text>
+        </BoxButton>
+        <BoxButton
+          onClick={() => {
+            editor.focus();
+            document
+              .querySelector(
+                `.bn-editor > .bn-block-group > .bn-block-outer:last-child`,
+              )
+              ?.scrollIntoView({
+                behavior: 'smooth',
+                block: 'start',
+              });
+          }}
+        >
+          <Text $theme="primary" $padding={{ vertical: 'xtiny' }}>
+            {t('Go to bottom')}
+          </Text>
+        </BoxButton>
+      </Box>
+    </Panel>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-table-content/components/index.ts

@@ -0,0 +1 @@
+export * from './TableContent';

src/frontend/apps/impress/src/features/docs/doc-table-content/stores/index.ts

@@ -0,0 +1 @@
+export * from './useDocTableContentStore';

src/frontend/apps/impress/src/features/docs/doc-table-content/stores/useDocTableContentStore.tsx

@@ -0,0 +1,15 @@
+import { create } from 'zustand';
+
+export interface UseDocTableContentStore {
+  isPanelTableContentOpen: boolean;
+  setIsPanelTableContentOpen: (isOpen: boolean) => void;
+}
+
+export const useDocTableContentStore = create<UseDocTableContentStore>(
+  (set) => ({
+    isPanelTableContentOpen: false,
+    setIsPanelTableContentOpen: (isPanelTableContentOpen) => {
+      set(() => ({ isPanelTableContentOpen }));
+    },
+  }),
+);

src/frontend/apps/impress/src/features/docs/docs-grid/components/DocsGrid.tsx

@@ -8,6 +8,7 @@ import { useCunninghamTheme } from '@/cunningham';
 import {
   Doc,
   DocsOrdering,
+  LinkReach,
   currentDocRole,
   isDocsOrdering,
   useDocs,
@@ -109,7 +110,7 @@ export const DocsGrid = () => {
             renderCell: ({ row }) => {
               return (
                 <StyledLink href={`/docs/${row.id}`}>
-                  {row.is_public && (
+                  {row.link_reach === LinkReach.PUBLIC && (
                     <Text
                       $weight="bold"
                       $background={colorsTokens()['primary-600']}
@@ -117,7 +118,7 @@ export const DocsGrid = () => {
                       $padding="xtiny"
                       $radius="3px"
                     >
-                      {row.is_public ? t('Public') : ''}
+                      {t('Public')}
                     </Text>
                   )}
                 </StyledLink>

src/frontend/apps/impress/src/features/docs/members/invitation-list/components/InvitationList.tsx

@@ -98,7 +98,7 @@ export const InvitationList = ({ doc }: InvitationListProps) => {
     <Card
       $margin="tiny"
       $padding="tiny"
-      $maxHeight="60%"
+      $maxHeight="40%"
       $overflow="auto"
       aria-label={t('List invitation card')}
     >

src/frontend/apps/impress/src/features/docs/members/members-add/components/AddMembers.tsx

@@ -138,7 +138,7 @@ export const AddMembers = ({ currentRole, doc }: ModalAddMembersProps) => {
   return (
     <Card
       $gap="1rem"
-      $padding="1rem"
+      $padding={{ horizontal: 'small', vertical: 'tiny' }}
       $margin="tiny"
       $direction="row"
       $align="center"

src/frontend/apps/impress/src/features/docs/members/members-list/components/MemberList.tsx

@@ -93,7 +93,7 @@ export const MemberList = ({ doc }: MemberListProps) => {
     <Card
       $margin="tiny"
       $padding="tiny"
-      $maxHeight="85%"
+      $maxHeight="69%"
       $overflow="auto"
       aria-label={t('List members card')}
     >

