✅(back) fix backend code related to multipage dev

During the multipage dev, the code base has changed a lot and rebase
after rebase it has come difficult to manage fixup commits. This commits
fix modification made that can be fixup in previous commits. The
persmission AccessPermission has been renamed in
ResourceWithAccessPermission and should be used in the
DocumentAskForAccessViewSet. A migration with the same dependency
exists, the last one is fixed. And a test didn't have removed an
abilitites.

.github/workflows/docker-hub.yml

@@ -6,6 +6,7 @@ on:
   push:
     branches:
       - 'main'
+      - 'feature/doc-dnd'
     tags:
       - 'v*'
   pull_request:

CHANGELOG.md

@@ -85,6 +85,9 @@ and this project adheres to
 
 ## Added
 
+- ✨(frontend) multi-pages #701
+- ✨(backend) include ancestors accesses on document accesses list view #846
+- ✨(backend) add ancestors links reach and role to document API #846
 - 🚸(backend) make document search on title accent-insensitive #874
 - 🚩 add homepage feature flag #861
 - 📝(doc) update contributing policy (commit signatures are now mandatory) #895
@@ -96,22 +99,30 @@ and this project adheres to
 
 ## Changed
 
+- ♻️(backend) stop requiring owner for non-root documents #846
+- ♻️(backend) simplify roles by ranking them and return only the max role #846
 - ⚡️(frontend) reduce unblocking time for config #867
 - ♻️(frontend) bind UI with ability access #900
 - ♻️(frontend) use built-in Quote block #908
 
 ## Fixed
 
+- 🐛(backend) fix link definition select options linked to ancestors #846
 - 🐛(nginx) fix 404 when accessing a doc #866
 - 🔒️(drf) disable browsable HTML API renderer #919
 - 🔒(frontend) enhance file download security #889
 - 🐛(backend) race condition create doc #633
 - 🐛(frontend) fix breaklines in custom blocks #908
 
+## Fixed
+
+- 🐛(backend) fix link definition select options linked to ancestors #846
+
 ## [3.1.0] - 2025-04-07
 
 ## Added
 
+- ✨(backend) add ancestors links definitions to document abilities #846
 - 🚩(backend) add feature flag for the footer #841
 - 🔧(backend) add view to manage footer json #841
 - ✨(frontend) add custom css style #771
@@ -123,6 +134,7 @@ and this project adheres to
 
 ## Fixed
 
+- 🐛(backend) fix link definition select options linked to ancestors #846
 - 🐛(back) validate document content in serializer #822
 - 🐛(frontend) fix selection click past end of content #840
 

env.d/development/common.e2e.dist

@@ -2,4 +2,8 @@
 BURST_THROTTLE_RATES="200/minute"
 COLLABORATION_API_URL=http://y-provider:4444/collaboration/api/
 SUSTAINED_THROTTLE_RATES="200/hour"
-Y_PROVIDER_API_BASE_URL=http://y-provider:4444/api/
+Y_PROVIDER_API_BASE_URL=http://y-provider:4444/api/
+THEME_CUSTOMIZATION_FILE_PATH="" #force theme_customization to be empty
+#COLLABORATION_API_URL=http://y-provider:4444/collaboration/api/
+#Y_PROVIDER_API_BASE_URL=http://y-provider:4444/api/
+

src/backend/core/api/permissions.py

@@ -6,6 +6,7 @@ from django.http import Http404
 
 from rest_framework import permissions
 
+from core import choices
 from core.models import DocumentAccess, RoleChoices, get_trashbin_cutoff
 
 ACTION_FOR_METHOD_TO_PERMISSION = {
@@ -96,26 +97,27 @@ class CanCreateInvitationPermission(permissions.BasePermission):
         ).exists()
 
 
-class AccessPermission(permissions.BasePermission):
-    """Permission class for access objects."""
+class ResourceWithAccessPermission(permissions.BasePermission):
+    """A permission class for templates and invitations."""
 
     def has_permission(self, request, view):
+        """check create permission for templates."""
         return request.user.is_authenticated or view.action != "create"
 
     def has_object_permission(self, request, view, obj):
         """Check permission for a given object."""
         abilities = obj.get_abilities(request.user)
         action = view.action
-        try:
-            action = ACTION_FOR_METHOD_TO_PERMISSION[view.action][request.method]
-        except KeyError:
-            pass
         return abilities.get(action, False)
 
 
-class DocumentAccessPermission(AccessPermission):
+class DocumentPermission(permissions.BasePermission):
     """Subclass to handle soft deletion specificities."""
 
+    def has_permission(self, request, view):
+        """check create permission for documents."""
+        return request.user.is_authenticated or view.action != "create"
+
     def has_object_permission(self, request, view, obj):
         """
         Return a 404 on deleted documents
@@ -127,10 +129,45 @@ class DocumentAccessPermission(AccessPermission):
         ) and deleted_at < get_trashbin_cutoff():
             raise Http404
 
-        # Compute permission first to ensure the "user_roles" attribute is set
-        has_permission = super().has_object_permission(request, view, obj)
+        abilities = obj.get_abilities(request.user)
+        action = view.action
+        try:
+            action = ACTION_FOR_METHOD_TO_PERMISSION[view.action][request.method]
+        except KeyError:
+            pass
+
+        has_permission = abilities.get(action, False)
 
         if obj.ancestors_deleted_at and not RoleChoices.OWNER in obj.user_roles:
             raise Http404
 
         return has_permission
+
+
+class ResourceAccessPermission(IsAuthenticated):
+    """Permission class for document access objects."""
+
+    def has_permission(self, request, view):
+        """check create permission for accesses in documents tree."""
+        if super().has_permission(request, view) is False:
+            return False
+
+        if view.action == "create":
+            role = getattr(view, view.resource_field_name).get_role(request.user)
+            if role not in choices.PRIVILEGED_ROLES:
+                raise exceptions.PermissionDenied(
+                    "You are not allowed to manage accesses for this resource."
+                )
+
+        return True
+
+    def has_object_permission(self, request, view, obj):
+        """Check permission for a given object."""
+        abilities = obj.get_abilities(request.user)
+
+        requested_role = request.data.get("role")
+        if requested_role and requested_role not in abilities.get("set_role_to", []):
+            return False
+
+        action = view.action
+        return abilities.get(action, False)

src/backend/core/api/serializers.py

@@ -10,9 +10,9 @@ from django.utils.functional import lazy
 from django.utils.translation import gettext_lazy as _
 
 import magic
-from rest_framework import exceptions, serializers
+from rest_framework import serializers
 
-from core import enums, models, utils
+from core import choices, enums, models, utils
 from core.services.ai_services import AI_ACTIONS
 from core.services.converter_services import (
     ConversionError,
@@ -32,134 +32,35 @@ class UserSerializer(serializers.ModelSerializer):
 class UserLightSerializer(UserSerializer):
     """Serialize users with limited fields."""
 
-    id = serializers.SerializerMethodField(read_only=True)
-    email = serializers.SerializerMethodField(read_only=True)
-
-    def get_id(self, _user):
-        """Return always None. Here to have the same fields than in UserSerializer."""
-        return None
-
-    def get_email(self, _user):
-        """Return always None. Here to have the same fields than in UserSerializer."""
-        return None
-
     class Meta:
         model = models.User
-        fields = ["id", "email", "full_name", "short_name"]
-        read_only_fields = ["id", "email", "full_name", "short_name"]
+        fields = ["full_name", "short_name"]
+        read_only_fields = ["full_name", "short_name"]
 
 
-class BaseAccessSerializer(serializers.ModelSerializer):
+class TemplateAccessSerializer(serializers.ModelSerializer):
     """Serialize template accesses."""
 
     abilities = serializers.SerializerMethodField(read_only=True)
 
-    def update(self, instance, validated_data):
-        """Make "user" field is readonly but only on update."""
-        validated_data.pop("user", None)
-        return super().update(instance, validated_data)
-
-    def get_abilities(self, access) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        request = self.context.get("request")
-        if request:
-            return access.get_abilities(request.user)
-        return {}
-
-    def validate(self, attrs):
-        """
-        Check access rights specific to writing (create/update)
-        """
-        request = self.context.get("request")
-        user = getattr(request, "user", None)
-        role = attrs.get("role")
-
-        # Update
-        if self.instance:
-            can_set_role_to = self.instance.get_abilities(user)["set_role_to"]
-
-            if role and role not in can_set_role_to:
-                message = (
-                    f"You are only allowed to set role to {', '.join(can_set_role_to)}"
-                    if can_set_role_to
-                    else "You are not allowed to set this role for this template."
-                )
-                raise exceptions.PermissionDenied(message)
-
-        # Create
-        else:
-            try:
-                resource_id = self.context["resource_id"]
-            except KeyError as exc:
-                raise exceptions.ValidationError(
-                    "You must set a resource ID in kwargs to create a new access."
-                ) from exc
-
-            if not self.Meta.model.objects.filter(  # pylint: disable=no-member
-                Q(user=user) | Q(team__in=user.teams),
-                role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
-                **{self.Meta.resource_field_name: resource_id},  # pylint: disable=no-member
-            ).exists():
-                raise exceptions.PermissionDenied(
-                    "You are not allowed to manage accesses for this resource."
-                )
-
-            if (
-                role == models.RoleChoices.OWNER
-                and not self.Meta.model.objects.filter(  # pylint: disable=no-member
-                    Q(user=user) | Q(team__in=user.teams),
-                    role=models.RoleChoices.OWNER,
-                    **{self.Meta.resource_field_name: resource_id},  # pylint: disable=no-member
-                ).exists()
-            ):
-                raise exceptions.PermissionDenied(
-                    "Only owners of a resource can assign other users as owners."
-                )
-
-        # pylint: disable=no-member
-        attrs[f"{self.Meta.resource_field_name}_id"] = self.context["resource_id"]
-        return attrs
-
-
-class DocumentAccessSerializer(BaseAccessSerializer):
-    """Serialize document accesses."""
-
-    user_id = serializers.PrimaryKeyRelatedField(
-        queryset=models.User.objects.all(),
-        write_only=True,
-        source="user",
-        required=False,
-        allow_null=True,
-    )
-    user = UserSerializer(read_only=True)
-
-    class Meta:
-        model = models.DocumentAccess
-        resource_field_name = "document"
-        fields = ["id", "user", "user_id", "team", "role", "abilities"]
-        read_only_fields = ["id", "abilities"]
-
-
-class DocumentAccessLightSerializer(DocumentAccessSerializer):
-    """Serialize document accesses with limited fields."""
-
-    user = UserLightSerializer(read_only=True)
-
-    class Meta:
-        model = models.DocumentAccess
-        fields = ["id", "user", "team", "role", "abilities"]
-        read_only_fields = ["id", "team", "role", "abilities"]
-
-
-class TemplateAccessSerializer(BaseAccessSerializer):
-    """Serialize template accesses."""
-
     class Meta:
         model = models.TemplateAccess
         resource_field_name = "template"
         fields = ["id", "user", "team", "role", "abilities"]
         read_only_fields = ["id", "abilities"]
 
+    def get_abilities(self, instance) -> dict:
+        """Return abilities of the logged-in user on the instance."""
+        request = self.context.get("request")
+        if request:
+            return instance.get_abilities(request.user)
+        return {}
+
+    def update(self, instance, validated_data):
+        """Make "user" field is readonly but only on update."""
+        validated_data.pop("user", None)
+        return super().update(instance, validated_data)
+
 
 class ListDocumentSerializer(serializers.ModelSerializer):
     """Serialize documents with limited fields for display in lists."""
@@ -167,7 +68,7 @@ class ListDocumentSerializer(serializers.ModelSerializer):
     is_favorite = serializers.BooleanField(read_only=True)
     nb_accesses_ancestors = serializers.IntegerField(read_only=True)
     nb_accesses_direct = serializers.IntegerField(read_only=True)
-    user_roles = serializers.SerializerMethodField(read_only=True)
+    user_role = serializers.SerializerMethodField(read_only=True)
     abilities = serializers.SerializerMethodField(read_only=True)
 
     class Meta:
@@ -175,6 +76,10 @@ class ListDocumentSerializer(serializers.ModelSerializer):
         fields = [
             "id",
             "abilities",
+            "ancestors_link_reach",
+            "ancestors_link_role",
+            "computed_link_reach",
+            "computed_link_role",
             "created_at",
             "creator",
             "depth",
@@ -188,11 +93,15 @@ class ListDocumentSerializer(serializers.ModelSerializer):
             "path",
             "title",
             "updated_at",
-            "user_roles",
+            "user_role",
         ]
         read_only_fields = [
             "id",
             "abilities",
+            "ancestors_link_reach",
+            "ancestors_link_role",
+            "computed_link_reach",
+            "computed_link_role",
             "created_at",
             "creator",
             "depth",
@@ -205,34 +114,45 @@ class ListDocumentSerializer(serializers.ModelSerializer):
             "numchild",
             "path",
             "updated_at",
-            "user_roles",
+            "user_role",
         ]
 
-    def get_abilities(self, document) -> dict:
+    def to_representation(self, instance):
+        """Precompute once per instance"""
+        paths_links_mapping = self.context.get("paths_links_mapping")
+
+        if paths_links_mapping is not None:
+            links = paths_links_mapping.get(instance.path[: -instance.steplen], [])
+            instance.ancestors_link_definition = choices.get_equivalent_link_definition(
+                links
+            )
+
+        return super().to_representation(instance)
+
+    def get_abilities(self, instance) -> dict:
         """Return abilities of the logged-in user on the instance."""
         request = self.context.get("request")
+        if not request:
+            return {}
 
-        if request:
-            paths_links_mapping = self.context.get("paths_links_mapping", None)
-            # Retrieve ancestor links from paths_links_mapping (if provided)
-            ancestors_links = (
-                paths_links_mapping.get(document.path[: -document.steplen])
-                if paths_links_mapping
-                else None
-            )
-            return document.get_abilities(request.user, ancestors_links=ancestors_links)
+        return instance.get_abilities(request.user)
 
-        return {}
-
-    def get_user_roles(self, document):
+    def get_user_role(self, instance):
         """
         Return roles of the logged-in user for the current document,
         taking into account ancestors.
         """
         request = self.context.get("request")
-        if request:
-            return document.get_roles(request.user)
-        return []
+        return instance.get_role(request.user) if request else None
+
+
+class DocumentLightSerializer(serializers.ModelSerializer):
+    """Minial document serializer for nesting in document accesses."""
+
+    class Meta:
+        model = models.Document
+        fields = ["id", "path", "depth"]
+        read_only_fields = ["id", "path", "depth"]
 
 
 class DocumentSerializer(ListDocumentSerializer):
@@ -245,6 +165,10 @@ class DocumentSerializer(ListDocumentSerializer):
         fields = [
             "id",
             "abilities",
+            "ancestors_link_reach",
+            "ancestors_link_role",
+            "computed_link_reach",
+            "computed_link_role",
             "content",
             "created_at",
             "creator",
@@ -259,11 +183,15 @@ class DocumentSerializer(ListDocumentSerializer):
             "path",
             "title",
             "updated_at",
-            "user_roles",
+            "user_role",
         ]
         read_only_fields = [
             "id",
             "abilities",
+            "ancestors_link_reach",
+            "ancestors_link_role",
+            "computed_link_reach",
+            "computed_link_role",
             "created_at",
             "creator",
             "depth",
@@ -275,7 +203,7 @@ class DocumentSerializer(ListDocumentSerializer):
             "numchild",
             "path",
             "updated_at",
-            "user_roles",
+            "user_role",
         ]
 
     def get_fields(self):
@@ -361,6 +289,99 @@ class DocumentSerializer(ListDocumentSerializer):
         return super().save(**kwargs)
 
 
+class DocumentAccessSerializer(serializers.ModelSerializer):
+    """Serialize document accesses."""
+
+    document = DocumentLightSerializer(read_only=True)
+    user_id = serializers.PrimaryKeyRelatedField(
+        queryset=models.User.objects.all(),
+        write_only=True,
+        source="user",
+        required=False,
+        allow_null=True,
+    )
+    user = UserSerializer(read_only=True)
+    team = serializers.CharField(required=False, allow_blank=True)
+    abilities = serializers.SerializerMethodField(read_only=True)
+    max_ancestors_role = serializers.SerializerMethodField(read_only=True)
+    max_role = serializers.SerializerMethodField(read_only=True)
+
+    class Meta:
+        model = models.DocumentAccess
+        resource_field_name = "document"
+        fields = [
+            "id",
+            "document",
+            "user",
+            "user_id",
+            "team",
+            "role",
+            "abilities",
+            "max_ancestors_role",
+            "max_role",
+        ]
+        read_only_fields = [
+            "id",
+            "document",
+            "abilities",
+            "max_ancestors_role",
+            "max_role",
+        ]
+
+    def get_abilities(self, instance) -> dict:
+        """Return abilities of the logged-in user on the instance."""
+        request = self.context.get("request")
+        if request:
+            return instance.get_abilities(request.user)
+        return {}
+
+    def get_max_ancestors_role(self, instance):
+        """Return max_ancestors_role if annotated; else None."""
+        return getattr(instance, "max_ancestors_role", None)
+
+    def get_max_role(self, instance):
+        """Return max_ancestors_role if annotated; else None."""
+        return choices.RoleChoices.max(
+            getattr(instance, "max_ancestors_role", None),
+            instance.role,
+        )
+
+    def update(self, instance, validated_data):
+        """Make "user" field readonly but only on update."""
+        validated_data.pop("team", None)
+        validated_data.pop("user", None)
+        return super().update(instance, validated_data)
+
+
+class DocumentAccessLightSerializer(DocumentAccessSerializer):
+    """Serialize document accesses with limited fields."""
+
+    user = UserLightSerializer(read_only=True)
+
+    class Meta:
+        model = models.DocumentAccess
+        resource_field_name = "document"
+        fields = [
+            "id",
+            "document",
+            "user",
+            "team",
+            "role",
+            "abilities",
+            "max_ancestors_role",
+            "max_role",
+        ]
+        read_only_fields = [
+            "id",
+            "document",
+            "team",
+            "role",
+            "abilities",
+            "max_ancestors_role",
+            "max_role",
+        ]
+
+
 class ServerCreateDocumentSerializer(serializers.Serializer):
     """
     Serializer for creating a document from a server-to-server request.

src/backend/core/api/viewsets.py

@@ -4,11 +4,11 @@
 import json
 import logging
 import uuid
+from collections import defaultdict
 from urllib.parse import unquote, urlencode, urlparse
 
 from django.conf import settings
 from django.contrib.postgres.aggregates import ArrayAgg
-from django.contrib.postgres.fields import ArrayField
 from django.contrib.postgres.search import TrigramSimilarity
 from django.core.cache import cache
 from django.core.exceptions import ValidationError
@@ -19,6 +19,7 @@ from django.db.models.expressions import RawSQL
 from django.db.models.functions import Left, Length
 from django.http import Http404, StreamingHttpResponse
 from django.urls import reverse
+from django.utils.functional import cached_property
 from django.utils.text import capfirst, slugify
 from django.utils.translation import gettext_lazy as _
 
@@ -33,7 +34,7 @@ from rest_framework import response as drf_response
 from rest_framework.permissions import AllowAny
 from rest_framework.throttling import UserRateThrottle
 
-from core import authentication, enums, models
+from core import authentication, choices, enums, models
 from core.services.ai_services import AIService
 from core.services.collaboration_services import CollaborationService
 from core.tasks.mail import send_ask_for_access_mail
@@ -223,14 +224,10 @@ class UserViewSet(
 class ResourceAccessViewsetMixin:
     """Mixin with methods common to all access viewsets."""
 
-    def get_permissions(self):
-        """User only needs to be authenticated to list resource accesses"""
-        if self.action == "list":
-            permission_classes = [permissions.IsAuthenticated]
-        else:
-            return super().get_permissions()
-
-        return [permission() for permission in permission_classes]
+    def filter_queryset(self, queryset):
+        """Override to filter on related resource."""
+        queryset = super().filter_queryset(queryset)
+        return queryset.filter(**{self.resource_field_name: self.kwargs["resource_id"]})
 
     def get_serializer_context(self):
         """Extra context provided to the serializer class."""
@@ -238,80 +235,6 @@ class ResourceAccessViewsetMixin:
         context["resource_id"] = self.kwargs["resource_id"]
         return context
 
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        queryset = super().get_queryset()
-        queryset = queryset.filter(
-            **{self.resource_field_name: self.kwargs["resource_id"]}
-        )
-
-        if self.action == "list":
-            user = self.request.user
-            teams = user.teams
-            user_roles_query = (
-                queryset.filter(
-                    db.Q(user=user) | db.Q(team__in=teams),
-                    **{self.resource_field_name: self.kwargs["resource_id"]},
-                )
-                .values(self.resource_field_name)
-                .annotate(roles_array=ArrayAgg("role"))
-                .values("roles_array")
-            )
-
-            # Limit to resource access instances related to a resource THAT also has
-            # a resource access
-            # instance for the logged-in user (we don't want to list only the resource
-            # access instances pointing to the logged-in user)
-            queryset = (
-                queryset.filter(
-                    db.Q(**{f"{self.resource_field_name}__accesses__user": user})
-                    | db.Q(
-                        **{f"{self.resource_field_name}__accesses__team__in": teams}
-                    ),
-                    **{self.resource_field_name: self.kwargs["resource_id"]},
-                )
-                .annotate(user_roles=db.Subquery(user_roles_query))
-                .distinct()
-            )
-        return queryset
-
-    def destroy(self, request, *args, **kwargs):
-        """Forbid deleting the last owner access"""
-        instance = self.get_object()
-        resource = getattr(instance, self.resource_field_name)
-
-        # Check if the access being deleted is the last owner access for the resource
-        if (
-            instance.role == "owner"
-            and resource.accesses.filter(role="owner").count() == 1
-        ):
-            return drf.response.Response(
-                {"detail": "Cannot delete the last owner access for the resource."},
-                status=drf.status.HTTP_403_FORBIDDEN,
-            )
-
-        return super().destroy(request, *args, **kwargs)
-
-    def perform_update(self, serializer):
-        """Check that we don't change the role if it leads to losing the last owner."""
-        instance = serializer.instance
-
-        # Check if the role is being updated and the new role is not "owner"
-        if (
-            "role" in self.request.data
-            and self.request.data["role"] != models.RoleChoices.OWNER
-        ):
-            resource = getattr(instance, self.resource_field_name)
-            # Check if the access being updated is the last owner access for the resource
-            if (
-                instance.role == models.RoleChoices.OWNER
-                and resource.accesses.filter(role=models.RoleChoices.OWNER).count() == 1
-            ):
-                message = "Cannot change the role to a non-owner role for the last owner access."
-                raise drf.exceptions.PermissionDenied({"detail": message})
-
-        serializer.save()
-
 
 class DocumentMetadata(drf.metadata.SimpleMetadata):
     """Custom metadata class to add information"""
@@ -434,7 +357,7 @@ class DocumentViewSet(
     ordering_fields = ["created_at", "updated_at", "title"]
     pagination_class = Pagination
     permission_classes = [
-        permissions.DocumentAccessPermission,
+        permissions.DocumentPermission,
     ]
     queryset = models.Document.objects.all()
     serializer_class = serializers.DocumentSerializer
@@ -445,44 +368,6 @@ class DocumentViewSet(
     trashbin_serializer_class = serializers.ListDocumentSerializer
     tree_serializer_class = serializers.ListDocumentSerializer
 
-    def annotate_is_favorite(self, queryset):
-        """
-        Annotate document queryset with the favorite status for the current user.
-        """
-        user = self.request.user
-
-        if user.is_authenticated:
-            favorite_exists_subquery = models.DocumentFavorite.objects.filter(
-                document_id=db.OuterRef("pk"), user=user
-            )
-            return queryset.annotate(is_favorite=db.Exists(favorite_exists_subquery))
-
-        return queryset.annotate(is_favorite=db.Value(False))
-
-    def annotate_user_roles(self, queryset):
-        """
-        Annotate document queryset with the roles of the current user
-        on the document or its ancestors.
-        """
-        user = self.request.user
-        output_field = ArrayField(base_field=db.CharField())
-
-        if user.is_authenticated:
-            user_roles_subquery = models.DocumentAccess.objects.filter(
-                db.Q(user=user) | db.Q(team__in=user.teams),
-                document__path=Left(db.OuterRef("path"), Length("document__path")),
-            ).values_list("role", flat=True)
-
-            return queryset.annotate(
-                user_roles=db.Func(
-                    user_roles_subquery, function="ARRAY", output_field=output_field
-                )
-            )
-
-        return queryset.annotate(
-            user_roles=db.Value([], output_field=output_field),
-        )
-
     def get_queryset(self):
         """Get queryset performing all annotation and filtering on the document tree structure."""
         user = self.request.user
@@ -518,18 +403,20 @@ class DocumentViewSet(
     def filter_queryset(self, queryset):
         """Override to apply annotations to generic views."""
         queryset = super().filter_queryset(queryset)
-        queryset = self.annotate_is_favorite(queryset)
-        queryset = self.annotate_user_roles(queryset)
+        user = self.request.user
+        queryset = queryset.annotate_is_favorite(user)
+        queryset = queryset.annotate_user_roles(user)
         return queryset
 
-    def get_response_for_queryset(self, queryset):
+    def get_response_for_queryset(self, queryset, context=None):
         """Return paginated response for the queryset if requested."""
+        context = context or self.get_serializer_context()
         page = self.paginate_queryset(queryset)
         if page is not None:
-            serializer = self.get_serializer(page, many=True)
+            serializer = self.get_serializer(page, many=True, context=context)
             return self.get_paginated_response(serializer.data)
 
-        serializer = self.get_serializer(queryset, many=True)
+        serializer = self.get_serializer(queryset, many=True, context=context)
         return drf.response.Response(serializer.data)
 
     def list(self, request, *args, **kwargs):
@@ -539,13 +426,11 @@ class DocumentViewSet(
         This method applies filtering based on request parameters using `ListDocumentFilter`.
         It performs early filtering on model fields, annotates user roles, and removes
         descendant documents to keep only the highest ancestors readable by the current user.
-
-        Additional annotations (e.g., `is_highest_ancestor_for_user`, favorite status) are
-        applied before ordering and returning the response.
         """
-        queryset = (
-            self.get_queryset()
-        )  # Not calling filter_queryset. We do our own cooking.
+        user = self.request.user
+
+        # Not calling filter_queryset. We do our own cooking.
+        queryset = self.get_queryset()
 
         filterset = ListDocumentFilter(
             self.request.GET, queryset=queryset, request=self.request
@@ -558,7 +443,7 @@ class DocumentViewSet(
         for field in ["is_creator_me", "title"]:
             queryset = filterset.filters[field].filter(queryset, filter_data[field])
 
-        queryset = self.annotate_user_roles(queryset)
+        queryset = queryset.annotate_user_roles(user)
 
         # Among the results, we may have documents that are ancestors/descendants
         # of each other. In this case we want to keep only the highest ancestors.
@@ -568,14 +453,8 @@ class DocumentViewSet(
         )
         queryset = queryset.filter(path__in=root_paths)
 
-        # Annotate the queryset with an attribute marking instances as highest ancestor
-        # in order to save some time while computing abilities on the instance
-        queryset = queryset.annotate(
-            is_highest_ancestor_for_user=db.Value(True, output_field=db.BooleanField())
-        )
-
         # Annotate favorite status and filter if applicable as late as possible
-        queryset = self.annotate_is_favorite(queryset)
+        queryset = queryset.annotate_is_favorite(user)
         queryset = filterset.filters["is_favorite"].filter(
             queryset, filter_data["is_favorite"]
         )
@@ -666,7 +545,7 @@ class DocumentViewSet(
             deleted_at__isnull=False,
             deleted_at__gte=models.get_trashbin_cutoff(),
         )
-        queryset = self.annotate_user_roles(queryset)
+        queryset = queryset.annotate_user_roles(self.request.user)
         queryset = queryset.filter(user_roles__contains=[models.RoleChoices.OWNER])
 
         return self.get_response_for_queryset(queryset)
@@ -734,7 +613,7 @@ class DocumentViewSet(
 
         position = validated_data["position"]
         message = None
-
+        owner_accesses = []
         if position in [
             enums.MoveNodePositionChoices.FIRST_CHILD,
             enums.MoveNodePositionChoices.LAST_CHILD,
@@ -744,12 +623,15 @@ class DocumentViewSet(
                     "You do not have permission to move documents "
                     "as a child to this target document."
                 )
-        elif not target_document.is_root():
-            if not target_document.get_parent().get_abilities(user).get("move"):
-                message = (
-                    "You do not have permission to move documents "
-                    "as a sibling of this target document."
-                )
+        elif target_document.is_root():
+            owner_accesses = document.get_root().accesses.filter(
+                role=models.RoleChoices.OWNER
+            )
+        elif not target_document.get_parent().get_abilities(user).get("move"):
+            message = (
+                "You do not have permission to move documents "
+                "as a sibling of this target document."
+            )
 
         if message:
             return drf.response.Response(
@@ -759,6 +641,19 @@ class DocumentViewSet(
 
         document.move(target_document, pos=position)
 
+        # Make sure we have at least one owner
+        if (
+            owner_accesses
+            and not document.accesses.filter(role=models.RoleChoices.OWNER).exists()
+        ):
+            for owner_access in owner_accesses:
+                models.DocumentAccess.objects.update_or_create(
+                    document=document,
+                    user=owner_access.user,
+                    team=owner_access.team,
+                    defaults={"role": models.RoleChoices.OWNER},
+                )
+
         return drf.response.Response(
             {"message": "Document moved successfully."}, status=status.HTTP_200_OK
         )
@@ -805,11 +700,7 @@ class DocumentViewSet(
                     creator=request.user,
                     **serializer.validated_data,
                 )
-                models.DocumentAccess.objects.create(
-                    document=child_document,
-                    user=request.user,
-                    role=models.RoleChoices.OWNER,
-                )
+
             # Set the created instance to the serializer
             serializer.instance = child_document
 
@@ -828,7 +719,17 @@ class DocumentViewSet(
 
         queryset = filterset.qs
 
-        return self.get_response_for_queryset(queryset)
+        # Pass ancestors' links paths mapping to the serializer as a context variable
+        # in order to allow saving time while computing abilities on the instance
+        paths_links_mapping = document.compute_ancestors_links_paths_mapping()
+
+        return self.get_response_for_queryset(
+            queryset,
+            context={
+                "request": request,
+                "paths_links_mapping": paths_links_mapping,
+            },
+        )
 
     @drf.decorators.action(
         detail=True,
@@ -860,10 +761,12 @@ class DocumentViewSet(
         List ancestors tree above the document.
         What we need to display is the tree structure opened for the current document.
         """
+        user = self.request.user
+
         try:
             current_document = self.queryset.only("depth", "path").get(pk=pk)
         except models.Document.DoesNotExist as excpt:
-            raise drf.exceptions.NotFound from excpt
+            raise drf.exceptions.NotFound() from excpt
 
         ancestors = (
             (current_document.get_ancestors() | self.queryset.filter(pk=pk))
@@ -885,13 +788,6 @@ class DocumentViewSet(
         ancestors_links = []
         children_clause = db.Q()
         for ancestor in ancestors:
-            if ancestor.depth < highest_readable.depth:
-                continue
-
-            children_clause |= db.Q(
-                path__startswith=ancestor.path, depth=ancestor.depth + 1
-            )
-
             # Compute cache for ancestors links to avoid many queries while computing
             # abilities for his documents in the tree!
             ancestors_links.append(
@@ -899,25 +795,21 @@ class DocumentViewSet(
             )
             paths_links_mapping[ancestor.path] = ancestors_links.copy()
 
+            if ancestor.depth < highest_readable.depth:
+                continue
+
+            children_clause |= db.Q(
+                path__startswith=ancestor.path, depth=ancestor.depth + 1
+            )
+
         children = self.queryset.filter(children_clause, deleted_at__isnull=True)
 
         queryset = ancestors.filter(depth__gte=highest_readable.depth) | children
         queryset = queryset.order_by("path")
-        # Annotate if the current document is the highest ancestor for the user
-        queryset = queryset.annotate(
-            is_highest_ancestor_for_user=db.Case(
-                db.When(
-                    path=db.Value(highest_readable.path),
-                    then=db.Value(True),
-                ),
-                default=db.Value(False),
-                output_field=db.BooleanField(),
-            )
-        )
-        queryset = self.annotate_user_roles(queryset)
-        queryset = self.annotate_is_favorite(queryset)
+        queryset = queryset.annotate_user_roles(user)
+        queryset = queryset.annotate_is_favorite(user)
 
-        # Pass ancestors' links definitions to the serializer as a context variable
+        # Pass ancestors' links paths mapping to the serializer as a context variable
         # in order to allow saving time while computing abilities on the instance
         serializer = self.get_serializer(
             queryset,
@@ -934,7 +826,10 @@ class DocumentViewSet(
     @drf.decorators.action(
         detail=True,
         methods=["post"],
-        permission_classes=[permissions.IsAuthenticated, permissions.AccessPermission],
+        permission_classes=[
+            permissions.IsAuthenticated,
+            permissions.DocumentPermission,
+        ],
         url_path="duplicate",
     )
     @transaction.atomic
@@ -1472,7 +1367,11 @@ class DocumentViewSet(
 
 class DocumentAccessViewSet(
     ResourceAccessViewsetMixin,
-    viewsets.ModelViewSet,
+    drf.mixins.CreateModelMixin,
+    drf.mixins.RetrieveModelMixin,
+    drf.mixins.UpdateModelMixin,
+    drf.mixins.DestroyModelMixin,
+    viewsets.GenericViewSet,
 ):
     """
     API ViewSet for all interactions with document accesses.
@@ -1499,50 +1398,143 @@ class DocumentAccessViewSet(
     """
 
     lookup_field = "pk"
-    pagination_class = Pagination
-    permission_classes = [permissions.IsAuthenticated, permissions.AccessPermission]
-    queryset = models.DocumentAccess.objects.select_related("user").all()
+    permission_classes = [permissions.ResourceAccessPermission]
+    queryset = models.DocumentAccess.objects.select_related("user", "document").only(
+        "id",
+        "created_at",
+        "role",
+        "team",
+        "user__id",
+        "user__short_name",
+        "user__full_name",
+        "user__email",
+        "user__language",
+        "document__id",
+        "document__path",
+        "document__depth",
+    )
     resource_field_name = "document"
-    serializer_class = serializers.DocumentAccessSerializer
-    is_current_user_owner_or_admin = False
 
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        queryset = super().get_queryset()
-
-        if self.action == "list":
-            try:
-                document = models.Document.objects.get(pk=self.kwargs["resource_id"])
-            except models.Document.DoesNotExist:
-                return queryset.none()
-
-            roles = set(document.get_roles(self.request.user))
-            is_owner_or_admin = bool(roles.intersection(set(models.PRIVILEGED_ROLES)))
-            self.is_current_user_owner_or_admin = is_owner_or_admin
-            if not is_owner_or_admin:
-                # Return only the document owner access
-                queryset = queryset.filter(role__in=models.PRIVILEGED_ROLES)
-
-        return queryset
+    @cached_property
+    def document(self):
+        """Get related document from resource ID in url and annotate user roles."""
+        try:
+            return models.Document.objects.annotate_user_roles(self.request.user).get(
+                pk=self.kwargs["resource_id"]
+            )
+        except models.Document.DoesNotExist as excpt:
+            raise drf.exceptions.NotFound() from excpt
 
     def get_serializer_class(self):
-        if self.action == "list" and not self.is_current_user_owner_or_admin:
-            return serializers.DocumentAccessLightSerializer
+        """Use light serializer for unprivileged users."""
+        return (
+            serializers.DocumentAccessSerializer
+            if self.document.get_role(self.request.user) in choices.PRIVILEGED_ROLES
+            else serializers.DocumentAccessLightSerializer
+        )
 
-        return super().get_serializer_class()
+    def list(self, request, *args, **kwargs):
+        """Return accesses for the current document with filters and annotations."""
+        user = request.user
+
+        role = self.document.get_role(user)
+        if not role:
+            return drf.response.Response([])
+
+        ancestors = (
+            self.document.get_ancestors()
+            | models.Document.objects.filter(pk=self.document.pk)
+        ).filter(ancestors_deleted_at__isnull=True)
+
+        queryset = self.get_queryset().filter(document__in=ancestors)
+
+        if role not in choices.PRIVILEGED_ROLES:
+            queryset = queryset.filter(role__in=choices.PRIVILEGED_ROLES)
+
+        accesses = list(queryset.order_by("document__path"))
+
+        # Annotate more information on roles
+        path_to_key_to_max_ancestors_role = defaultdict(
+            lambda: defaultdict(lambda: None)
+        )
+        path_to_ancestors_roles = defaultdict(list)
+        path_to_role = defaultdict(lambda: None)
+        for access in accesses:
+            key = access.target_key
+            path = access.document.path
+            parent_path = path[: -models.Document.steplen]
+
+            path_to_key_to_max_ancestors_role[path][key] = choices.RoleChoices.max(
+                path_to_key_to_max_ancestors_role[path][key], access.role
+            )
+
+            if parent_path:
+                path_to_key_to_max_ancestors_role[path][key] = choices.RoleChoices.max(
+                    path_to_key_to_max_ancestors_role[parent_path][key],
+                    path_to_key_to_max_ancestors_role[path][key],
+                )
+                path_to_ancestors_roles[path].extend(
+                    path_to_ancestors_roles[parent_path]
+                )
+                path_to_ancestors_roles[path].append(path_to_role[parent_path])
+            else:
+                path_to_ancestors_roles[path] = []
+
+            if access.user_id == user.id or access.team in user.teams:
+                path_to_role[path] = choices.RoleChoices.max(
+                    path_to_role[path], access.role
+                )
+
+        # serialize and return the response
+        context = self.get_serializer_context()
+        serializer_class = self.get_serializer_class()
+        serialized_data = []
+        for access in accesses:
+            path = access.document.path
+            parent_path = path[: -models.Document.steplen]
+            access.max_ancestors_role = (
+                path_to_key_to_max_ancestors_role[parent_path][access.target_key]
+                if parent_path
+                else None
+            )
+            access.set_user_roles_tuple(
+                choices.RoleChoices.max(*path_to_ancestors_roles[path]),
+                path_to_role.get(path),
+            )
+            serializer = serializer_class(access, context=context)
+            serialized_data.append(serializer.data)
+
+        return drf.response.Response(serialized_data)
 
     def perform_create(self, serializer):
-        """Add a new access to the document and send an email to the new added user."""
-        access = serializer.save()
+        """
+        Actually create the new document access:
+        - Ensures the `document_id` is explicitly set from the URL
+        - If the assigned role is `OWNER`, checks that the requesting user is an owner
+          of the document. This is the only permission check deferred until this step;
+          all other access checks are handled earlier in the permission lifecycle.
+        - Sends an invitation email to the newly added user after saving the access.
+        """
+        role = serializer.validated_data.get("role")
+        if (
+            role == choices.RoleChoices.OWNER
+            and self.document.get_role(self.request.user) != choices.RoleChoices.OWNER
+        ):
+            raise drf.exceptions.PermissionDenied(
+                "Only owners of a document can assign other users as owners."
+            )
 
-        access.document.send_invitation_email(
-            access.user.email,
-            access.role,
-            self.request.user,
-            access.user.language
-            or self.request.user.language
-            or settings.LANGUAGE_CODE,
-        )
+        access = serializer.save(document_id=self.kwargs["resource_id"])
+
+        if access.user:
+            access.document.send_invitation_email(
+                access.user.email,
+                access.role,
+                self.request.user,
+                access.user.language
+                or self.request.user.language
+                or settings.LANGUAGE_CODE,
+            )
 
     def perform_update(self, serializer):
         """Update an access to the document and notify the collaboration server."""
@@ -1579,7 +1571,7 @@ class TemplateViewSet(
     filter_backends = [drf.filters.OrderingFilter]
     permission_classes = [
         permissions.IsAuthenticatedOrSafe,
-        permissions.AccessPermission,
+        permissions.ResourceWithAccessPermission,
     ]
     ordering = ["-created_at"]
     ordering_fields = ["created_at", "updated_at", "title"]
@@ -1641,7 +1633,6 @@ class TemplateAccessViewSet(
     ResourceAccessViewsetMixin,
     drf.mixins.CreateModelMixin,
     drf.mixins.DestroyModelMixin,
-    drf.mixins.ListModelMixin,
     drf.mixins.RetrieveModelMixin,
     drf.mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
@@ -1671,12 +1662,55 @@ class TemplateAccessViewSet(
     """
 
     lookup_field = "pk"
-    pagination_class = Pagination
-    permission_classes = [permissions.IsAuthenticated, permissions.AccessPermission]
+    permission_classes = [permissions.ResourceAccessPermission]
     queryset = models.TemplateAccess.objects.select_related("user").all()
     resource_field_name = "template"
     serializer_class = serializers.TemplateAccessSerializer
 