src/frontend/apps/impress/src/features/header/AccountDropdown.tsx

@@ -1,34 +0,0 @@
-import { Button } from '@openfun/cunningham-react';
-import React from 'react';
-import { useTranslation } from 'react-i18next';
-
-import { Box, DropButton, Text } from '@/components';
-import { useAuthStore } from '@/core/auth';
-
-export const AccountDropdown = () => {
-  const { t } = useTranslation();
-  const { logout } = useAuthStore();
-
-  return (
-    <DropButton
-      aria-label={t('My account')}
-      button={
-        <Box $flex $direction="row" $align="center">
-          <Text $theme="primary">{t('My account')}</Text>
-          <Text className="material-icons" $theme="primary">
-            arrow_drop_down
-          </Text>
-        </Box>
-      }
-    >
-      <Button
-        onClick={logout}
-        color="primary-text"
-        icon={<span className="material-icons">logout</span>}
-        aria-label={t('Logout')}
-      >
-        <Text $weight="normal">{t('Logout')}</Text>
-      </Button>
-    </DropButton>
-  );
-};

src/frontend/apps/impress/src/features/header/Header.tsx

@@ -4,11 +4,11 @@ import { useTranslation } from 'react-i18next';
 import styled from 'styled-components';
 
 import { Box, StyledLink, Text } from '@/components/';
+import { AccountDropdown } from '@/core/auth';
 import { useCunninghamTheme } from '@/cunningham';
 
 import { LanguagePicker } from '../language/';
 
-import { AccountDropdown } from './AccountDropdown';
 import { LaGaufre } from './LaGaufre';
 import { default as IconDocs } from './assets/icon-docs.svg?url';
 

src/frontend/apps/impress/src/features/service-worker/ApiPlugin.ts

@@ -189,6 +189,7 @@ export class ApiPlugin implements WorkboxPlugin {
       updated_at: new Date().toISOString(),
       abilities: {
         destroy: true,
+        link_configuration: true,
         versions_destroy: true,
         versions_list: true,
         versions_retrieve: true,