+    @cached_property
+    def template(self):
+        """Get related template from resource ID in url."""
+        try:
+            return models.Template.objects.get(pk=self.kwargs["resource_id"])
+        except models.Template.DoesNotExist as excpt:
+            raise drf.exceptions.NotFound() from excpt
+
+    def list(self, request, *args, **kwargs):
+        """Restrict templates returned by the list endpoint"""
+        user = self.request.user
+        teams = user.teams
+        queryset = self.filter_queryset(self.get_queryset())
+
+        # Limit to resource access instances related to a resource THAT also has
+        # a resource access instance for the logged-in user (we don't want to list
+        # only the resource access instances pointing to the logged-in user)
+        queryset = queryset.filter(
+            db.Q(template__accesses__user=user)
+            | db.Q(template__accesses__team__in=teams),
+        ).distinct()
+
+        serializer = self.get_serializer(queryset, many=True)
+        return drf.response.Response(serializer.data)
+
+    def perform_create(self, serializer):
+        """
+        Actually create the new template access:
+        - Ensures the `template_id` is explicitly set from the URL.
+        - If the assigned role is `OWNER`, checks that the requesting user is an owner
+          of the document. This is the only permission check deferred until this step;
+          all other access checks are handled earlier in the permission lifecycle.
+        """
+        role = serializer.validated_data.get("role")
+        if (
+            role == choices.RoleChoices.OWNER
+            and self.template.get_role(self.request.user) != choices.RoleChoices.OWNER
+        ):
+            raise drf.exceptions.PermissionDenied(
+                "Only owners of a template can assign other users as owners."
+            )
+
+        serializer.save(template_id=self.kwargs["resource_id"])
+
 
 class InvitationViewset(
     drf.mixins.CreateModelMixin,
@@ -1709,7 +1743,7 @@ class InvitationViewset(
     pagination_class = Pagination
     permission_classes = [
         permissions.CanCreateInvitationPermission,
-        permissions.AccessPermission,
+        permissions.ResourceWithAccessPermission,
     ]
     queryset = (
         models.Invitation.objects.all()
@@ -1749,11 +1783,11 @@ class InvitationViewset(
                 queryset.filter(
                     db.Q(
                         document__accesses__user=user,
-                        document__accesses__role__in=models.PRIVILEGED_ROLES,
+                        document__accesses__role__in=choices.PRIVILEGED_ROLES,
                     )
                     | db.Q(
                         document__accesses__team__in=teams,
-                        document__accesses__role__in=models.PRIVILEGED_ROLES,
+                        document__accesses__role__in=choices.PRIVILEGED_ROLES,
                     ),
                 )
                 # Abilities are computed based on logged-in user's role and
@@ -1785,7 +1819,10 @@ class DocumentAskForAccessViewSet(
 
     lookup_field = "id"
     pagination_class = Pagination
-    permission_classes = [permissions.IsAuthenticated, permissions.AccessPermission]
+    permission_classes = [
+        permissions.IsAuthenticated,
+        permissions.ResourceWithAccessPermission,
+    ]
     queryset = models.DocumentAskForAccess.objects.all()
     serializer_class = serializers.DocumentAskForAccessSerializer
     _document = None
@@ -1808,8 +1845,9 @@ class DocumentAskForAccessViewSet(
         queryset = super().get_queryset()
         queryset = queryset.filter(document=document)
 
-        roles = set(document.get_roles(self.request.user))
-        is_owner_or_admin = bool(roles.intersection(set(models.PRIVILEGED_ROLES)))
+        is_owner_or_admin = (
+            document.get_role(self.request.user) in models.PRIVILEGED_ROLES
+        )
         if not is_owner_or_admin:
             queryset = queryset.filter(user=self.request.user)
 

src/backend/core/choices.py

@@ -0,0 +1,115 @@
+"""Declare and configure choices for Docs' core application."""
+
+from django.db.models import TextChoices
+from django.utils.translation import gettext_lazy as _
+
+
+class PriorityTextChoices(TextChoices):
+    """
+    This class inherits from Django's TextChoices and provides a method to get the priority
+    of a given value based on its position in the class.
+    """
+
+    @classmethod
+    def get_priority(cls, role):
+        """Returns the priority of the given role based on its order in the class."""
+
+        members = list(cls.__members__.values())
+        return members.index(role) + 1 if role in members else 0
+
+    @classmethod
+    def max(cls, *roles):
+        """
+        Return the highest-priority role among the given roles, using get_priority().
+        If no valid roles are provided, returns None.
+        """
+        valid_roles = [role for role in roles if cls.get_priority(role) is not None]
+        if not valid_roles:
+            return None
+        return max(valid_roles, key=cls.get_priority)
+
+
+class LinkRoleChoices(PriorityTextChoices):
+    """Defines the possible roles a link can offer on a document."""
+
+    READER = "reader", _("Reader")  # Can read
+    EDITOR = "editor", _("Editor")  # Can read and edit
+
+
+class RoleChoices(PriorityTextChoices):
+    """Defines the possible roles a user can have in a resource."""
+
+    READER = "reader", _("Reader")  # Can read
+    EDITOR = "editor", _("Editor")  # Can read and edit
+    ADMIN = "administrator", _("Administrator")  # Can read, edit, delete and share
+    OWNER = "owner", _("Owner")
+
+
+PRIVILEGED_ROLES = [RoleChoices.ADMIN, RoleChoices.OWNER]
+
+
+class LinkReachChoices(PriorityTextChoices):
+    """Defines types of access for links"""
+
+    RESTRICTED = (
+        "restricted",
+        _("Restricted"),
+    )  # Only users with a specific access can read/edit the document
+    AUTHENTICATED = (
+        "authenticated",
+        _("Authenticated"),
+    )  # Any authenticated user can access the document
+    PUBLIC = "public", _("Public")  # Even anonymous users can access the document
+
+    @classmethod
+    def get_select_options(cls, link_reach, link_role):
+        """
+        Determines the valid select options for link reach and link role depending on the
+        ancestors' link reach/role given as arguments.
+        Returns:
+            Dictionary mapping possible reach levels to their corresponding possible roles.
+        """
+        return {
+            reach: [
+                role
+                for role in LinkRoleChoices.values
+                if LinkRoleChoices.get_priority(role)
+                >= LinkRoleChoices.get_priority(link_role)
+            ]
+            if reach != cls.RESTRICTED
+            else None
+            for reach in cls.values
+            if LinkReachChoices.get_priority(reach)
+            >= LinkReachChoices.get_priority(link_reach)
+        }
+
+
+def get_equivalent_link_definition(ancestors_links):
+    """
+    Return the (reach, role) pair with:
+    1. Highest reach
+    2. Highest role among links having that reach
+    """
+    if not ancestors_links:
+        return {"link_reach": None, "link_role": None}
+
+    # 1) Find the highest reach
+    max_reach = max(
+        ancestors_links,
+        key=lambda link: LinkReachChoices.get_priority(link["link_reach"]),
+    )["link_reach"]
+
+    # 2) Among those, find the highest role (ignore role if RESTRICTED)
+    if max_reach == LinkReachChoices.RESTRICTED:
+        max_role = None
+    else:
+        max_role = max(
+            (
+                link["link_role"]
+                for link in ancestors_links
+                if link["link_reach"] == max_reach
+            ),
+            key=LinkRoleChoices.get_priority,
+        )
+
+    return {"link_reach": max_reach, "link_role": max_role}

src/backend/core/migrations/0022_remove_document_is_public_and_more.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.1.7 on 2025-03-14 14:03
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("core", "0022_alter_user_language_documentaskforaccess"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="document",
+            name="has_deleted_children",
+            field=models.BooleanField(default=False),
+        ),
+    ]

src/backend/core/models.py

@@ -6,7 +6,6 @@ Declare and configure the models for the impress core application
 import hashlib
 import smtplib
 import uuid
-from collections import defaultdict
 from datetime import timedelta
 from logging import getLogger
 
@@ -33,6 +32,14 @@ from rest_framework.exceptions import ValidationError
 from timezone_field import TimeZoneField
 from treebeard.mp_tree import MP_Node, MP_NodeManager, MP_NodeQuerySet
 
+from .choices import (
+    PRIVILEGED_ROLES,
+    LinkReachChoices,
+    LinkRoleChoices,
+    RoleChoices,
+    get_equivalent_link_definition,
+)
+
 logger = getLogger(__name__)
 
 
@@ -50,88 +57,6 @@ def get_trashbin_cutoff():
     return timezone.now() - timedelta(days=settings.TRASHBIN_CUTOFF_DAYS)
 
 
-class LinkRoleChoices(models.TextChoices):
-    """Defines the possible roles a link can offer on a document."""
-
-    READER = "reader", _("Reader")  # Can read
-    EDITOR = "editor", _("Editor")  # Can read and edit
-
-
-class RoleChoices(models.TextChoices):
-    """Defines the possible roles a user can have in a resource."""
-
-    READER = "reader", _("Reader")  # Can read
-    EDITOR = "editor", _("Editor")  # Can read and edit
-    ADMIN = "administrator", _("Administrator")  # Can read, edit, delete and share
-    OWNER = "owner", _("Owner")
-
-
-PRIVILEGED_ROLES = [RoleChoices.ADMIN, RoleChoices.OWNER]
-
-
-class LinkReachChoices(models.TextChoices):
-    """Defines types of access for links"""
-
-    RESTRICTED = (
-        "restricted",
-        _("Restricted"),
-    )  # Only users with a specific access can read/edit the document
-    AUTHENTICATED = (
-        "authenticated",
-        _("Authenticated"),
-    )  # Any authenticated user can access the document
-    PUBLIC = "public", _("Public")  # Even anonymous users can access the document
-
-    @classmethod
-    def get_select_options(cls, ancestors_links):
-        """
-        Determines the valid select options for link reach and link role depending on the
-        list of ancestors' link reach/role.
-
-        Args:
-            ancestors_links: List of dictionaries, each with 'link_reach' and 'link_role' keys
-                             representing the reach and role of ancestors links.
-
-        Returns:
-            Dictionary mapping possible reach levels to their corresponding possible roles.
-        """
-        # If no ancestors, return all options
-        if not ancestors_links:
-            return dict.fromkeys(cls.values, LinkRoleChoices.values)
-
-        # Initialize result with all possible reaches and role options as sets
-        result = {reach: set(LinkRoleChoices.values) for reach in cls.values}
-
-        # Group roles by reach level
-        reach_roles = defaultdict(set)
-        for link in ancestors_links:
-            reach_roles[link["link_reach"]].add(link["link_role"])
-
-        # Apply constraints based on ancestor links
-        if LinkRoleChoices.EDITOR in reach_roles[cls.RESTRICTED]:
-            result[cls.RESTRICTED].discard(LinkRoleChoices.READER)
-
-        if LinkRoleChoices.EDITOR in reach_roles[cls.AUTHENTICATED]:
-            result[cls.AUTHENTICATED].discard(LinkRoleChoices.READER)
-            result.pop(cls.RESTRICTED, None)
-        elif LinkRoleChoices.READER in reach_roles[cls.AUTHENTICATED]:
-            result[cls.RESTRICTED].discard(LinkRoleChoices.READER)
-
-        if LinkRoleChoices.EDITOR in reach_roles[cls.PUBLIC]:
-            result[cls.PUBLIC].discard(LinkRoleChoices.READER)
-            result.pop(cls.AUTHENTICATED, None)
-            result.pop(cls.RESTRICTED, None)
-        elif LinkRoleChoices.READER in reach_roles[cls.PUBLIC]:
-            result[cls.AUTHENTICATED].discard(LinkRoleChoices.READER)
-            result.get(cls.RESTRICTED, set()).discard(LinkRoleChoices.READER)
-
-        # Convert roles sets to lists while maintaining the order from LinkRoleChoices
-        for reach, roles in result.items():
-            result[reach] = [role for role in LinkRoleChoices.values if role in roles]
-
-        return result
-
-
 class DuplicateEmailError(Exception):
     """Raised when an email is already associated with a pre-existing user."""
 
@@ -364,69 +289,6 @@ class BaseAccess(BaseModel):
     class Meta:
         abstract = True
 
-    def _get_roles(self, resource, user):
-        """
-        Get the roles a user has on a resource.
-        """
-        roles = []
-        if user.is_authenticated:
-            teams = user.teams
-            try:
-                roles = self.user_roles or []
-            except AttributeError:
-                try:
-                    roles = resource.accesses.filter(
-                        models.Q(user=user) | models.Q(team__in=teams),
-                    ).values_list("role", flat=True)
-                except (self._meta.model.DoesNotExist, IndexError):
-                    roles = []
-
-        return roles
-
-    def _get_abilities(self, resource, user):
-        """
-        Compute and return abilities for a given user taking into account
-        the current state of the object.
-        """
-        roles = self._get_roles(resource, user)
-
-        is_owner_or_admin = bool(
-            set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
-        )
-        if self.role == RoleChoices.OWNER:
-            can_delete = (
-                RoleChoices.OWNER in roles
-                and resource.accesses.filter(role=RoleChoices.OWNER).count() > 1
-            )
-            set_role_to = (
-                [RoleChoices.ADMIN, RoleChoices.EDITOR, RoleChoices.READER]
-                if can_delete
-                else []
-            )
-        else:
-            can_delete = is_owner_or_admin
-            set_role_to = []
-            if RoleChoices.OWNER in roles:
-                set_role_to.append(RoleChoices.OWNER)
-            if is_owner_or_admin:
-                set_role_to.extend(
-                    [RoleChoices.ADMIN, RoleChoices.EDITOR, RoleChoices.READER]
-                )
-
-        # Remove the current role as we don't want to propose it as an option
-        try:
-            set_role_to.remove(self.role)
-        except ValueError:
-            pass
-
-        return {
-            "destroy": can_delete,
-            "update": bool(set_role_to),
-            "partial_update": bool(set_role_to),
-            "retrieve": bool(roles),
-            "set_role_to": set_role_to,
-        }
-
 
 class DocumentQuerySet(MP_NodeQuerySet):
     """
@@ -452,6 +314,41 @@ class DocumentQuerySet(MP_NodeQuerySet):
 
         return self.filter(link_reach=LinkReachChoices.PUBLIC)
 
+    def annotate_is_favorite(self, user):
+        """
+        Annotate document queryset with the favorite status for the current user.
+        """
+        if user.is_authenticated:
+            favorite_exists_subquery = DocumentFavorite.objects.filter(
+                document_id=models.OuterRef("pk"), user=user
+            )
+            return self.annotate(is_favorite=models.Exists(favorite_exists_subquery))
+
+        return self.annotate(is_favorite=models.Value(False))
+
+    def annotate_user_roles(self, user):
+        """
+        Annotate document queryset with the roles of the current user
+        on the document or its ancestors.
+        """
+        output_field = ArrayField(base_field=models.CharField())
+
+        if user.is_authenticated:
+            user_roles_subquery = DocumentAccess.objects.filter(
+                models.Q(user=user) | models.Q(team__in=user.teams),
+                document__path=Left(models.OuterRef("path"), Length("document__path")),
+            ).values_list("role", flat=True)
+
+            return self.annotate(
+                user_roles=models.Func(
+                    user_roles_subquery, function="ARRAY", output_field=output_field
+                )
+            )
+
+        return self.annotate(
+            user_roles=models.Value([], output_field=output_field),
+        )
+
 
 class DocumentManager(MP_NodeManager.from_queryset(DocumentQuerySet)):
     """
@@ -464,6 +361,7 @@ class DocumentManager(MP_NodeManager.from_queryset(DocumentQuerySet)):
         return self._queryset_class(self.model).order_by("path")
 
 
+# pylint: disable=too-many-public-methods
 class Document(MP_Node, BaseModel):
     """Pad document carrying the content."""
 
@@ -486,6 +384,7 @@ class Document(MP_Node, BaseModel):
     )
     deleted_at = models.DateTimeField(null=True, blank=True)
     ancestors_deleted_at = models.DateTimeField(null=True, blank=True)
+    has_deleted_children = models.BooleanField(default=False)
     duplicated_from = models.ForeignKey(
         "self",
         on_delete=models.SET_NULL,
@@ -531,6 +430,12 @@ class Document(MP_Node, BaseModel):
     def __str__(self):
         return str(self.title) if self.title else str(_("Untitled Document"))
 
+    def __init__(self, *args, **kwargs):
+        """Initialize cache property."""
+        super().__init__(*args, **kwargs)
+        self._ancestors_link_definition = None
+        self._computed_link_definition = None
+
     def save(self, *args, **kwargs):
         """Write content to object storage only if _content has changed."""
         super().save(*args, **kwargs)
@@ -561,6 +466,12 @@ class Document(MP_Node, BaseModel):
                 content_file = ContentFile(bytes_content)
                 default_storage.save(file_key, content_file)
 
+    def is_leaf(self):
+        """
+        :returns: True if the node is has no children
+        """
+        return not self.has_deleted_children and self.numchild == 0
+
     @property
     def key_base(self):
         """Key base of the location where the document is stored in object storage."""
@@ -718,38 +629,22 @@ class Document(MP_Node, BaseModel):
             cache_key = document.get_nb_accesses_cache_key()
             cache.delete(cache_key)
 
-    def get_roles(self, user):
+    def get_role(self, user):
         """Return the roles a user has on a document."""
         if not user.is_authenticated:
-            return []
+            return None
 
         try:
             roles = self.user_roles or []
         except AttributeError:
-            try:
-                roles = DocumentAccess.objects.filter(
-                    models.Q(user=user) | models.Q(team__in=user.teams),
-                    document__path=Left(
-                        models.Value(self.path), Length("document__path")
-                    ),
-                ).values_list("role", flat=True)
-            except (models.ObjectDoesNotExist, IndexError):
-                roles = []
-        return roles
+            roles = DocumentAccess.objects.filter(
+                models.Q(user=user) | models.Q(team__in=user.teams),
+                document__path=Left(models.Value(self.path), Length("document__path")),
+            ).values_list("role", flat=True)
 
-    def get_links_definitions(self, ancestors_links):
-        """Get links reach/role definitions for the current document and its ancestors."""
+        return RoleChoices.max(*roles)
 
-        links_definitions = defaultdict(set)
-        links_definitions[self.link_reach].add(self.link_role)
-
-        # Merge ancestor link definitions
-        for ancestor in ancestors_links:
-            links_definitions[ancestor["link_reach"]].add(ancestor["link_role"])
-
-        return dict(links_definitions)  # Convert default dict back to a normal dict
-
-    def compute_ancestors_links(self, user):
+    def compute_ancestors_links_paths_mapping(self):
         """
         Compute the ancestors links for the current document up to the highest readable ancestor.
         """
@@ -758,63 +653,114 @@ class Document(MP_Node, BaseModel):
             .filter(ancestors_deleted_at__isnull=True)
             .order_by("path")
         )
-        highest_readable = ancestors.readable_per_se(user).only("depth").first()
-
-        if highest_readable is None:
-            return []
-
         ancestors_links = []
         paths_links_mapping = {}
-        for ancestor in ancestors.filter(depth__gte=highest_readable.depth):
+
+        for ancestor in ancestors:
             ancestors_links.append(
                 {"link_reach": ancestor.link_reach, "link_role": ancestor.link_role}
             )
             paths_links_mapping[ancestor.path] = ancestors_links.copy()
 
-        ancestors_links = paths_links_mapping.get(self.path[: -self.steplen], [])
+        return paths_links_mapping
 
-        return ancestors_links
+    @property
+    def link_definition(self):
+        """Returns link reach/role as a definition in dictionary format."""
+        return {"link_reach": self.link_reach, "link_role": self.link_role}
 
-    def get_abilities(self, user, ancestors_links=None):
+    @property
+    def ancestors_link_definition(self):
+        """Link defintion equivalent to all document's ancestors."""
+        if getattr(self, "_ancestors_link_definition", None) is None:
+            if self.depth <= 1:
+                ancestors_links = []
+            else:
+                mapping = self.compute_ancestors_links_paths_mapping()
+                ancestors_links = mapping.get(self.path[: -self.steplen], [])
+            self._ancestors_link_definition = get_equivalent_link_definition(
+                ancestors_links
+            )
+
+        return self._ancestors_link_definition
+
+    @ancestors_link_definition.setter
+    def ancestors_link_definition(self, definition):
+        """Cache the ancestors_link_definition."""
+        self._ancestors_link_definition = definition
+
+    @property
+    def ancestors_link_reach(self):
+        """Link reach equivalent to all document's ancestors."""
+        return self.ancestors_link_definition["link_reach"]
+
+    @property
+    def ancestors_link_role(self):
+        """Link role equivalent to all document's ancestors."""
+        return self.ancestors_link_definition["link_role"]
+
+    @property
+    def computed_link_definition(self):
+        """
+        Link reach/role on the document, combining inherited ancestors' link
+        definitions and the document's own link definition.
+        """
+        if getattr(self, "_computed_link_definition", None) is None:
+            self._computed_link_definition = get_equivalent_link_definition(
+                [self.ancestors_link_definition, self.link_definition]
+            )
+        return self._computed_link_definition
+
+    @property
+    def computed_link_reach(self):
+        """Actual link reach on the document."""
+        return self.computed_link_definition["link_reach"]
+
+    @property
+    def computed_link_role(self):
+        """Actual link role on the document."""
+        return self.computed_link_definition["link_role"]
+
+    def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the document.
         """
-        if self.depth <= 1 or getattr(self, "is_highest_ancestor_for_user", False):
-            ancestors_links = []
-        elif ancestors_links is None:
-            ancestors_links = self.compute_ancestors_links(user=user)
-
-        roles = set(
-            self.get_roles(user)
-        )  # at this point only roles based on specific access
+        # First get the role based on specific access
+        role = self.get_role(user)
 
         # Characteristics that are based only on specific access
-        is_owner = RoleChoices.OWNER in roles
+        is_owner = role == RoleChoices.OWNER
         is_deleted = self.ancestors_deleted_at and not is_owner
-        is_owner_or_admin = (is_owner or RoleChoices.ADMIN in roles) and not is_deleted
+        is_owner_or_admin = (is_owner or role == RoleChoices.ADMIN) and not is_deleted
 
         # Compute access roles before adding link roles because we don't
         # want anonymous users to access versions (we wouldn't know from
         # which date to allow them anyway)
         # Anonymous users should also not see document accesses
-        has_access_role = bool(roles) and not is_deleted
+        has_access_role = bool(role) and not is_deleted
         can_update_from_access = (
-            is_owner_or_admin or RoleChoices.EDITOR in roles
+            is_owner_or_admin or role == RoleChoices.EDITOR
         ) and not is_deleted
 
-        # Add roles provided by the document link, taking into account its ancestors
-        links_definitions = self.get_links_definitions(ancestors_links)
-        public_roles = links_definitions.get(LinkReachChoices.PUBLIC, set())
-        authenticated_roles = (
-            links_definitions.get(LinkReachChoices.AUTHENTICATED, set())
-            if user.is_authenticated
-            else set()
+        link_select_options = LinkReachChoices.get_select_options(
+            **self.ancestors_link_definition
+        )
+        link_definition = get_equivalent_link_definition(
+            [
+                self.ancestors_link_definition,
+                {"link_reach": self.link_reach, "link_role": self.link_role},
+            ]
         )
-        roles = roles | public_roles | authenticated_roles
 
-        can_get = bool(roles) and not is_deleted
+        link_reach = link_definition["link_reach"]
+        if link_reach == LinkReachChoices.PUBLIC or (
+            link_reach == LinkReachChoices.AUTHENTICATED and user.is_authenticated
+        ):
+            role = RoleChoices.max(role, link_definition["link_role"])
+
+        can_get = bool(role) and not is_deleted
         can_update = (
-            is_owner_or_admin or RoleChoices.EDITOR in roles
+            is_owner_or_admin or role == RoleChoices.EDITOR
         ) and not is_deleted
 
         ai_allow_reach_from = settings.AI_ALLOW_REACH_FROM
@@ -851,7 +797,7 @@ class Document(MP_Node, BaseModel):
             "restore": is_owner,
             "retrieve": can_get,
             "media_auth": can_get,
-            "link_select_options": LinkReachChoices.get_select_options(ancestors_links),
+            "link_select_options": link_select_options,
             "tree": can_get,
             "update": can_update,
             "versions_destroy": is_owner_or_admin,
@@ -946,7 +892,8 @@ class Document(MP_Node, BaseModel):
 
         if self.depth > 1:
             self._meta.model.objects.filter(pk=self.get_parent().pk).update(
-                numchild=models.F("numchild") - 1
+                numchild=models.F("numchild") - 1,
+                has_deleted_children=True,
             )
 
         # Mark all descendants as soft deleted
@@ -1103,48 +1050,120 @@ class DocumentAccess(BaseAccess):
         super().save(*args, **kwargs)
         self.document.invalidate_nb_accesses_cache()
 
+    @property
+    def target_key(self):
+        """Get a unique key for the actor targeted by the access, without possible conflict."""
+        return f"user:{self.user_id!s}" if self.user_id else f"team:{self.team:s}"
+
     def delete(self, *args, **kwargs):
         """Override delete to clear the document's cache for number of accesses."""
         super().delete(*args, **kwargs)
         self.document.invalidate_nb_accesses_cache()
 
+    def set_user_roles_tuple(self, ancestors_role, current_role):
+        """
+        Set a precomputed (ancestor_role, current_role) tuple for this instance.
+
+        This avoids querying the database in `get_roles_tuple()` and is useful
+        when roles are already known, such as in bulk serialization.
+
+        Args:
+            ancestor_role (str | None): Highest role on any ancestor document.
+            current_role (str | None): Role on the current document.
+        """
+        # pylint: disable=attribute-defined-outside-init
+        self._prefetched_user_roles_tuple = (ancestors_role, current_role)
+
+    def get_user_roles_tuple(self, user):
+        """
+        Return a tuple of:
+        - the highest role the user has on any ancestor of the document
+        - the role the user has on the current document
+
+        If roles have been explicitly set using `set_user_roles_tuple()`,
+        those will be returned instead of querying the database.
+
+        This allows viewsets or serializers to precompute roles for performance
+        when handling multiple documents at once.
+
+        Args:
+            user (User): The user whose roles are being evaluated.
+
+        Returns:
+            tuple[str | None, str | None]: (max_ancestor_role, current_document_role)
+        """
+        if not user.is_authenticated:
+            return None, None
+
+        try:
+            return self._prefetched_user_roles_tuple
+        except AttributeError:
+            pass
+
+        ancestors = (
+            self.document.get_ancestors() | Document.objects.filter(pk=self.document_id)
+        ).filter(ancestors_deleted_at__isnull=True)
+
+        access_tuples = DocumentAccess.objects.filter(
+            models.Q(user=user) | models.Q(team__in=user.teams),
+            document__in=ancestors,
+        ).values_list("document_id", "role")
+
+        ancestors_roles = []
+        current_roles = []
+        for doc_id, role in access_tuples:
+            if doc_id == self.document_id:
+                current_roles.append(role)
+            else:
+                ancestors_roles.append(role)
+
+        return RoleChoices.max(*ancestors_roles), RoleChoices.max(*current_roles)
+
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the document access.
         """
-        roles = self._get_roles(self.document, user)
-        is_owner_or_admin = bool(set(roles).intersection(set(PRIVILEGED_ROLES)))
+        ancestors_role, current_role = self.get_user_roles_tuple(user)
+        role = RoleChoices.max(ancestors_role, current_role)
+        is_owner_or_admin = role in PRIVILEGED_ROLES
+
         if self.role == RoleChoices.OWNER:
-            can_delete = (
-                RoleChoices.OWNER in roles
-                and self.document.accesses.filter(role=RoleChoices.OWNER).count() > 1
-            )
-            set_role_to = (
-                [RoleChoices.ADMIN, RoleChoices.EDITOR, RoleChoices.READER]
-                if can_delete
-                else []
+            can_delete = role == RoleChoices.OWNER and (
+                # check if document is not root trying to avoid an extra query
+                self.document.depth > 1
+                or DocumentAccess.objects.filter(
+                    document_id=self.document_id, role=RoleChoices.OWNER
+                ).count()
+                > 1
             )
+            set_role_to = RoleChoices.values if can_delete else []
         else:
             can_delete = is_owner_or_admin
             set_role_to = []
-            if RoleChoices.OWNER in roles:
-                set_role_to.append(RoleChoices.OWNER)
             if is_owner_or_admin:
                 set_role_to.extend(
-                    [RoleChoices.ADMIN, RoleChoices.EDITOR, RoleChoices.READER]
+                    [RoleChoices.READER, RoleChoices.EDITOR, RoleChoices.ADMIN]
                 )
+            if role == RoleChoices.OWNER:
+                set_role_to.append(RoleChoices.OWNER)
 
-        # Remove the current role as we don't want to propose it as an option
-        try:
-            set_role_to.remove(self.role)
-        except ValueError:
-            pass
+        # Filter out roles that would be lower than the one the user already has
+        ancestors_role_priority = RoleChoices.get_priority(
+            getattr(self, "max_ancestors_role", None)
+        )
+        set_role_to = [
+            candidate_role
+            for candidate_role in set_role_to
+            if RoleChoices.get_priority(candidate_role) >= ancestors_role_priority
+        ]
+        if len(set_role_to) == 1:
+            set_role_to = []
 
         return {
             "destroy": can_delete,
             "update": bool(set_role_to) and is_owner_or_admin,
             "partial_update": bool(set_role_to) and is_owner_or_admin,
-            "retrieve": self.user and self.user.id == user.id or is_owner_or_admin,
+            "retrieve": (self.user and self.user.id == user.id) or is_owner_or_admin,
             "set_role_to": set_role_to,
         }
 
@@ -1277,10 +1296,10 @@ class Template(BaseModel):
     def __str__(self):
         return self.title
 
-    def get_roles(self, user):
+    def get_role(self, user):
         """Return the roles a user has on a resource as an iterable."""
         if not user.is_authenticated:
-            return []
+            return None
 
         try:
             roles = self.user_roles or []
@@ -1291,21 +1310,20 @@ class Template(BaseModel):
                 ).values_list("role", flat=True)
             except (models.ObjectDoesNotExist, IndexError):
                 roles = []
-        return roles
+
+        return RoleChoices.max(*roles)
 
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the template.
         """
-        roles = self.get_roles(user)
-        is_owner_or_admin = bool(
-            set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
-        )
-        can_get = self.is_public or bool(roles)
-        can_update = is_owner_or_admin or RoleChoices.EDITOR in roles
+        role = self.get_role(user)
+        is_owner_or_admin = role in PRIVILEGED_ROLES
+        can_get = self.is_public or bool(role)
+        can_update = is_owner_or_admin or role == RoleChoices.EDITOR
 
         return {
-            "destroy": RoleChoices.OWNER in roles,
+            "destroy": role == RoleChoices.OWNER,
             "generate_document": can_get,
             "accesses_manage": is_owner_or_admin,
             "update": can_update,
@@ -1352,11 +1370,65 @@ class TemplateAccess(BaseAccess):
     def __str__(self):
         return f"{self.user!s} is {self.role:s} in template {self.template!s}"
 
+    def get_role(self, user):
+        """
+        Get the role a user has on a resource.
+        """
+        if not user.is_authenticated:
+            return None
+
+        try:
+            roles = self.user_roles or []
+        except AttributeError:
+            teams = user.teams
+            try:
+                roles = self.template.accesses.filter(
+                    models.Q(user=user) | models.Q(team__in=teams),
+                ).values_list("role", flat=True)
+            except (Template.DoesNotExist, IndexError):
+                roles = []
+
+        return RoleChoices.max(*roles)
+
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the template access.
         """
-        return self._get_abilities(self.template, user)
+        role = self.get_role(user)
+        is_owner_or_admin = role in PRIVILEGED_ROLES
+
+        if self.role == RoleChoices.OWNER:
+            can_delete = (role == RoleChoices.OWNER) and self.template.accesses.filter(
+                role=RoleChoices.OWNER
+            ).count() > 1
+            set_role_to = (
+                [RoleChoices.ADMIN, RoleChoices.EDITOR, RoleChoices.READER]
+                if can_delete
+                else []
+            )
+        else:
+            can_delete = is_owner_or_admin
+            set_role_to = []
+            if role == RoleChoices.OWNER:
+                set_role_to.append(RoleChoices.OWNER)
+            if is_owner_or_admin:
+                set_role_to.extend(
+                    [RoleChoices.ADMIN, RoleChoices.EDITOR, RoleChoices.READER]
+                )
+
+        # Remove the current role as we don't want to propose it as an option
+        try:
+            set_role_to.remove(self.role)
+        except ValueError:
+            pass
+
+        return {
+            "destroy": can_delete,
+            "update": bool(set_role_to),
+            "partial_update": bool(set_role_to),
+            "retrieve": bool(role),
+            "set_role_to": set_role_to,
+        }
 
 
 class Invitation(BaseModel):

src/backend/core/tests/documents/test_api_document_accesses.py

@@ -1,6 +1,7 @@
 """
 Test document accesses API endpoints for users in impress's core app.
 """
+# pylint: disable=too-many-lines
 
 import random
 from uuid import uuid4
@@ -8,7 +9,7 @@ from uuid import uuid4
 import pytest
 from rest_framework.test import APIClient
 
-from core import factories, models
+from core import choices, factories, models
 from core.api import serializers
 from core.tests.conftest import TEAM, USER, VIA
 from core.tests.test_services_collaboration_services import (  # pylint: disable=unused-import
@@ -51,12 +52,7 @@ def test_api_document_accesses_list_authenticated_unrelated():
         f"/api/v1.0/documents/{document.id!s}/accesses/",
     )
     assert response.status_code == 200
-    assert response.json() == {
-        "count": 0,
-        "next": None,
-        "previous": None,
-        "results": [],
-    }
+    assert response.json() == []
 
 
 def test_api_document_accesses_list_unexisting_document():
@@ -69,39 +65,46 @@ def test_api_document_accesses_list_unexisting_document():
     client.force_login(user)
 
     response = client.get(f"/api/v1.0/documents/{uuid4()!s}/accesses/")
-    assert response.status_code == 200
-    assert response.json() == {
-        "count": 0,
-        "next": None,
-        "previous": None,
-        "results": [],
-    }
+    assert response.status_code == 404
+    assert response.json() == {"detail": "Not found."}
 
 
 @pytest.mark.parametrize("via", VIA)
 @pytest.mark.parametrize(
-    "role", [role for role in models.RoleChoices if role not in models.PRIVILEGED_ROLES]
+    "role",
+    [role for role in choices.RoleChoices if role not in choices.PRIVILEGED_ROLES],
 )
 def test_api_document_accesses_list_authenticated_related_non_privileged(
-    via, role, mock_user_teams
+    via, role, mock_user_teams, django_assert_num_queries
 ):
     """
-    Authenticated users should be able to list document accesses for a document
-    to which they are directly related, whatever their role in the document.
+    Authenticated users with no privileged role should only be able to list document
+    accesses associated with privileged roles for a document, including from ancestors.
     """
     user = factories.UserFactory()
-
     client = APIClient()
     client.force_login(user)
 
-    owner = factories.UserFactory()
-    accesses = []
-
-    document_access = factories.UserDocumentAccessFactory(
-        user=owner, role=models.RoleChoices.OWNER
+    # Create documents structured as a tree
+    unreadable_ancestor = factories.DocumentFactory(link_reach="restricted")
+    # make all documents below the grand parent readable without a specific access for the user
+    grand_parent = factories.DocumentFactory(
+        parent=unreadable_ancestor, link_reach="authenticated"
     )
-    accesses.append(document_access)
-    document = document_access.document
+    parent = factories.DocumentFactory(parent=grand_parent)
+    document = factories.DocumentFactory(parent=parent)
+    child = factories.DocumentFactory(parent=document)
+
+    # Create accesses related to each document
+    accesses = (
+        factories.UserDocumentAccessFactory(document=unreadable_ancestor),
+        factories.UserDocumentAccessFactory(document=grand_parent),
+        factories.UserDocumentAccessFactory(document=parent),
+        factories.UserDocumentAccessFactory(document=document),
+        factories.TeamDocumentAccessFactory(document=document),
+    )
+    factories.UserDocumentAccessFactory(document=child)
+
     if via == USER:
         models.DocumentAccess.objects.create(
             document=document,
@@ -116,33 +119,32 @@ def test_api_document_accesses_list_authenticated_related_non_privileged(
             role=role,
         )
 
-    access1 = factories.TeamDocumentAccessFactory(document=document)
-    access2 = factories.UserDocumentAccessFactory(document=document)
-    accesses.append(access1)
-    accesses.append(access2)
-
     # Accesses for other documents to which the user is related should not be listed either
     other_access = factories.UserDocumentAccessFactory(user=user)
     factories.UserDocumentAccessFactory(document=other_access.document)
 
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/accesses/",
-    )
+    with django_assert_num_queries(3):
+        response = client.get(f"/api/v1.0/documents/{document.id!s}/accesses/")
 
-    # Return only owners
-    owners_accesses = [
-        access for access in accesses if access.role in models.PRIVILEGED_ROLES
-    ]
     assert response.status_code == 200
     content = response.json()
-    assert content["count"] == len(owners_accesses)
-    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
+
+    # Make sure only privileged roles are returned
+    privileged_accesses = [
+        acc for acc in accesses if acc.role in choices.PRIVILEGED_ROLES
+    ]
+    assert len(content) == len(privileged_accesses)
+
+    assert sorted(content, key=lambda x: x["id"]) == sorted(
         [
             {
                 "id": str(access.id),
+                "document": {
+                    "id": str(access.document_id),
+                    "path": access.document.path,
+                    "depth": access.document.depth,
+                },
                 "user": {
-                    "id": None,
-                    "email": None,
                     "full_name": access.user.full_name,
                     "short_name": access.user.short_name,
                 }
@@ -150,40 +152,47 @@ def test_api_document_accesses_list_authenticated_related_non_privileged(
                 else None,
                 "team": access.team,
                 "role": access.role,
-                "abilities": access.get_abilities(user),
+                "max_ancestors_role": None,
+                "max_role": access.role,
+                "abilities": {
+                    "destroy": False,
+                    "partial_update": False,
+                    "retrieve": False,
+                    "set_role_to": [],
+                    "update": False,
+                },
             }
-            for access in owners_accesses
+            for access in privileged_accesses
         ],
         key=lambda x: x["id"],
     )
 
-    for access in content["results"]:
-        assert access["role"] in models.PRIVILEGED_ROLES
-
 
 @pytest.mark.parametrize("via", VIA)
-@pytest.mark.parametrize("role", models.PRIVILEGED_ROLES)
-def test_api_document_accesses_list_authenticated_related_privileged_roles(
-    via, role, mock_user_teams
+@pytest.mark.parametrize(
+    "role", [role for role in choices.RoleChoices if role in choices.PRIVILEGED_ROLES]
+)
+def test_api_document_accesses_list_authenticated_related_privileged(
+    via, role, mock_user_teams, django_assert_num_queries
 ):
     """
-    Authenticated users should be able to list document accesses for a document
-    to which they are directly related, whatever their role in the document.
+    Authenticated users with a privileged role should be able to list all
+    document accesses whatever the role, including from ancestors.
     """
     user = factories.UserFactory()
-
     client = APIClient()
     client.force_login(user)
 
-    owner = factories.UserFactory()
-    accesses = []
-
-    document_access = factories.UserDocumentAccessFactory(
-        user=owner, role=models.RoleChoices.OWNER
+    # Create documents structured as a tree
+    unreadable_ancestor = factories.DocumentFactory(link_reach="restricted")
+    # make all documents below the grand parent readable without a specific access for the user
+    grand_parent = factories.DocumentFactory(
+        parent=unreadable_ancestor, link_reach="authenticated"
     )
-    accesses.append(document_access)
-    document = document_access.document
-    user_access = None
+    parent = factories.DocumentFactory(parent=grand_parent)
+    document = factories.DocumentFactory(parent=parent)
+    child = factories.DocumentFactory(parent=document)
+
     if via == USER:
         user_access = models.DocumentAccess.objects.create(
             document=document,
@@ -197,61 +206,319 @@ def test_api_document_accesses_list_authenticated_related_privileged_roles(
             team="lasuite",
             role=role,
         )
+    else:
+        raise RuntimeError()
 
-    access1 = factories.TeamDocumentAccessFactory(document=document)
-    access2 = factories.UserDocumentAccessFactory(document=document)
-    accesses.append(access1)
-    accesses.append(access2)
+    # Create accesses related to each document
+    ancestors_accesses = [
+        # Access on unreadable ancestor should still be listed
+        # as the related user gains access to our document
+        factories.UserDocumentAccessFactory(document=unreadable_ancestor),
+        factories.UserDocumentAccessFactory(document=grand_parent),
+        factories.UserDocumentAccessFactory(document=parent),
+    ]
+    document_accesses = [
+        factories.UserDocumentAccessFactory(document=document),
+        factories.TeamDocumentAccessFactory(document=document),
+        factories.UserDocumentAccessFactory(document=document),
+        user_access,
+    ]
+    factories.UserDocumentAccessFactory(document=child)
 
     # Accesses for other documents to which the user is related should not be listed either
     other_access = factories.UserDocumentAccessFactory(user=user)
     factories.UserDocumentAccessFactory(document=other_access.document)
 
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/accesses/",
-    )
-
-    access2_user = serializers.UserSerializer(instance=access2.user).data
-    base_user = serializers.UserSerializer(instance=user).data
+    with django_assert_num_queries(3):
+        response = client.get(f"/api/v1.0/documents/{document.id!s}/accesses/")
 
     assert response.status_code == 200
     content = response.json()
-    assert len(content["results"]) == 4
-    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
+    assert len(content) == 7
+    assert sorted(content, key=lambda x: x["id"]) == sorted(
         [
             {
-                "id": str(user_access.id),
-                "user": base_user if via == "user" else None,
-                "team": "lasuite" if via == "team" else "",
-                "role": user_access.role,
-                "abilities": user_access.get_abilities(user),
-            },
-            {
-                "id": str(access1.id),
-                "user": None,
-                "team": access1.team,
-                "role": access1.role,
-                "abilities": access1.get_abilities(user),
-            },
-            {
-                "id": str(access2.id),
-                "user": access2_user,
-                "team": "",
-                "role": access2.role,
-                "abilities": access2.get_abilities(user),
-            },
-            {
-                "id": str(document_access.id),
-                "user": serializers.UserSerializer(instance=owner).data,
-                "team": "",
-                "role": models.RoleChoices.OWNER,
-                "abilities": document_access.get_abilities(user),
-            },
+                "id": str(access.id),
+                "document": {
+                    "id": str(access.document_id),
+                    "path": access.document.path,
+                    "depth": access.document.depth,
+                },
+                "user": {
+                    "id": str(access.user.id),
+                    "email": access.user.email,
+                    "language": access.user.language,
+                    "full_name": access.user.full_name,
+                    "short_name": access.user.short_name,
+                }
+                if access.user
+                else None,
+                "max_ancestors_role": None,
+                "max_role": access.role,
+                "team": access.team,
+                "role": access.role,
+                "abilities": access.get_abilities(user),
+            }
+            for access in ancestors_accesses + document_accesses
         ],
         key=lambda x: x["id"],
     )
 
 
+def test_api_document_accesses_retrieve_set_role_to_child():
+    """Check set_role_to for an access with no access on the ancestor."""
+    user, other_user = factories.UserFactory.create_batch(2)
+    client = APIClient()
+    client.force_login(user)
+
+    parent = factories.DocumentFactory()
+    parent_access = factories.UserDocumentAccessFactory(
+        document=parent, user=user, role="owner"
+    )
+
+    document = factories.DocumentFactory(parent=parent)
+    document_access_other_user = factories.UserDocumentAccessFactory(
+        document=document, user=other_user, role="editor"
+    )
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/accesses/")
+
+    assert response.status_code == 200
+    content = response.json()
+    assert len(content) == 2
+
+    result_dict = {
+        result["id"]: result["abilities"]["set_role_to"] for result in content
+    }
+    assert result_dict[str(document_access_other_user.id)] == [
+        "reader",
+        "editor",
+        "administrator",
+        "owner",
+    ]
+    assert result_dict[str(parent_access.id)] == []
+
+    # Add an access for the other user on the parent
+    parent_access_other_user = factories.UserDocumentAccessFactory(
+        document=parent, user=other_user, role="editor"
+    )
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/accesses/")
+
+    assert response.status_code == 200
+    content = response.json()
+    assert len(content) == 3
+
+    result_dict = {
+        result["id"]: result["abilities"]["set_role_to"] for result in content
+    }
+    assert result_dict[str(document_access_other_user.id)] == [
+        "editor",
+        "administrator",
+        "owner",
+    ]
+    assert result_dict[str(parent_access.id)] == []
+    assert result_dict[str(parent_access_other_user.id)] == [
+        "reader",
+        "editor",
+        "administrator",
+        "owner",
+    ]
+
+
+@pytest.mark.parametrize(
+    "roles,results",
+    [
+        [
+            ["administrator", "reader", "reader", "reader"],
+            [
+                ["reader", "editor", "administrator"],
+                [],
+                [],
+                ["reader", "editor", "administrator"],
+            ],
+        ],
+        [
+            ["owner", "reader", "reader", "reader"],
+            [
+                ["reader", "editor", "administrator", "owner"],
+                [],
+                [],
+                ["reader", "editor", "administrator", "owner"],
+            ],
+        ],
+        [
+            ["owner", "reader", "reader", "owner"],
+            [
+                ["reader", "editor", "administrator", "owner"],
+                [],
+                [],
+                ["reader", "editor", "administrator", "owner"],
+            ],
+        ],
+    ],
+)
+def test_api_document_accesses_list_authenticated_related_same_user(roles, results):
+    """
+    The maximum role across ancestor documents and set_role_to optionsfor
+    a given user should be filled as expected.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Create documents structured as a tree
+    grand_parent = factories.DocumentFactory(link_reach="authenticated")
+    parent = factories.DocumentFactory(parent=grand_parent)
+    document = factories.DocumentFactory(parent=parent)
+
+    # Create accesses for another user
+    other_user = factories.UserFactory()
+    accesses = [
+        factories.UserDocumentAccessFactory(
+            document=document, user=user, role=roles[0]
+        ),
+        factories.UserDocumentAccessFactory(
+            document=grand_parent, user=other_user, role=roles[1]
+        ),
+        factories.UserDocumentAccessFactory(
+            document=parent, user=other_user, role=roles[2]
+        ),
+        factories.UserDocumentAccessFactory(
+            document=document, user=other_user, role=roles[3]
+        ),
+    ]
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/accesses/")
+
+    assert response.status_code == 200
+    content = response.json()
+    assert len(content) == 4
+
+    for result in content:
+        assert (
+            result["max_ancestors_role"] is None
+            if result["user"]["id"] == str(user.id)
+            else choices.RoleChoices.max(roles[1], roles[2])
+        )
+
+    result_dict = {
+        result["id"]: result["abilities"]["set_role_to"] for result in content
+    }
+    assert [result_dict[str(access.id)] for access in accesses] == results
+
+
+@pytest.mark.parametrize(
+    "roles,results",
+    [
+        [
+            ["administrator", "reader", "reader", "reader"],
+            [
+                ["reader", "editor", "administrator"],
+                [],
+                [],
+                ["reader", "editor", "administrator"],
+            ],
+        ],
+        [
+            ["owner", "reader", "reader", "reader"],
+            [
+                ["reader", "editor", "administrator", "owner"],
+                [],
+                [],
+                ["reader", "editor", "administrator", "owner"],
+            ],
+        ],
+        [
+            ["owner", "reader", "reader", "owner"],
+            [
+                ["reader", "editor", "administrator", "owner"],
+                [],
+                [],
+                ["reader", "editor", "administrator", "owner"],
+            ],
+        ],
+        [
+            ["reader", "reader", "reader", "owner"],
+            [
+                ["reader", "editor", "administrator", "owner"],
+                [],
+                [],
+                ["reader", "editor", "administrator", "owner"],
+            ],
+        ],
+        [
+            ["reader", "administrator", "reader", "editor"],
+            [
+                ["reader", "editor", "administrator"],
+                ["reader", "editor", "administrator"],
+                [],
+                [],
+            ],
+        ],
+        [
+            ["editor", "editor", "administrator", "editor"],
+            [
+                ["reader", "editor", "administrator"],
+                [],
+                ["editor", "administrator"],
+                [],
+            ],
+        ],
+    ],
+)
+def test_api_document_accesses_list_authenticated_related_same_team(
+    roles, results, mock_user_teams
+):
+    """
+    The maximum role across ancestor documents and set_role_to optionsfor
+    a given team should be filled as expected.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    # Create documents structured as a tree
+    grand_parent = factories.DocumentFactory(link_reach="authenticated")
+    parent = factories.DocumentFactory(parent=grand_parent)
+    document = factories.DocumentFactory(parent=parent)
+
+    mock_user_teams.return_value = ["lasuite", "unknown"]
+    accesses = [
+        factories.UserDocumentAccessFactory(
+            document=document, user=user, role=roles[0]
+        ),
+        # Create accesses for a team
+        factories.TeamDocumentAccessFactory(
+            document=grand_parent, team="lasuite", role=roles[1]
+        ),
+        factories.TeamDocumentAccessFactory(
+            document=parent, team="lasuite", role=roles[2]
+        ),
+        factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role=roles[3]
+        ),
+    ]
+
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/accesses/")
+
+    assert response.status_code == 200
+    content = response.json()
+    assert len(content) == 4
+
+    for result in content:
+        assert (
+            result["max_ancestors_role"] is None
+            if result["user"] and result["user"]["id"] == str(user.id)
+            else choices.RoleChoices.max(roles[1], roles[2])
+        )
+
+    result_dict = {
+        result["id"]: result["abilities"]["set_role_to"] for result in content
+    }
+    assert [result_dict[str(access.id)] for access in accesses] == results
+
+
 def test_api_document_accesses_retrieve_anonymous():
     """
     Anonymous users should not be allowed to retrieve a document access.
@@ -307,7 +574,9 @@ def test_api_document_accesses_retrieve_authenticated_unrelated():
 @pytest.mark.parametrize("via", VIA)
 @pytest.mark.parametrize("role", models.RoleChoices)
 def test_api_document_accesses_retrieve_authenticated_related(
-    via, role, mock_user_teams
+    via,
+    role,
+    mock_user_teams,
 ):
     """
     A user who is related to a document should be allowed to retrieve the
@@ -333,7 +602,7 @@ def test_api_document_accesses_retrieve_authenticated_related(
         f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
     )
 
-    if not role in models.PRIVILEGED_ROLES:
+    if not role in choices.PRIVILEGED_ROLES:
         assert response.status_code == 403
     else:
         access_user = serializers.UserSerializer(instance=access.user).data
@@ -341,9 +610,16 @@ def test_api_document_accesses_retrieve_authenticated_related(
         assert response.status_code == 200
         assert response.json() == {
             "id": str(access.id),
+            "document": {
+                "id": str(access.document_id),
+                "path": access.document.path,
+                "depth": access.document.depth,
+            },
             "user": access_user,
             "team": "",
             "role": access.role,
+            "max_ancestors_role": None,
+            "max_role": access.role,
             "abilities": access.get_abilities(user),
         }
 
@@ -448,7 +724,9 @@ def test_api_document_accesses_update_authenticated_reader_or_editor(
 
 
 @pytest.mark.parametrize("via", VIA)
+@pytest.mark.parametrize("create_for", VIA)
 def test_api_document_accesses_update_administrator_except_owner(
+    create_for,
     via,
     mock_user_teams,
     mock_reset_connections,  # pylint: disable=redefined-outer-name
@@ -481,32 +759,31 @@ def test_api_document_accesses_update_administrator_except_owner(
 
     new_values = {
         "id": uuid4(),
-        "user_id": factories.UserFactory().id,
         "role": random.choice(["administrator", "editor", "reader"]),
     }
+    if create_for == USER:
+        new_values["user_id"] = factories.UserFactory().id
+    elif create_for == TEAM:
+        new_values["team"] = "new-team"
 
     for field, value in new_values.items():
         new_data = {**old_values, field: value}
-        if new_data["role"] == old_values["role"]:
+        with mock_reset_connections(document.id, str(access.user_id)):
             response = client.put(
                 f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
                 data=new_data,
                 format="json",
             )
-            assert response.status_code == 403
-        else:
-            with mock_reset_connections(document.id, str(access.user_id)):
-                response = client.put(
-                    f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
-                    data=new_data,
-                    format="json",
-                )
-                assert response.status_code == 200
+            assert response.status_code == 200
 
         access.refresh_from_db()
         updated_values = serializers.DocumentAccessSerializer(instance=access).data
-        if field == "role":
-            assert updated_values == {**old_values, "role": new_values["role"]}
+        if field in ["role", "max_role"]:
+            assert updated_values == {
+                **old_values,
+                "role": new_values["role"],
+                "max_role": new_values["role"],
+            }
         else:
             assert updated_values == old_values
 
@@ -601,7 +878,7 @@ def test_api_document_accesses_update_administrator_to_owner(
     for field, value in new_values.items():
         new_data = {**old_values, field: value}
         # We are not allowed or not really updating the role
-        if field == "role" or new_data["role"] == old_values["role"]:
+        if field == "role":
             response = client.put(
                 f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
                 data=new_data,
@@ -624,7 +901,9 @@ def test_api_document_accesses_update_administrator_to_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
+@pytest.mark.parametrize("create_for", VIA)
 def test_api_document_accesses_update_owner(
+    create_for,
     via,
     mock_user_teams,
     mock_reset_connections,  # pylint: disable=redefined-outer-name
@@ -655,42 +934,39 @@ def test_api_document_accesses_update_owner(
 
     new_values = {
         "id": uuid4(),
-        "user_id": factories.UserFactory().id,
         "role": random.choice(models.RoleChoices.values),
     }
+    if create_for == USER:
+        new_values["user_id"] = factories.UserFactory().id
+    elif create_for == TEAM:
+        new_values["team"] = "new-team"
 
     for field, value in new_values.items():
         new_data = {**old_values, field: value}
-        if (
-            new_data["role"] == old_values["role"]
-        ):  # we are not really updating the role
+        with mock_reset_connections(document.id, str(access.user_id)):
             response = client.put(
                 f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
                 data=new_data,
                 format="json",
             )
-            assert response.status_code == 403
-        else:
-            with mock_reset_connections(document.id, str(access.user_id)):
-                response = client.put(
-                    f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
-                    data=new_data,
-                    format="json",
-                )
 
-                assert response.status_code == 200
+            assert response.status_code == 200
 
         access.refresh_from_db()
         updated_values = serializers.DocumentAccessSerializer(instance=access).data
 
-        if field == "role":
-            assert updated_values == {**old_values, "role": new_values["role"]}
+        if field in ["role", "max_role"]:
+            assert updated_values == {
+                **old_values,
+                "role": new_values["role"],
+                "max_role": new_values["role"],
+            }
         else:
             assert updated_values == old_values
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_owner_self(
+def test_api_document_accesses_update_owner_self_root(
     via,
     mock_user_teams,
     mock_reset_connections,  # pylint: disable=redefined-outer-name
@@ -751,6 +1027,51 @@ def test_api_document_accesses_update_owner_self(
         assert access.role == new_role
 
 
+@pytest.mark.parametrize("via", VIA)
+def test_api_document_accesses_update_owner_self_child(
+    via,
+    mock_user_teams,
+    mock_reset_connections,  # pylint: disable=redefined-outer-name
+):
+    """
+    A user who is owner of a document should be allowed to update
+    their own user access even if they are the only owner in the document,
+    provided the document is not a root.
+    """
+    user = factories.UserFactory(with_owned_document=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    parent = factories.DocumentFactory()
+    document = factories.DocumentFactory(parent=parent)
+    access = None
+    if via == USER:
+        access = factories.UserDocumentAccessFactory(
+            document=document, user=user, role="owner"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        access = factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role="owner"
+        )
+
+    old_values = serializers.DocumentAccessSerializer(instance=access).data
+    new_role = random.choice(["administrator", "editor", "reader"])
+
+    user_id = str(access.user_id) if via == USER else None
+    with mock_reset_connections(document.id, user_id):
+        response = client.put(
+            f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
+            data={**old_values, "role": new_role},
+            format="json",
+        )
+
+    assert response.status_code == 200
+    access.refresh_from_db()
+    assert access.role == new_role
+
+
 # Delete
 
 
@@ -931,17 +1252,16 @@ def test_api_document_accesses_delete_owners(
             f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
         )
 
-        assert response.status_code == 204
-        assert models.DocumentAccess.objects.count() == 1
+    assert response.status_code == 204
+    assert models.DocumentAccess.objects.count() == 1
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_owners_last_owner(via, mock_user_teams):
+def test_api_document_accesses_delete_owners_last_owner_root(via, mock_user_teams):
     """
-    It should not be possible to delete the last owner access from a document
+    It should not be possible to delete the last owner access from a root document
     """
     user = factories.UserFactory(with_owned_document=True)
-
     client = APIClient()
     client.force_login(user)
 
@@ -964,3 +1284,63 @@ def test_api_document_accesses_delete_owners_last_owner(via, mock_user_teams):
 
     assert response.status_code == 403
     assert models.DocumentAccess.objects.count() == 2
+
+
+def test_api_document_accesses_delete_owners_last_owner_child_user(
+    mock_reset_connections,  # pylint: disable=redefined-outer-name
+):
+    """
+    It should be possible to delete the last owner access from a document that is not a root.
+    """
+    user = factories.UserFactory(with_owned_document=True)
+    client = APIClient()
+    client.force_login(user)
+
+    parent = factories.DocumentFactory()
+    document = factories.DocumentFactory(parent=parent)
+    access = None
+    access = factories.UserDocumentAccessFactory(
+        document=document, user=user, role="owner"
+    )
+
+    assert models.DocumentAccess.objects.count() == 2
+    with mock_reset_connections(document.id, str(access.user_id)):
+        response = client.delete(
+            f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
+        )
+
+    assert response.status_code == 204
+    assert models.DocumentAccess.objects.count() == 1
+
+
+@pytest.mark.skip(
+    reason="Pending fix on https://github.com/suitenumerique/docs/issues/969"
+)
+def test_api_document_accesses_delete_owners_last_owner_child_team(
+    mock_user_teams,
+    mock_reset_connections,  # pylint: disable=redefined-outer-name
+):
+    """
+    It should be possible to delete the last owner access from a document that
+    is not a root.
+    """
+    user = factories.UserFactory(with_owned_document=True)
+    client = APIClient()
+    client.force_login(user)
+
+    parent = factories.DocumentFactory()
+    document = factories.DocumentFactory(parent=parent)
+    access = None
+    mock_user_teams.return_value = ["lasuite", "unknown"]
+    access = factories.TeamDocumentAccessFactory(
+        document=document, team="lasuite", role="owner"
+    )
+
+    assert models.DocumentAccess.objects.count() == 2
+    with mock_reset_connections(document.id, str(access.user_id)):
+        response = client.delete(
+            f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
+        )
+
+    assert response.status_code == 204
+    assert models.DocumentAccess.objects.count() == 1

src/backend/core/tests/documents/test_api_document_accesses_create.py

@@ -103,32 +103,37 @@ def test_api_document_accesses_create_authenticated_reader_or_editor(
     assert not models.DocumentAccess.objects.filter(user=other_user).exists()
 
 
+@pytest.mark.parametrize("depth", [1, 2, 3])
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_create_authenticated_administrator(via, mock_user_teams):
+def test_api_document_accesses_create_authenticated_administrator_share_to_user(
+    via, depth, mock_user_teams
+):
     """
-    Administrators of a document should be able to create document accesses
-    except for the "owner" role.
+    Administrators of a document (direct or by heritage) should be able to create
+    document accesses except for the "owner" role.
     An email should be sent to the accesses to notify them of the adding.
     """
     user = factories.UserFactory(with_owned_document=True)
-
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory()
+    documents = []
+    for i in range(depth):
+        parent = documents[i - 1] if i > 0 else None
+        documents.append(factories.DocumentFactory(parent=parent))
+
     if via == USER:
         factories.UserDocumentAccessFactory(
-            document=document, user=user, role="administrator"
+            document=documents[0], user=user, role="administrator"
         )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role="administrator"
+            document=documents[0], team="lasuite", role="administrator"
         )
 
     other_user = factories.UserFactory(language="en-us")
-
-    # It should not be allowed to create an owner access
+    document = documents[-1]
     response = client.post(
         f"/api/v1.0/documents/{document.id!s}/accesses/",
         {
@@ -140,7 +145,7 @@ def test_api_document_accesses_create_authenticated_administrator(via, mock_user
 
     assert response.status_code == 403
     assert response.json() == {
-        "detail": "Only owners of a resource can assign other users as owners."
+        "detail": "Only owners of a document can assign other users as owners."
     }
 
     # It should be allowed to create a lower access
@@ -165,9 +170,16 @@ def test_api_document_accesses_create_authenticated_administrator(via, mock_user
     other_user = serializers.UserSerializer(instance=other_user).data
     assert response.json() == {
         "abilities": new_document_access.get_abilities(user),
+        "document": {
+            "id": str(new_document_access.document_id),
+            "depth": new_document_access.document.depth,
+            "path": new_document_access.document.path,
+        },
         "id": str(new_document_access.id),
-        "team": "",
+        "max_ancestors_role": None,
+        "max_role": role,
         "role": role,
+        "team": "",
         "user": other_user,
     }
     assert len(mail.outbox) == 1
@@ -182,28 +194,119 @@ def test_api_document_accesses_create_authenticated_administrator(via, mock_user
     assert "docs/" + str(document.id) + "/" in email_content
 
 
+@pytest.mark.parametrize("depth", [1, 2, 3])
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_create_authenticated_owner(via, mock_user_teams):
+def test_api_document_accesses_create_authenticated_administrator_share_to_team(
+    via, depth, mock_user_teams
+):
     """
-    Owners of a document should be able to create document accesses whatever the role.
+    Administrators of a document (direct or by heritage) should be able to create
+    document accesses except for the "owner" role.
     An email should be sent to the accesses to notify them of the adding.
     """
+    user = factories.UserFactory(with_owned_document=True)
+    client = APIClient()
+    client.force_login(user)
+
+    documents = []
+    for i in range(depth):
+        parent = documents[i - 1] if i > 0 else None
+        documents.append(factories.DocumentFactory(parent=parent))
+
+    if via == USER:
+        factories.UserDocumentAccessFactory(
+            document=documents[0], user=user, role="administrator"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(
+            document=documents[0], team="lasuite", role="administrator"
+        )
+
+    other_user = factories.UserFactory(language="en-us")
+    document = documents[-1]
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/accesses/",
+        {
+            "team": "new-team",
+            "role": "owner",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Only owners of a document can assign other users as owners."
+    }
+
+    # It should be allowed to create a lower access
+    role = random.choice(
+        [role[0] for role in models.RoleChoices.choices if role[0] != "owner"]
+    )
+
+    assert len(mail.outbox) == 0
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/accesses/",
+        {
+            "team": "new-team",
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.DocumentAccess.objects.filter(team="new-team").count() == 1
+    new_document_access = models.DocumentAccess.objects.filter(team="new-team").get()
+    other_user = serializers.UserSerializer(instance=other_user).data
+    assert response.json() == {
+        "abilities": new_document_access.get_abilities(user),
+        "document": {
+            "id": str(new_document_access.document_id),
+            "depth": new_document_access.document.depth,
+            "path": new_document_access.document.path,
+        },
+        "id": str(new_document_access.id),
+        "max_ancestors_role": None,
+        "max_role": role,
+        "role": role,
+        "team": "new-team",
+        "user": None,
+    }
+    assert len(mail.outbox) == 0
+
+
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize("via", VIA)
+def test_api_document_accesses_create_authenticated_owner_share_to_user(
+    via, depth, mock_user_teams
+):
+    """
+    Owners of a document (direct or by heritage) should be able to create document accesses
+    whatever the role. An email should be sent to the accesses to notify them of the adding.
+    """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory()
+    documents = []
+    for i in range(depth):
+        parent = documents[i - 1] if i > 0 else None
+        documents.append(factories.DocumentFactory(parent=parent))
+
     if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
+        factories.UserDocumentAccessFactory(
+            document=documents[0], user=user, role="owner"
+        )
     elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role="owner"
+            document=documents[0], team="lasuite", role="owner"
         )
 
     other_user = factories.UserFactory(language="en-us")
-
+    document = documents[-1]
     role = random.choice([role[0] for role in models.RoleChoices.choices])
 
     assert len(mail.outbox) == 0
@@ -222,11 +325,18 @@ def test_api_document_accesses_create_authenticated_owner(via, mock_user_teams):
     new_document_access = models.DocumentAccess.objects.filter(user=other_user).get()
     other_user = serializers.UserSerializer(instance=other_user).data
     assert response.json() == {
-        "id": str(new_document_access.id),
-        "user": other_user,
-        "team": "",
-        "role": role,
         "abilities": new_document_access.get_abilities(user),
+        "document": {
+            "id": str(new_document_access.document_id),
+            "depth": new_document_access.document.depth,
+            "path": new_document_access.document.path,
+        },
+        "id": str(new_document_access.id),
+        "max_ancestors_role": None,
+        "max_role": role,
+        "role": role,
+        "team": "",
+        "user": other_user,
     }
     assert len(mail.outbox) == 1
     email = mail.outbox[0]
@@ -240,6 +350,71 @@ def test_api_document_accesses_create_authenticated_owner(via, mock_user_teams):
     assert "docs/" + str(document.id) + "/" in email_content
 
 
+@pytest.mark.parametrize("depth", [1, 2, 3])
+@pytest.mark.parametrize("via", VIA)
+def test_api_document_accesses_create_authenticated_owner_share_to_team(
+    via, depth, mock_user_teams
+):
+    """
+    Owners of a document (direct or by heritage) should be able to create document accesses
+    whatever the role. An email should be sent to the accesses to notify them of the adding.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    documents = []
+    for i in range(depth):
+        parent = documents[i - 1] if i > 0 else None
+        documents.append(factories.DocumentFactory(parent=parent))
+
+    if via == USER:
+        factories.UserDocumentAccessFactory(
+            document=documents[0], user=user, role="owner"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(
+            document=documents[0], team="lasuite", role="owner"
+        )
+
+    other_user = factories.UserFactory(language="en-us")
+    document = documents[-1]
+    role = random.choice([role[0] for role in models.RoleChoices.choices])
+
+    assert len(mail.outbox) == 0
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/accesses/",
+        {
+            "team": "new-team",
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.DocumentAccess.objects.filter(team="new-team").count() == 1
+    new_document_access = models.DocumentAccess.objects.filter(team="new-team").get()
+    other_user = serializers.UserSerializer(instance=other_user).data
+    assert response.json() == {
+        "abilities": new_document_access.get_abilities(user),
+        "document": {
+            "id": str(new_document_access.document_id),
+            "path": new_document_access.document.path,
+            "depth": new_document_access.document.depth,
+        },
+        "id": str(new_document_access.id),
+        "max_ancestors_role": None,
+        "max_role": role,
+        "role": role,
+        "team": "new-team",
+        "user": None,
+    }
+    assert len(mail.outbox) == 0
+
+
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_accesses_create_email_in_receivers_language(via, mock_user_teams):
     """
@@ -286,11 +461,18 @@ def test_api_document_accesses_create_email_in_receivers_language(via, mock_user
         ).get()
         other_user_data = serializers.UserSerializer(instance=other_user).data
         assert response.json() == {
-            "id": str(new_document_access.id),
-            "user": other_user_data,
-            "team": "",
-            "role": role,
             "abilities": new_document_access.get_abilities(user),
+            "document": {
+                "id": str(new_document_access.document_id),
+                "path": new_document_access.document.path,
+                "depth": new_document_access.document.depth,
+            },
+            "id": str(new_document_access.id),
+            "max_ancestors_role": None,
+            "max_role": role,
+            "role": role,
+            "team": "",
+            "user": other_user_data,
         }
         assert len(mail.outbox) == index + 1
         email = mail.outbox[index]

src/backend/core/tests/documents/test_api_documents_children_create.py

@@ -98,7 +98,9 @@ def test_api_documents_children_create_authenticated_success(reach, role, depth)
         if i == 0:
             document = factories.DocumentFactory(link_reach=reach, link_role=role)
         else:
-            document = factories.DocumentFactory(parent=document, link_role="reader")
+            document = factories.DocumentFactory(
+                parent=document, link_reach="restricted"
+            )
 
     response = client.post(
         f"/api/v1.0/documents/{document.id!s}/children/",
@@ -112,7 +114,8 @@ def test_api_documents_children_create_authenticated_success(reach, role, depth)
     child = Document.objects.get(id=response.json()["id"])
     assert child.title == "my child"
     assert child.link_reach == "restricted"
-    assert child.accesses.filter(role="owner", user=user).exists()
+    # Access objects on the child are not necessary
+    assert child.accesses.exists() is False
 
 
 @pytest.mark.parametrize("depth", [1, 2, 3])
@@ -180,7 +183,8 @@ def test_api_documents_children_create_related_success(role, depth):
     child = Document.objects.get(id=response.json()["id"])
     assert child.title == "my child"
     assert child.link_reach == "restricted"
-    assert child.accesses.filter(role="owner", user=user).exists()
+    # Access objects on the child are not necessary
+    assert child.accesses.exists() is False
 
 
 def test_api_documents_children_create_authenticated_title_null():

src/backend/core/tests/documents/test_api_documents_children_list.py

@@ -14,13 +14,18 @@ from core import factories
 pytestmark = pytest.mark.django_db
 
 
-def test_api_documents_children_list_anonymous_public_standalone():
+def test_api_documents_children_list_anonymous_public_standalone(
+    django_assert_num_queries,
+):
     """Anonymous users should be allowed to retrieve the children of a public document."""
     document = factories.DocumentFactory(link_reach="public")
     child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
     factories.UserDocumentAccessFactory(document=child1)
 
-    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
+    with django_assert_num_queries(8):
+        APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
+    with django_assert_num_queries(4):
+        response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
 
     assert response.status_code == 200
     assert response.json() == {
@@ -30,6 +35,10 @@ def test_api_documents_children_list_anonymous_public_standalone():
         "results": [
             {
                 "abilities": child1.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": "public",
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": "public",
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 2,
@@ -44,10 +53,14 @@ def test_api_documents_children_list_anonymous_public_standalone():
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": child2.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": "public",
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": "public",
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 2,
@@ -62,13 +75,13 @@ def test_api_documents_children_list_anonymous_public_standalone():
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
     }
 
 
-def test_api_documents_children_list_anonymous_public_parent():
+def test_api_documents_children_list_anonymous_public_parent(django_assert_num_queries):
     """
     Anonymous users should be allowed to retrieve the children of a document who
     has a public ancestor.
@@ -83,7 +96,10 @@ def test_api_documents_children_list_anonymous_public_parent():
     child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
     factories.UserDocumentAccessFactory(document=child1)
 
-    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
+    with django_assert_num_queries(9):
+        APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
+    with django_assert_num_queries(5):
+        response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/children/")
 
     assert response.status_code == 200
     assert response.json() == {
@@ -93,6 +109,10 @@ def test_api_documents_children_list_anonymous_public_parent():
         "results": [
             {
                 "abilities": child1.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": child1.ancestors_link_reach,
+                "ancestors_link_role": child1.ancestors_link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 4,
@@ -107,10 +127,14 @@ def test_api_documents_children_list_anonymous_public_parent():
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": child2.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": child2.ancestors_link_reach,
+                "ancestors_link_role": child2.ancestors_link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 4,
@@ -125,7 +149,7 @@ def test_api_documents_children_list_anonymous_public_parent():
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
     }
@@ -149,7 +173,7 @@ def test_api_documents_children_list_anonymous_restricted_or_authenticated(reach
 
 @pytest.mark.parametrize("reach", ["public", "authenticated"])
 def test_api_documents_children_list_authenticated_unrelated_public_or_authenticated(
-    reach,
+    reach, django_assert_num_queries
 ):
     """
     Authenticated users should be able to retrieve the children of a public/authenticated
@@ -163,9 +187,13 @@ def test_api_documents_children_list_authenticated_unrelated_public_or_authentic
     child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
     factories.UserDocumentAccessFactory(document=child1)
 
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/children/",
-    )
+    with django_assert_num_queries(9):
+        client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+    with django_assert_num_queries(5):
+        response = client.get(
+            f"/api/v1.0/documents/{document.id!s}/children/",
+        )
+
     assert response.status_code == 200
     assert response.json() == {
         "count": 2,
@@ -174,6 +202,10 @@ def test_api_documents_children_list_authenticated_unrelated_public_or_authentic
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": reach,
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 2,
@@ -188,10 +220,14 @@ def test_api_documents_children_list_authenticated_unrelated_public_or_authentic
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": reach,
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 2,
@@ -206,7 +242,7 @@ def test_api_documents_children_list_authenticated_unrelated_public_or_authentic
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
     }
@@ -214,7 +250,7 @@ def test_api_documents_children_list_authenticated_unrelated_public_or_authentic
 
 @pytest.mark.parametrize("reach", ["public", "authenticated"])
 def test_api_documents_children_list_authenticated_public_or_authenticated_parent(
-    reach,
+    reach, django_assert_num_queries
 ):
     """
     Authenticated users should be allowed to retrieve the children of a document who
@@ -231,7 +267,11 @@ def test_api_documents_children_list_authenticated_public_or_authenticated_paren
     child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
     factories.UserDocumentAccessFactory(document=child1)
 
-    response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+    with django_assert_num_queries(10):
+        client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+
+    with django_assert_num_queries(6):
+        response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
 
     assert response.status_code == 200
     assert response.json() == {
@@ -241,6 +281,10 @@ def test_api_documents_children_list_authenticated_public_or_authenticated_paren
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": child1.ancestors_link_reach,
+                "ancestors_link_role": child1.ancestors_link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 4,
@@ -255,10 +299,14 @@ def test_api_documents_children_list_authenticated_public_or_authenticated_paren
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": child2.ancestors_link_reach,
+                "ancestors_link_role": child2.ancestors_link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 4,
@@ -273,13 +321,15 @@ def test_api_documents_children_list_authenticated_public_or_authenticated_paren
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
     }
 
 
-def test_api_documents_children_list_authenticated_unrelated_restricted():
+def test_api_documents_children_list_authenticated_unrelated_restricted(
+    django_assert_num_queries,
+):
     """
     Authenticated users should not be allowed to retrieve the children of a document that is
     restricted and to which they are not related.
@@ -293,16 +343,20 @@ def test_api_documents_children_list_authenticated_unrelated_restricted():
     child1, _child2 = factories.DocumentFactory.create_batch(2, parent=document)
     factories.UserDocumentAccessFactory(document=child1)
 
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/children/",
-    )
+    with django_assert_num_queries(2):
+        response = client.get(
+            f"/api/v1.0/documents/{document.id!s}/children/",
+        )
+
     assert response.status_code == 403
     assert response.json() == {
         "detail": "You do not have permission to perform this action."
     }
 
 
-def test_api_documents_children_list_authenticated_related_direct():
+def test_api_documents_children_list_authenticated_related_direct(
+    django_assert_num_queries,
+):
     """
     Authenticated users should be allowed to retrieve the children of a document
     to which they are directly related whatever the role.
@@ -319,10 +373,13 @@ def test_api_documents_children_list_authenticated_related_direct():
     child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
     factories.UserDocumentAccessFactory(document=child1)
 
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/children/",
-    )
+    with django_assert_num_queries(9):
+        response = client.get(
+            f"/api/v1.0/documents/{document.id!s}/children/",
+        )
+
     assert response.status_code == 200
+    link_role = None if document.link_reach == "restricted" else document.link_role
     assert response.json() == {
         "count": 2,
         "next": None,
@@ -330,6 +387,10 @@ def test_api_documents_children_list_authenticated_related_direct():
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": document.link_reach,
+                "ancestors_link_role": link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 2,
@@ -344,10 +405,14 @@ def test_api_documents_children_list_authenticated_related_direct():
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": document.link_reach,
+                "ancestors_link_role": link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 2,
@@ -362,13 +427,15 @@ def test_api_documents_children_list_authenticated_related_direct():
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
         ],
     }
 
 
-def test_api_documents_children_list_authenticated_related_parent():
+def test_api_documents_children_list_authenticated_related_parent(
+    django_assert_num_queries,
+):
     """
     Authenticated users should be allowed to retrieve the children of a document if they
     are related to one of its ancestors whatever the role.
@@ -389,9 +456,11 @@ def test_api_documents_children_list_authenticated_related_parent():
         document=grand_parent, user=user
     )
 
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/children/",
-    )
+    with django_assert_num_queries(10):
+        response = client.get(
+            f"/api/v1.0/documents/{document.id!s}/children/",
+        )
+
     assert response.status_code == 200
     assert response.json() == {
         "count": 2,
@@ -400,6 +469,10 @@ def test_api_documents_children_list_authenticated_related_parent():
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": "restricted",
+                "ancestors_link_role": None,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 4,
@@ -414,10 +487,14 @@ def test_api_documents_children_list_authenticated_related_parent():
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [grand_parent_access.role],
+                "user_role": grand_parent_access.role,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": "restricted",
+                "ancestors_link_role": None,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 4,
@@ -432,13 +509,15 @@ def test_api_documents_children_list_authenticated_related_parent():
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [grand_parent_access.role],
+                "user_role": grand_parent_access.role,
             },
         ],
     }
 
 
-def test_api_documents_children_list_authenticated_related_child():
+def test_api_documents_children_list_authenticated_related_child(
+    django_assert_num_queries,
+):
     """
     Authenticated users should not be allowed to retrieve all the children of a document
     as a result of being related to one of its children.
@@ -454,16 +533,20 @@ def test_api_documents_children_list_authenticated_related_child():
     factories.UserDocumentAccessFactory(document=child1, user=user)
     factories.UserDocumentAccessFactory(document=document)
 
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/children/",
-    )
+    with django_assert_num_queries(2):
+        response = client.get(
+            f"/api/v1.0/documents/{document.id!s}/children/",
+        )
+
     assert response.status_code == 403
     assert response.json() == {
         "detail": "You do not have permission to perform this action."
     }
 
 
-def test_api_documents_children_list_authenticated_related_team_none(mock_user_teams):
+def test_api_documents_children_list_authenticated_related_team_none(
+    mock_user_teams, django_assert_num_queries
+):
     """
     Authenticated users should not be able to retrieve the children of a restricted document
     related to teams in which the user is not.
@@ -480,7 +563,9 @@ def test_api_documents_children_list_authenticated_related_team_none(mock_user_t
 
     factories.TeamDocumentAccessFactory(document=document, team="myteam")
 
-    response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+    with django_assert_num_queries(2):
+        response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+
     assert response.status_code == 403
     assert response.json() == {
         "detail": "You do not have permission to perform this action."
@@ -488,7 +573,7 @@ def test_api_documents_children_list_authenticated_related_team_none(mock_user_t
 
 
 def test_api_documents_children_list_authenticated_related_team_members(
-    mock_user_teams,
+    mock_user_teams, django_assert_num_queries
 ):
     """
     Authenticated users should be allowed to retrieve the children of a document to which they
@@ -506,7 +591,8 @@ def test_api_documents_children_list_authenticated_related_team_members(
 
     access = factories.TeamDocumentAccessFactory(document=document, team="myteam")
 
-    response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
+    with django_assert_num_queries(9):
+        response = client.get(f"/api/v1.0/documents/{document.id!s}/children/")
 