src/frontend/apps/impress/src/i18n/translations.json

@@ -20,6 +20,7 @@
       "Content modal to delete document": "Contenu modal pour supprimer le document",
       "Content modal to export the document": "Contenu modal pour exporter le document",
       "Cookies placed": "Cookies déposés",
+      "Copy link": "Copier le lien",
       "Copyright": "Copyright",
       "Create a new document": "Créer un nouveau document",
       "Create the document": "Créer le document",
@@ -29,9 +30,10 @@
       "Defender of Rights - Free response - 71120 75342 Paris CEDEX 07": "Défenseur des droits - Réponse gratuite - 71120 75342 Paris CEDEX 07",
       "Delete document": "Supprimer le document",
       "Deleting the document \"{{title}}\"": "Suppression du document \"{{title}}\"",
+      "Doc visibility card": "Carte de visibilité du doc",
       "Docs": "Docs",
-      "Docs Description": "Description de Docs",
       "Docs Logo": "Logo Docs",
+      "Docs: Your new companion to collaborate on documents efficiently, intuitively, and securely.": "Docs : Votre nouveau compagnon pour collaborer sur des documents efficacement, intuitivement et en toute sécurité.",
       "Document icon": "Icône du document",
       "Document name": "Nom du document",
       "Document panel": "Panneau du document",
@@ -45,6 +47,7 @@
       "Export": "Exporter",
       "Export your document, it will be inserted in the selected template.": "Exportez votre document, il sera inséré dans le modèle sélectionné.",
       "Failed to add the member in the document.": "Impossible d'ajouter le membre dans le document.",
+      "Failed to copy link": "Échec de la copie du lien",
       "Failed to create the invitation for {{email}}.": "Impossible de créer l'invitation pour {{email}}.",
       "Find a member to add to the document": "Trouver un membre à ajouter au document",
       "French Interministerial Directorate for Digital Affairs (DINUM), 20 avenue de Ségur 75007 Paris.": "Direction interministérielle des affaires numériques (DINUM), 20 avenue de Segur 75007 Paris.",
@@ -56,7 +59,6 @@
       "Invitation sent to {{email}}.": "Invitation envoyée à {{email}}.",
       "Invite new members to {{title}}": "Invitez de nouveaux membres à rejoindre {{title}}",
       "Invited": "Invité",
-      "Is it public ?": "Est-ce public?",
       "It is the card information about the document.": "Il s'agit de la carte d'information du document.",
       "It seems that the page you are looking for does not exist or cannot be displayed correctly.": "Il semble que la page que vous cherchez n'existe pas ou ne puisse pas être affichée correctement.",
       "It's true, you didn't have to click on a block that covers half the page to say you agree to the placement of cookies — even if you don't know what it means!": "C'est vrai, vous n'avez pas à cliquer sur un bloc qui couvre la moitié de la page pour dire que vous acceptez le placement de cookies — même si vous ne savez pas ce que cela signifie !",
@@ -64,13 +66,14 @@
       "Language Icon": "Icône de langue",
       "Legal Notice": "Mentions Legales",
       "Legal notice": "Mention légale",
+      "Link Copied !": "Lien copié !",
       "List invitation card": "Carte de liste d'invitation",
       "List members card": "Carte liste des membres",
+      "Login": "Connexion",
       "Logout": "Se déconnecter",
       "Members": "Membres",
       "Modal confirmation to restore the version": "Modale de confirmation pour restaurer la version",
       "More info?": "Plus d'infos ?",
-      "My account": "Mon compte",
       "No editor found": "Pas d'éditeur trouvé",
       "Nothing exceptional, no special privileges related to a .gouv.fr.": "Rien d'exceptionnel, pas de privilèges spéciaux liés à un .gouv.fr.",
       "Offline ?!": "Hors-ligne ?!",
@@ -94,16 +97,16 @@
       "Restore this version": "Restaurer cette version",
       "Restore this version?": "Restaurer cette version?",
       "Role": "Rôle",
-      "SUMMARY": "RÉSUMÉ",
       "Search by email": "Recherche par email",
       "Send a letter by post (free of charge, no stamp needed):": "Envoyer un courrier par la poste (gratuit, ne pas mettre de timbre):",
       "Share": "Partager",
       "Something bad happens, please retry.": "Une erreur inattendue s'est produite, veuillez réessayer.",
       "Stéphanie Schaer: Interministerial Digital Director (DINUM).": "Stéphanie Schaer: Directrice numérique interministériel (DINUM).",
-      "Summary": "Résumé",
+      "Table of contents": "Table des matières",
       "Template": "Template",
       "The document has been deleted.": "Le document a bien été supprimé.",
       "The document has been updated.": "Le document a été mis à jour.",
+      "The document visiblitity has been updated.": "La visibilité du document a été mise à jour.",
       "The invitation has been removed.": "L'invitation a été supprimée.",
       "The member has been removed from the document": "Le membre a été retiré du document",
       "The role has been updated": "Le rôle a été mis à jour",

src/frontend/apps/impress/src/pages/_document.tsx

@@ -1,10 +1,8 @@
 import { Head, Html, Main, NextScript } from 'next/document';
 
-import '@/i18n/initI18n';
-
 export default function RootLayout() {
   return (
-    <Html lang="en">
+    <Html>
       <Head />
       <body suppressHydrationWarning={process.env.NODE_ENV === 'development'}>
         <Main />

src/frontend/apps/impress/src/pages/docs/[id]/index.tsx

@@ -1,7 +1,7 @@
 import { Loader } from '@openfun/cunningham-react';
 import { useRouter as useNavigate } from 'next/navigation';
 import { useRouter } from 'next/router';
-import { useEffect } from 'react';
+import { useEffect, useState } from 'react';
 
 import { Box, Text } from '@/components';
 import { TextErrors } from '@/components/TextErrors';
@@ -31,7 +31,9 @@ interface DocProps {
 }
 
 const DocPage = ({ id }: DocProps) => {
-  const { data: doc, isLoading, isError, error } = useDoc({ id });
+  const { data: docQuery, isError, error } = useDoc({ id });
+  const [doc, setDoc] = useState(docQuery);
+
   const navigate = useNavigate();
 
   useEffect(() => {
@@ -42,6 +44,14 @@ const DocPage = ({ id }: DocProps) => {
     }
   }, [doc?.title]);
 
+  useEffect(() => {
+    if (!docQuery) {
+      return;
+    }
+
+    setDoc(docQuery);
+  }, [docQuery]);
+
   if (isError && error) {
     if (error.status === 404) {
       navigate.replace(`/404`);
@@ -64,7 +74,7 @@ const DocPage = ({ id }: DocProps) => {
     );
   }
 