     # pylint: disable=R0801
     assert response.status_code == 200
@@ -517,6 +603,10 @@ def test_api_documents_children_list_authenticated_related_team_members(
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": "restricted",
+                "ancestors_link_role": None,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 2,
@@ -531,10 +621,14 @@ def test_api_documents_children_list_authenticated_related_team_members(
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": "restricted",
+                "ancestors_link_role": None,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 2,
@@ -549,7 +643,7 @@ def test_api_documents_children_list_authenticated_related_team_members(
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
         ],
     }

src/backend/core/tests/documents/test_api_documents_descendants.py

@@ -32,6 +32,10 @@ def test_api_documents_descendants_list_anonymous_public_standalone():
         "results": [
             {
                 "abilities": child1.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": "public",
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 2,
@@ -46,10 +50,16 @@ def test_api_documents_descendants_list_anonymous_public_standalone():
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": grand_child.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": "public",
+                "ancestors_link_role": "editor"
+                if (child1.link_reach == "public" and child1.link_role == "editor")
+                else document.link_role,
+                "computed_link_reach": "public",
+                "computed_link_role": grand_child.computed_link_role,
                 "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(grand_child.creator.id),
                 "depth": 3,
@@ -64,10 +74,14 @@ def test_api_documents_descendants_list_anonymous_public_standalone():
                 "path": grand_child.path,
                 "title": grand_child.title,
                 "updated_at": grand_child.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": child2.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": "public",
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": "public",
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 2,
@@ -82,7 +96,7 @@ def test_api_documents_descendants_list_anonymous_public_standalone():
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
     }
@@ -115,6 +129,10 @@ def test_api_documents_descendants_list_anonymous_public_parent():
         "results": [
             {
                 "abilities": child1.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": "public",
+                "ancestors_link_role": grand_parent.link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 4,
@@ -129,10 +147,14 @@ def test_api_documents_descendants_list_anonymous_public_parent():
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": grand_child.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": "public",
+                "ancestors_link_role": grand_child.ancestors_link_role,
+                "computed_link_reach": "public",
+                "computed_link_role": grand_child.computed_link_role,
                 "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(grand_child.creator.id),
                 "depth": 5,
@@ -147,10 +169,14 @@ def test_api_documents_descendants_list_anonymous_public_parent():
                 "path": grand_child.path,
                 "title": grand_child.title,
                 "updated_at": grand_child.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": child2.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": "public",
+                "ancestors_link_role": grand_parent.link_role,
+                "computed_link_reach": "public",
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 4,
@@ -165,7 +191,7 @@ def test_api_documents_descendants_list_anonymous_public_parent():
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
     }
@@ -201,7 +227,9 @@ def test_api_documents_descendants_list_authenticated_unrelated_public_or_authen
     client.force_login(user)
 
     document = factories.DocumentFactory(link_reach=reach)
-    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    child1, child2 = factories.DocumentFactory.create_batch(
+        2, parent=document, link_reach="restricted"
+    )
     grand_child = factories.DocumentFactory(parent=child1)
 
     factories.UserDocumentAccessFactory(document=child1)
@@ -217,6 +245,10 @@ def test_api_documents_descendants_list_authenticated_unrelated_public_or_authen
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": reach,
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 2,
@@ -231,10 +263,14 @@ def test_api_documents_descendants_list_authenticated_unrelated_public_or_authen
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": grand_child.get_abilities(user),
+                "ancestors_link_reach": reach,
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": grand_child.computed_link_reach,
+                "computed_link_role": grand_child.computed_link_role,
                 "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(grand_child.creator.id),
                 "depth": 3,
@@ -249,10 +285,14 @@ def test_api_documents_descendants_list_authenticated_unrelated_public_or_authen
                 "path": grand_child.path,
                 "title": grand_child.title,
                 "updated_at": grand_child.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": reach,
+                "ancestors_link_role": document.link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 2,
@@ -267,7 +307,7 @@ def test_api_documents_descendants_list_authenticated_unrelated_public_or_authen
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
     }
@@ -289,7 +329,9 @@ def test_api_documents_descendants_list_authenticated_public_or_authenticated_pa
     grand_parent = factories.DocumentFactory(link_reach=reach)
     parent = factories.DocumentFactory(parent=grand_parent, link_reach="restricted")
     document = factories.DocumentFactory(link_reach="restricted", parent=parent)
-    child1, child2 = factories.DocumentFactory.create_batch(2, parent=document)
+    child1, child2 = factories.DocumentFactory.create_batch(
+        2, parent=document, link_reach="restricted"
+    )
     grand_child = factories.DocumentFactory(parent=child1)
 
     factories.UserDocumentAccessFactory(document=child1)
@@ -304,6 +346,10 @@ def test_api_documents_descendants_list_authenticated_public_or_authenticated_pa
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": reach,
+                "ancestors_link_role": grand_parent.link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 4,
@@ -318,10 +364,14 @@ def test_api_documents_descendants_list_authenticated_public_or_authenticated_pa
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": grand_child.get_abilities(user),
+                "ancestors_link_reach": reach,
+                "ancestors_link_role": grand_parent.link_role,
+                "computed_link_reach": grand_child.computed_link_reach,
+                "computed_link_role": grand_child.computed_link_role,
                 "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(grand_child.creator.id),
                 "depth": 5,
@@ -336,10 +386,14 @@ def test_api_documents_descendants_list_authenticated_public_or_authenticated_pa
                 "path": grand_child.path,
                 "title": grand_child.title,
                 "updated_at": grand_child.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": reach,
+                "ancestors_link_role": grand_parent.link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 4,
@@ -354,7 +408,7 @@ def test_api_documents_descendants_list_authenticated_public_or_authenticated_pa
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
     }
@@ -414,6 +468,10 @@ def test_api_documents_descendants_list_authenticated_related_direct():
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": child1.ancestors_link_reach,
+                "ancestors_link_role": child1.ancestors_link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 2,
@@ -428,10 +486,14 @@ def test_api_documents_descendants_list_authenticated_related_direct():
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": grand_child.get_abilities(user),
+                "ancestors_link_reach": grand_child.ancestors_link_reach,
+                "ancestors_link_role": grand_child.ancestors_link_role,
+                "computed_link_reach": grand_child.computed_link_reach,
+                "computed_link_role": grand_child.computed_link_role,
                 "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(grand_child.creator.id),
                 "depth": 3,
@@ -446,10 +508,14 @@ def test_api_documents_descendants_list_authenticated_related_direct():
                 "path": grand_child.path,
                 "title": grand_child.title,
                 "updated_at": grand_child.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": child2.ancestors_link_reach,
+                "ancestors_link_role": child2.ancestors_link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 2,
@@ -464,7 +530,7 @@ def test_api_documents_descendants_list_authenticated_related_direct():
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
         ],
     }
@@ -504,6 +570,10 @@ def test_api_documents_descendants_list_authenticated_related_parent():
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": child1.ancestors_link_reach,
+                "ancestors_link_role": child1.ancestors_link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 4,
@@ -518,10 +588,14 @@ def test_api_documents_descendants_list_authenticated_related_parent():
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [grand_parent_access.role],
+                "user_role": grand_parent_access.role,
             },
             {
                 "abilities": grand_child.get_abilities(user),
+                "ancestors_link_reach": grand_child.ancestors_link_reach,
+                "ancestors_link_role": grand_child.ancestors_link_role,
+                "computed_link_reach": grand_child.computed_link_reach,
+                "computed_link_role": grand_child.computed_link_role,
                 "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(grand_child.creator.id),
                 "depth": 5,
@@ -536,10 +610,14 @@ def test_api_documents_descendants_list_authenticated_related_parent():
                 "path": grand_child.path,
                 "title": grand_child.title,
                 "updated_at": grand_child.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [grand_parent_access.role],
+                "user_role": grand_parent_access.role,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": child2.ancestors_link_reach,
+                "ancestors_link_role": child2.ancestors_link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 4,
@@ -554,7 +632,7 @@ def test_api_documents_descendants_list_authenticated_related_parent():
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [grand_parent_access.role],
+                "user_role": grand_parent_access.role,
             },
         ],
     }
@@ -640,6 +718,10 @@ def test_api_documents_descendants_list_authenticated_related_team_members(
         "results": [
             {
                 "abilities": child1.get_abilities(user),
+                "ancestors_link_reach": child1.ancestors_link_reach,
+                "ancestors_link_role": child1.ancestors_link_role,
+                "computed_link_reach": child1.computed_link_reach,
+                "computed_link_role": child1.computed_link_role,
                 "created_at": child1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child1.creator.id),
                 "depth": 2,
@@ -654,10 +736,14 @@ def test_api_documents_descendants_list_authenticated_related_team_members(
                 "path": child1.path,
                 "title": child1.title,
                 "updated_at": child1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": grand_child.get_abilities(user),
+                "ancestors_link_reach": grand_child.ancestors_link_reach,
+                "ancestors_link_role": grand_child.ancestors_link_role,
+                "computed_link_reach": grand_child.computed_link_reach,
+                "computed_link_role": grand_child.computed_link_role,
                 "created_at": grand_child.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(grand_child.creator.id),
                 "depth": 3,
@@ -672,10 +758,14 @@ def test_api_documents_descendants_list_authenticated_related_team_members(
                 "path": grand_child.path,
                 "title": grand_child.title,
                 "updated_at": grand_child.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": child2.get_abilities(user),
+                "ancestors_link_reach": child2.ancestors_link_reach,
+                "ancestors_link_role": child2.ancestors_link_role,
+                "computed_link_reach": child2.computed_link_reach,
+                "computed_link_role": child2.computed_link_role,
                 "created_at": child2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(child2.creator.id),
                 "depth": 2,
@@ -690,7 +780,7 @@ def test_api_documents_descendants_list_authenticated_related_team_members(
                 "path": child2.path,
                 "title": child2.title,
                 "updated_at": child2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
         ],
     }

src/backend/core/tests/documents/test_api_documents_duplicate.py

@@ -14,6 +14,7 @@ from django.utils import timezone
 import pycrdt
 import pytest
 import requests
+from freezegun import freeze_time
 from rest_framework.test import APIClient
 
 from core import factories, models
@@ -133,19 +134,21 @@ def test_api_documents_duplicate_success(index):
 
     # Ensure access persists after the owner loses access to the original document
     models.DocumentAccess.objects.filter(document=document).delete()
-    response = client.get(
-        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=image_refs[0][1]
-    )
+
+    now = timezone.now()
+    with freeze_time(now):
+        response = client.get(
+            "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=image_refs[0][1]
+        )
 
     assert response.status_code == 200
-
+    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
     authorization = response["Authorization"]
     assert "AWS4-HMAC-SHA256 Credential=" in authorization
     assert (
         "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
         in authorization
     )
-    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
 
     s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
     response = requests.get(

src/backend/core/tests/documents/test_api_documents_favorite_list.py

@@ -59,6 +59,10 @@ def test_api_document_favorite_list_authenticated_with_favorite():
         "results": [
             {
                 "abilities": document.get_abilities(user),
+                "ancestors_link_reach": None,
+                "ancestors_link_role": None,
+                "computed_link_reach": document.computed_link_reach,
+                "computed_link_role": document.computed_link_role,
                 "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(document.creator.id),
                 "content": document.content,
@@ -74,7 +78,7 @@ def test_api_document_favorite_list_authenticated_with_favorite():
                 "path": document.path,
                 "title": document.title,
                 "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": ["reader"],
+                "user_role": "reader",
             }
         ],
     }

src/backend/core/tests/documents/test_api_documents_list.py

@@ -63,6 +63,10 @@ def test_api_documents_list_format():
     assert results[0] == {
         "id": str(document.id),
         "abilities": document.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
         "depth": 1,
@@ -76,7 +80,7 @@ def test_api_documents_list_format():
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [access.role],
+        "user_role": access.role,
     }
 
 
@@ -148,11 +152,11 @@ def test_api_documents_list_authenticated_direct(django_assert_num_queries):
         str(child4_with_access.id),
     }
 
-    with django_assert_num_queries(12):
+    with django_assert_num_queries(14):
         response = client.get("/api/v1.0/documents/")
 
     # nb_accesses should now be cached
-    with django_assert_num_queries(4):
+    with django_assert_num_queries(6):
         response = client.get("/api/v1.0/documents/")
 
     assert response.status_code == 200
@@ -268,11 +272,11 @@ def test_api_documents_list_authenticated_link_reach_public_or_authenticated(
 
     expected_ids = {str(document1.id), str(document2.id), str(visible_child.id)}
 
-    with django_assert_num_queries(10):
+    with django_assert_num_queries(11):
         response = client.get("/api/v1.0/documents/")
 
     # nb_accesses should now be cached
-    with django_assert_num_queries(4):
+    with django_assert_num_queries(5):
         response = client.get("/api/v1.0/documents/")
 
     assert response.status_code == 200

src/backend/core/tests/documents/test_api_documents_media_auth.py

@@ -12,6 +12,7 @@ from django.utils import timezone
 
 import pytest
 import requests
+from freezegun import freeze_time
 from rest_framework.test import APIClient
 
 from core import factories, models
@@ -52,9 +53,11 @@ def test_api_documents_media_auth_anonymous_public():
     factories.DocumentFactory(id=document_id, link_reach="public", attachments=[key])
 
     original_url = f"http://localhost/media/{key:s}"
-    response = APIClient().get(
-        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
+    now = timezone.now()
+    with freeze_time(now):
+        response = APIClient().get(
+            "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+        )
 
     assert response.status_code == 200
 
@@ -64,7 +67,7 @@ def test_api_documents_media_auth_anonymous_public():
         "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
         in authorization
     )
-    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
 
     s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
     file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
@@ -167,9 +170,11 @@ def test_api_documents_media_auth_anonymous_attachments():
     parent = factories.DocumentFactory(link_reach="public")
     factories.DocumentFactory(parent=parent, link_reach="restricted", attachments=[key])
 
-    response = APIClient().get(
-        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
-    )
+    now = timezone.now()
+    with freeze_time(now):
+        response = APIClient().get(
+            "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
+        )
 
     assert response.status_code == 200
 
@@ -179,7 +184,7 @@ def test_api_documents_media_auth_anonymous_attachments():
         "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
         in authorization
     )
-    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
 
     s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
     file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
@@ -221,9 +226,11 @@ def test_api_documents_media_auth_authenticated_public_or_authenticated(reach):
 
     factories.DocumentFactory(id=document_id, link_reach=reach, attachments=[key])
 
-    response = client.get(
-        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
-    )
+    now = timezone.now()
+    with freeze_time(now):
+        response = client.get(
+            "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
+        )
 
     assert response.status_code == 200
 
@@ -233,7 +240,7 @@ def test_api_documents_media_auth_authenticated_public_or_authenticated(reach):
         "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
         in authorization
     )
-    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
 
     s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
     file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
@@ -307,9 +314,11 @@ def test_api_documents_media_auth_related(via, mock_user_teams):
         mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
-    response = client.get(
-        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
-    )
+    now = timezone.now()
+    with freeze_time(now):
+        response = client.get(
+            "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=media_url
+        )
 
     assert response.status_code == 200
 
@@ -319,7 +328,7 @@ def test_api_documents_media_auth_related(via, mock_user_teams):
         "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
         in authorization
     )
-    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
 
     s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
     file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
@@ -373,10 +382,12 @@ def test_api_documents_media_auth_missing_status_metadata():
 
     factories.DocumentFactory(id=document_id, link_reach="public", attachments=[key])
 
+    now = timezone.now()
     original_url = f"http://localhost/media/{key:s}"
-    response = APIClient().get(
-        "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
-    )
+    with freeze_time(now):
+        response = APIClient().get(
+            "/api/v1.0/documents/media-auth/", HTTP_X_ORIGINAL_URL=original_url
+        )
 
     assert response.status_code == 200
 
@@ -386,7 +397,7 @@ def test_api_documents_media_auth_missing_status_metadata():
         "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
         in authorization
     )
-    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+    assert response["X-Amz-Date"] == now.strftime("%Y%m%dT%H%M%SZ")
 
     s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
     file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"

src/backend/core/tests/documents/test_api_documents_move.py

@@ -124,8 +124,8 @@ def test_api_documents_move_authenticated_target_roles_mocked(
     target_role, target_parent_role, position
 ):
     """
-    Authenticated users with insufficient permissions on the target document (or its
-    parent depending on the position chosen), should not be allowed to move documents.
+    Only authenticated users with sufficient permissions on the target document (or its
+    parent depending on the position chosen), should be allowed to move documents.
     """
 
     user = factories.UserFactory()
@@ -208,6 +208,107 @@ def test_api_documents_move_authenticated_target_roles_mocked(
         assert document.is_root() is True
 
 
+def test_api_documents_move_authenticated_no_owner_user_and_team():
+    """
+    Moving a document with no owner to the root of the tree should automatically declare
+    the owner of the previous root of the document as owner of the document itself.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    parent_owner = factories.UserFactory()
+    parent = factories.DocumentFactory(
+        users=[(parent_owner, "owner")], teams=[("lasuite", "owner")]
+    )
+    # A document with no owner
+    document = factories.DocumentFactory(parent=parent, users=[(user, "administrator")])
+    child = factories.DocumentFactory(parent=document)
+    target = factories.DocumentFactory()
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id), "position": "first-sibling"},
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"message": "Document moved successfully."}
+    assert list(target.get_siblings()) == [document, parent, target]
+
+    document.refresh_from_db()
+    assert list(document.get_children()) == [child]
+    assert document.accesses.count() == 3
+    assert document.accesses.get(user__isnull=False, role="owner").user == parent_owner
+    assert document.accesses.get(user__isnull=True, role="owner").team == "lasuite"
+    assert document.accesses.get(role="administrator").user == user
+
+
+def test_api_documents_move_authenticated_no_owner_same_user():
+    """
+    Moving a document should not fail if the user moving a document with no owner was
+    at the same time owner of the previous root and has a role on the document being moved.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    parent = factories.DocumentFactory(
+        users=[(user, "owner")], teams=[("lasuite", "owner")]
+    )
+    # A document with no owner
+    document = factories.DocumentFactory(parent=parent, users=[(user, "reader")])
+    child = factories.DocumentFactory(parent=document)
+    target = factories.DocumentFactory()
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id), "position": "first-sibling"},
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"message": "Document moved successfully."}
+    assert list(target.get_siblings()) == [document, parent, target]
+
+    document.refresh_from_db()
+    assert list(document.get_children()) == [child]
+    assert document.accesses.count() == 2
+    assert document.accesses.get(user__isnull=False, role="owner").user == user
+    assert document.accesses.get(user__isnull=True, role="owner").team == "lasuite"
+
+
+def test_api_documents_move_authenticated_no_owner_same_team():
+    """
+    Moving a document should not fail if the team that is owner of the document root was
+    already declared on the document with a different role.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    parent = factories.DocumentFactory(teams=[("lasuite", "owner")])
+    # A document with no owner but same team
+    document = factories.DocumentFactory(
+        parent=parent, users=[(user, "administrator")], teams=[("lasuite", "reader")]
+    )
+    child = factories.DocumentFactory(parent=document)
+    target = factories.DocumentFactory()
+
+    response = client.post(
+        f"/api/v1.0/documents/{document.id!s}/move/",
+        data={"target_document_id": str(target.id), "position": "first-sibling"},
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {"message": "Document moved successfully."}
+    assert list(target.get_siblings()) == [document, parent, target]
+
+    document.refresh_from_db()
+    assert list(document.get_children()) == [child]
+    assert document.accesses.count() == 2
+    assert document.accesses.get(user__isnull=False, role="administrator").user == user
+    assert document.accesses.get(user__isnull=True, role="owner").team == "lasuite"
+
+
 def test_api_documents_move_authenticated_deleted_document():
     """
     It should not be possible to move a deleted document or its descendants, even

src/backend/core/tests/documents/test_api_documents_retrieve.py

@@ -1,6 +1,7 @@
 """
 Tests for Documents API endpoint in impress's core app: retrieve
 """
+# pylint: disable=too-many-lines
 
 import random
 from datetime import timedelta
@@ -11,7 +12,7 @@ from django.utils import timezone
 import pytest
 from rest_framework.test import APIClient
 
-from core import factories, models
+from core import choices, factories, models
 
 pytestmark = pytest.mark.django_db
 
@@ -45,7 +46,7 @@ def test_api_documents_retrieve_anonymous_public_standalone():
             "link_select_options": {
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
-                "restricted": ["reader", "editor"],
+                "restricted": None,
             },
             "media_auth": True,
             "media_check": True,
@@ -59,6 +60,10 @@ def test_api_documents_retrieve_anonymous_public_standalone():
             "versions_list": False,
             "versions_retrieve": False,
         },
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
@@ -73,7 +78,7 @@ def test_api_documents_retrieve_anonymous_public_standalone():
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [],
+        "user_role": None,
     }
 
 
@@ -91,6 +96,7 @@ def test_api_documents_retrieve_anonymous_public_parent():
 
     assert response.status_code == 200
     links = document.get_ancestors().values("link_reach", "link_role")
+    links_definition = choices.get_equivalent_link_definition(links)
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
@@ -110,7 +116,9 @@ def test_api_documents_retrieve_anonymous_public_parent():
             "favorite": False,
             "invite_owner": False,
             "link_configuration": False,
-            "link_select_options": models.LinkReachChoices.get_select_options(links),
+            "link_select_options": models.LinkReachChoices.get_select_options(
+                **links_definition
+            ),
             "media_auth": True,
             "media_check": True,
             "move": False,
@@ -123,6 +131,10 @@ def test_api_documents_retrieve_anonymous_public_parent():
             "versions_list": False,
             "versions_retrieve": False,
         },
+        "ancestors_link_reach": "public",
+        "ancestors_link_role": grand_parent.link_role,
+        "computed_link_reach": "public",
+        "computed_link_role": grand_parent.link_role,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
@@ -137,7 +149,7 @@ def test_api_documents_retrieve_anonymous_public_parent():
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [],
+        "user_role": None,
     }
 
 
@@ -209,7 +221,7 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
             "link_select_options": {
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
-                "restricted": ["reader", "editor"],
+                "restricted": None,
             },
             "media_auth": True,
             "media_check": True,
@@ -223,6 +235,10 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
             "versions_list": False,
             "versions_retrieve": False,
         },
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
@@ -237,7 +253,7 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [],
+        "user_role": None,
     }
     assert (
         models.LinkTrace.objects.filter(document=document, user=user).exists() is True
@@ -263,6 +279,7 @@ def test_api_documents_retrieve_authenticated_public_or_authenticated_parent(rea
 
     assert response.status_code == 200
     links = document.get_ancestors().values("link_reach", "link_role")
+    links_definition = choices.get_equivalent_link_definition(links)
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
@@ -281,10 +298,12 @@ def test_api_documents_retrieve_authenticated_public_or_authenticated_parent(rea
             "favorite": True,
             "invite_owner": False,
             "link_configuration": False,
-            "link_select_options": models.LinkReachChoices.get_select_options(links),
+            "link_select_options": models.LinkReachChoices.get_select_options(
+                **links_definition
+            ),
+            "move": False,
             "media_auth": True,
             "media_check": True,
-            "move": False,
             "partial_update": grand_parent.link_role == "editor",
             "restore": False,
             "retrieve": True,
@@ -294,6 +313,10 @@ def test_api_documents_retrieve_authenticated_public_or_authenticated_parent(rea
             "versions_list": False,
             "versions_retrieve": False,
         },
+        "ancestors_link_reach": reach,
+        "ancestors_link_role": grand_parent.link_role,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
@@ -308,7 +331,7 @@ def test_api_documents_retrieve_authenticated_public_or_authenticated_parent(rea
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [],
+        "user_role": None,
     }
 
 
@@ -404,6 +427,10 @@ def test_api_documents_retrieve_authenticated_related_direct():
     assert response.json() == {
         "id": str(document.id),
         "abilities": document.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "content": document.content,
         "creator": str(document.creator.id),
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
@@ -418,7 +445,7 @@ def test_api_documents_retrieve_authenticated_related_direct():
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [access.role],
+        "user_role": access.role,
     }
 
 
@@ -444,6 +471,7 @@ def test_api_documents_retrieve_authenticated_related_parent():
     )
     assert response.status_code == 200
     links = document.get_ancestors().values("link_reach", "link_role")
+    link_definition = choices.get_equivalent_link_definition(links)
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
@@ -462,7 +490,9 @@ def test_api_documents_retrieve_authenticated_related_parent():
             "favorite": True,
             "invite_owner": access.role == "owner",
             "link_configuration": access.role in ["administrator", "owner"],
-            "link_select_options": models.LinkReachChoices.get_select_options(links),
+            "link_select_options": models.LinkReachChoices.get_select_options(
+                **link_definition
+            ),
             "media_auth": True,
             "media_check": True,
             "move": access.role in ["administrator", "owner"],
@@ -475,6 +505,10 @@ def test_api_documents_retrieve_authenticated_related_parent():
             "versions_list": True,
             "versions_retrieve": True,
         },
+        "ancestors_link_reach": "restricted",
+        "ancestors_link_role": None,
+        "computed_link_reach": "restricted",
+        "computed_link_role": None,
         "content": document.content,
         "creator": str(document.creator.id),
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
@@ -489,7 +523,7 @@ def test_api_documents_retrieve_authenticated_related_parent():
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [access.role],
+        "user_role": access.role,
     }
 
 
@@ -585,16 +619,16 @@ def test_api_documents_retrieve_authenticated_related_team_none(mock_user_teams)
 
 
 @pytest.mark.parametrize(
-    "teams,roles",
+    "teams,role",
     [
-        [["readers"], ["reader"]],
-        [["unknown", "readers"], ["reader"]],
-        [["editors"], ["editor"]],
-        [["unknown", "editors"], ["editor"]],
+        [["readers"], "reader"],
+        [["unknown", "readers"], "reader"],
+        [["editors"], "editor"],
+        [["unknown", "editors"], "editor"],
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_members(
-    teams, roles, mock_user_teams
+    teams, role, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a document to which they
@@ -627,6 +661,10 @@ def test_api_documents_retrieve_authenticated_related_team_members(
     assert response.json() == {
         "id": str(document.id),
         "abilities": document.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
@@ -641,20 +679,20 @@ def test_api_documents_retrieve_authenticated_related_team_members(
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": roles,
+        "user_role": role,
     }
 
 
 @pytest.mark.parametrize(
-    "teams,roles",
+    "teams,role",
     [
-        [["administrators"], ["administrator"]],
-        [["editors", "administrators"], ["administrator", "editor"]],
-        [["unknown", "administrators"], ["administrator"]],
+        [["administrators"], "administrator"],
+        [["editors", "administrators"], "administrator"],
+        [["unknown", "administrators"], "administrator"],
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_administrators(
-    teams, roles, mock_user_teams
+    teams, role, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a document to which they
@@ -689,6 +727,10 @@ def test_api_documents_retrieve_authenticated_related_team_administrators(
     assert response.json() == {
         "id": str(document.id),
         "abilities": document.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
@@ -703,21 +745,21 @@ def test_api_documents_retrieve_authenticated_related_team_administrators(
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": roles,
+        "user_role": role,
     }
 
 
 @pytest.mark.parametrize(
-    "teams,roles",
+    "teams,role",
     [
-        [["owners"], ["owner"]],
-        [["owners", "administrators"], ["owner", "administrator"]],
-        [["members", "administrators", "owners"], ["owner", "administrator"]],
-        [["unknown", "owners"], ["owner"]],
+        [["owners"], "owner"],
+        [["owners", "administrators"], "owner"],
+        [["members", "administrators", "owners"], "owner"],
+        [["unknown", "owners"], "owner"],
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_owners(
-    teams, roles, mock_user_teams
+    teams, role, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a restricted document to which
@@ -751,6 +793,10 @@ def test_api_documents_retrieve_authenticated_related_team_owners(
     assert response.json() == {
         "id": str(document.id),
         "abilities": document.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
@@ -765,11 +811,11 @@ def test_api_documents_retrieve_authenticated_related_team_owners(
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": roles,
+        "user_role": role,
     }
 
 
-def test_api_documents_retrieve_user_roles(django_assert_max_num_queries):
+def test_api_documents_retrieve_user_role(django_assert_max_num_queries):
     """
     Roles should be annotated on querysets taking into account all documents ancestors.
     """
@@ -792,15 +838,14 @@ def test_api_documents_retrieve_user_roles(django_assert_max_num_queries):
         factories.UserDocumentAccessFactory(document=parent, user=user),
         factories.UserDocumentAccessFactory(document=document, user=user),
     )
-    expected_roles = {access.role for access in accesses}
+    expected_role = choices.RoleChoices.max(*[access.role for access in accesses])
 
     with django_assert_max_num_queries(14):
         response = client.get(f"/api/v1.0/documents/{document.id!s}/")
 
     assert response.status_code == 200
 
-    user_roles = response.json()["user_roles"]
-    assert set(user_roles) == expected_roles
+    assert response.json()["user_role"] == expected_role
 
 
 def test_api_documents_retrieve_numqueries_with_link_trace(django_assert_num_queries):

src/backend/core/tests/documents/test_api_documents_trashbin.py

@@ -88,7 +88,7 @@ def test_api_documents_trashbin_format():
             "link_select_options": {
                 "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
-                "restricted": ["reader", "editor"],
+                "restricted": None,
             },
             "media_auth": True,
             "media_check": True,
@@ -102,6 +102,10 @@ def test_api_documents_trashbin_format():
             "versions_list": True,
             "versions_retrieve": True,
         },
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(document.creator.id),
         "depth": 1,
@@ -114,7 +118,7 @@ def test_api_documents_trashbin_format():
         "path": document.path,
         "title": document.title,
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": ["owner"],
+        "user_role": "owner",
     }
 
 

src/backend/core/tests/documents/test_api_documents_tree.py

@@ -32,13 +32,19 @@ def test_api_documents_tree_list_anonymous_public_standalone(django_assert_num_q
     assert response.status_code == 200
     assert response.json() == {
         "abilities": parent.get_abilities(AnonymousUser()),
+        "ancestors_link_reach": parent.ancestors_link_reach,
+        "ancestors_link_role": parent.ancestors_link_role,
         "children": [
             {
                 "abilities": document.get_abilities(AnonymousUser()),
                 "children": [
                     {
                         "abilities": child.get_abilities(AnonymousUser()),
+                        "ancestors_link_reach": child.ancestors_link_reach,
+                        "ancestors_link_role": child.ancestors_link_role,
                         "children": [],
+                        "computed_link_reach": child.computed_link_reach,
+                        "computed_link_role": child.computed_link_role,
                         "created_at": child.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -57,9 +63,13 @@ def test_api_documents_tree_list_anonymous_public_standalone(django_assert_num_q
                         "updated_at": child.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [],
+                        "user_role": None,
                     },
                 ],
+                "ancestors_link_reach": document.ancestors_link_reach,
+                "ancestors_link_role": document.ancestors_link_role,
+                "computed_link_reach": document.computed_link_reach,
+                "computed_link_role": document.computed_link_role,
                 "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(document.creator.id),
                 "depth": 2,
@@ -74,11 +84,15 @@ def test_api_documents_tree_list_anonymous_public_standalone(django_assert_num_q
                 "path": document.path,
                 "title": document.title,
                 "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": sibling1.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": sibling1.ancestors_link_reach,
+                "ancestors_link_role": sibling1.ancestors_link_role,
                 "children": [],
+                "computed_link_reach": sibling1.computed_link_reach,
+                "computed_link_role": sibling1.computed_link_role,
                 "created_at": sibling1.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(sibling1.creator.id),
                 "depth": 2,
@@ -93,11 +107,15 @@ def test_api_documents_tree_list_anonymous_public_standalone(django_assert_num_q
                 "path": sibling1.path,
                 "title": sibling1.title,
                 "updated_at": sibling1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": sibling2.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": sibling2.ancestors_link_reach,
+                "ancestors_link_role": sibling2.ancestors_link_role,
                 "children": [],
+                "computed_link_reach": sibling2.computed_link_reach,
+                "computed_link_role": sibling2.computed_link_role,
                 "created_at": sibling2.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(sibling2.creator.id),
                 "depth": 2,
@@ -112,9 +130,11 @@ def test_api_documents_tree_list_anonymous_public_standalone(django_assert_num_q
                 "path": sibling2.path,
                 "title": sibling2.title,
                 "updated_at": sibling2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
+        "computed_link_reach": parent.computed_link_reach,
+        "computed_link_role": parent.computed_link_role,
         "created_at": parent.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(parent.creator.id),
         "depth": 1,
@@ -129,7 +149,7 @@ def test_api_documents_tree_list_anonymous_public_standalone(django_assert_num_q
         "path": parent.path,
         "title": parent.title,
         "updated_at": parent.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [],
+        "user_role": None,
     }
 
 
@@ -163,18 +183,28 @@ def test_api_documents_tree_list_anonymous_public_parent():
     response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/tree/")
 
     assert response.status_code == 200
-    assert response.json() == {
+    expected_tree = {
         "abilities": grand_parent.get_abilities(AnonymousUser()),
+        "ancestors_link_reach": grand_parent.ancestors_link_reach,
+        "ancestors_link_role": grand_parent.ancestors_link_role,
         "children": [
             {
                 "abilities": parent.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": parent.ancestors_link_reach,
+                "ancestors_link_role": parent.ancestors_link_role,
                 "children": [
                     {
                         "abilities": document.get_abilities(AnonymousUser()),
+                        "ancestors_link_reach": document.ancestors_link_reach,
+                        "ancestors_link_role": document.ancestors_link_role,
                         "children": [
                             {
                                 "abilities": child.get_abilities(AnonymousUser()),
+                                "ancestors_link_reach": child.ancestors_link_reach,
+                                "ancestors_link_role": child.ancestors_link_role,
                                 "children": [],
+                                "computed_link_reach": child.computed_link_reach,
+                                "computed_link_role": child.computed_link_role,
                                 "created_at": child.created_at.isoformat().replace(
                                     "+00:00", "Z"
                                 ),
@@ -193,9 +223,11 @@ def test_api_documents_tree_list_anonymous_public_parent():
                                 "updated_at": child.updated_at.isoformat().replace(
                                     "+00:00", "Z"
                                 ),
-                                "user_roles": [],
+                                "user_role": None,
                             },
                         ],
+                        "computed_link_reach": document.computed_link_reach,
+                        "computed_link_role": document.computed_link_role,
                         "created_at": document.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -214,11 +246,15 @@ def test_api_documents_tree_list_anonymous_public_parent():
                         "updated_at": document.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [],
+                        "user_role": None,
                     },
                     {
                         "abilities": document_sibling.get_abilities(AnonymousUser()),
+                        "ancestors_link_reach": document_sibling.ancestors_link_reach,
+                        "ancestors_link_role": document_sibling.ancestors_link_role,
                         "children": [],
+                        "computed_link_reach": document_sibling.computed_link_reach,
+                        "computed_link_role": document_sibling.computed_link_role,
                         "created_at": document_sibling.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -237,9 +273,11 @@ def test_api_documents_tree_list_anonymous_public_parent():
                         "updated_at": document_sibling.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [],
+                        "user_role": None,
                     },
                 ],
+                "computed_link_reach": parent.computed_link_reach,
+                "computed_link_role": parent.computed_link_role,
                 "created_at": parent.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(parent.creator.id),
                 "depth": 3,
@@ -254,11 +292,15 @@ def test_api_documents_tree_list_anonymous_public_parent():
                 "path": parent.path,
                 "title": parent.title,
                 "updated_at": parent.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": parent_sibling.get_abilities(AnonymousUser()),
+                "ancestors_link_reach": parent_sibling.ancestors_link_reach,
+                "ancestors_link_role": parent_sibling.ancestors_link_role,
                 "children": [],
+                "computed_link_reach": parent_sibling.computed_link_reach,
+                "computed_link_role": parent_sibling.computed_link_role,
                 "created_at": parent_sibling.created_at.isoformat().replace(
                     "+00:00", "Z"
                 ),
@@ -277,9 +319,11 @@ def test_api_documents_tree_list_anonymous_public_parent():
                 "updated_at": parent_sibling.updated_at.isoformat().replace(
                     "+00:00", "Z"
                 ),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
+        "computed_link_reach": grand_parent.computed_link_reach,
+        "computed_link_role": grand_parent.computed_link_role,
         "created_at": grand_parent.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(grand_parent.creator.id),
         "depth": 2,
@@ -294,8 +338,9 @@ def test_api_documents_tree_list_anonymous_public_parent():
         "path": grand_parent.path,
         "title": grand_parent.title,
         "updated_at": grand_parent.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [],
+        "user_role": None,
     }
+    assert response.json() == expected_tree
 
 
 @pytest.mark.parametrize("reach", ["restricted", "authenticated"])
@@ -341,13 +386,21 @@ def test_api_documents_tree_list_authenticated_unrelated_public_or_authenticated
     assert response.status_code == 200
     assert response.json() == {
         "abilities": parent.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
         "children": [
             {
                 "abilities": document.get_abilities(user),
+                "ancestors_link_reach": document.ancestors_link_reach,
+                "ancestors_link_role": document.ancestors_link_role,
                 "children": [
                     {
                         "abilities": child.get_abilities(user),
+                        "ancestors_link_reach": child.ancestors_link_reach,
+                        "ancestors_link_role": child.ancestors_link_role,
                         "children": [],
+                        "computed_link_reach": child.computed_link_reach,
+                        "computed_link_role": child.computed_link_role,
                         "created_at": child.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -366,9 +419,11 @@ def test_api_documents_tree_list_authenticated_unrelated_public_or_authenticated
                         "updated_at": child.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [],
+                        "user_role": None,
                     },
                 ],
+                "computed_link_reach": document.computed_link_reach,
+                "computed_link_role": document.computed_link_role,
                 "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(document.creator.id),
                 "depth": 2,
@@ -383,11 +438,15 @@ def test_api_documents_tree_list_authenticated_unrelated_public_or_authenticated
                 "path": document.path,
                 "title": document.title,
                 "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": sibling.get_abilities(user),
+                "ancestors_link_reach": sibling.ancestors_link_reach,
+                "ancestors_link_role": sibling.ancestors_link_role,
                 "children": [],
+                "computed_link_reach": sibling.computed_link_reach,
+                "computed_link_role": sibling.computed_link_role,
                 "created_at": sibling.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(sibling.creator.id),
                 "depth": 2,
@@ -402,9 +461,11 @@ def test_api_documents_tree_list_authenticated_unrelated_public_or_authenticated
                 "path": sibling.path,
                 "title": sibling.title,
                 "updated_at": sibling.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
+        "computed_link_reach": parent.computed_link_reach,
+        "computed_link_role": parent.computed_link_role,
         "created_at": parent.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(parent.creator.id),
         "depth": 1,
@@ -419,7 +480,7 @@ def test_api_documents_tree_list_authenticated_unrelated_public_or_authenticated
         "path": parent.path,
         "title": parent.title,
         "updated_at": parent.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [],
+        "user_role": None,
     }
 