-  if (isLoading || !doc) {
+  if (!doc) {
     return (
       <Box $align="center" $justify="center" $height="100%">
         <Loader />

src/frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impress",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "private": true,
   "workspaces": {
     "packages": [
@@ -25,15 +25,18 @@
     "i18n:test": "yarn I18N run test"
   },
   "resolutions": {
-    "@blocknote/core": "0.15.6",
-    "@blocknote/mantine": "0.15.6",
-    "@blocknote/react": "0.15.6",
-    "@types/node": "20.16.3",
+    "@blocknote/core": "0.15.7",
+    "@blocknote/mantine": "0.15.7",
+    "@blocknote/react": "0.15.7",
+    "@types/node": "20.16.5",
     "@types/react-dom": "18.3.0",
+    "@typescript-eslint/eslint-plugin": "8.5.0",
+    "@typescript-eslint/parser": "8.5.0",
     "cross-env": "7.0.3",
+    "eslint": "8.57.0",
     "react": "18.3.1",
     "react-dom": "18.3.1",
-    "typescript": "5.5.4",
-    "yjs": "13.6.18"
+    "typescript": "5.6.2",
+    "yjs": "13.6.19"
   }
 }

src/frontend/packages/eslint-config-impress/package.json

@@ -1,24 +1,25 @@
 {
   "name": "eslint-config-impress",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "license": "MIT",
   "scripts": {
     "lint": "eslint --ext .js ."
   },
   "dependencies": {
-    "@next/eslint-plugin-next": "14.2.7",
-    "@tanstack/eslint-plugin-query": "5.53.0",
-    "@typescript-eslint/eslint-plugin": "8.3.0",
-    "@typescript-eslint/parser": "8.3.0",
-    "eslint": "8.57.0",
-    "eslint-config-next": "14.2.7",
+    "@next/eslint-plugin-next": "14.2.11",
+    "@tanstack/eslint-plugin-query": "5.56.1",
+    "@typescript-eslint/eslint-plugin": "*",
+    "@typescript-eslint/parser": "*",
+    "eslint": "*",
+    "eslint-config-next": "14.2.11",
     "eslint-config-prettier": "9.1.0",
-    "eslint-plugin-import": "2.29.1",
-    "eslint-plugin-jest": "28.8.2",
-    "eslint-plugin-jsx-a11y": "6.9.0",
+    "eslint-plugin-import": "2.30.0",
+    "eslint-plugin-jest": "28.8.3",
+    "eslint-plugin-jsx-a11y": "6.10.0",
     "eslint-plugin-playwright": "1.6.2",
     "eslint-plugin-prettier": "5.2.1",
-    "eslint-plugin-react": "7.35.0",
-    "eslint-plugin-testing-library": "6.3.0"
+    "eslint-plugin-react": "7.36.1",
+    "eslint-plugin-testing-library": "6.3.0",
+    "prettier": "3.3.3"
   }
 }

src/frontend/packages/i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packages-i18n",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "private": true,
   "scripts": {
     "extract-translation": "yarn extract-translation:impress",
@@ -11,10 +11,10 @@
     "test": "jest"
   },
   "dependencies": {
-    "@types/jest": "29.5.12",
+    "@types/jest": "29.5.13",
     "@types/node": "*",
     "eslint-config-impress": "*",
-    "eslint-plugin-import": "2.29.1",
+    "eslint-plugin-import": "2.30.0",
     "i18next-parser": "9.0.2",
     "jest": "29.7.0",
     "ts-jest": "29.2.5",

src/frontend/servers/y-provider/package.json

@@ -1,6 +1,6 @@
 {
   "name": "server-y-provider",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Y.js provider for docs",
   "repository": "https://github.com/numerique-gouv/impress",
   "license": "MIT",
@@ -15,7 +15,8 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@hocuspocus/server": "2.13.5"
+    "@hocuspocus/server": "2.13.5",
+    "y-protocols": "1.0.6"
   },
   "devDependencies": {
     "@types/node": "*",