 
@@ -460,16 +521,26 @@ def test_api_documents_tree_list_authenticated_public_or_authenticated_parent(
     assert response.status_code == 200
     assert response.json() == {
         "abilities": grand_parent.get_abilities(user),
+        "ancestors_link_reach": grand_parent.ancestors_link_reach,
+        "ancestors_link_role": grand_parent.ancestors_link_role,
         "children": [
             {
                 "abilities": parent.get_abilities(user),
+                "ancestors_link_reach": parent.ancestors_link_reach,
+                "ancestors_link_role": parent.ancestors_link_role,
                 "children": [
                     {
                         "abilities": document.get_abilities(user),
+                        "ancestors_link_reach": document.ancestors_link_reach,
+                        "ancestors_link_role": document.ancestors_link_role,
                         "children": [
                             {
                                 "abilities": child.get_abilities(user),
+                                "ancestors_link_reach": child.ancestors_link_reach,
+                                "ancestors_link_role": child.ancestors_link_role,
                                 "children": [],
+                                "computed_link_reach": child.computed_link_reach,
+                                "computed_link_role": child.computed_link_role,
                                 "created_at": child.created_at.isoformat().replace(
                                     "+00:00", "Z"
                                 ),
@@ -488,9 +559,11 @@ def test_api_documents_tree_list_authenticated_public_or_authenticated_parent(
                                 "updated_at": child.updated_at.isoformat().replace(
                                     "+00:00", "Z"
                                 ),
-                                "user_roles": [],
+                                "user_role": None,
                             },
                         ],
+                        "computed_link_reach": document.computed_link_reach,
+                        "computed_link_role": document.computed_link_role,
                         "created_at": document.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -509,11 +582,15 @@ def test_api_documents_tree_list_authenticated_public_or_authenticated_parent(
                         "updated_at": document.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [],
+                        "user_role": None,
                     },
                     {
                         "abilities": document_sibling.get_abilities(user),
+                        "ancestors_link_reach": document_sibling.ancestors_link_reach,
+                        "ancestors_link_role": document_sibling.ancestors_link_role,
                         "children": [],
+                        "computed_link_reach": document_sibling.computed_link_reach,
+                        "computed_link_role": document_sibling.computed_link_role,
                         "created_at": document_sibling.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -532,9 +609,11 @@ def test_api_documents_tree_list_authenticated_public_or_authenticated_parent(
                         "updated_at": document_sibling.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [],
+                        "user_role": None,
                     },
                 ],
+                "computed_link_reach": parent.computed_link_reach,
+                "computed_link_role": parent.computed_link_role,
                 "created_at": parent.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(parent.creator.id),
                 "depth": 3,
@@ -549,11 +628,15 @@ def test_api_documents_tree_list_authenticated_public_or_authenticated_parent(
                 "path": parent.path,
                 "title": parent.title,
                 "updated_at": parent.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [],
+                "user_role": None,
             },
             {
                 "abilities": parent_sibling.get_abilities(user),
+                "ancestors_link_reach": parent_sibling.ancestors_link_reach,
+                "ancestors_link_role": parent_sibling.ancestors_link_role,
                 "children": [],
+                "computed_link_reach": parent_sibling.computed_link_reach,
+                "computed_link_role": parent_sibling.computed_link_role,
                 "created_at": parent_sibling.created_at.isoformat().replace(
                     "+00:00", "Z"
                 ),
@@ -572,9 +655,11 @@ def test_api_documents_tree_list_authenticated_public_or_authenticated_parent(
                 "updated_at": parent_sibling.updated_at.isoformat().replace(
                     "+00:00", "Z"
                 ),
-                "user_roles": [],
+                "user_role": None,
             },
         ],
+        "computed_link_reach": grand_parent.computed_link_reach,
+        "computed_link_role": grand_parent.computed_link_role,
         "created_at": grand_parent.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(grand_parent.creator.id),
         "depth": 2,
@@ -589,7 +674,7 @@ def test_api_documents_tree_list_authenticated_public_or_authenticated_parent(
         "path": grand_parent.path,
         "title": grand_parent.title,
         "updated_at": grand_parent.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [],
+        "user_role": None,
     }
 
 
@@ -639,13 +724,21 @@ def test_api_documents_tree_list_authenticated_related_direct():
     assert response.status_code == 200
     assert response.json() == {
         "abilities": parent.get_abilities(user),
+        "ancestors_link_reach": parent.ancestors_link_reach,
+        "ancestors_link_role": parent.ancestors_link_role,
         "children": [
             {
                 "abilities": document.get_abilities(user),
+                "ancestors_link_reach": document.ancestors_link_reach,
+                "ancestors_link_role": document.ancestors_link_role,
                 "children": [
                     {
                         "abilities": child.get_abilities(user),
+                        "ancestors_link_reach": child.ancestors_link_reach,
+                        "ancestors_link_role": child.ancestors_link_role,
                         "children": [],
+                        "computed_link_reach": child.computed_link_reach,
+                        "computed_link_role": child.computed_link_role,
                         "created_at": child.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -664,9 +757,11 @@ def test_api_documents_tree_list_authenticated_related_direct():
                         "updated_at": child.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [access.role],
+                        "user_role": access.role,
                     },
                 ],
+                "computed_link_reach": document.computed_link_reach,
+                "computed_link_role": document.computed_link_role,
                 "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(document.creator.id),
                 "depth": 2,
@@ -681,11 +776,15 @@ def test_api_documents_tree_list_authenticated_related_direct():
                 "path": document.path,
                 "title": document.title,
                 "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": sibling.get_abilities(user),
+                "ancestors_link_reach": sibling.ancestors_link_reach,
+                "ancestors_link_role": sibling.ancestors_link_role,
                 "children": [],
+                "computed_link_reach": sibling.computed_link_reach,
+                "computed_link_role": sibling.computed_link_role,
                 "created_at": sibling.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(sibling.creator.id),
                 "depth": 2,
@@ -700,9 +799,11 @@ def test_api_documents_tree_list_authenticated_related_direct():
                 "path": sibling.path,
                 "title": sibling.title,
                 "updated_at": sibling.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
         ],
+        "computed_link_reach": parent.computed_link_reach,
+        "computed_link_role": parent.computed_link_role,
         "created_at": parent.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(parent.creator.id),
         "depth": 1,
@@ -717,7 +818,7 @@ def test_api_documents_tree_list_authenticated_related_direct():
         "path": parent.path,
         "title": parent.title,
         "updated_at": parent.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [access.role],
+        "user_role": access.role,
     }
 
 
@@ -762,16 +863,26 @@ def test_api_documents_tree_list_authenticated_related_parent():
     assert response.status_code == 200
     assert response.json() == {
         "abilities": grand_parent.get_abilities(user),
+        "ancestors_link_reach": grand_parent.ancestors_link_reach,
+        "ancestors_link_role": grand_parent.ancestors_link_role,
         "children": [
             {
                 "abilities": parent.get_abilities(user),
+                "ancestors_link_reach": parent.ancestors_link_reach,
+                "ancestors_link_role": parent.ancestors_link_role,
                 "children": [
                     {
                         "abilities": document.get_abilities(user),
+                        "ancestors_link_reach": document.ancestors_link_reach,
+                        "ancestors_link_role": document.ancestors_link_role,
                         "children": [
                             {
                                 "abilities": child.get_abilities(user),
+                                "ancestors_link_reach": child.ancestors_link_reach,
+                                "ancestors_link_role": child.ancestors_link_role,
+                                "computed_link_reach": child.computed_link_reach,
                                 "children": [],
+                                "computed_link_role": child.computed_link_role,
                                 "created_at": child.created_at.isoformat().replace(
                                     "+00:00", "Z"
                                 ),
@@ -790,9 +901,11 @@ def test_api_documents_tree_list_authenticated_related_parent():
                                 "updated_at": child.updated_at.isoformat().replace(
                                     "+00:00", "Z"
                                 ),
-                                "user_roles": [access.role],
+                                "user_role": access.role,
                             },
                         ],
+                        "computed_link_reach": document.computed_link_reach,
+                        "computed_link_role": document.computed_link_role,
                         "created_at": document.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -811,11 +924,15 @@ def test_api_documents_tree_list_authenticated_related_parent():
                         "updated_at": document.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [access.role],
+                        "user_role": access.role,
                     },
                     {
                         "abilities": document_sibling.get_abilities(user),
+                        "ancestors_link_reach": document_sibling.ancestors_link_reach,
+                        "ancestors_link_role": document_sibling.ancestors_link_role,
                         "children": [],
+                        "computed_link_reach": document_sibling.computed_link_reach,
+                        "computed_link_role": document_sibling.computed_link_role,
                         "created_at": document_sibling.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -834,9 +951,11 @@ def test_api_documents_tree_list_authenticated_related_parent():
                         "updated_at": document_sibling.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [access.role],
+                        "user_role": access.role,
                     },
                 ],
+                "computed_link_reach": parent.computed_link_reach,
+                "computed_link_role": parent.computed_link_role,
                 "created_at": parent.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(parent.creator.id),
                 "depth": 3,
@@ -851,11 +970,15 @@ def test_api_documents_tree_list_authenticated_related_parent():
                 "path": parent.path,
                 "title": parent.title,
                 "updated_at": parent.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": parent_sibling.get_abilities(user),
+                "ancestors_link_reach": parent_sibling.ancestors_link_reach,
+                "ancestors_link_role": parent_sibling.ancestors_link_role,
                 "children": [],
+                "computed_link_reach": parent_sibling.computed_link_reach,
+                "computed_link_role": parent_sibling.computed_link_role,
                 "created_at": parent_sibling.created_at.isoformat().replace(
                     "+00:00", "Z"
                 ),
@@ -874,9 +997,11 @@ def test_api_documents_tree_list_authenticated_related_parent():
                 "updated_at": parent_sibling.updated_at.isoformat().replace(
                     "+00:00", "Z"
                 ),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
         ],
+        "computed_link_reach": grand_parent.computed_link_reach,
+        "computed_link_role": grand_parent.computed_link_role,
         "created_at": grand_parent.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(grand_parent.creator.id),
         "depth": 2,
@@ -891,7 +1016,7 @@ def test_api_documents_tree_list_authenticated_related_parent():
         "path": grand_parent.path,
         "title": grand_parent.title,
         "updated_at": grand_parent.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [access.role],
+        "user_role": access.role,
     }
 
 
@@ -949,13 +1074,21 @@ def test_api_documents_tree_list_authenticated_related_team_members(
     assert response.status_code == 200
     assert response.json() == {
         "abilities": parent.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
         "children": [
             {
                 "abilities": document.get_abilities(user),
+                "ancestors_link_reach": "restricted",
+                "ancestors_link_role": None,
                 "children": [
                     {
                         "abilities": child.get_abilities(user),
+                        "ancestors_link_reach": "restricted",
+                        "ancestors_link_role": None,
                         "children": [],
+                        "computed_link_reach": child.computed_link_reach,
+                        "computed_link_role": child.computed_link_role,
                         "created_at": child.created_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
@@ -974,9 +1107,11 @@ def test_api_documents_tree_list_authenticated_related_team_members(
                         "updated_at": child.updated_at.isoformat().replace(
                             "+00:00", "Z"
                         ),
-                        "user_roles": [access.role],
+                        "user_role": access.role,
                     },
                 ],
+                "computed_link_reach": document.computed_link_reach,
+                "computed_link_role": document.computed_link_role,
                 "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(document.creator.id),
                 "depth": 2,
@@ -991,11 +1126,15 @@ def test_api_documents_tree_list_authenticated_related_team_members(
                 "path": document.path,
                 "title": document.title,
                 "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
             {
                 "abilities": sibling.get_abilities(user),
+                "ancestors_link_reach": "restricted",
+                "ancestors_link_role": None,
                 "children": [],
+                "computed_link_reach": sibling.computed_link_reach,
+                "computed_link_role": sibling.computed_link_role,
                 "created_at": sibling.created_at.isoformat().replace("+00:00", "Z"),
                 "creator": str(sibling.creator.id),
                 "depth": 2,
@@ -1010,9 +1149,11 @@ def test_api_documents_tree_list_authenticated_related_team_members(
                 "path": sibling.path,
                 "title": sibling.title,
                 "updated_at": sibling.updated_at.isoformat().replace("+00:00", "Z"),
-                "user_roles": [access.role],
+                "user_role": access.role,
             },
         ],
+        "computed_link_reach": parent.computed_link_reach,
+        "computed_link_role": parent.computed_link_role,
         "created_at": parent.created_at.isoformat().replace("+00:00", "Z"),
         "creator": str(parent.creator.id),
         "depth": 1,
@@ -1027,5 +1168,5 @@ def test_api_documents_tree_list_authenticated_related_team_members(
         "path": parent.path,
         "title": parent.title,
         "updated_at": parent.updated_at.isoformat().replace("+00:00", "Z"),
-        "user_roles": [access.role],
+        "user_role": access.role,
     }

src/backend/core/tests/documents/test_api_documents_update.py

@@ -155,6 +155,10 @@ def test_api_documents_update_anonymous_or_authenticated_unrelated(
     for key, value in document_values.items():
         if key in [
             "id",
+            "ancestors_link_reach",
+            "ancestors_link_role",
+            "computed_link_reach",
+            "computed_link_role",
             "accesses",
             "created_at",
             "creator",
@@ -270,6 +274,10 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
     for key, value in document_values.items():
         if key in [
             "id",
+            "ancestors_link_reach",
+            "ancestors_link_role",
+            "computed_link_reach",
+            "computed_link_role",
             "created_at",
             "creator",
             "depth",

src/backend/core/tests/templates/test_api_template_accesses.py

@@ -48,12 +48,7 @@ def test_api_template_accesses_list_authenticated_unrelated():
         f"/api/v1.0/templates/{template.id!s}/accesses/",
     )
     assert response.status_code == 200
-    assert response.json() == {
-        "count": 0,
-        "next": None,
-        "previous": None,
-        "results": [],
-    }
+    assert response.json() == []
 
 
 @pytest.mark.parametrize("via", VIA)
@@ -96,8 +91,8 @@ def test_api_template_accesses_list_authenticated_related(via, mock_user_teams):
 
     assert response.status_code == 200
     content = response.json()
-    assert len(content["results"]) == 3
-    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
+    assert len(content) == 3
+    assert sorted(content, key=lambda x: x["id"]) == sorted(
         [
             {
                 "id": str(user_access.id),

src/backend/core/tests/templates/test_api_template_accesses_create.py

@@ -133,7 +133,7 @@ def test_api_template_accesses_create_authenticated_administrator(via, mock_user
 
     assert response.status_code == 403
     assert response.json() == {
-        "detail": "Only owners of a resource can assign other users as owners."
+        "detail": "Only owners of a template can assign other users as owners."
     }
 
     # It should be allowed to create a lower access

src/backend/core/tests/test_api_users.py

@@ -186,7 +186,7 @@ def test_api_users_list_query_short_queries():
     """
     Queries shorter than 5 characters should return an empty result set.
     """
-    user = factories.UserFactory()
+    user = factories.UserFactory(email="paul@example.com")
     client = APIClient()
     client.force_login(user)
 

src/backend/core/tests/test_models_document_accesses.py

@@ -123,16 +123,22 @@ def test_models_document_access_get_abilities_for_owner_of_self_allowed():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["administrator", "editor", "reader"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
-def test_models_document_access_get_abilities_for_owner_of_self_last():
+def test_models_document_access_get_abilities_for_owner_of_self_last_on_root(
+    django_assert_num_queries,
+):
     """
-    Check abilities of self access for the owner of a document when there is only one owner left.
+    Check abilities of self access for the owner of a root document when there
+    is only one owner left.
     """
     access = factories.UserDocumentAccessFactory(role="owner")
-    abilities = access.get_abilities(access.user)
+
+    with django_assert_num_queries(2):
+        abilities = access.get_abilities(access.user)
+
     assert abilities == {
         "destroy": False,
         "retrieve": True,
@@ -142,6 +148,28 @@ def test_models_document_access_get_abilities_for_owner_of_self_last():
     }
 
 
+def test_models_document_access_get_abilities_for_owner_of_self_last_on_child(
+    django_assert_num_queries,
+):
+    """
+    Check abilities of self access for the owner of a child document when there
+    is only one owner left.
+    """
+    parent = factories.DocumentFactory()
+    access = factories.UserDocumentAccessFactory(document__parent=parent, role="owner")
+
+    with django_assert_num_queries(1):
+        abilities = access.get_abilities(access.user)
+
+    assert abilities == {
+        "destroy": True,
+        "retrieve": True,
+        "update": True,
+        "partial_update": True,
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
+    }
+
+
 def test_models_document_access_get_abilities_for_owner_of_owner():
     """Check abilities of owner access for the owner of a document."""
     access = factories.UserDocumentAccessFactory(role="owner")
@@ -155,7 +183,7 @@ def test_models_document_access_get_abilities_for_owner_of_owner():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["administrator", "editor", "reader"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -172,7 +200,7 @@ def test_models_document_access_get_abilities_for_owner_of_administrator():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["owner", "editor", "reader"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -189,7 +217,7 @@ def test_models_document_access_get_abilities_for_owner_of_editor():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["owner", "administrator", "reader"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -206,7 +234,7 @@ def test_models_document_access_get_abilities_for_owner_of_reader():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["owner", "administrator", "editor"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -243,7 +271,7 @@ def test_models_document_access_get_abilities_for_administrator_of_administrator
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["editor", "reader"],
+        "set_role_to": ["reader", "editor", "administrator"],
     }
 
 
@@ -260,7 +288,7 @@ def test_models_document_access_get_abilities_for_administrator_of_editor():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["administrator", "reader"],
+        "set_role_to": ["reader", "editor", "administrator"],
     }
 
 
@@ -277,7 +305,7 @@ def test_models_document_access_get_abilities_for_administrator_of_reader():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["administrator", "editor"],
+        "set_role_to": ["reader", "editor", "administrator"],
     }
 
 
@@ -400,12 +428,12 @@ def test_models_document_access_get_abilities_for_reader_of_reader_user(
 
 
 def test_models_document_access_get_abilities_preset_role(django_assert_num_queries):
-    """No query is done if the role is preset, e.g., with a query annotation."""
+    """No query is done if user roles are preset on the document, e.g., with a query annotation."""
     access = factories.UserDocumentAccessFactory(role="reader")
     user = factories.UserDocumentAccessFactory(
         document=access.document, role="reader"
     ).user
-    access.user_roles = ["reader"]
+    access.set_user_roles_tuple(None, "reader")
 
     with django_assert_num_queries(0):
         abilities = access.get_abilities(user)

src/backend/core/tests/test_models_documents.py

@@ -171,7 +171,7 @@ def test_models_documents_get_abilities_forbidden(
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": ["reader", "editor"],
+            "restricted": None,
         },
         "partial_update": False,
         "restore": False,
@@ -229,7 +229,7 @@ def test_models_documents_get_abilities_reader(
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": ["reader", "editor"],
+            "restricted": None,
         },
         "media_auth": True,
         "media_check": True,
@@ -252,7 +252,7 @@ def test_models_documents_get_abilities_reader(
     assert all(
         value is False
         for key, value in document.get_abilities(user).items()
-        if key != "link_select_options"
+        if key not in ["link_select_options", "ancestors_links_definition"]
     )
 
 
@@ -292,7 +292,7 @@ def test_models_documents_get_abilities_editor(
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": ["reader", "editor"],
+            "restricted": None,
         },
         "media_auth": True,
         "media_check": True,
@@ -314,7 +314,7 @@ def test_models_documents_get_abilities_editor(
     assert all(
         value is False
         for key, value in document.get_abilities(user).items()
-        if key != "link_select_options"
+        if key not in ["link_select_options", "ancestors_links_definition"]
     )
 
 
@@ -344,7 +344,7 @@ def test_models_documents_get_abilities_owner(django_assert_num_queries):
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": ["reader", "editor"],
+            "restricted": None,
         },
         "media_auth": True,
         "media_check": True,
@@ -393,7 +393,7 @@ def test_models_documents_get_abilities_administrator(django_assert_num_queries)
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": ["reader", "editor"],
+            "restricted": None,
         },
         "media_auth": True,
         "media_check": True,
@@ -415,7 +415,7 @@ def test_models_documents_get_abilities_administrator(django_assert_num_queries)
     assert all(
         value is False
         for key, value in document.get_abilities(user).items()
-        if key != "link_select_options"
+        if key not in ["link_select_options", "ancestors_links_definition"]
     )
 
 
@@ -445,7 +445,7 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": ["reader", "editor"],
+            "restricted": None,
         },
         "media_auth": True,
         "media_check": True,
@@ -467,7 +467,7 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
     assert all(
         value is False
         for key, value in document.get_abilities(user).items()
-        if key != "link_select_options"
+        if key not in ["link_select_options", "ancestors_links_definition"]
     )
 
 
@@ -504,7 +504,7 @@ def test_models_documents_get_abilities_reader_user(
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": ["reader", "editor"],
+            "restricted": None,
         },
         "media_auth": True,
         "media_check": True,
@@ -528,7 +528,7 @@ def test_models_documents_get_abilities_reader_user(
         assert all(
             value is False
             for key, value in document.get_abilities(user).items()
-            if key != "link_select_options"
+            if key not in ["link_select_options", "ancestors_links_definition"]
         )
 
 
@@ -561,7 +561,7 @@ def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
         "link_select_options": {
             "authenticated": ["reader", "editor"],
             "public": ["reader", "editor"],
-            "restricted": ["reader", "editor"],
+            "restricted": None,
         },
         "media_auth": True,
         "media_check": True,
@@ -1176,184 +1176,134 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
 
 
 @pytest.mark.parametrize(
-    "ancestors_links, select_options",
+    "reach, role, select_options",
     [
-        # One ancestor
         (
-            [{"link_reach": "public", "link_role": "reader"}],
+            "public",
+            "reader",
             {
-                "restricted": ["editor"],
+                "public": ["reader", "editor"],
+            },
+        ),
+        ("public", "editor", {"public": ["editor"]}),
+        (
+            "authenticated",
+            "reader",
+            {
+                "authenticated": ["reader", "editor"],
+                "public": ["reader", "editor"],
+            },
+        ),
+        (
+            "authenticated",
+            "editor",
+            {"authenticated": ["editor"], "public": ["editor"]},
+        ),
+        (
+            "restricted",
+            "reader",
+            {
+                "restricted": None,
+                "authenticated": ["reader", "editor"],
+                "public": ["reader", "editor"],
+            },
+        ),
+        (
+            "restricted",
+            "editor",
+            {
+                "restricted": None,
                 "authenticated": ["editor"],
-                "public": ["reader", "editor"],
+                "public": ["editor"],
             },
         ),
-        ([{"link_reach": "public", "link_role": "editor"}], {"public": ["editor"]}),
+        # Edge cases
         (
-            [{"link_reach": "authenticated", "link_role": "reader"}],
+            "public",
+            None,
             {
-                "restricted": ["editor"],
-                "authenticated": ["reader", "editor"],
                 "public": ["reader", "editor"],
             },
         ),
         (
-            [{"link_reach": "authenticated", "link_role": "editor"}],
-            {"authenticated": ["editor"], "public": ["reader", "editor"]},
-        ),
-        (
-            [{"link_reach": "restricted", "link_role": "reader"}],
-            {
-                "restricted": ["reader", "editor"],
-                "authenticated": ["reader", "editor"],
-                "public": ["reader", "editor"],
-            },
-        ),
-        (
-            [{"link_reach": "restricted", "link_role": "editor"}],
-            {
-                "restricted": ["editor"],
-                "authenticated": ["reader", "editor"],
-                "public": ["reader", "editor"],
-            },
-        ),
-        # Multiple ancestors with different roles
-        (
-            [
-                {"link_reach": "public", "link_role": "reader"},
-                {"link_reach": "public", "link_role": "editor"},
-            ],
-            {"public": ["editor"]},
-        ),
-        (
-            [
-                {"link_reach": "authenticated", "link_role": "reader"},
-                {"link_reach": "authenticated", "link_role": "editor"},
-            ],
-            {"authenticated": ["editor"], "public": ["reader", "editor"]},
-        ),
-        (
-            [
-                {"link_reach": "restricted", "link_role": "reader"},
-                {"link_reach": "restricted", "link_role": "editor"},
-            ],
-            {
-                "restricted": ["editor"],
-                "authenticated": ["reader", "editor"],
-                "public": ["reader", "editor"],
-            },
-        ),
-        # Multiple ancestors with different reaches
-        (
-            [
-                {"link_reach": "authenticated", "link_role": "reader"},
-                {"link_reach": "public", "link_role": "reader"},
-            ],
-            {
-                "restricted": ["editor"],
-                "authenticated": ["editor"],
-                "public": ["reader", "editor"],
-            },
-        ),
-        (
-            [
-                {"link_reach": "restricted", "link_role": "reader"},
-                {"link_reach": "authenticated", "link_role": "reader"},
-                {"link_reach": "public", "link_role": "reader"},
-            ],
-            {
-                "restricted": ["editor"],
-                "authenticated": ["editor"],
-                "public": ["reader", "editor"],
-            },
-        ),
-        # Multiple ancestors with mixed reaches and roles
-        (
-            [
-                {"link_reach": "authenticated", "link_role": "editor"},
-                {"link_reach": "public", "link_role": "reader"},
-            ],
-            {"authenticated": ["editor"], "public": ["reader", "editor"]},
-        ),
-        (
-            [
-                {"link_reach": "authenticated", "link_role": "reader"},
-                {"link_reach": "public", "link_role": "editor"},
-            ],
-            {"public": ["editor"]},
-        ),
-        (
-            [
-                {"link_reach": "restricted", "link_role": "editor"},
-                {"link_reach": "authenticated", "link_role": "reader"},
-            ],
-            {
-                "restricted": ["editor"],
-                "authenticated": ["reader", "editor"],
-                "public": ["reader", "editor"],
-            },
-        ),
-        (
-            [
-                {"link_reach": "restricted", "link_role": "reader"},
-                {"link_reach": "authenticated", "link_role": "editor"},
-            ],
-            {"authenticated": ["editor"], "public": ["reader", "editor"]},
-        ),
-        # No ancestors (edge case)
-        (
-            [],
+            None,
+            "reader",
             {
                 "public": ["reader", "editor"],
                 "authenticated": ["reader", "editor"],
-                "restricted": ["reader", "editor"],
+                "restricted": None,
+            },
+        ),
+        (
+            None,
+            None,
+            {
+                "public": ["reader", "editor"],
+                "authenticated": ["reader", "editor"],
+                "restricted": None,
             },
         ),
     ],
 )
-def test_models_documents_get_select_options(ancestors_links, select_options):
+def test_models_documents_get_select_options(reach, role, select_options):
     """Validate that the "get_select_options" method operates as expected."""
-    assert models.LinkReachChoices.get_select_options(ancestors_links) == select_options
+    assert models.LinkReachChoices.get_select_options(reach, role) == select_options
 
 
-def test_models_documents_compute_ancestors_links_no_highest_readable():
-    """Test the compute_ancestors_links method."""
-    document = factories.DocumentFactory(link_reach="public")
-    assert document.compute_ancestors_links(user=AnonymousUser()) == []
-
-
-def test_models_documents_compute_ancestors_links_highest_readable(
+def test_models_documents_compute_ancestors_links_paths_mapping_single(
     django_assert_num_queries,
 ):
-    """Test the compute_ancestors_links method."""
+    """Test the compute_ancestors_links_paths_mapping method on a single document."""
+    document = factories.DocumentFactory(link_reach="public")
+    with django_assert_num_queries(1):
+        assert document.compute_ancestors_links_paths_mapping() == {
+            document.path: [{"link_reach": "public", "link_role": document.link_role}]
+        }
+
+
+def test_models_documents_compute_ancestors_links_paths_mapping_structure(
+    django_assert_num_queries,
+):
+    """Test the compute_ancestors_links_paths_mapping method on a tree of documents."""
     user = factories.UserFactory()
     other_user = factories.UserFactory()
-    root = factories.DocumentFactory(
-        link_reach="restricted", link_role="reader", users=[user]
-    )
 
-    factories.DocumentFactory(
-        parent=root, link_reach="public", link_role="reader", users=[user]
-    )
-    child2 = factories.DocumentFactory(
+    root = factories.DocumentFactory(link_reach="restricted", users=[user])
+    document = factories.DocumentFactory(
         parent=root,
         link_reach="authenticated",
         link_role="editor",
         users=[user, other_user],
     )
-    child3 = factories.DocumentFactory(
-        parent=child2,
+    sibling = factories.DocumentFactory(parent=root, link_reach="public", users=[user])
+    child = factories.DocumentFactory(
+        parent=document,
         link_reach="authenticated",
         link_role="reader",
         users=[user, other_user],
     )
 
-    with django_assert_num_queries(2):
-        assert child3.compute_ancestors_links(user=user) == [
-            {"link_reach": root.link_reach, "link_role": root.link_role},
-            {"link_reach": child2.link_reach, "link_role": child2.link_role},
-        ]
+    # Child
+    with django_assert_num_queries(1):
+        assert child.compute_ancestors_links_paths_mapping() == {
+            root.path: [{"link_reach": "restricted", "link_role": root.link_role}],
+            document.path: [
+                {"link_reach": "restricted", "link_role": root.link_role},
+                {"link_reach": document.link_reach, "link_role": document.link_role},
+            ],
+            child.path: [
+                {"link_reach": "restricted", "link_role": root.link_role},
+                {"link_reach": document.link_reach, "link_role": document.link_role},
+                {"link_reach": child.link_reach, "link_role": child.link_role},
+            ],
+        }
 
-    with django_assert_num_queries(2):
-        assert child3.compute_ancestors_links(user=other_user) == [
-            {"link_reach": child2.link_reach, "link_role": child2.link_role},
-        ]
+    # Sibling
+    with django_assert_num_queries(1):
+        assert sibling.compute_ancestors_links_paths_mapping() == {
+            root.path: [{"link_reach": "restricted", "link_role": root.link_role}],
+            sibling.path: [
+                {"link_reach": "restricted", "link_role": root.link_role},
+                {"link_reach": sibling.link_reach, "link_role": sibling.link_role},
+            ],
+        }

src/frontend/apps/e2e/__tests__/app-impress/common.ts

@@ -78,12 +78,15 @@ export const createDoc = async (
   docName: string,
   browserName: string,
   length: number = 1,
+  isChild: boolean = false,
 ) => {
   const randomDocs = randomName(docName, browserName, length);
 
   for (let i = 0; i < randomDocs.length; i++) {
-    const header = page.locator('header').first();
-    await header.locator('h2').getByText('Docs').click();
+    if (!isChild) {
+      const header = page.locator('header').first();
+      await header.locator('h2').getByText('Docs').click();
+    }
 
     await page
       .getByRole('button', {
@@ -210,7 +213,27 @@ export const goToGridDoc = async (
   return docTitle as string;
 };
 
-export const mockedDocument = async (page: Page, json: object) => {
+export const updateDocTitle = async (page: Page, title: string) => {
+  const input = page.getByLabel('doc title input');
+  await expect(input).toBeVisible();
+  await expect(input).toHaveText('');
+  await input.click();
+  await input.fill(title);
+  await input.click();
+  await input.blur();
+  await verifyDocName(page, title);
+};
+
+export const getWaitForCreateDoc = (page: Page) => {
+  return page.waitForResponse(
+    (response) =>
+      response.url().includes('/documents/') &&
+      response.url().includes('/children/') &&
+      response.request().method() === 'POST',
+  );
+};
+
+export const mockedDocument = async (page: Page, data: object) => {
   await page.route('**/documents/**/', async (route) => {
     const request = route.request();
     if (
@@ -220,12 +243,15 @@ export const mockedDocument = async (page: Page, json: object) => {
       !request.url().includes('accesses') &&
       !request.url().includes('invitations')
     ) {
+      const { abilities, ...rest } = data as unknown as {
+        abilities?: Record<string, unknown>;
+      };
       await route.fulfill({
         json: {
           id: 'mocked-document-id',
           content: '',
           title: 'Mocked document',
-          accesses: [],
+          path: '000000',
           abilities: {
             destroy: false, // Means not owner
             link_configuration: false,
@@ -236,10 +262,22 @@ export const mockedDocument = async (page: Page, json: object) => {
             update: false,
             partial_update: false, // Means not editor
             retrieve: true,
+            link_select_options: {
+              public: ['reader', 'editor'],
+              authenticated: ['reader', 'editor'],
+              restricted: null,
+            },
+            ...abilities,
           },
           link_reach: 'restricted',
+          computed_link_reach: 'restricted',
+          computed_link_role: 'reader',
+          ancestors_link_reach: null,
+          ancestors_link_role: null,
           created_at: '2021-09-01T09:00:00Z',
-          ...json,
+          user_role: 'owner',
+          user_roles: ['owner'],
+          ...rest,
         },
       });
     } else {
@@ -248,7 +286,41 @@ export const mockedDocument = async (page: Page, json: object) => {
   });
 };
 
+export const mockedListDocs = async (page: Page, data: object[] = []) => {
+  await page.route('**/documents/**/', async (route) => {
+    const request = route.request();
+    if (request.method().includes('GET') && request.url().includes('page=')) {
+      await route.fulfill({
+        json: {
+          count: data.length,
+          next: null,
+          previous: null,
+          results: data,
+        },
+      });
+    }
+  });
+};
+
 export const mockedInvitations = async (page: Page, json?: object) => {
+  let result = [
+    {
+      id: '120ec765-43af-4602-83eb-7f4e1224548a',
+      abilities: {
+        destroy: true,
+        update: true,
+        partial_update: true,
+        retrieve: true,
+      },
+      created_at: '2024-10-03T12:19:26.107687Z',
+      email: 'test@invitation.test',
+      document: '4888c328-8406-4412-9b0b-c0ba5b9e5fb6',
+      role: 'editor',
+      issuer: '7380f42f-02eb-4ad5-b8f0-037a0e66066d',
+      is_expired: false,
+      ...json,
+    },
+  ];
   await page.route('**/invitations/**/', async (route) => {
     const request = route.request();
     if (
@@ -256,70 +328,75 @@ export const mockedInvitations = async (page: Page, json?: object) => {
       request.url().includes('invitations') &&
       request.url().includes('page=')
     ) {
+      console.log('GET');
       await route.fulfill({
         json: {
           count: 1,
           next: null,
           previous: null,
-          results: [
-            {
-              id: '120ec765-43af-4602-83eb-7f4e1224548a',
-              abilities: {
-                destroy: true,
-                update: true,
-                partial_update: true,
-                retrieve: true,
-              },
-              created_at: '2024-10-03T12:19:26.107687Z',
-              email: 'test@invitation.test',
-              document: '4888c328-8406-4412-9b0b-c0ba5b9e5fb6',
-              role: 'editor',
-              issuer: '7380f42f-02eb-4ad5-b8f0-037a0e66066d',
-              is_expired: false,
-              ...json,
-            },
-          ],
+          results: result,
         },
       });
     } else {
       await route.continue();
     }
   });
+
+  await page.route(
+    '**/invitations/120ec765-43af-4602-83eb-7f4e1224548a/**/',
+    async (route) => {
+      const request = route.request();
+      if (request.method().includes('DELETE')) {
+        result = [];
+
+        await route.fulfill({
+          json: {},
+        });
+      }
+    },
+  );
 };
 
 export const mockedAccesses = async (page: Page, json?: object) => {
   await page.route('**/accesses/**/', async (route) => {
     const request = route.request();
+
     if (
       request.method().includes('GET') &&
-      request.url().includes('accesses') &&
-      request.url().includes('page=')
+      request.url().includes('accesses')
     ) {
       await route.fulfill({
-        json: {
-          count: 1,
-          next: null,
-          previous: null,
-          results: [
-            {
-              id: 'bc8bbbc5-a635-4f65-9817-fd1e9ec8ef87',
-              user: {
-                id: 'b4a21bb3-722e-426c-9f78-9d190eda641c',
-                email: 'test@accesses.test',
-              },
-              team: '',
-              role: 'reader',
-              abilities: {
-                destroy: true,
-                update: true,
-                partial_update: true,
-                retrieve: true,
-                set_role_to: ['administrator', 'editor'],
-              },
-              ...json,
+        json: [
+          {
+            id: 'bc8bbbc5-a635-4f65-9817-fd1e9ec8ef87',
+            user: {
+              id: 'b4a21bb3-722e-426c-9f78-9d190eda641c',
+              email: 'test@accesses.test',
             },
-          ],
-        },
+            team: '',
+            max_ancestors_role: null,
+            max_role: 'reader',
+            role: 'reader',
+            document: {
+              id: 'mocked-document-id',
+              path: '000000',
+              depth: 1,
+            },
+            abilities: {
+              destroy: true,
+              update: true,
+              partial_update: true,
+              retrieve: true,
+              link_select_options: {
+                public: ['reader', 'editor'],
+                authenticated: ['reader', 'editor'],
+                restricted: null,
+              },
+              set_role_to: ['administrator', 'editor'],
+            },
+            ...json,
+          },
+        ],
       });
     } else {
       await route.continue();

src/frontend/apps/e2e/__tests__/app-impress/doc-create.spec.ts

@@ -14,10 +14,10 @@ test.beforeEach(async ({ page }) => {
 
 test.describe('Doc Create', () => {
   test('it creates a doc', async ({ page, browserName }) => {
-    const [docTitle] = await createDoc(page, 'My new doc', browserName, 1);
+    const [docTitle] = await createDoc(page, 'my-new-doc', browserName, 1);
 
     await page.waitForFunction(
-      () => document.title.match(/My new doc - Docs/),
+      () => document.title.match(/my-new-doc - Docs/),
       { timeout: 5000 },
     );
 

src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts

@@ -173,6 +173,7 @@ test.describe('Doc Editor', () => {
     await expect(editor.getByText('Hello World Doc 2')).toBeHidden();
     await expect(editor.getByText('Hello World Doc 1')).toBeVisible();
 
+    await page.goto('/');
     await page
       .getByRole('button', {
         name: 'New doc',

src/frontend/apps/e2e/__tests__/app-impress/doc-grid-dnd.spec.ts

@@ -0,0 +1,314 @@
+import { expect, test } from '@playwright/test';
+
+import { createDoc, mockedListDocs } from './common';
+
+test.describe('Doc grid dnd', () => {
+  test('it creates a doc', async ({ page, browserName }) => {
+    await page.goto('/');
+    const header = page.locator('header').first();
+    await createDoc(page, 'Draggable doc', browserName, 1);
+    await header.locator('h2').getByText('Docs').click();
+    await createDoc(page, 'Droppable doc', browserName, 1);
+    await header.locator('h2').getByText('Docs').click();
+
+    const response = await page.waitForResponse(
+      (response) =>
+        response.url().endsWith('documents/?page=1') &&
+        response.status() === 200,
+    );
+    const responseJson = await response.json();
+
+    const items = responseJson.results;
+
+    const docsGrid = page.getByTestId('docs-grid');
+    await expect(docsGrid).toBeVisible();
+    await expect(page.getByTestId('grid-loader')).toBeHidden();
+    const draggableElement = page.getByTestId(`draggable-doc-${items[1].id}`);
+    const dropZone = page.getByTestId(`droppable-doc-${items[0].id}`);
+    await expect(draggableElement).toBeVisible();
+    await expect(dropZone).toBeVisible();
+
+    // Obtenir les positions des éléments
+    const draggableBoundingBox = await draggableElement.boundingBox();
+    const dropZoneBoundingBox = await dropZone.boundingBox();
+
+    expect(draggableBoundingBox).toBeDefined();
+    expect(dropZoneBoundingBox).toBeDefined();
+
+    // eslint-disable-next-line playwright/no-conditional-in-test
+    if (!draggableBoundingBox || !dropZoneBoundingBox) {
+      throw new Error('Impossible de déterminer la position des éléments');
+    }
+
+    await page.mouse.move(
+      draggableBoundingBox.x + draggableBoundingBox.width / 2,
+      draggableBoundingBox.y + draggableBoundingBox.height / 2,
+    );
+    await page.mouse.down();
+
+    // Déplacer vers la zone cible
+    await page.mouse.move(
+      dropZoneBoundingBox.x + dropZoneBoundingBox.width / 2,
+      dropZoneBoundingBox.y + dropZoneBoundingBox.height / 2,
+      { steps: 10 }, // Make the movement smoother
+    );
+
+    const dragOverlay = page.getByTestId('drag-doc-overlay');
+
+    await expect(dragOverlay).toBeVisible();
+    await expect(dragOverlay).toHaveText(items[1].title as string);
+    await page.mouse.up();
+
+    await expect(dragOverlay).toBeHidden();
+  });
+
+  test("it checks can't drop when we have not the minimum role", async ({
+    page,
+  }) => {
+    await mockedListDocs(page, data);
+    await page.goto('/');
+    const docsGrid = page.getByTestId('docs-grid');
+    await expect(docsGrid).toBeVisible();
+    await expect(page.getByTestId('grid-loader')).toBeHidden();
+
+    const canDropAndDrag = page.getByTestId('droppable-doc-can-drop-and-drag');
+
+    const noDropAndNoDrag = page.getByTestId(
+      'droppable-doc-no-drop-and-no-drag',
+    );
+
+    await expect(canDropAndDrag).toBeVisible();
+
+    await expect(noDropAndNoDrag).toBeVisible();
+
+    const canDropAndDragBoundigBox = await canDropAndDrag.boundingBox();
+
+    const noDropAndNoDragBoundigBox = await noDropAndNoDrag.boundingBox();
+
+    // eslint-disable-next-line playwright/no-conditional-in-test
+    if (!canDropAndDragBoundigBox || !noDropAndNoDragBoundigBox) {
+      throw new Error('Impossible de déterminer la position des éléments');
+    }
+
+    await page.mouse.move(
+      canDropAndDragBoundigBox.x + canDropAndDragBoundigBox.width / 2,
+      canDropAndDragBoundigBox.y + canDropAndDragBoundigBox.height / 2,
+    );
+
+    await page.mouse.down();
+
+    await page.mouse.move(
+      noDropAndNoDragBoundigBox.x + noDropAndNoDragBoundigBox.width / 2,
+      noDropAndNoDragBoundigBox.y + noDropAndNoDragBoundigBox.height / 2,
+      { steps: 10 },
+    );
+
+    const dragOverlay = page.getByTestId('drag-doc-overlay');
+
+    await expect(dragOverlay).toBeVisible();
+    await expect(dragOverlay).toHaveText(
+      'You must be at least the editor of the target document',
+    );
+
+    await page.mouse.up();
+  });
+
+  test("it checks can't drag when we have not the minimum role", async ({
+    page,
+  }) => {
+    await mockedListDocs(page, data);
+    await page.goto('/');
+    const docsGrid = page.getByTestId('docs-grid');
+    await expect(docsGrid).toBeVisible();
+    await expect(page.getByTestId('grid-loader')).toBeHidden();
+
+    const canDropAndDrag = page.getByTestId('droppable-doc-can-drop-and-drag');
+
+    const noDropAndNoDrag = page.getByTestId(
+      'droppable-doc-no-drop-and-no-drag',
+    );
+
+    await expect(canDropAndDrag).toBeVisible();
+
+    await expect(noDropAndNoDrag).toBeVisible();
+
+    const canDropAndDragBoundigBox = await canDropAndDrag.boundingBox();
+
+    const noDropAndNoDragBoundigBox = await noDropAndNoDrag.boundingBox();
+
+    // eslint-disable-next-line playwright/no-conditional-in-test
+    if (!canDropAndDragBoundigBox || !noDropAndNoDragBoundigBox) {
+      throw new Error('Impossible de déterminer la position des éléments');
+    }
+
+    await page.mouse.move(
+      noDropAndNoDragBoundigBox.x + noDropAndNoDragBoundigBox.width / 2,
+      noDropAndNoDragBoundigBox.y + noDropAndNoDragBoundigBox.height / 2,
+    );
+
+    await page.mouse.down();
+
+    await page.mouse.move(
+      canDropAndDragBoundigBox.x + canDropAndDragBoundigBox.width / 2,
+      canDropAndDragBoundigBox.y + canDropAndDragBoundigBox.height / 2,
+      { steps: 10 },
+    );
+
+    const dragOverlay = page.getByTestId('drag-doc-overlay');
+
+    await expect(dragOverlay).toBeVisible();
+    await expect(dragOverlay).toHaveText(
+      'You must be the owner to move the document',
+    );
+
+    await page.mouse.up();
+  });
+});
+
+const data = [
+  {
+    id: 'can-drop-and-drag',
+    abilities: {
+      accesses_manage: true,
+      accesses_view: true,
+      ai_transform: true,
+      ai_translate: true,
+      attachment_upload: true,
+      children_list: true,
+      children_create: true,
+      collaboration_auth: true,
+      descendants: true,
+      destroy: true,
+      favorite: true,
+      link_configuration: true,
+      invite_owner: true,
+      move: true,
+      partial_update: true,
+      restore: true,
+      retrieve: true,
+      media_auth: true,
+      link_select_options: {
+        restricted: ['reader', 'editor'],
+        authenticated: ['reader', 'editor'],
+        public: ['reader', 'editor'],
+      },
+      tree: true,
+      update: true,
+      versions_destroy: true,
+      versions_list: true,
+      versions_retrieve: true,
+    },
+    created_at: '2025-03-14T14:45:22.527221Z',
+    creator: 'bc6895e0-8f6d-4b00-827d-c143aa6b2ecb',
+    depth: 1,
+    excerpt: null,
+    is_favorite: false,
+    link_role: 'reader',
+    link_reach: 'restricted',
+    nb_accesses_ancestors: 1,
+    nb_accesses_direct: 1,
+    numchild: 5,
+    path: '000000o',
+    title: 'Can drop and drag',
+    updated_at: '2025-03-14T14:45:27.699542Z',
+    user_roles: ['owner'],
+    user_role: 'owner',
+  },
+  {
+    id: 'can-only-drop',
+    title: 'Can only drop',
+    abilities: {
+      accesses_manage: true,
+      accesses_view: true,
+      ai_transform: true,
+      ai_translate: true,
+      attachment_upload: true,
+      children_list: true,
+      children_create: true,
+      collaboration_auth: true,
+      descendants: true,
+      destroy: true,
+      favorite: true,
+      link_configuration: true,
+      invite_owner: true,
+      move: true,
+      partial_update: true,
+      restore: true,
+      retrieve: true,
+      media_auth: true,
+      link_select_options: {
+        restricted: ['reader', 'editor'],
+        authenticated: ['reader', 'editor'],
+        public: ['reader', 'editor'],
+      },
+      tree: true,
+      update: true,
+      versions_destroy: true,
+      versions_list: true,
+      versions_retrieve: true,
+    },
+    created_at: '2025-03-14T14:45:22.527221Z',
+    creator: 'bc6895e0-8f6d-4b00-827d-c143aa6b2ecb',
+    depth: 1,
+    excerpt: null,
+    is_favorite: false,
+    link_role: 'reader',
+    link_reach: 'restricted',
+    nb_accesses_ancestors: 1,
+    nb_accesses_direct: 1,
+    numchild: 5,
+    path: '000000o',
+
+    updated_at: '2025-03-14T14:45:27.699542Z',
+    user_roles: ['editor'],
+    user_role: 'editor',
+  },
+  {
+    id: 'no-drop-and-no-drag',
+    abilities: {
+      accesses_manage: false,
+      accesses_view: true,
+      ai_transform: false,
+      ai_translate: false,
+      attachment_upload: false,
+      children_list: true,
+      children_create: false,
+      collaboration_auth: true,
+      descendants: true,
+      destroy: false,
+      favorite: true,
+      link_configuration: false,
+      invite_owner: false,
+      move: false,
+      partial_update: false,
+      restore: false,
+      retrieve: true,
+      media_auth: true,
+      link_select_options: {
+        restricted: ['reader', 'editor'],
+        authenticated: ['reader', 'editor'],
+        public: ['reader', 'editor'],
+      },
+      tree: true,
+      update: false,
+      versions_destroy: false,
+      versions_list: true,
+      versions_retrieve: true,
+    },
+    created_at: '2025-03-14T14:44:16.032773Z',
+    creator: '9264f420-f018-4bd6-96ae-4788f41af56d',
+    depth: 1,
+    excerpt: null,
+    is_favorite: false,
+    link_role: 'reader',
+    link_reach: 'restricted',
+    nb_accesses_ancestors: 14,
+    nb_accesses_direct: 14,
+    numchild: 0,
+    path: '000000l',
+    title: 'No drop and no drag',
+    updated_at: '2025-03-14T14:44:16.032774Z',
+    user_roles: ['reader'],
+    user_role: 'reader',
+  },
+];

src/frontend/apps/e2e/__tests__/app-impress/doc-grid.spec.ts

@@ -59,6 +59,7 @@ test.describe('Documents Grid mobile', () => {
                 link_reach: 'public',
                 created_at: '2024-10-07T13:02:41.085298Z',
                 updated_at: '2024-10-07T13:30:21.829690Z',
+                user_roles: ['owner'],
               },
             ],
           },
@@ -168,6 +169,8 @@ test.describe('Document grid item options', () => {
               },
               link_reach: 'restricted',
               created_at: '2021-09-01T09:00:00Z',
+              user_roles: ['editor'],
+              user_role: 'editor',
             },
           ],
         },

src/frontend/apps/e2e/__tests__/app-impress/doc-header.spec.ts

@@ -54,6 +54,7 @@ test.describe('Doc Header', () => {
         retrieve: true,
       },
       link_reach: 'public',
+      computed_link_reach: 'public',
       created_at: '2021-09-01T09:00:00Z',
     });
 
@@ -96,7 +97,9 @@ test.describe('Doc Header', () => {
     ).toBeVisible();
 
     await expect(
-      page.getByText(`Are you sure you want to delete this document ?`),
+      page.getByText(
+        `This document will be permanently deleted. This action is irreversible.`,
+      ),
     ).toBeVisible();
 
     await page
@@ -158,32 +161,31 @@ test.describe('Doc Header', () => {
     await expect(shareModal).toBeVisible();
     await expect(page.getByText('Share the document')).toBeVisible();
 
-    await expect(page.getByPlaceholder('Type a name or email')).toBeVisible();
-
     const invitationCard = shareModal.getByLabel('List invitation card');
     await expect(invitationCard).toBeVisible();
     await expect(
       invitationCard.getByText('test@invitation.test').first(),
     ).toBeVisible();
-    await expect(invitationCard.getByLabel('doc-role-dropdown')).toBeVisible();
+    const invitationRole = invitationCard.getByLabel('doc-role-dropdown');
+    await expect(invitationRole).toBeVisible();
 
-    await invitationCard.getByRole('button', { name: 'more_horiz' }).click();
+    await invitationRole.click();
 
-    await expect(page.getByLabel('Delete')).toBeEnabled();
-    await invitationCard.click();
+    await page.getByRole('menuitem', { name: 'Remove access' }).click();
+    await expect(invitationCard).toBeHidden();
 
     const memberCard = shareModal.getByLabel('List members card');
+    const roles = memberCard.getByLabel('doc-role-dropdown');
     await expect(memberCard).toBeVisible();
     await expect(
       memberCard.getByText('test@accesses.test').first(),
     ).toBeVisible();
-    await expect(memberCard.getByLabel('doc-role-dropdown')).toBeVisible();
-    await expect(
-      memberCard.getByRole('button', { name: 'more_horiz' }),
-    ).toBeVisible();
-    await memberCard.getByRole('button', { name: 'more_horiz' }).click();
+    await expect(roles).toBeVisible();
 
-    await expect(page.getByLabel('Delete')).toBeEnabled();
+    await roles.click();
+    await expect(
+      page.getByRole('menuitem', { name: 'Remove access' }),
+    ).toBeEnabled();
   });
 
   test('it checks the options available if editor', async ({ page }) => {

src/frontend/apps/e2e/__tests__/app-impress/doc-inherited-share.spec.ts

@@ -0,0 +1,154 @@
+import { expect, test } from '@playwright/test';
+
+import { createDoc } from './common';
+import { updateShareLink } from './share-utils';
+import { createRootSubPage } from './sub-pages-utils';
+
+test.describe('Inherited share accesses', () => {
+  test('it checks inherited accesses', async ({ page, browserName }) => {
+    await page.goto('/');
+    await createDoc(page, 'root-doc', browserName, 1);
+    const docTree = page.getByTestId('doc-tree');
+
+    // Wait for and intercept the POST request to create a new page
+    const responsePromise = page.waitForResponse(
+      (response) =>
+        response.url().includes('/documents/') &&
+        response.url().includes('/children/') &&
+        response.request().method() === 'POST',
+    );
+    await createRootSubPage(page, browserName, 'sub-page');
+
+    const response = await responsePromise;
+    expect(response.ok()).toBeTruthy();
+    const subPageJson = await response.json();
+
+    await expect(docTree).toBeVisible();
+    const subPageItem = docTree
+      .getByTestId(`doc-sub-page-item-${subPageJson.id}`)
+      .first();
+
+    await expect(subPageItem).toBeVisible();
+    await subPageItem.click();
+    await page.getByRole('button', { name: 'Share' }).click();
+    await expect(
+      page.getByText('People with access via the parent document'),
+    ).toBeVisible();
+
+    const user = page.getByTestId(
+      `doc-share-member-row-user@${browserName}.e2e`,
+    );
+    await expect(user).toBeVisible();
+    await expect(user.getByText('E2E Chromium')).toBeVisible();
+    await expect(user.getByText('Owner')).toBeVisible();
+  });
+});
+
+test.describe('Inherited share link', () => {
+  test('it checks if the link is inherited', async ({ page, browserName }) => {
+    await page.goto('/');
+    // Create root doc
+    await createDoc(page, 'root-doc', browserName, 1);
+
+    // Update share link
+    await page.getByRole('button', { name: 'Share' }).click();
+    await updateShareLink(page, 'Connected', 'Reading');
+    await page.getByRole('button', { name: 'OK' }).click();
+
+    // Create sub page
+    await createRootSubPage(page, browserName, 'sub-page');
+
+    // // verify share link is restricted and reader
+    await page.getByRole('button', { name: 'Share' }).click();
+    // await expect(page.getByText('Inherited share')).toBeVisible();
+    const docVisibilityCard = page.getByLabel('Doc visibility card');
+    await expect(docVisibilityCard).toBeVisible();
+    await expect(docVisibilityCard.getByText('Connected')).toBeVisible();
+    await expect(docVisibilityCard.getByText('Reading')).toBeVisible();
+  });
+
+  /**
+   * These tests are temporarily removed because we hide the ability to modify this parameter in sub-pages for now.
+   * There is a high probability that this feature will not change and therefore the test won't either.
+   */
+
+  // test('it checks warning message when sharing rules differ', async ({
+  //   page,
+  //   browserName,
+  // }) => {
+  //   await page.goto('/');
+  //   // Create root doc
+  //   await createDoc(page, 'root-doc', browserName, 1);
+
+  //   // Update share link
+  //   await page.getByRole('button', { name: 'Share' }).click();
+  //   await updateShareLink(page, 'Connected', 'Reading');
+  //   await page.getByRole('button', { name: 'OK' }).click();
+
+  //   // Create sub page
+  //   await createRootSubPage(page, browserName, 'sub-page');
+  //   await page.getByRole('button', { name: 'Share' }).click();
+
+  //   // Update share link to public and edition
+  //   await updateShareLink(page, 'Public', 'Edition');
+  //   await expect(page.getByText('Sharing rules differ from the')).toBeVisible();
+  //   const restoreButton = page.getByRole('button', { name: 'Restore' });
+  //   await expect(restoreButton).toBeVisible();
+  //   await restoreButton.click();
+  //   await expect(
+  //     page.getByText('The document visibility has been updated').first(),
+  //   ).toBeVisible();
+  //   await expect(page.getByText('Sharing rules differ from the')).toBeHidden();
+  // });
+
+  // test('it checks inherited link possibilities', async ({
+  //   page,
+  //   browserName,
+  // }) => {
+  //   await page.goto('/');
+  //   // Create root doc
+  //   await createDoc(page, 'root-doc', browserName, 1);
+
+  //   // Update share link
+  //   await page.getByRole('button', { name: 'Share' }).click();
+  //   await updateShareLink(page, 'Connected', 'Reading');
+  //   await page.getByRole('button', { name: 'OK' }).click();
+  //   await expect(
+  //     page.getByText('Document accessible to any connected person'),
+  //   ).toBeVisible();
+
+  //   // Create sub page
+  //   const { item: subPageItem } = await createRootSubPage(
+  //     page,
+  //     browserName,
+  //     'sub-page',
+  //   );
+  //   await expect(
+  //     page.getByText('Document accessible to any connected person'),
+  //   ).toBeVisible();
+
+  //   // Update share link to public and edition
+  //   await page.getByRole('button', { name: 'Share' }).click();
+  //   await verifyLinkReachIsDisabled(page, 'Private');
+  //   await updateShareLink(page, 'Public', 'Edition');
+  //   await page.getByRole('button', { name: 'OK' }).click();
+  //   await expect(page.getByText('Public document')).toBeVisible();
+
+  //   // Create sub page
+  //   await createSubPageFromParent(
+  //     page,
+  //     browserName,
+  //     subPageItem.id,
+  //     'sub-page-2',
+  //   );
+  //   await expect(page.getByText('Public document')).toBeVisible();
+
+  //   // Verify share link and role
+  //   await page.getByRole('button', { name: 'Share' }).click();
+  //   await verifyLinkReachIsDisabled(page, 'Private');
+  //   await verifyLinkReachIsDisabled(page, 'Connected');
+  //   await verifyLinkReachIsEnabled(page, 'Public');
+  //   await verifyLinkRoleIsDisabled(page, 'Reading');
+  //   await verifyLinkRoleIsEnabled(page, 'Edition');
+  // });
+});

src/frontend/apps/e2e/__tests__/app-impress/doc-member-list.spec.ts

@@ -8,47 +8,59 @@ test.beforeEach(async ({ page }) => {
 
 test.describe('Document list members', () => {
   test('it checks a big list of members', async ({ page }) => {
-    await page.route(
-      /.*\/documents\/.*\/accesses\/\?page=.*/,
-      async (route) => {
-        const request = route.request();
-        const url = new URL(request.url());
-        const pageId = url.searchParams.get('page') ?? '1';
-
-        const accesses = {
-          count: 40,
-          next: +pageId < 2 ? 'http://anything/?page=2' : undefined,
-          previous: null,
-          results: Array.from({ length: 20 }, (_, i) => ({
-            id: `2ff1ec07-86c1-4534-a643-f41824a6c53a-${pageId}-${i}`,
-            user: {
-              id: `fc092149-cafa-4ffa-a29d-e4b18af751-${pageId}-${i}`,
-              email: `impress@impress.world-page-${pageId}-${i}`,
-              full_name: `Impress World Page ${pageId}-${i}`,
-            },
-            team: '',
-            role: 'editor',
-            abilities: {
-              destroy: false,
-              partial_update: true,
-              set_role_to: [],
-            },
-          })),
-        };
-
-        if (request.method().includes('GET')) {
-          await route.fulfill({
-            json: accesses,
-          });
-        } else {
-          await route.continue();
-        }
-      },
-    );
-
     const docTitle = await goToGridDoc(page);
     await verifyDocName(page, docTitle);
 
+    // Get the current URL and extract the last part
+    const currentUrl = page.url();
+
+    const currentDocId = (() => {
+      // Remove trailing slash if present
+      const cleanUrl = currentUrl.endsWith('/')
+        ? currentUrl.slice(0, -1)
+        : currentUrl;
+
+      // Split by '/' and get the last part
+      return cleanUrl.split('/').pop() || '';
+    })();
+
+    await page.route('**/documents/**/accesses/', async (route) => {
+      const request = route.request();
+      const url = new URL(request.url());
+      const pageId = url.searchParams.get('page') ?? '1';
+
+      const accesses = Array.from({ length: 20 }, (_, i) => ({
+        id: `2ff1ec07-86c1-4534-a643-f41824a6c53a-${pageId}-${i}`,
+        document: {
+          id: currentDocId,
+          name: `Doc ${pageId}-${i}`,
+          path: `0000.${pageId}-${i}`,
+        },
+        user: {
+          id: `fc092149-cafa-4ffa-a29d-e4b18af751-${pageId}-${i}`,
+          email: `impress@impress.world-page-${pageId}-${i}`,
+          full_name: `Impress World Page ${pageId}-${i}`,
+        },
+        team: '',
+        role: 'editor',
+        max_ancestors_role: null,
+        max_role: 'editor',
+        abilities: {
+          destroy: false,
+          partial_update: true,
+          set_role_to: ['administrator', 'editor'],
+        },
+      }));
+
+      if (request.method().includes('GET')) {
+        await route.fulfill({
+          json: accesses,
+        });
+      } else {
+        await route.continue();
+      }
+    });
+
     await page.getByRole('button', { name: 'Share' }).click();
 
     const prefix = 'doc-share-member-row';
@@ -56,11 +68,6 @@ test.describe('Document list members', () => {
     const loadMore = page.getByTestId('load-more-members');
 
     await expect(elements).toHaveCount(20);
-    await expect(page.getByText(`Impress World Page 1-16`)).toBeVisible();
-
-    await loadMore.click();
-    await expect(elements).toHaveCount(40);
-    await expect(page.getByText(`Impress World Page 2-15`)).toBeVisible();
 
     await expect(loadMore).toBeHidden();
   });
@@ -177,17 +184,14 @@ test.describe('Document list members', () => {
 
     const emailMyself = `user@${browserName}.test`;
     const mySelf = list.getByTestId(`doc-share-member-row-${emailMyself}`);
-    const mySelfMoreActions = mySelf.getByRole('button', {
-      name: 'more_horiz',
+    const mySelfRole = mySelf.getByRole('button', {
+      name: 'doc-role-dropdown',
     });
 
     const userOwnerEmail = await addNewMember(page, 0, 'Owner');
     const userOwner = list.getByTestId(
       `doc-share-member-row-${userOwnerEmail}`,
     );
-    const userOwnerMoreActions = userOwner.getByRole('button', {
-      name: 'more_horiz',
-    });
 
     await page.getByRole('button', { name: 'close' }).first().click();
     await page.getByRole('button', { name: 'Share' }).first().click();
@@ -197,24 +201,21 @@ test.describe('Document list members', () => {
     const userReader = list.getByTestId(
       `doc-share-member-row-${userReaderEmail}`,
     );
-    const userReaderMoreActions = userReader.getByRole('button', {
-      name: 'more_horiz',
+    const userReaderRole = userReader.getByRole('button', {
+      name: 'doc-role-dropdown',
     });
 
+
     await expect(mySelf).toBeVisible();
     await expect(userOwner).toBeVisible();
     await expect(userReader).toBeVisible();
 
-    await expect(userOwnerMoreActions).toBeVisible();
-    await expect(userReaderMoreActions).toBeVisible();
-    await expect(mySelfMoreActions).toBeVisible();
-
-    await userReaderMoreActions.click();
-    await page.getByLabel('Delete').click();
+    await userReaderRole.click();
+    await page.getByRole('menuitem', { name: 'Remove access' }).click();
     await expect(userReader).toBeHidden();
 
-    await mySelfMoreActions.click();
-    await page.getByLabel('Delete').click();
+    await mySelfRole.click();
+    await page.getByRole('menuitem', { name: 'Remove access' }).click();
     await expect(
       page.getByText('Insufficient access rights to view the document.'),
     ).toBeVisible();

src/frontend/apps/e2e/__tests__/app-impress/doc-routing.spec.ts

@@ -60,7 +60,7 @@ test.describe('Doc Routing', () => {
   });
 
   test('checks 401 on docs/[id] page', async ({ page, browserName }) => {
-    const [docTitle] = await createDoc(page, 'My new doc', browserName, 1);
+    const [docTitle] = await createDoc(page, '401-doc', browserName, 1);
     await verifyDocName(page, docTitle);
 
     const responsePromise = page.route(

src/frontend/apps/e2e/__tests__/app-impress/doc-search.spec.ts

@@ -1,6 +1,6 @@
 import { expect, test } from '@playwright/test';
 
-import { createDoc, verifyDocName } from './common';
+import { createDoc, randomName, verifyDocName } from './common';
 
 test.beforeEach(async ({ page }) => {
   await page.goto('/');
@@ -25,7 +25,10 @@ test.describe('Document search', () => {
     );
     await verifyDocName(page, doc2Title);
     await page.goto('/');
-    await page.getByRole('button', { name: 'search' }).click();
+    await page
+      .getByTestId('left-panel-desktop')
+      .getByRole('button', { name: 'search' })
+      .click();
 
     await expect(
       page.getByRole('img', { name: 'No active search' }),
@@ -94,4 +97,85 @@ test.describe('Document search', () => {
       page.getByLabel('Search modal').getByText('search'),
     ).toBeHidden();
   });
+
+  test("it checks we don't see filters in search modal", async ({ page }) => {
+    const searchButton = page
+      .getByTestId('left-panel-desktop')
+      .getByRole('button', { name: 'search' });
+
+    await expect(searchButton).toBeVisible();
+    await page.getByRole('button', { name: 'search', exact: true }).click();
+    await expect(
+      page.getByRole('combobox', { name: 'Quick search input' }),
+    ).toBeVisible();
+    await expect(page.getByTestId('doc-search-filters')).toBeHidden();
+  });
+});
+
+test.describe('Sub page search', () => {
+  test('it check the presence of filters in search modal', async ({
+    page,
+    browserName,
+  }) => {
+    await page.goto('/');
+    const [doc1Title] = await createDoc(
+      page,
+      'My sub page search',
+      browserName,
+      1,
+    );
+    await verifyDocName(page, doc1Title);
+    const searchButton = page
+      .getByTestId('left-panel-desktop')
+      .getByRole('button', { name: 'search' });
+    await searchButton.click();
+    const filters = page.getByTestId('doc-search-filters');
+    await expect(filters).toBeVisible();
+    await filters.click();
+    await filters.getByRole('button', { name: 'Current doc' }).click();
+    await expect(
+      page.getByRole('menuitem', { name: 'All docs' }),
+    ).toBeVisible();
+    await expect(
+      page.getByRole('menuitem', { name: 'Current doc' }),
+    ).toBeVisible();
+    await page.getByRole('menuitem', { name: 'Current doc' }).click();
+
+    await expect(page.getByRole('button', { name: 'Reset' })).toBeVisible();
+  });
+
+  test('it searches sub pages', async ({ page, browserName }) => {
+    await page.goto('/');
+
+    const [doc1Title] = await createDoc(
+      page,
+      'My sub page search',
+      browserName,
+      1,
+    );
+    await verifyDocName(page, doc1Title);
+    await page.getByRole('button', { name: 'New doc' }).click();
+    await verifyDocName(page, '');
+    await page.getByRole('textbox', { name: 'doc title input' }).click();
+    await page
+      .getByRole('textbox', { name: 'doc title input' })
+      .press('ControlOrMeta+a');
+    const [randomDocName] = randomName('doc-sub-page', browserName, 1);
+    await page
+      .getByRole('textbox', { name: 'doc title input' })
+      .fill(randomDocName);
+    const searchButton = page
+      .getByTestId('left-panel-desktop')
+      .getByRole('button', { name: 'search' });
+
+    await searchButton.click();
+    await expect(
+      page.getByRole('button', { name: 'Current doc' }),
+    ).toBeVisible();
+    await page.getByRole('combobox', { name: 'Quick search input' }).click();
+    await page
+      .getByRole('combobox', { name: 'Quick search input' })
+      .fill('sub');
+    await expect(page.getByLabel(randomDocName)).toBeVisible();
+  });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-tree.spec.ts

@@ -0,0 +1,261 @@
+/* eslint-disable playwright/no-conditional-in-test */
+import { expect, test } from '@playwright/test';
+
+import {
+  createDoc,
+  expectLoginPage,
+  keyCloakSignIn,
+  randomName,
+  updateDocTitle,
+  verifyDocName,
+} from './common';
+import { clickOnAddRootSubPage, createRootSubPage } from './sub-pages-utils';
+
+test.describe('Doc Tree', () => {
+  test('create new sub pages', async ({ page, browserName }) => {
+    await page.goto('/');
+    const [titleParent] = await createDoc(
+      page,
+      'doc-tree-content',
+      browserName,
+      1,
+    );
+    await verifyDocName(page, titleParent);
+    const addButton = page.getByRole('button', { name: 'New doc' });
+    const docTree = page.getByTestId('doc-tree');
+
+    await expect(addButton).toBeVisible();
+
+    // Wait for and intercept the POST request to create a new page
+    const responsePromise = page.waitForResponse(
+      (response) =>
+        response.url().includes('/documents/') &&
+        response.url().includes('/children/') &&
+        response.request().method() === 'POST',
+    );
+
+    await clickOnAddRootSubPage(page);
+    const response = await responsePromise;
+    expect(response.ok()).toBeTruthy();
+    const subPageJson = await response.json();
+
+    await expect(docTree).toBeVisible();
+    const subPageItem = docTree
+      .getByTestId(`doc-sub-page-item-${subPageJson.id}`)
+      .first();
+
+    await expect(subPageItem).toBeVisible();
+    await subPageItem.click();
+    await verifyDocName(page, '');
+    const input = page.getByRole('textbox', { name: 'doc title input' });
+    await input.click();
+    const [randomDocName] = randomName('doc-tree-test', browserName, 1);
+    await input.fill(randomDocName);
+    await input.press('Enter');
+    await expect(subPageItem.getByText(randomDocName)).toBeVisible();
+    await page.reload();
+    await expect(subPageItem.getByText(randomDocName)).toBeVisible();
+  });
+
+  test('check the reorder of sub pages', async ({ page, browserName }) => {
+    await page.goto('/');
+    await createDoc(page, 'doc-tree-content', browserName, 1);
+    const addButton = page.getByRole('button', { name: 'New doc' });
+    await expect(addButton).toBeVisible();
+
+    const docTree = page.getByTestId('doc-tree');
+
+    // Create first sub page
+    const firstResponsePromise = page.waitForResponse(
+      (response) =>
+        response.url().includes('/documents/') &&
+        response.url().includes('/children/') &&
+        response.request().method() === 'POST',
+    );
+
+    await clickOnAddRootSubPage(page);
+    const firstResponse = await firstResponsePromise;
+    expect(firstResponse.ok()).toBeTruthy();
+    await updateDocTitle(page, 'first');
+
+    const secondResponsePromise = page.waitForResponse(
+      (response) =>
+        response.url().includes('/documents/') &&
+        response.url().includes('/children/') &&
+        response.request().method() === 'POST',
+    );
+
+    // Create second sub page
+    await clickOnAddRootSubPage(page);
+    const secondResponse = await secondResponsePromise;
+    expect(secondResponse.ok()).toBeTruthy();
+    await updateDocTitle(page, 'second');
+
+    const secondSubPageJson = await secondResponse.json();
+    const firstSubPageJson = await firstResponse.json();
+
+    const firstSubPageItem = docTree
+      .getByTestId(`doc-sub-page-item-${firstSubPageJson.id}`)
+      .first();
+
+    const secondSubPageItem = docTree
+      .getByTestId(`doc-sub-page-item-${secondSubPageJson.id}`)
+      .first();
+
+    // check that the sub pages are visible in the tree
+    await expect(firstSubPageItem).toBeVisible();
+    await expect(secondSubPageItem).toBeVisible();
+
+    // get the bounding boxes of the sub pages
+    const firstSubPageBoundingBox = await firstSubPageItem.boundingBox();
+    const secondSubPageBoundingBox = await secondSubPageItem.boundingBox();
+
+    expect(firstSubPageBoundingBox).toBeDefined();
+    expect(secondSubPageBoundingBox).toBeDefined();
+
+    if (!firstSubPageBoundingBox || !secondSubPageBoundingBox) {
+      throw new Error('Impossible de déterminer la position des éléments');
+    }
+
+    // move the first sub page to the second position
+    await page.mouse.move(
+      firstSubPageBoundingBox.x + firstSubPageBoundingBox.width / 2,
+      firstSubPageBoundingBox.y + firstSubPageBoundingBox.height / 2,
+    );
+
+    await page.mouse.down();
+
+    await page.mouse.move(
+      secondSubPageBoundingBox.x + secondSubPageBoundingBox.width / 2,
+      secondSubPageBoundingBox.y + secondSubPageBoundingBox.height + 2,
+      { steps: 20 },
+    );
+
+    await page.mouse.up();
+
+    // check that the sub pages are visible in the tree
+    await expect(firstSubPageItem).toBeVisible();
+    await expect(secondSubPageItem).toBeVisible();
+
+    // reload the page
+    await page.reload();
+
+    // check that the sub pages are visible in the tree
+    await expect(firstSubPageItem).toBeVisible();
+    await expect(secondSubPageItem).toBeVisible();
+
+    // Check the position of the sub pages
+    const allSubPageItems = await docTree
+      .getByTestId(/^doc-sub-page-item/)
+      .all();
+
+    expect(allSubPageItems.length).toBe(2);
+
+    // Check that the first element has the ID of the second sub page after the drag and drop
+    await expect(allSubPageItems[0]).toHaveAttribute(
+      'data-testid',
+      `doc-sub-page-item-${secondSubPageJson.id}`,
+    );
+
+    // Check that the second element has the ID of the first sub page after the drag and drop
+    await expect(allSubPageItems[1]).toHaveAttribute(
+      'data-testid',
+      `doc-sub-page-item-${firstSubPageJson.id}`,
+    );
+  });
+
+  test('it detaches a document', async ({ page, browserName }) => {
+    await page.goto('/');
+    const [docParent] = await createDoc(
+      page,
+      'doc-tree-detach',
+      browserName,
+      1,
+    );
+    await verifyDocName(page, docParent);
+
+    const { name: docChild } = await createRootSubPage(
+      page,
+      browserName,
+      'doc-tree-detach-child',
+    );
+
+    const docTree = page.getByTestId('doc-tree');
+    await expect(docTree.getByText(docChild)).toBeVisible();
+    await docTree.click();
+    const child = docTree
+      .getByRole('treeitem')
+      .locator('.--docs-sub-page-item')
+      .filter({
+        hasText: docChild,
+      });
+    await child.hover();
+    const menu = child.getByText(`more_horiz`);
+    await menu.click();
+    await page.getByText('Move to my docs').click();
+
+    await expect(
+      page.getByRole('textbox', { name: 'doc title input' }),
+    ).not.toHaveText(docChild);
+
+    const header = page.locator('header').first();
+    await header.locator('h2').getByText('Docs').click();
+    await expect(page.getByText(docChild)).toBeVisible();
+  });
+});
+
+test.describe('Doc Tree: Inheritance', () => {
+  test.use({ storageState: { cookies: [], origins: [] } });
+
+  test('A child inherit from the parent', async ({ page, browserName }) => {
+    await page.goto('/');
+    await keyCloakSignIn(page, browserName);
+
+    const [docParent] = await createDoc(
+      page,
+      'doc-tree-inheritance-parent',
+      browserName,
+      1,
+    );
+    await verifyDocName(page, docParent);
+
+    await page.getByRole('button', { name: 'Share' }).click();
+    const selectVisibility = page.getByLabel('Visibility', { exact: true });
+    await selectVisibility.click();
+
+    await page
+      .getByRole('menuitem', {
+        name: 'Public',
+      })
+      .click();
+
+    await expect(
+      page.getByText('The document visibility has been updated.'),
+    ).toBeVisible();
+
+    await page.getByRole('button', { name: 'close' }).click();
+
+    const { name: docChild } = await createRootSubPage(
+      page,
+      browserName,
+      'doc-tree-inheritance-child',
+    );
+
+    const urlDoc = page.url();
+
+    await page
+      .getByRole('button', {
+        name: 'Logout',
+      })
+      .click();
+
+    await expectLoginPage(page);
+
+    await page.goto(urlDoc);
+
+    await expect(page.locator('h2').getByText(docChild)).toBeVisible();
+
+    const docTree = page.getByTestId('doc-tree');
+    await expect(docTree.getByText(docParent)).toBeVisible();
+  });
+});

src/frontend/apps/e2e/__tests__/app-impress/doc-visibility.spec.ts

@@ -262,7 +262,8 @@ test.describe('Doc Visibility: Public', () => {
 
     await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
     await expect(page.getByRole('button', { name: 'search' })).toBeHidden();
-    await expect(page.getByRole('button', { name: 'New doc' })).toBeHidden();
+    await expect(page.getByRole('button', { name: 'New padoce' })).toBeHidden();
+    await expect(page.getByRole('button', { name: 'Share' })).toBeVisible();
     const card = page.getByLabel('It is the card information');
     await expect(card).toBeVisible();
     await expect(card.getByText('Reader')).toBeVisible();

src/frontend/apps/e2e/__tests__/app-impress/share-utils.ts

@@ -0,0 +1,158 @@
+import { Locator, Page, expect } from '@playwright/test';
+
+export type UserSearchResult = {
+  email: string;
+  full_name?: string | null;
+};
+
+export type Role = 'Administrator' | 'Owner' | 'Member' | 'Editor' | 'Reader';
+export type LinkReach = 'Private' | 'Connected' | 'Public';
+export type LinkRole = 'Reading' | 'Edition';
+
+export const searchUserToInviteToDoc = async (
+  page: Page,
+  inputFill?: string,
+): Promise<UserSearchResult[]> => {
+  const inputFillValue = inputFill ?? 'user ';
+
+  const responsePromise = page.waitForResponse(
+    (response) =>
+      response
+        .url()
+        .includes(`/users/?q=${encodeURIComponent(inputFillValue)}`) &&
+      response.status() === 200,
+  );
+
+  await page.getByRole('button', { name: 'Share' }).click();
+  const inputSearch = page.getByRole('combobox', {
+    name: 'Quick search input',
+  });
+  await expect(inputSearch).toBeVisible();
+  await inputSearch.fill(inputFillValue);
+  const response = await responsePromise;
+  const users = (await response.json()) as UserSearchResult[];
+  return users;
+};
+
+export const addMemberToDoc = async (
+  page: Page,
+  role: Role,
+  users: UserSearchResult[],
+) => {
+  const list = page.getByTestId('doc-share-add-member-list');
+  await expect(list).toBeHidden();
+  const quickSearchContent = page.getByTestId('doc-share-quick-search');
+  for (const user of users) {
+    await quickSearchContent
+      .getByTestId(`search-user-row-${user.email}`)
+      .click();
+  }
+
+  await list.getByLabel('doc-role-dropdown').click();
+  await expect(page.getByLabel(role)).toBeVisible();
+  await page.getByLabel(role).click();
+  await page.getByRole('button', { name: 'Invite' }).click();
+};
+
+export const verifyMemberAddedToDoc = async (
+  page: Page,
+  user: UserSearchResult,
+  role: Role,
+): Promise<Locator> => {
+  const container = page.getByLabel('List members card');
+  await expect(container).toBeVisible();
+  const userRow = container.getByTestId(`doc-share-member-row-${user.email}`);
+  await expect(userRow).toBeVisible();
+  await expect(userRow.getByText(role)).toBeVisible();
+  await expect(userRow.getByText(user.full_name || user.email)).toBeVisible();
+  return userRow;
+};
+
+export const updateShareLink = async (
+  page: Page,
+  linkReach: LinkReach,
+  linkRole?: LinkRole | null,
+) => {
+  await page.getByRole('button', { name: 'Visibility', exact: true }).click();
+  await page.getByRole('menuitem', { name: linkReach }).click();
+
+  const visibilityUpdatedText = page
+    .getByText('The document visibility has been updated')
+    .first();
+
+  await expect(visibilityUpdatedText).toBeVisible();
+
+  if (linkRole) {
+    await page
+      .getByRole('button', { name: 'Visibility mode', exact: true })
+      .click();
+    await page.getByRole('menuitem', { name: linkRole }).click();
+    await expect(visibilityUpdatedText).toBeVisible();
+  }
+};
+
+export const verifyLinkReachIsDisabled = async (
+  page: Page,
+  linkReach: LinkReach,
+) => {
+  await page.getByRole('button', { name: 'Visibility', exact: true }).click();
+  const item = page.getByRole('menuitem', { name: linkReach });
+  await expect(item).toBeDisabled();
+  await page.click('body');
+};
+
+export const verifyLinkReachIsEnabled = async (
+  page: Page,
+  linkReach: LinkReach,
+) => {
+  await page.getByRole('button', { name: 'Visibility', exact: true }).click();
+  const item = page.getByRole('menuitem', { name: linkReach });
+  await expect(item).toBeEnabled();
+  await page.click('body');
+};
+
+export const verifyLinkRoleIsDisabled = async (
+  page: Page,
+  linkRole: LinkRole,
+) => {
+  await page
+    .getByRole('button', { name: 'Visibility mode', exact: true })
+    .click();
+  const item = page.getByRole('menuitem', { name: linkRole });
+  await expect(item).toBeDisabled();
+  await page.click('body');
+};
+
+export const verifyLinkRoleIsEnabled = async (
+  page: Page,
+  linkRole: LinkRole,
+) => {
+  await page
+    .getByRole('button', { name: 'Visibility mode', exact: true })
+    .click();
+  const item = page.getByRole('menuitem', { name: linkRole });
+  await expect(item).toBeEnabled();
+  await page.click('body');
+};
+
+export const verifyShareLink = async (
+  page: Page,
+  linkReach: LinkReach,
+  linkRole?: LinkRole | null,
+) => {
+  const visibilityDropdownButton = page.getByRole('button', {
+    name: 'Visibility',
+    exact: true,
+  });
+  await expect(visibilityDropdownButton).toBeVisible();
+  await expect(visibilityDropdownButton.getByText(linkReach)).toBeVisible();
+
+  if (linkRole) {
+    const visibilityModeButton = page.getByRole('button', {
+      name: 'Visibility mode',
+      exact: true,
+    });
+    await expect(visibilityModeButton).toBeVisible();
+    await expect(page.getByText(linkRole)).toBeVisible();
+  }
+};

src/frontend/apps/e2e/__tests__/app-impress/sub-pages-utils.ts

@@ -0,0 +1,82 @@
+import { Page, expect } from '@playwright/test';
+
+import { getWaitForCreateDoc, randomName, updateDocTitle } from './common';
+
+export const createRootSubPage = async (
+  page: Page,
+  browserName: string,
+  docName: string,
+) => {
+  // Get add button
+
+  // Get response
+  const responsePromise = getWaitForCreateDoc(page);
+  await clickOnAddRootSubPage(page);
+  const response = await responsePromise;
+  expect(response.ok()).toBeTruthy();
+  const subPageJson = (await response.json()) as { id: string };
+
+  // Get doc tree
+  const docTree = page.getByTestId('doc-tree');
+  await expect(docTree).toBeVisible();
+
+  // Get sub page item
+  const subPageItem = docTree
+    .getByTestId(`doc-sub-page-item-${subPageJson.id}`)
+    .first();
+  await expect(subPageItem).toBeVisible();
+  await subPageItem.click();
+
+  // Update sub page name
+  const randomDocs = randomName(docName, browserName, 1);
+  await updateDocTitle(page, randomDocs[0]);
+
+  // Return sub page data
+  return { name: randomDocs[0], docTreeItem: subPageItem, item: subPageJson };
+};
+
+export const clickOnAddRootSubPage = async (page: Page) => {
+  const rootItem = page.getByTestId('doc-tree-root-item');
+  await expect(rootItem).toBeVisible();
+  await rootItem.hover();
+  await rootItem.getByRole('button', { name: 'add_box' }).click();
+};
+
+export const createSubPageFromParent = async (
+  page: Page,
+  browserName: string,
+  parentId: string,
+  subPageName: string,
+) => {
+  // Get parent doc tree item
+  const parentDocTreeItem = page.getByTestId(`doc-sub-page-item-${parentId}`);
+  await expect(parentDocTreeItem).toBeVisible();
+  await parentDocTreeItem.hover();
+
+  // Create sub page
+  const responsePromise = getWaitForCreateDoc(page);
+  await parentDocTreeItem.getByRole('button', { name: 'add_box' }).click();
+
+  // Get response
+  const response = await responsePromise;
+  expect(response.ok()).toBeTruthy();
+  const subPageJson = (await response.json()) as { id: string };
+
+  // Get doc tree
+  const docTree = page.getByTestId('doc-tree');
+  await expect(docTree).toBeVisible();
+
+  // Get sub page item
+  const subPageItem = docTree
+    .getByTestId(`doc-sub-page-item-${subPageJson.id}`)
+    .first();
+  await expect(subPageItem).toBeVisible();
+  await subPageItem.click();
+
+  // Update sub page name
+  const subPageTitle = randomName(subPageName, browserName, 1)[0];
+  await updateDocTitle(page, subPageTitle);
+
+  // Return sub page data
+  return { name: subPageTitle, docTreeItem: subPageItem, item: subPageJson };
+};

src/frontend/apps/impress/package.json

@@ -22,6 +22,8 @@
     "@blocknote/react": "0.32.0",
     "@blocknote/xl-docx-exporter": "0.32.0",
     "@blocknote/xl-pdf-exporter": "0.32.0",
+    "@dnd-kit/core": "6.3.1",
+    "@dnd-kit/modifiers": "9.0.0",
     "@emoji-mart/data": "1.2.1",
     "@emoji-mart/react": "1.1.1",
     "@fontsource/material-icons": "5.2.5",

src/frontend/apps/impress/src/api/helpers.tsx

@@ -21,6 +21,11 @@ export type DefinedInitialDataInfiniteOptionsAPI<
   TPageParam
 >;
 
+export type InfiniteQueryConfig<Q> = Omit<
+  DefinedInitialDataInfiniteOptionsAPI<Q>,
+  'queryKey' | 'initialData' | 'getNextPageParam' | 'initialPageParam'
+>;
+
 /**
  * Custom React hook that wraps React Query's `useInfiniteQuery` for paginated API requests.
  *
@@ -38,7 +43,7 @@ export const useAPIInfiniteQuery = <T, Q extends { next?: APIList<Q>['next'] }>(
   key: string,
   api: (props: T & { page: number }) => Promise<Q>,
   param: T,
-  queryConfig?: DefinedInitialDataInfiniteOptionsAPI<Q>,
+  queryConfig?: InfiniteQueryConfig<Q>,
 ) => {
   return useInfiniteQuery<Q, APIError, InfiniteData<Q>, QueryKey, number>({
     initialPageParam: 1,

src/frontend/apps/impress/src/components/AlertModal/AlertModal.tsx

@@ -0,0 +1,67 @@
+import { Button, Modal, ModalSize } from '@openfun/cunningham-react';
+import { useTranslation } from 'react-i18next';
+
+import { Box } from '../Box';
+import { Text } from '../Text';
+
+export type AlertModalProps = {
+  isOpen: boolean;
+  onClose: () => void;
+  title: string;
+  description: string | React.ReactNode;
+  onConfirm: () => void;
+  confirmLabel?: string;
+  cancelLabel?: string;
+};
+
+export const AlertModal = ({
+  isOpen,
+  onClose,
+  title,
+  description,
+  onConfirm,
+  confirmLabel,
+  cancelLabel,
+}: AlertModalProps) => {
+  const { t } = useTranslation();
+  return (
+    <Modal
+      isOpen={isOpen}
+      size={ModalSize.MEDIUM}
+      onClose={onClose}
+      title={
+        <Text $size="h6" $align="flex-start" $variation="1000">
+          {title}
+        </Text>
+      }
+      rightActions={
+        <>
+          <Button
+            aria-label={t('Close the modal')}
+            color="secondary"
+            fullWidth
+            onClick={() => onClose()}
+          >
+            {cancelLabel ?? t('Cancel')}
+          </Button>
+          <Button
+            aria-label={confirmLabel ?? t('Confirm')}
+            color="danger"
+            onClick={onConfirm}
+          >
+            {confirmLabel ?? t('Confirm')}
+          </Button>
+        </>
+      }
+    >
+      <Box
+        aria-label={t('Confirmation button')}
+        className="--docs--alert-modal"
+      >
+        <Box>
+          <Text $variation="600">{description}</Text>
+        </Box>
+      </Box>
+    </Modal>
+  );
+};

src/frontend/apps/impress/src/components/DropdownMenu.tsx

@@ -1,4 +1,5 @@
-import { PropsWithChildren, useRef, useState } from 'react';
+import { HorizontalSeparator } from '@gouvfr-lasuite/ui-kit';
+import { Fragment, PropsWithChildren, useRef, useState } from 'react';
 import { css } from 'styled-components';
 
 import { Box, BoxButton, BoxProps, DropButton, Icon, Text } from '@/components';
@@ -8,11 +9,13 @@ export type DropdownMenuOption = {
   icon?: string;
   label: string;
   testId?: string;
+  value?: string;
   callback?: () => void | Promise<unknown>;
   danger?: boolean;
   isSelected?: boolean;
   disabled?: boolean;
   show?: boolean;
+  showSeparator?: boolean;
 };
 
 export type DropdownMenuProps = {
@@ -23,6 +26,8 @@ export type DropdownMenuProps = {
   buttonCss?: BoxProps['$css'];
   disabled?: boolean;
   topMessage?: string;
+  selectedValues?: string[];
+  afterOpenChange?: (isOpen: boolean) => void;
 };
 
 export const DropdownMenu = ({
@@ -34,6 +39,8 @@ export const DropdownMenu = ({
   buttonCss,
   label,
   topMessage,
+  afterOpenChange,
+  selectedValues,
 }: PropsWithChildren<DropdownMenuProps>) => {
   const { spacingsTokens, colorsTokens } = useCunninghamTheme();
   const [isOpen, setIsOpen] = useState(false);
@@ -41,6 +48,7 @@ export const DropdownMenu = ({
 
   const onOpenChange = (isOpen: boolean) => {
     setIsOpen(isOpen);
+    afterOpenChange?.(isOpen);
   };
 
   if (disabled) {
@@ -93,6 +101,9 @@ export const DropdownMenu = ({
             $size="xs"
             $weight="bold"
             $padding={{ vertical: 'xs', horizontal: 'base' }}
+            $css={css`
+              white-space: pre-line;
+            `}
           >
             {topMessage}
           </Text>
@@ -103,70 +114,76 @@ export const DropdownMenu = ({
           }
           const isDisabled = option.disabled !== undefined && option.disabled;
           return (
-            <BoxButton
-              role="menuitem"
-              aria-label={option.label}
-              data-testid={option.testId}
-              $direction="row"
-              disabled={isDisabled}
-              onClick={(event) => {
-                event.preventDefault();
-                event.stopPropagation();
-                onOpenChange?.(false);
-                void option.callback?.();
-              }}
-              key={option.label}
-              $align="center"
-              $justify="space-between"
-              $background={colorsTokens['greyscale-000']}
-              $color={colorsTokens['primary-600']}
-              $padding={{ vertical: 'xs', horizontal: 'base' }}
-              $width="100%"
-              $gap={spacingsTokens['base']}
-              $css={css`
-                border: none;
-                ${index === 0 &&
-                css`
-                  border-top-left-radius: 4px;
-                  border-top-right-radius: 4px;
-                `}
-                ${index === options.length - 1 &&
-                css`
-                  border-bottom-left-radius: 4px;
-                  border-bottom-right-radius: 4px;
-                `}
-                font-size: var(--c--theme--font--sizes--sm);
-                color: var(--c--theme--colors--greyscale-1000);
-                font-weight: 500;
-                cursor: ${isDisabled ? 'not-allowed' : 'pointer'};
-                user-select: none;
-
-                &:hover {
-                  background-color: var(--c--theme--colors--greyscale-050);
-                }
-              `}
-            >
-              <Box
+            <Fragment key={option.label}>
+              <BoxButton
+                role="menuitem"
+                aria-label={option.label}
+                data-testid={option.testId}
                 $direction="row"
+                disabled={isDisabled}
+                onClick={(event) => {
+                  event.preventDefault();
+                  event.stopPropagation();
+                  onOpenChange?.(false);
+                  void option.callback?.();
+                }}
+                key={option.label}
                 $align="center"
+                $justify="space-between"
+                $background={colorsTokens['greyscale-000']}
+                $color={colorsTokens['primary-600']}
+                $padding={{ vertical: 'xs', horizontal: 'base' }}
+                $width="100%"
                 $gap={spacingsTokens['base']}
+                $css={css`
+                  border: none;
+                  ${index === 0 &&
+                  css`
+                    border-top-left-radius: 4px;
+                    border-top-right-radius: 4px;
+                  `}
+                  ${index === options.length - 1 &&
+                  css`
+                    border-bottom-left-radius: 4px;
+                    border-bottom-right-radius: 4px;
+                  `}
+                font-size: var(--c--theme--font--sizes--sm);
+                  color: var(--c--theme--colors--greyscale-1000);
+                  font-weight: 500;
+                  cursor: ${isDisabled ? 'not-allowed' : 'pointer'};
+                  user-select: none;
+
+                  &:hover {
+                    background-color: var(--c--theme--colors--greyscale-050);
+                  }
+                `}
               >
-                {option.icon && (
-                  <Icon
-                    $size="20px"
-                    $theme="greyscale"
-                    $variation={isDisabled ? '400' : '1000'}
-                    iconName={option.icon}
-                  />
+                <Box
+                  $direction="row"
+                  $align="center"
+                  $gap={spacingsTokens['base']}
+                >
+                  {option.icon && (
+                    <Icon
+                      $size="20px"
+                      $theme="greyscale"
+                      $variation={isDisabled ? '400' : '1000'}
+                      iconName={option.icon}
+                    />
+                  )}
+                  <Text $variation={isDisabled ? '400' : '1000'}>
+                    {option.label}
+                  </Text>
+                </Box>
+                {(option.isSelected ||
+                  selectedValues?.includes(option.value ?? '')) && (
+                  <Icon iconName="check" $size="20px" $theme="greyscale" />
                 )}
-                <Text $variation={isDisabled ? '400' : '1000'}>
-                  {option.label}
-                </Text>
-              </Box>
-              {option.isSelected && (
-                <Icon iconName="check" $size="20px" $theme="greyscale" />
+              </BoxButton>
+              {option.showSeparator && (
+                <HorizontalSeparator withPadding={false} />
               )}
-            </BoxButton>
+            </Fragment>
           );
         })}
       </Box>

src/frontend/apps/impress/src/components/filter/FilterDropdown.tsx

@@ -0,0 +1,63 @@
+import { css } from 'styled-components';
+
+import { Box } from '../Box';
+import { DropdownMenu, DropdownMenuOption } from '../DropdownMenu';
+import { Icon } from '../Icon';
+import { Text } from '../Text';
+
+export type FilterDropdownProps = {
+  options: DropdownMenuOption[];
+  selectedValue?: string;
+};
+
+export const FilterDropdown = ({
+  options,
+  selectedValue,
+}: FilterDropdownProps) => {
+  const selectedOption = options.find(
+    (option) => option.value === selectedValue,
+  );
+
+  if (options.length === 0) {
+    return null;
+  }
+
+  return (
+    <DropdownMenu
+      selectedValues={selectedValue ? [selectedValue] : undefined}
+      options={options}
+    >
+      <Box
+        $css={css`
+          border: 1px solid
+            ${selectedOption
+              ? 'var(--c--theme--colors--primary-500)'
+              : 'var(--c--theme--colors--greyscale-250)'};
+          border-radius: 4px;
+          background-color: ${selectedOption
+            ? 'var(--c--theme--colors--primary-100)'
+            : 'var(--c--theme--colors--greyscale-000)'};
+          gap: var(--c--theme--spacings--2xs);
+          padding: var(--c--theme--spacings--2xs) var(--c--theme--spacings--xs);
+        `}
+        color="secondary"
+        $direction="row"
+        $align="center"
+      >
+        <Text
+          $weight={400}
+          $variation={selectedOption ? '800' : '600'}
+          $theme={selectedOption ? 'primary' : 'greyscale'}
+        >
+          {selectedOption?.label ?? options[0].label}
+        </Text>
+        <Icon
+          $size="16px"
+          iconName="keyboard_arrow_down"
+          $variation={selectedOption ? '800' : '600'}
+          $theme={selectedOption ? 'primary' : 'greyscale'}
+        />
+      </Box>
+    </DropdownMenu>
+  );
+};

src/frontend/apps/impress/src/components/quick-search/QuickSearchGroup.tsx

@@ -18,7 +18,7 @@ export const QuickSearchGroup = <T,>({
   renderElement,
 }: Props<T>) => {
   return (
-    <Box $margin={{ top: 'base' }}>
+    <Box $margin={{ top: 'sm' }}>
       <Command.Group
         key={group.groupName}
         heading={group.groupName}

src/frontend/apps/impress/src/components/quick-search/QuickSearchInput.tsx

@@ -44,7 +44,7 @@ export const QuickSearchInput = ({
         $align="center"
         className="quick-search-input"
         $gap={spacingsTokens['2xs']}
-        $padding={{ all: 'base' }}
+        $padding={{ horizontal: 'base', vertical: 'sm' }}
       >
         {!loading && <Icon iconName="search" $variation="600" />}
         {loading && (
@@ -56,6 +56,9 @@ export const QuickSearchInput = ({
           /* eslint-disable-next-line jsx-a11y/no-autofocus */
           autoFocus={true}
           aria-label={t('Quick search input')}
+          onClick={(e) => {
+            e.stopPropagation();
+          }}
           value={inputValue}
           role="combobox"
           placeholder={placeholder ?? t('Search')}

src/frontend/apps/impress/src/components/quick-search/QuickSearchItemContent.tsx

@@ -24,7 +24,7 @@ export const QuickSearchItemContent = ({
     <Box
       $direction="row"
       $align="center"
-      $padding={{ horizontal: '2xs', vertical: '3xs' }}
+      $padding={{ horizontal: '2xs', vertical: '4xs' }}
       $justify="space-between"
       $width="100%"
     >

src/frontend/apps/impress/src/components/quick-search/QuickSearchStyle.tsx

@@ -65,9 +65,7 @@ export const QuickSearchStyle = createGlobalStyle`
 
   [cmdk-list] {
   
-    padding: 0 var(--c--theme--spacings--base) var(--c--theme--spacings--base)
-      var(--c--theme--spacings--base);
-  
+
     flex:1;
     overflow-y: auto;
     overscroll-behavior: contain;

src/frontend/apps/impress/src/components/separators/HorizontalSeparator.tsx

@@ -1,4 +1,5 @@
 import { useCunninghamTheme } from '@/cunningham';
+import { Spacings } from '@/utils';
 
 import { Box } from '../Box';
 
@@ -10,19 +11,25 @@ export enum SeparatorVariant {
 type Props = {
   variant?: SeparatorVariant;
   $withPadding?: boolean;
+  customPadding?: Spacings;
 };
 
 export const HorizontalSeparator = ({
   variant = SeparatorVariant.LIGHT,
   $withPadding = true,
+  customPadding,
 }: Props) => {
   const { colorsTokens } = useCunninghamTheme();
 
+  const padding = $withPadding
+    ? (customPadding ?? 'base')
+    : ('none' as Spacings);
+
   return (
     <Box
       $height="1px"
       $width="100%"
-      $margin={{ vertical: $withPadding ? 'base' : 'none' }}
+      $margin={{ vertical: padding }}
       $background={
         variant === SeparatorVariant.DARK
           ? '#e5e5e533'

src/frontend/apps/impress/src/features/docs/doc-editor/components/DocEditor.tsx

@@ -54,11 +54,7 @@ export const DocEditor = ({ doc, versionId }: DocEditorProps) => {
           $padding={{ horizontal: isDesktop ? '54px' : 'base' }}
           className="--docs--doc-editor-header"
         >
-          {isVersion ? (
-            <DocVersionHeader title={doc.title} />
-          ) : (
-            <DocHeader doc={doc} />
-          )}
+          {isVersion ? <DocVersionHeader /> : <DocHeader doc={doc} />}
         </Box>
 
         <Box

src/frontend/apps/impress/src/features/docs/doc-export/components/ModalExport.tsx

@@ -46,8 +46,7 @@ export const ModalExport = ({ onClose, doc }: ModalExportProps) => {
   const [format, setFormat] = useState<DocDownloadFormat>(
     DocDownloadFormat.PDF,
   );
-  const { untitledDocument } = useTrans();
-
+  const { untitledDocument } = useTrans(doc);
   const templateOptions = useMemo(() => {
     const templateOptions = (templates?.pages || [])
       .map((page) =>

src/frontend/apps/impress/src/features/docs/doc-header/components/DocHeader.tsx

@@ -8,6 +8,7 @@ import {
   LinkReach,
   Role,
   currentDocRole,
+  getDocLinkReach,
   useIsCollaborativeEditable,
   useTrans,
 } from '@/docs/doc-management';
@@ -28,8 +29,8 @@ export const DocHeader = ({ doc }: DocHeaderProps) => {
   const { t } = useTranslation();
   const { transRole } = useTrans();
   const { isEditable } = useIsCollaborativeEditable(doc);
-  const docIsPublic = doc.link_reach === LinkReach.PUBLIC;
-  const docIsAuth = doc.link_reach === LinkReach.AUTHENTICATED;
+  const docIsPublic = getDocLinkReach(doc) === LinkReach.PUBLIC;
+  const docIsAuth = getDocLinkReach(doc) === LinkReach.AUTHENTICATED;
 
   return (
     <>

src/frontend/apps/impress/src/features/docs/doc-header/components/DocTitle.tsx

@@ -1,10 +1,7 @@
 /* eslint-disable jsx-a11y/click-events-have-key-events */
 /* eslint-disable jsx-a11y/no-noninteractive-element-interactions */
-import {
-  Tooltip,
-  VariantType,
-  useToastProvider,
-} from '@openfun/cunningham-react';
+import { Tooltip } from '@openfun/cunningham-react';
+import { useQueryClient } from '@tanstack/react-query';
 import React, { useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
@@ -15,6 +12,8 @@ import {
   Doc,
   KEY_DOC,
   KEY_LIST_DOC,
+  KEY_SUB_PAGE,
+  useDocStore,
   useTrans,
   useUpdateDoc,
 } from '@/docs/doc-management';
@@ -26,19 +25,16 @@ interface DocTitleProps {
 
 export const DocTitle = ({ doc }: DocTitleProps) => {
   if (!doc.abilities.partial_update) {
-    return <DocTitleText title={doc.title} />;
+    return <DocTitleText />;
   }
 
   return <DocTitleInput doc={doc} />;
 };
 
-interface DocTitleTextProps {
-  title?: string;
-}
-
-export const DocTitleText = ({ title }: DocTitleTextProps) => {
+export const DocTitleText = () => {
   const { isMobile } = useResponsiveStore();
-  const { untitledDocument } = useTrans();
+  const { currentDoc } = useDocStore();
+  const { untitledDocument } = useTrans(currentDoc);
 
   return (
     <Text
@@ -47,28 +43,31 @@ export const DocTitleText = ({ title }: DocTitleTextProps) => {
       $size={isMobile ? 'h4' : 'h2'}
       $variation="1000"
     >
-      {title || untitledDocument}
+      {currentDoc?.title || untitledDocument}
     </Text>
   );
 };
 
 const DocTitleInput = ({ doc }: DocTitleProps) => {
   const { isDesktop } = useResponsiveStore();
+  const queryClient = useQueryClient();
   const { t } = useTranslation();
   const { colorsTokens } = useCunninghamTheme();
   const [titleDisplay, setTitleDisplay] = useState(doc.title);
-  const { toast } = useToastProvider();
-  const { untitledDocument } = useTrans();
+
+  const { untitledDocument } = useTrans(doc);
 
   const { broadcast } = useBroadcastStore();
 
   const { mutate: updateDoc } = useUpdateDoc({
     listInvalideQueries: [KEY_DOC, KEY_LIST_DOC],
-    onSuccess(data) {
-      toast(t('Document title updated successfully'), VariantType.SUCCESS);
-
+    onSuccess(updatedDoc) {
       // Broadcast to every user connected to the document
-      broadcast(`${KEY_DOC}-${data.id}`);
+      broadcast(`${KEY_DOC}-${updatedDoc.id}`);
+      queryClient.setQueryData(
+        [KEY_SUB_PAGE, { id: updatedDoc.id }],
+        updatedDoc,
+      );
     },
   });
 

src/frontend/apps/impress/src/features/docs/doc-header/components/DocToolBox.tsx

@@ -1,7 +1,8 @@
+import { useTreeContext } from '@gouvfr-lasuite/ui-kit';
 import { Button, useModal } from '@openfun/cunningham-react';
 import { useQueryClient } from '@tanstack/react-query';
 import dynamic from 'next/dynamic';
-import { useEffect } from 'react';
+import { useEffect, useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 
@@ -23,7 +24,20 @@ const DocToolBoxLicence = dynamic(() =>
 
 export const DocToolBox = ({ doc }: DocToolBoxProps) => {
   const { t } = useTranslation();
-  const hasAccesses = doc.nb_accesses_direct > 1 && doc.abilities.accesses_view;
+  const treeContext = useTreeContext<Doc>();
+
+  /**
+   * Following the change where there is no default owner when adding a sub-page,
+   * we need to handle both the case where the doc is the root and the case of sub-pages.
+   */
+  const hasAccesses = useMemo(() => {
+    if (treeContext?.root?.id === doc.id) {
+      return doc.nb_accesses_direct > 1 && doc.abilities.accesses_view;
+    }
+
+    return doc.nb_accesses_direct >= 1 && doc.abilities.accesses_view;
+  }, [doc, treeContext?.root]);
+
   const queryClient = useQueryClient();
 
   const { spacingsTokens } = useCunninghamTheme();
@@ -103,6 +117,7 @@ export const DocToolBox = ({ doc }: DocToolBoxProps) => {
           doc={doc}
           modalHistory={modalHistory}
           modalShare={modalShare}
+          isRootDoc={treeContext?.root?.id === doc.id}
         />
       </Box>
     </Box>

src/frontend/apps/impress/src/features/docs/doc-header/components/DocToolBoxLicenceAGPL.tsx

@@ -37,12 +37,14 @@ interface DocToolBoxLicenceProps {
   doc: Doc;
   modalHistory: ModalType;
   modalShare: ModalType;
+  isRootDoc?: boolean;
 }
 
 export const DocToolBoxLicenceAGPL = ({
   doc,
   modalHistory,
   modalShare,
+  isRootDoc = true,
 }: DocToolBoxLicenceProps) => {
   const { t } = useTranslation();
   const queryClient = useQueryClient();
@@ -176,7 +178,11 @@ export const DocToolBoxLicenceAGPL = ({
       </DropdownMenu>
 
       {modalShare.isOpen && (
-        <DocShareModal onClose={() => modalShare.close()} doc={doc} />
+        <DocShareModal
+          onClose={() => modalShare.close()}
+          doc={doc}
+          isRootDoc={isRootDoc}
+        />
       )}
       {isModalExportOpen && (
         <ModalExport onClose={() => setIsModalExportOpen(false)} doc={doc} />

src/frontend/apps/impress/src/features/docs/doc-header/components/DocToolBoxLicenceMIT.tsx

@@ -31,12 +31,14 @@ interface DocToolBoxLicenceProps {
   doc: Doc;
   modalHistory: ModalType;
   modalShare: ModalType;
+  isRootDoc?: boolean;
 }
 
 export const DocToolBoxLicenceMIT = ({
   doc,
   modalHistory,
   modalShare,
+  isRootDoc = true,
 }: DocToolBoxLicenceProps) => {
   const { t } = useTranslation();
   const queryClient = useQueryClient();
@@ -152,7 +154,11 @@ export const DocToolBoxLicenceMIT = ({
       </DropdownMenu>
 
       {modalShare.isOpen && (
-        <DocShareModal onClose={() => modalShare.close()} doc={doc} />
+        <DocShareModal
+          onClose={() => modalShare.close()}
+          doc={doc}
+          isRootDoc={isRootDoc}
+        />
       )}
       {isModalRemoveOpen && (
         <ModalRemoveDoc onClose={() => setIsModalRemoveOpen(false)} doc={doc} />

src/frontend/apps/impress/src/features/docs/doc-header/components/DocVersionHeader.tsx

@@ -5,11 +5,7 @@ import { useCunninghamTheme } from '@/cunningham';
 
 import { DocTitleText } from './DocTitle';
 
-interface DocVersionHeaderProps {
-  title?: string;
-}
-
-export const DocVersionHeader = ({ title }: DocVersionHeaderProps) => {
+export const DocVersionHeader = () => {
   const { spacingsTokens } = useCunninghamTheme();
 
   const { t } = useTranslation();
@@ -23,7 +19,7 @@ export const DocVersionHeader = ({ title }: DocVersionHeaderProps) => {
         aria-label={t('It is the document title')}
         className="--docs--doc-version-header"
       >
-        <DocTitleText title={title} />
+        <DocTitleText />
         <HorizontalSeparator />
       </Box>
     </>

src/frontend/apps/impress/src/features/docs/doc-management/api/index.ts

@@ -1,8 +1,9 @@
 export * from './useCreateDoc';
+export * from './useCreateFavoriteDoc';
 export * from './useDeleteFavoriteDoc';
 export * from './useDoc';
 export * from './useDocOptions';
 export * from './useDocs';
-export * from './useCreateFavoriteDoc';
+export * from './useSubDocs';
 export * from './useUpdateDoc';
 export * from './useUpdateDocLink';

src/frontend/apps/impress/src/features/docs/doc-management/api/useDoc.tsx

@@ -19,6 +19,7 @@ export const getDoc = async ({ id }: DocParams): Promise<Doc> => {
 };
 
 export const KEY_DOC = 'doc';
+export const KEY_SUB_PAGE = 'sub-page';
 export const KEY_DOC_VISIBILITY = 'doc-visibility';
 
 export function useDoc(
@@ -26,7 +27,7 @@ export function useDoc(
   queryConfig?: UseQueryOptions<Doc, APIError, Doc>,
 ) {
   return useQuery<Doc, APIError, Doc>({
-    queryKey: [KEY_DOC, param],
+    queryKey: queryConfig?.queryKey ?? [KEY_DOC, param],
     queryFn: () => getDoc(param),
     ...queryConfig,
   });

src/frontend/apps/impress/src/features/docs/doc-management/api/useDocs.tsx

@@ -8,22 +8,7 @@ import {
   useAPIInfiniteQuery,
 } from '@/api';
 
-import { Doc } from '../types';
-
-export const isDocsOrdering = (data: string): data is DocsOrdering => {
-  return !!docsOrdering.find((validKey) => validKey === data);
-};
-
-const docsOrdering = [
-  'created_at',
-  '-created_at',
-  'updated_at',
-  '-updated_at',
-  'title',
-  '-title',
-] as const;
-
-export type DocsOrdering = (typeof docsOrdering)[number];
+import { Doc, DocsOrdering } from '../types';
 
 export type DocsParams = {
   page: number;
@@ -33,20 +18,18 @@ export type DocsParams = {
   is_favorite?: boolean;
 };
 
-export type DocsResponse = APIList<Doc>;
-export const getDocs = async (params: DocsParams): Promise<DocsResponse> => {
+export const constructParams = (params: DocsParams): URLSearchParams => {
   const searchParams = new URLSearchParams();
+
   if (params.page) {
     searchParams.set('page', params.page.toString());
   }
-
   if (params.ordering) {
     searchParams.set('ordering', params.ordering);
   }
   if (params.is_creator_me !== undefined) {
     searchParams.set('is_creator_me', params.is_creator_me.toString());
   }
-
   if (params.title && params.title.length > 0) {
     searchParams.set('title', params.title);
   }
@@ -54,6 +37,12 @@ export const getDocs = async (params: DocsParams): Promise<DocsResponse> => {
     searchParams.set('is_favorite', params.is_favorite.toString());
   }
 
+  return searchParams;
+};
+
+export type DocsResponse = APIList<Doc>;
+export const getDocs = async (params: DocsParams): Promise<DocsResponse> => {
+  const searchParams = constructParams(params);
   const response = await fetchAPI(`documents/?${searchParams.toString()}`);
 
   if (!response.ok) {

src/frontend/apps/impress/src/features/docs/doc-management/api/useSubDocs.tsx

@@ -0,0 +1,62 @@
+import { UseQueryOptions, useQuery } from '@tanstack/react-query';
+
+import {
+  APIError,
+  InfiniteQueryConfig,
+  errorCauses,
+  fetchAPI,
+  useAPIInfiniteQuery,
+} from '@/api';
+
+import { DocsOrdering } from '../types';
+
+import { DocsResponse, constructParams } from './useDocs';
+
+export type SubDocsParams = {
+  page: number;
+  ordering?: DocsOrdering;
+  is_creator_me?: boolean;
+  title?: string;
+  is_favorite?: boolean;
+  parent_id: string;
+};
+
+export const getSubDocs = async (
+  params: SubDocsParams,
+): Promise<DocsResponse> => {
+  const searchParams = constructParams(params);
+  searchParams.set('parent_id', params.parent_id);
+
+  const response: Response = await fetchAPI(
+    `documents/${params.parent_id}/descendants/?${searchParams.toString()}`,
+  );
+
+  if (!response.ok) {
+    throw new APIError(
+      'Failed to get the sub docs',
+      await errorCauses(response),
+    );
+  }
+
+  return response.json() as Promise<DocsResponse>;
+};
+
+export const KEY_LIST_SUB_DOC = 'sub-docs';
+
+export function useSubDocs(
+  params: SubDocsParams,
+  queryConfig?: UseQueryOptions<DocsResponse, APIError, DocsResponse>,
+) {
+  return useQuery<DocsResponse, APIError, DocsResponse>({
+    queryKey: [KEY_LIST_SUB_DOC, params],
+    queryFn: () => getSubDocs(params),
+    ...queryConfig,
+  });
+}
+
+export const useInfiniteSubDocs = (
+  params: SubDocsParams,
+  queryConfig?: InfiniteQueryConfig<DocsResponse>,
+) => {
+  return useAPIInfiniteQuery(KEY_LIST_SUB_DOC, getSubDocs, params, queryConfig);
+};

src/frontend/apps/impress/src/features/docs/doc-management/components/ModalRemoveDoc.tsx

@@ -17,16 +17,22 @@ import { Doc } from '../types';
 interface ModalRemoveDocProps {
   onClose: () => void;
   doc: Doc;
+  afterDelete?: (doc: Doc) => void;
 }
 
-export const ModalRemoveDoc = ({ onClose, doc }: ModalRemoveDocProps) => {
+export const ModalRemoveDoc = ({
+  onClose,
+  doc,
+  afterDelete,
+}: ModalRemoveDocProps) => {
   const { toast } = useToastProvider();
   const { push } = useRouter();
   const pathname = usePathname();
 
+  const hasChildren = doc.numchild && doc.numchild > 0;
+
   const {
     mutate: removeDoc,
-
     isError,
     error,
   } = useRemoveDoc({
@@ -34,6 +40,11 @@ export const ModalRemoveDoc = ({ onClose, doc }: ModalRemoveDocProps) => {
       toast(t('The document has been deleted.'), VariantType.SUCCESS, {
         duration: 4000,
       });
+      if (afterDelete) {
+        afterDelete(doc);
+        return;
+      }
+
       if (pathname === '/') {
         onClose();
       } else {
@@ -71,7 +82,7 @@ export const ModalRemoveDoc = ({ onClose, doc }: ModalRemoveDocProps) => {
           </Button>
         </>
       }
-      size={ModalSize.SMALL}
+      size={ModalSize.MEDIUM}
       title={
         <Text
           $size="h6"
@@ -89,9 +100,13 @@ export const ModalRemoveDoc = ({ onClose, doc }: ModalRemoveDocProps) => {
         className="--docs--modal-remove-doc"
       >
         {!isError && (
-          <Text $size="sm" $variation="600">
-            {t('Are you sure you want to delete this document ?')}
-          </Text>
+          <>
+            <Text $size="sm" $variation="600">
+              {t(
+                'This document will be permanently deleted. This action is irreversible.',
+              )}
+            </Text>
+          </>
         )}
 
         {isError && <TextErrors causes={error.cause} />}

src/frontend/apps/impress/src/features/docs/doc-management/hooks/useTrans.tsx

@@ -1,9 +1,10 @@
 import { useTranslation } from 'react-i18next';
 
-import { Role } from '../types';
+import { Doc, Role } from '../types';
 
-export const useTrans = () => {
+export const useTrans = (doc?: Doc) => {
   const { t } = useTranslation();
+  const isChild = doc && doc.nb_accesses_ancestors > 1;
 
   const translatedRoles = {
     [Role.READER]: t('Reader'),
@@ -16,7 +17,7 @@ export const useTrans = () => {
     transRole: (role: Role) => {
       return translatedRoles[role];
     },
-    untitledDocument: t('Untitled document'),
+    untitledDocument: isChild ? t('Untitled page') : t('Untitled document'),
     translatedRoles,
   };
 };

src/frontend/apps/impress/src/features/docs/doc-management/types.tsx

@@ -2,9 +2,16 @@ import { User } from '@/features/auth';
 
 export interface Access {
   id: string;
+  max_ancestors_role: Role;
   role: Role;
+  max_role: Role;
   team: string;
   user: User;
+  document: {
+    id: string;
+    path: string;
+    depth: number;
+  };
   abilities: {
     destroy: boolean;
     partial_update: boolean;
@@ -21,10 +28,17 @@ export enum Role {
   OWNER = 'owner',
 }
 
+export const RoleImportance = {
+  [Role.READER]: 1,
+  [Role.EDITOR]: 2,
+  [Role.ADMIN]: 3,
+  [Role.OWNER]: 4,
+};
+
 export enum LinkReach {
   RESTRICTED = 'restricted',
-  PUBLIC = 'public',
   AUTHENTICATED = 'authenticated',
+  PUBLIC = 'public',
 }
 
 export enum LinkRole {
@@ -37,15 +51,26 @@ export type Base64 = string;
 export interface Doc {
   id: string;
   title?: string;
+  children?: Doc[];
+  childrenCount?: number;
   content: Base64;
+  created_at: string;
   creator: string;
+  depth: number;
+  path: string;
   is_favorite: boolean;
   link_reach: LinkReach;
   link_role: LinkRole;
-  nb_accesses_ancestors: number;
   nb_accesses_direct: number;
-  created_at: string;
+  nb_accesses_ancestors: number;
+  computed_link_reach: LinkReach;
+  computed_link_role?: LinkRole;
+  ancestors_link_reach: LinkReach;
+  ancestors_link_role?: LinkRole;
+  numchild: number;
   updated_at: string;
+  user_role: Role;
+  user_roles: Role[];
   abilities: {
     accesses_manage: boolean;
     accesses_view: boolean;
@@ -68,15 +93,31 @@ export interface Doc {
     versions_destroy: boolean;
     versions_list: boolean;
     versions_retrieve: boolean;
+    link_select_options: LinkSelectOption;
   };
 }
 
+export interface LinkSelectOption {
+  public?: LinkRole[];
+  authenticated?: LinkRole[];
+  restricted?: LinkRole[];
+}
+
 export enum DocDefaultFilter {
   ALL_DOCS = 'all_docs',
   MY_DOCS = 'my_docs',
   SHARED_WITH_ME = 'shared_with_me',
 }
 
+export type DocsOrdering =
+  | 'title'
+  | 'created_at'
+  | '-created_at'
+  | 'updated_at'
+  | '-updated_at'
+  | '-title'
+  | undefined;
+
 export interface AccessRequest {
   id: string;
   document: string;

src/frontend/apps/impress/src/features/docs/doc-management/utils.ts

@@ -22,3 +22,29 @@ export const base64ToYDoc = (base64: string) => {
 export const base64ToBlocknoteXmlFragment = (base64: string) => {
   return base64ToYDoc(base64).getXmlFragment('document-store');
 };
+
+export const getDocLinkReach = (doc: Doc) => {
+  if (doc.computed_link_reach) {
+    return doc.computed_link_reach;
+  }
+  return doc.link_reach;
+};
+
+export const getDocLinkRole = (doc: Doc) => {
+  if (doc.computed_link_role) {
+    return doc.computed_link_role;
+  }
+  return doc.link_role;
+};
+
+export const docLinkIsDesync = (doc: Doc) => {
+  // If the document has no ancestors
+  if (!doc.ancestors_link_reach) {
+    return false;
+  }
+
+  return (
+    doc.computed_link_reach !== doc.ancestors_link_reach ||
+    doc.computed_link_role !== doc.ancestors_link_role
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-search/components/DocSearchContent.tsx

@@ -0,0 +1,68 @@
+import { t } from 'i18next';
+import { useEffect, useMemo } from 'react';
+import { InView } from 'react-intersection-observer';
+
+import { QuickSearchData, QuickSearchGroup } from '@/components/quick-search';
+
+import { Doc, useInfiniteDocs } from '../../doc-management';
+
+import { DocSearchFiltersValues } from './DocSearchFilters';
+import { DocSearchItem } from './DocSearchItem';
+
+type DocSearchContentProps = {
+  search: string;
+  filters: DocSearchFiltersValues;
+  onSelect: (doc: Doc) => void;
+  onLoadingChange?: (loading: boolean) => void;
+};
+
+export const DocSearchContent = ({
+  search,
+  filters,
+  onSelect,
+  onLoadingChange,
+}: DocSearchContentProps) => {
+  const {
+    data,
+    isFetching,
+    isRefetching,
+    isLoading,
+    fetchNextPage,
+    hasNextPage,
+  } = useInfiniteDocs({
+    page: 1,
+    title: search,
+    ...filters,
+  });
+
+  const loading = isFetching || isRefetching || isLoading;
+
+  const docsData: QuickSearchData<Doc> = useMemo(() => {
+    const docs = data?.pages.flatMap((page) => page.results) || [];
+
+    return {
+      groupName: docs.length > 0 ? t('Select a document') : '',
+      elements: search ? docs : [],
+      emptyString: t('No document found'),
+      endActions: hasNextPage
+        ? [
+            {
+              content: <InView onChange={() => void fetchNextPage()} />,
+            },
+          ]
+        : [],
+    };
+  }, [search, data?.pages, fetchNextPage, hasNextPage]);
+
+  useEffect(() => {
+    onLoadingChange?.(loading);
+  }, [loading, onLoadingChange]);
+
+  return (
+    <QuickSearchGroup
+      onSelect={onSelect}
+      group={docsData}
+      renderElement={(doc) => <DocSearchItem doc={doc} />}
+    />
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-search/components/DocSearchFilters.tsx

@@ -0,0 +1,67 @@
+import { Button } from '@openfun/cunningham-react';
+import { useTranslation } from 'react-i18next';
+
+import { Box } from '@/components';
+import { FilterDropdown } from '@/components/filter/FilterDropdown';
+
+export enum DocSearchTarget {
+  ALL = 'all',
+  CURRENT = 'current',
+}
+
+export type DocSearchFiltersValues = {
+  target?: DocSearchTarget;
+};
+
+export type DocSearchFiltersProps = {
+  values?: DocSearchFiltersValues;
+  onValuesChange?: (values: DocSearchFiltersValues) => void;
+  onReset?: () => void;
+};
+
+export const DocSearchFilters = ({
+  values,
+  onValuesChange,
+  onReset,
+}: DocSearchFiltersProps) => {
+  const { t } = useTranslation();
+  const hasFilters = Object.keys(values ?? {}).length > 0;
+  const handleTargetChange = (target: DocSearchTarget) => {
+    onValuesChange?.({ ...values, target });
+  };
+
+  return (
+    <Box
+      $direction="row"
+      $align="center"
+      $height="35px"
+      $justify="space-between"
+      $gap="10px"
+      data-testid="doc-search-filters"
+      $margin={{ vertical: 'base' }}
+    >
+      <Box $direction="row" $align="center" $gap="10px">
+        <FilterDropdown
+          selectedValue={values?.target}
+          options={[
+            {
+              label: t('All docs'),
+              value: DocSearchTarget.ALL,
+              callback: () => handleTargetChange(DocSearchTarget.ALL),
+            },
+            {
+              label: t('Current doc'),
+              value: DocSearchTarget.CURRENT,
+              callback: () => handleTargetChange(DocSearchTarget.CURRENT),
+            },
+          ]}
+        />
+      </Box>
+      {hasFilters && (
+        <Button color="primary-text" size="small" onClick={onReset}>
+          {t('Reset')}
+        </Button>
+      )}
+    </Box>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-search/components/DocSearchModal.tsx

@@ -1,65 +1,61 @@
 import { Modal, ModalSize } from '@openfun/cunningham-react';
 import Image from 'next/image';
-import { useRouter } from 'next/navigation';
-import { useMemo, useState } from 'react';
+import { useRouter } from 'next/router';
+import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { InView } from 'react-intersection-observer';
 import { useDebouncedCallback } from 'use-debounce';
 
 import { Box } from '@/components';
-import {
-  QuickSearch,
-  QuickSearchData,
-  QuickSearchGroup,
-} from '@/components/quick-search';
-import { Doc, useInfiniteDocs } from '@/docs/doc-management';
+import { QuickSearch } from '@/components/quick-search';
 import { useResponsiveStore } from '@/stores';
 
+import { Doc } from '../../doc-management';
 import EmptySearchIcon from '../assets/illustration-docs-empty.png';
 
-import { DocSearchItem } from './DocSearchItem';
+import { DocSearchContent } from './DocSearchContent';
+import {
+  DocSearchFilters,
+  DocSearchFiltersValues,
+  DocSearchTarget,
+} from './DocSearchFilters';
+import { DocSearchSubPageContent } from './DocSearchSubPageContent';
 
 type DocSearchModalProps = {
   onClose: () => void;
   isOpen: boolean;
+  showFilters?: boolean;
+  defaultFilters?: DocSearchFiltersValues;
 };
 
-export const DocSearchModal = ({ ...modalProps }: DocSearchModalProps) => {
+export const DocSearchModal = ({
+  showFilters = false,
+  defaultFilters,
+  ...modalProps
+}: DocSearchModalProps) => {
   const { t } = useTranslation();
+  const [loading, setLoading] = useState(false);
+
   const router = useRouter();
+  const isDocPage = router.pathname === '/docs/[id]';
+
   const [search, setSearch] = useState('');
+  const [filters, setFilters] = useState<DocSearchFiltersValues>(
+    defaultFilters ?? {},
+  );
+
+  const target = filters.target ?? DocSearchTarget.ALL;
   const { isDesktop } = useResponsiveStore();
-  const {
-    data,
-    isFetching,
-    isRefetching,
-    isLoading,
-    fetchNextPage,
-    hasNextPage,
-  } = useInfiniteDocs({
-    page: 1,
-    title: search,
-  });
-  const loading = isFetching || isRefetching || isLoading;
+
   const handleInputSearch = useDebouncedCallback(setSearch, 300);
 
   const handleSelect = (doc: Doc) => {
-    router.push(`/docs/${doc.id}`);
+    void router.push(`/docs/${doc.id}`);
     modalProps.onClose?.();
   };
 
-  const docsData: QuickSearchData<Doc> = useMemo(() => {
-    const docs = data?.pages.flatMap((page) => page.results) || [];
-
-    return {
-      groupName: docs.length > 0 ? t('Select a document') : '',
-      elements: search ? docs : [],
-      emptyString: t('No document found'),
-      endActions: hasNextPage
-        ? [{ content: <InView onChange={() => void fetchNextPage()} /> }]
-        : [],
-    };
-  }, [data, hasNextPage, fetchNextPage, t, search]);
+  const handleResetFilters = () => {
+    setFilters({});
+  };
 
   return (
     <Modal
@@ -78,7 +74,17 @@ export const DocSearchModal = ({ ...modalProps }: DocSearchModalProps) => {
           loading={loading}
           onFilter={handleInputSearch}
         >
-          <Box $height={isDesktop ? '500px' : 'calc(100vh - 68px - 1rem)'}>
+          <Box
+            $padding={{ horizontal: '10px' }}
+            $height={isDesktop ? '500px' : 'calc(100vh - 68px - 1rem)'}
+          >
+            {showFilters && (
+              <DocSearchFilters
+                values={filters}
+                onValuesChange={setFilters}
+                onReset={handleResetFilters}
+              />
+            )}
             {search.length === 0 && (
               <Box
                 $direction="column"
@@ -95,11 +101,24 @@ export const DocSearchModal = ({ ...modalProps }: DocSearchModalProps) => {
               </Box>
             )}
             {search && (
-              <QuickSearchGroup
-                onSelect={handleSelect}
-                group={docsData}
-                renderElement={(doc) => <DocSearchItem doc={doc} />}
-              />
+              <>
+                {target === DocSearchTarget.ALL && (
+                  <DocSearchContent
+                    search={search}
+                    filters={filters}
+                    onSelect={handleSelect}
+                    onLoadingChange={setLoading}
+                  />
+                )}
+                {isDocPage && target === DocSearchTarget.CURRENT && (
+                  <DocSearchSubPageContent
+                    search={search}
+                    filters={filters}
+                    onSelect={handleSelect}
+                    onLoadingChange={setLoading}
+                  />
+                )}
+              </>
             )}
           </Box>
         </QuickSearch>

src/frontend/apps/impress/src/features/docs/doc-search/components/DocSearchSubPageContent.tsx

@@ -0,0 +1,73 @@
+import { useTreeContext } from '@gouvfr-lasuite/ui-kit';
+import { t } from 'i18next';
+import { useEffect, useMemo } from 'react';
+import { InView } from 'react-intersection-observer';
+
+import { QuickSearchData, QuickSearchGroup } from '@/components/quick-search';
+
+import { Doc } from '../../doc-management';
+import { useInfiniteSubDocs } from '../../doc-management/api/useSubDocs';
+
+import { DocSearchFiltersValues } from './DocSearchFilters';
+import { DocSearchItem } from './DocSearchItem';
+
+type DocSearchSubPageContentProps = {
+  search: string;
+  filters: DocSearchFiltersValues;
+  onSelect: (doc: Doc) => void;
+  onLoadingChange?: (loading: boolean) => void;
+};
+
+export const DocSearchSubPageContent = ({
+  search,
+  filters,
+  onSelect,
+  onLoadingChange,
+}: DocSearchSubPageContentProps) => {
+  const treeContext = useTreeContext<Doc>();
+
+  const {
+    data: subDocsData,
+    isFetching,
+    isRefetching,
+    isLoading,
+    fetchNextPage: subDocsFetchNextPage,
+    hasNextPage: subDocsHasNextPage,
+  } = useInfiniteSubDocs({
+    page: 1,
+    title: search,
+    ...filters,
+    parent_id: treeContext?.root?.id ?? '',
+  });
+
+  const loading = isFetching || isRefetching || isLoading;
+
+  const docsData: QuickSearchData<Doc> = useMemo(() => {
+    const subDocs = subDocsData?.pages.flatMap((page) => page.results) || [];
+
+    return {
+      groupName: subDocs.length > 0 ? t('Select a page') : '',
+      elements: search ? subDocs : [],
+      emptyString: t('No document found'),
+      endActions: subDocsHasNextPage
+        ? [
+            {
+              content: <InView onChange={() => void subDocsFetchNextPage()} />,
+            },
+          ]
+        : [],
+    };
+  }, [search, subDocsData, subDocsFetchNextPage, subDocsHasNextPage]);
+
+  useEffect(() => {
+    onLoadingChange?.(loading);
+  }, [loading, onLoadingChange]);
+
+  return (
+    <QuickSearchGroup
+      onSelect={onSelect}
+      group={docsData}
+      renderElement={(doc) => <DocSearchItem doc={doc} />}
+    />
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-search/components/index.ts

@@ -1 +1,2 @@
 export * from './DocSearchModal';
+export * from './DocSearchFilters';

src/frontend/apps/impress/src/features/docs/doc-share/api/useDocAccesses.tsx

@@ -1,12 +1,7 @@
 import { UseQueryOptions, useQuery } from '@tanstack/react-query';
 
-import {
-  APIError,
-  APIList,
-  errorCauses,
-  fetchAPI,
-  useAPIInfiniteQuery,
-} from '@/api';
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
 import { Access } from '@/docs/doc-management';
 
 export type DocAccessesParams = {
@@ -14,18 +9,13 @@ export type DocAccessesParams = {
   ordering?: string;
 };
 
-export type DocAccessesAPIParams = DocAccessesParams & {
-  page: number;
-};
-
-type AccessesResponse = APIList<Access>;
+export type DocAccessesAPIParams = DocAccessesParams & {};
 
 export const getDocAccesses = async ({
-  page,
   docId,
   ordering,
-}: DocAccessesAPIParams): Promise<AccessesResponse> => {
-  let url = `documents/${docId}/accesses/?page=${page}`;
+}: DocAccessesAPIParams): Promise<Access[]> => {
+  let url = `documents/${docId}/accesses/`;
 
   if (ordering) {
     url += '&ordering=' + ordering;
@@ -40,27 +30,18 @@ export const getDocAccesses = async ({
     );
   }
 
-  return response.json() as Promise<AccessesResponse>;
+  return (await response.json()) as Access[];
 };
 
 export const KEY_LIST_DOC_ACCESSES = 'docs-accesses';
 
 export function useDocAccesses(
   params: DocAccessesAPIParams,
-  queryConfig?: UseQueryOptions<AccessesResponse, APIError, AccessesResponse>,
+  queryConfig?: UseQueryOptions<Access[], APIError, Access[]>,
 ) {
-  return useQuery<AccessesResponse, APIError, AccessesResponse>({
+  return useQuery<Access[], APIError, Access[]>({
     queryKey: [KEY_LIST_DOC_ACCESSES, params],
     queryFn: () => getDocAccesses(params),
     ...queryConfig,
   });
 }
-
-/**
- * @param param Used for infinite scroll pagination
- * @param queryConfig
- * @returns
- */
-export function useDocAccessesInfinite(params: DocAccessesParams) {
-  return useAPIInfiniteQuery(KEY_LIST_DOC_ACCESSES, getDocAccesses, params);
-}

src/frontend/apps/impress/src/features/docs/doc-share/api/useDocInvitations.tsx

@@ -15,7 +15,7 @@ export type DocInvitationsParams = {
 };
 
 export type DocInvitationsAPIParams = DocInvitationsParams & {
-  page: number;
+  page?: number;
 };
 
 type DocInvitationsResponse = APIList<Invitation>;

src/frontend/apps/impress/src/features/docs/doc-share/assets/desynchro.svg

@@ -0,0 +1,5 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g id="desynchro">
+<path id="&#244;&#128;&#153;&#160;" d="M5.99986 12.2256C5.99986 11.7946 6.25238 11.5791 6.75741 11.5791H10.4145C10.802 11.5791 11.2156 11.4811 11.6553 11.2852C12.0994 11.0893 12.5413 10.8302 12.981 10.508C13.4208 10.1902 13.8235 9.84192 14.1892 9.46314C14.5593 9.08437 14.864 8.70778 15.1035 8.33336L15.4496 7.80438C15.5802 7.59105 15.7718 7.48438 16.0243 7.48438C16.1897 7.48438 16.3334 7.5388 16.4553 7.64765C16.5816 7.76084 16.6447 7.91758 16.6447 8.11785C16.6447 8.30506 16.5837 8.48791 16.4618 8.66641L16.2398 9.01254C15.996 9.37389 15.7086 9.7309 15.3778 10.0835C15.0469 10.4362 14.6964 10.7606 14.3263 11.0566C13.9606 11.357 13.6058 11.6073 13.2619 11.8076C12.9179 12.0122 12.6153 12.1472 12.3541 12.2125V12.2386C12.6153 12.2996 12.9179 12.4324 13.2619 12.637C13.6058 12.8416 13.9606 13.0941 14.3263 13.3945C14.6921 13.695 15.0404 14.0193 15.3712 14.3676C15.7065 14.7203 15.996 15.0794 16.2398 15.4451L16.4618 15.7847C16.5837 15.9632 16.6447 16.1461 16.6447 16.3333C16.6447 16.5292 16.5837 16.6838 16.4618 16.797C16.3443 16.9102 16.1963 16.9668 16.0178 16.9668C15.7696 16.9668 15.5802 16.8601 15.4496 16.6468L15.1035 16.1243C14.864 15.7499 14.5593 15.3711 14.1892 14.988C13.8235 14.6092 13.4208 14.2588 12.981 13.9366C12.5413 13.6188 12.0994 13.3619 11.6553 13.166C11.2156 12.9701 10.802 12.8721 10.4145 12.8721H6.75741C6.25238 12.8721 5.99986 12.6566 5.99986 12.2256ZM14.3068 7.64112C14.1065 7.48438 14.0303 7.32329 14.0782 7.15785C14.1261 6.99677 14.2697 6.88139 14.5092 6.81173L17.0822 6.03459C17.2782 5.97364 17.4392 5.99323 17.5655 6.09337C17.6918 6.1935 17.7505 6.34371 17.7418 6.54398L17.6308 9.23457C17.6221 9.48274 17.5437 9.64818 17.3957 9.7309C17.252 9.81362 17.0822 9.78097 16.8863 9.63294L14.3068 7.64112ZM14.3198 16.7251L16.9516 14.8117C17.1519 14.6637 17.3239 14.6354 17.4675 14.7268C17.6112 14.8182 17.6831 14.9858 17.6831 15.2296L17.7157 17.9268C17.7157 18.127 17.6504 18.2729 17.5198 18.3643C17.3935 18.4601 17.2324 18.4753 17.0365 18.41L14.4896 17.5545C14.2545 17.4805 14.1152 17.3608 14.0717 17.1953C14.0281 17.0299 14.1108 16.8732 14.3198 16.7251Z" fill="#000091"/>
+</g>
+</svg>

src/frontend/apps/impress/src/features/docs/doc-share/assets/undo.svg

@@ -0,0 +1,5 @@
+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g id="undo">
+<path id="v" d="M4.6665 12.667V11.3337H9.39984C10.0998 11.3337 10.7082 11.1114 11.2248 10.667C11.7415 10.2225 11.9998 9.66699 11.9998 9.00033C11.9998 8.33366 11.7415 7.7781 11.2248 7.33366C10.7082 6.88921 10.0998 6.66699 9.39984 6.66699H5.19984L6.93317 8.40033L5.99984 9.33366L2.6665 6.00033L5.99984 2.66699L6.93317 3.60033L5.19984 5.33366H9.39984C10.4776 5.33366 11.4026 5.68366 12.1748 6.38366C12.9471 7.08366 13.3332 7.95588 13.3332 9.00033C13.3332 10.0448 12.9471 10.917 12.1748 11.617C11.4026 12.317 10.4776 12.667 9.39984 12.667H4.6665Z" fill="#000091"/>
+</g>
+</svg>

src/frontend/apps/impress/src/features/docs/doc-share/components/DocInheritedShareContent.tsx

@@ -0,0 +1,76 @@
+import { Button } from '@openfun/cunningham-react';
+import { useRouter } from 'next/router';
+import { Fragment } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { Box, HorizontalSeparator, Icon, Text } from '@/components';
+import { useCunninghamTheme } from '@/cunningham';
+
+import { Access, useDocStore } from '../../doc-management';
+
+import { DocShareMemberItem } from './DocShareMemberItem';
+
+type Props = {
+  rawAccesses: Access[];
+};
+
+export const DocInheritedShareContent = ({ rawAccesses }: Props) => {
+  const { t } = useTranslation();
+  const { spacingsTokens } = useCunninghamTheme();
+  const { currentDoc } = useDocStore();
+  const router = useRouter();
+
+  // Check if accesses map is empty
+  const hasAccesses = rawAccesses.length > 0;
+
+  if (!hasAccesses) {
+    return null;
+  }
+
+  return (
+    <>
+      <Box $gap={spacingsTokens.sm} $padding={{ top: spacingsTokens.sm }}>
+        <HorizontalSeparator $withPadding={false} />
+        <Box
+          $gap={spacingsTokens.sm}
+          $padding={{
+            horizontal: spacingsTokens.base,
+            // vertical: spacingsTokens.sm,
+            // bottom: '0px',
+          }}
+        >
+          <Box $direction="row" $align="center" $gap={spacingsTokens['4xs']}>
+            <Text $variation="1000" $weight="bold" $size="sm">
+              {t('People with access via the parent document')}
+            </Text>
+            <div>
+              <Button
+                onClick={() => {
+                  void router.push(`/docs/${rawAccesses[0].document.id}`);
+                }}
+                size="small"
+                icon={
+                  <Icon
+                    $theme="greyscale"
+                    $variation="600"
+                    iconName="open_in_new"
+                  />
+                }
+                color="tertiary-text"
+              />
+            </div>
+          </Box>
+          {rawAccesses.map((access) => (
+            <Fragment key={access.id}>
+              <DocShareMemberItem
+                doc={currentDoc}
+                access={access}
+                isInherited
+              />
+            </Fragment>
+          ))}
+        </Box>
+      </Box>
+    </>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-share/components/DocRoleDropdown.tsx

@@ -1,9 +1,24 @@
+import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import { useQueryClient } from '@tanstack/react-query';
+import { useMemo } from 'react';
+import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 
 import { DropdownMenu, DropdownMenuOption, Text } from '@/components';
-import { Role, useTrans } from '@/docs/doc-management/';
+import {
+  Access,
+  Doc,
+  KEY_SUB_PAGE,
+  Role,
+  useTrans,
+} from '@/docs/doc-management/';
+
+import { useDeleteDocAccess, useDeleteDocInvitation } from '../api';
+import { Invitation, isInvitation } from '../types';
 
 type DocRoleDropdownProps = {
+  doc?: Doc;
+  access?: Access | Invitation;
   canUpdate?: boolean;
   currentRole: Role;
   message?: string;
@@ -16,9 +31,97 @@ export const DocRoleDropdown = ({
   currentRole,
   message,
   onSelectRole,
+  doc,
   rolesAllowed,
+  access,
 }: DocRoleDropdownProps) => {
+  const { t } = useTranslation();
   const { transRole, translatedRoles } = useTrans();
+  const queryClient = useQueryClient();
+  const { toast } = useToastProvider();
+
+  const { mutate: removeDocInvitation } = useDeleteDocInvitation({
+    onSuccess: () => {
+      if (!doc) {
+        return;
+      }
+
+      console.log('doc HERE', doc);
+      void queryClient.invalidateQueries({
+        queryKey: [KEY_SUB_PAGE, { id: doc.id }],
+      });
+    },
+    onError: (error) => {
+      toast(
+        error?.data?.role?.[0] ?? t('Error during delete invitation'),
+        VariantType.ERROR,
+        {
+          duration: 4000,
+        },
+      );
+    },
+  });
+
+  const { mutate: removeDocAccess } = useDeleteDocAccess({
+    onSuccess: () => {
+      if (!doc) {
+        return;
+      }
+      void queryClient.invalidateQueries({
+        queryKey: [KEY_SUB_PAGE, { id: doc.id }],
+      });
+    },
+    onError: () => {
+      toast(t('Error while deleting invitation'), VariantType.ERROR, {
+        duration: 4000,
+      });
+    },
+  });
+
+  const onRemove = () => {
+    const invitation = isInvitation(access);
+    if (!doc || !access) {
+      return;
+    }
+
+    if (invitation) {
+      removeDocInvitation({ invitationId: access.id, docId: doc.id });
+    } else {
+      removeDocAccess({ accessId: access.id, docId: doc.id });
+    }
+  };
+
+  /**
+   * When there is a higher role, the rolesAllowed are truncated
+   * We display a message to indicate that there is a higher role
+   */
+  const topMessage = useMemo(() => {
+    if (!canUpdate || !rolesAllowed || rolesAllowed.length === 0) {
+      return message;
+    }
+
+    const allRoles = Object.keys(translatedRoles);
+
+    if (rolesAllowed.length < allRoles.length) {
+      let result = message ? `${message}\n\n` : '';
+      result += t('This user has access inherited from a parent page.');
+      return result;
+    }
+
+    return message;
+  }, [canUpdate, rolesAllowed, translatedRoles, message, t]);
+
+  const roles: DropdownMenuOption[] = Object.keys(translatedRoles).map(
+    (key, index) => {
+      const isLast = index === Object.keys(translatedRoles).length - 1;
+      return {
+        label: transRole(key as Role),
+        callback: () => onSelectRole?.(key as Role),
+        isSelected: currentRole === (key as Role),
+        showSeparator: isLast,
+      };
+    },
+  );
 
   if (!canUpdate) {
     return (
@@ -28,26 +131,26 @@ export const DocRoleDropdown = ({
     );
   }
 
-  const roles: DropdownMenuOption[] = Object.keys(translatedRoles).map(
-    (key) => {
-      return {
-        label: transRole(key as Role),
-        callback: () => onSelectRole?.(key as Role),
-        disabled: rolesAllowed && !rolesAllowed.includes(key as Role),
-        isSelected: currentRole === (key as Role),
-      };
-    },
-  );
-
   return (
     <DropdownMenu
-      topMessage={message}
+      topMessage={topMessage}
       label="doc-role-dropdown"
       showArrow={true}
-      options={roles}
+      arrowCss={css`
+        color: var(--c--theme--colors--primary-800) !important;
+      `}
+      options={[
+        ...roles,
+        {
+          label: t('Remove access'),
+          disabled: !access?.abilities.destroy,
+          callback: onRemove,
+        },
+      ]}
     >
       <Text
-        $variation="600"
+        $theme="primary"
+        $variation="800"
         $css={css`
           font-family: Arial, Helvetica, sans-serif;
         `}

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareAddMemberList.tsx

@@ -3,6 +3,7 @@ import {
   VariantType,
   useToastProvider,
 } from '@openfun/cunningham-react';
+import { useQueryClient } from '@tanstack/react-query';
 import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
@@ -11,7 +12,7 @@ import { APIError } from '@/api';
 import { Box } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
 import { User } from '@/features/auth';
-import { Doc, Role } from '@/features/docs';
+import { Doc, KEY_SUB_PAGE, Role } from '@/features/docs';
 
 import { useCreateDocAccess, useCreateDocInvitation } from '../api';
 import { OptionType } from '../types';
@@ -39,11 +40,12 @@ export const DocShareAddMemberList = ({
 }: Props) => {
   const { t } = useTranslation();
   const { toast } = useToastProvider();
+
   const [isLoading, setIsLoading] = useState(false);
   const { spacingsTokens, colorsTokens } = useCunninghamTheme();
   const [invitationRole, setInvitationRole] = useState<Role>(Role.EDITOR);
   const canShare = doc.abilities.accesses_manage;
-
+  const queryClient = useQueryClient();
   const { mutateAsync: createInvitation } = useCreateDocInvitation();
   const { mutateAsync: createDocAccess } = useCreateDocAccess();
 
@@ -89,14 +91,32 @@ export const DocShareAddMemberList = ({
       };
 
       return isInvitationMode
-        ? createInvitation({
-            ...payload,
-            email: user.email,
-          })
-        : createDocAccess({
-            ...payload,
-            memberId: user.id,
-          });
+        ? createInvitation(
+            {
+              ...payload,
+              email: user.email,
+            },
+            {
+              onSuccess: () => {
+                void queryClient.invalidateQueries({
+                  queryKey: [KEY_SUB_PAGE, { id: doc.id }],
+                });
+              },
+            },
+          )
+        : createDocAccess(
+            {
+              ...payload,
+              memberId: user.id,
+            },
+            {
+              onSuccess: () => {
+                void queryClient.invalidateQueries({
+                  queryKey: [KEY_SUB_PAGE, { id: doc.id }],
+                });
+              },
+            },
+          );
     });
 
     const settledPromises = await Promise.allSettled(promises);

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareInvitation.tsx

@@ -1,4 +1,5 @@
 import { VariantType, useToastProvider } from '@openfun/cunningham-react';
+import { useQueryClient } from '@tanstack/react-query';
 import { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
@@ -14,7 +15,7 @@ import {
 } from '@/components';
 import { QuickSearchData, QuickSearchGroup } from '@/components/quick-search';
 import { useCunninghamTheme } from '@/cunningham';
-import { Doc, Role } from '@/docs/doc-management';
+import { Doc, KEY_SUB_PAGE, Role } from '@/docs/doc-management';
 import { User } from '@/features/auth';
 
 import {
@@ -32,11 +33,12 @@ type DocShareInvitationItemProps = {
   invitation: Invitation;
 };
 
-const DocShareInvitationItem = ({
+export const DocShareInvitationItem = ({
   doc,
   invitation,
 }: DocShareInvitationItemProps) => {
   const { t } = useTranslation();
+  const queryClient = useQueryClient();
   const { spacingsTokens } = useCunninghamTheme();
   const invitedUser: User = {
     id: invitation.email,
@@ -50,6 +52,11 @@ const DocShareInvitationItem = ({
   const canUpdate = doc.abilities.accesses_manage;
 
   const { mutate: updateDocInvitation } = useUpdateDocInvitation({
+    onSuccess: () => {
+      void queryClient.invalidateQueries({
+        queryKey: [KEY_SUB_PAGE, { id: doc.id }],
+      });
+    },
     onError: (error) => {
       toast(
         error?.data?.role?.[0] ?? t('Error during update invitation'),
@@ -62,6 +69,11 @@ const DocShareInvitationItem = ({
   });
 
   const { mutate: removeDocInvitation } = useDeleteDocInvitation({
+    onSuccess: () => {
+      void queryClient.invalidateQueries({
+        queryKey: [KEY_SUB_PAGE, { id: doc.id }],
+      });
+    },
     onError: (error) => {
       toast(
         error?.data?.role?.[0] ?? t('Error during delete invitation'),
@@ -110,6 +122,8 @@ const DocShareInvitationItem = ({
               currentRole={invitation.role}
               onSelectRole={onUpdate}
               canUpdate={canUpdate}
+              doc={doc}
+              access={invitation}
             />
 
             {canUpdate && (

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareMember.tsx

@@ -1,39 +1,32 @@
 import { VariantType, useToastProvider } from '@openfun/cunningham-react';
-import { useMemo } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
 import { useTranslation } from 'react-i18next';
 
-import {
-  Box,
-  DropdownMenu,
-  DropdownMenuOption,
-  IconOptions,
-  LoadMoreText,
-} from '@/components';
-import { QuickSearchData, QuickSearchGroup } from '@/components/quick-search';
+import { Box } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
-import { Access, Doc, Role } from '@/docs/doc-management/';
-import { useResponsiveStore } from '@/stores';
+import { Access, Doc, KEY_SUB_PAGE, Role } from '@/docs/doc-management/';
 
-import {
-  useDeleteDocAccess,
-  useDocAccessesInfinite,
-  useUpdateDocAccess,
-} from '../api';
-import { useWhoAmI } from '../hooks';
+import { useUpdateDocAccess } from '../api';
+import { useWhoAmI } from '../hooks/';
 
 import { DocRoleDropdown } from './DocRoleDropdown';
 import { SearchUserRow } from './SearchUserRow';
 
 type Props = {
-  doc: Doc;
+  doc?: Doc;
   access: Access;
+  isInherited?: boolean;
 };
-
-const DocShareMemberItem = ({ doc, access }: Props) => {
+export const DocShareMemberItem = ({
+  doc,
+  access,
+  isInherited = false,
+}: Props) => {
   const { t } = useTranslation();
+  const queryClient = useQueryClient();
   const { isLastOwner } = useWhoAmI(access);
   const { toast } = useToastProvider();
-  const { isDesktop } = useResponsiveStore();
+
   const { spacingsTokens } = useCunninghamTheme();
 
   const message = isLastOwner
@@ -43,6 +36,14 @@ const DocShareMemberItem = ({ doc, access }: Props) => {
     : undefined;
 
   const { mutate: updateDocAccess } = useUpdateDocAccess({
+    onSuccess: () => {
+      if (!doc) {
+        return;
+      }
+      void queryClient.invalidateQueries({
+        queryKey: [KEY_SUB_PAGE, { id: doc.id }],
+      });
+    },
     onError: () => {
       toast(t('Error while updating the member role.'), VariantType.ERROR, {
         duration: 4000,
@@ -50,15 +51,10 @@ const DocShareMemberItem = ({ doc, access }: Props) => {
     },
   });
 
-  const { mutate: removeDocAccess } = useDeleteDocAccess({
-    onError: () => {
-      toast(t('Error while deleting the member.'), VariantType.ERROR, {
-        duration: 4000,
-      });
-    },
-  });
-
   const onUpdate = (newRole: Role) => {
+    if (!doc) {
+      return;
+    }
     updateDocAccess({
       docId: doc.id,
       role: newRole,
@@ -66,18 +62,9 @@ const DocShareMemberItem = ({ doc, access }: Props) => {
     });
   };
 
-  const onRemove = () => {
-    removeDocAccess({ accessId: access.id, docId: doc.id });
-  };
-
-  const moreActions: DropdownMenuOption[] = [
-    {
-      label: t('Delete'),
-      icon: 'delete',
-      callback: onRemove,
-      disabled: !access.abilities.destroy,
-    },
-  ];
+  const canUpdate = isInherited
+    ? false
+    : (doc?.abilities.accesses_manage ?? false);
 
   return (
     <Box
@@ -91,74 +78,17 @@ const DocShareMemberItem = ({ doc, access }: Props) => {
         right={
           <Box $direction="row" $align="center" $gap={spacingsTokens['2xs']}>
             <DocRoleDropdown
-              currentRole={access.role}
+              currentRole={isInherited ? access.max_role : access.role}
               onSelectRole={onUpdate}
-              canUpdate={doc.abilities.accesses_manage}
+              canUpdate={canUpdate}
               message={message}
               rolesAllowed={access.abilities.set_role_to}
+              access={access}
+              doc={doc}
             />
-
-            {isDesktop && doc.abilities.accesses_manage && (
-              <DropdownMenu options={moreActions}>
-                <IconOptions
-                  isHorizontal
-                  data-testid="doc-share-member-more-actions"
-                  $variation="600"
-                />
-              </DropdownMenu>
-            )}
           </Box>
         }
       />
     </Box>
   );
 };
-
-interface QuickSearchGroupMemberProps {
-  doc: Doc;
-}
-
-export const QuickSearchGroupMember = ({
-  doc,
-}: QuickSearchGroupMemberProps) => {
-  const { t } = useTranslation();
-  const membersQuery = useDocAccessesInfinite({
-    docId: doc.id,
-  });
-
-  const membersData: QuickSearchData<Access> = useMemo(() => {
-    const members =
-      membersQuery.data?.pages.flatMap((page) => page.results) || [];
-
-    const count = membersQuery.data?.pages[0]?.count ?? 1;
-
-    return {
-      groupName:
-        count === 1
-          ? t('Document owner')
-          : t('Share with {{count}} users', {
-              count: count,
-            }),
-      elements: members,
-      endActions: membersQuery.hasNextPage
-        ? [
-            {
-              content: <LoadMoreText data-testid="load-more-members" />,
-              onSelect: () => void membersQuery.fetchNextPage(),
-            },
-          ]
-        : undefined,
-    };
-  }, [membersQuery, t]);
-
-  return (
-    <Box aria-label={t('List members card')}>
-      <QuickSearchGroup
-        group={membersData}
-        renderElement={(access) => (
-          <DocShareMemberItem doc={doc} access={access} />
-        )}
-      />
-    </Box>
-  );
-};

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareModal.tsx

@@ -11,22 +11,26 @@ import {
   QuickSearchGroup,
 } from '@/components/quick-search/';
 import { User } from '@/features/auth';
-import { Doc } from '@/features/docs';
+import { Access, Doc } from '@/features/docs';
 import { useResponsiveStore } from '@/stores';
 import { isValidEmail } from '@/utils';
 
-import { KEY_LIST_USER, useUsers } from '../api';
-
 import {
-  ButtonAccessRequest,
-  QuickSearchGroupAccessRequest,
-} from './DocShareAccessRequest';
+  KEY_LIST_USER,
+  useDocAccesses,
+  useDocInvitationsInfinite,
+  useUsers,
+} from '../api';
+import { Invitation } from '../types';
+
+import { DocInheritedShareContent } from './DocInheritedShareContent';
+import { ButtonAccessRequest } from './DocShareAccessRequest';
 import { DocShareAddMemberList } from './DocShareAddMemberList';
 import {
+  DocShareInvitationItem,
   DocShareModalInviteUserRow,
-  QuickSearchGroupInvitation,
 } from './DocShareInvitation';
-import { QuickSearchGroupMember } from './DocShareMember';
+import { DocShareMemberItem } from './DocShareMember';
 import { DocShareModalFooter } from './DocShareModalFooter';
 
 const ShareModalStyle = createGlobalStyle`
@@ -40,10 +44,11 @@ const ShareModalStyle = createGlobalStyle`
 
 type Props = {
   doc: Doc;
+  isRootDoc?: boolean;
   onClose: () => void;
 };
 
-export const DocShareModal = ({ doc, onClose }: Props) => {
+export const DocShareModal = ({ doc, onClose, isRootDoc = true }: Props) => {
   const { t } = useTranslation();
   const selectedUsersRef = useRef<HTMLDivElement>(null);
 
@@ -57,7 +62,7 @@ export const DocShareModal = ({ doc, onClose }: Props) => {
   const [inputValue, setInputValue] = useState('');
 
   const [listHeight, setListHeight] = useState<string>('400px');
-  const canShare = doc.abilities.accesses_manage;
+  const canShare = doc.abilities.accesses_manage && isRootDoc;
   const canViewAccesses = doc.abilities.accesses_view;
   const showMemberSection = inputValue === '' && selectedUsers.length === 0;
   const showFooter = selectedUsers.length === 0 && !inputValue;
@@ -69,6 +74,10 @@ export const DocShareModal = ({ doc, onClose }: Props) => {
     setInputValue('');
   };
 
+  const { data: membersQuery } = useDocAccesses({
+    docId: doc.id,
+  });
+
   const searchUsersQuery = useUsers(
     { query: userQuery, docId: doc.id },
     {
@@ -77,6 +86,23 @@ export const DocShareModal = ({ doc, onClose }: Props) => {
     },
   );
 
+  const membersData: QuickSearchData<Access> = useMemo(() => {
+    const members: Access[] =
+      membersQuery?.filter((access) => access.document.id === doc.id) ?? [];
+
+    const count = doc.nb_accesses_direct > 1 ? doc.nb_accesses_direct : 1;
+
+    return {
+      groupName:
+        count === 1
+          ? t('Document owner')
+          : t('Share with {{count}} users', {
+              count: count,
+            }),
+      elements: members,
+    };
+  }, [membersQuery, doc.id, doc.nb_accesses_direct, t]);
+
   const onFilter = useDebouncedCallback((str: string) => {
     setUserQuery(str);
   }, 300);
@@ -103,6 +129,15 @@ export const DocShareModal = ({ doc, onClose }: Props) => {
     setListHeight(height);
   };
 
+  const inheritedAccesses = useMemo(() => {
+    return (
+      membersQuery?.filter((access) => access.document.id !== doc.id) ?? []
+    );
+  }, [membersQuery, doc.id]);
+
+  const showInheritedShareContent =
+    inheritedAccesses.length > 0 && showMemberSection && !isRootDoc;
+
   return (
     <>
       <Modal
@@ -133,10 +168,7 @@ export const DocShareModal = ({ doc, onClose }: Props) => {
           >
             <Box ref={selectedUsersRef}>
               {canShare && selectedUsers.length > 0 && (
-                <Box
-                  $padding={{ horizontal: 'base' }}
-                  $margin={{ top: '11px' }}
-                >
+                <Box $padding={{ horizontal: 'base' }} $margin={{ top: '12x' }}>
                   <DocShareAddMemberList
                     doc={doc}
                     selectedUsers={selectedUsers}
@@ -149,7 +181,7 @@ export const DocShareModal = ({ doc, onClose }: Props) => {
                   />
                 </Box>
               )}
-              {!canViewAccesses && <HorizontalSeparator />}
+              {!canViewAccesses && <HorizontalSeparator customPadding="12px" />}
             </Box>
 
             <Box data-testid="doc-share-quick-search">
@@ -188,12 +220,22 @@ export const DocShareModal = ({ doc, onClose }: Props) => {
                   loading={searchUsersQuery.isLoading}
                   placeholder={t('Type a name or email')}
                 >
+                  {inheritedAccesses.length > 0 &&
+                    showInheritedShareContent && (
+                      <DocInheritedShareContent
+                        rawAccesses={
+                          membersQuery?.filter(
+                            (access) => access.document.id !== doc.id,
+                          ) ?? []
+                        }
+                      />
+                    )}
                   {showMemberSection ? (
-                    <>
-                      <QuickSearchGroupAccessRequest doc={doc} />
-                      <QuickSearchGroupInvitation doc={doc} />
-                      <QuickSearchGroupMember doc={doc} />
-                    </>
+                    <QuickSearchMemberSection
+                      doc={doc}
+                      hasInheritedShareContent={inheritedAccesses.length > 0}
+                      membersData={membersData}
+                    />
                   ) : (
                     <QuickSearchInviteInputSection
                       searchUsersRawData={searchUsersQuery.data}
@@ -207,7 +249,13 @@ export const DocShareModal = ({ doc, onClose }: Props) => {
           </Box>
 
           <Box ref={handleRef}>
-            {showFooter && <DocShareModalFooter doc={doc} onClose={onClose} />}
+            {showFooter && (
+              <DocShareModalFooter
+                doc={doc}
+                onClose={onClose}
+                canEditVisibility={canShare}
+              />
+            )}
           </Box>
         </Box>
       </Modal>
@@ -257,10 +305,96 @@ const QuickSearchInviteInputSection = ({
   }, [onSelect, searchUsersRawData, t, userQuery]);
 
   return (
-    <QuickSearchGroup
-      group={searchUserData}
-      onSelect={onSelect}
-      renderElement={(user) => <DocShareModalInviteUserRow user={user} />}
-    />
+    <Box
+      aria-label={t('List search user result card')}
+      $padding={{ horizontal: 'base', bottom: '3xs' }}
+    >
+      <QuickSearchGroup
+        group={searchUserData}
+        onSelect={onSelect}
+        renderElement={(user) => <DocShareModalInviteUserRow user={user} />}
+      />
+    </Box>
+  );
+};
+
+interface QuickSearchMemberSectionProps {
+  doc: Doc;
+  membersData: QuickSearchData<Access>;
+  hasInheritedShareContent?: boolean;
+}
+
+const QuickSearchMemberSection = ({
+  doc,
+  membersData,
+  hasInheritedShareContent = false,
+}: QuickSearchMemberSectionProps) => {
+  const { t } = useTranslation();
+  const { data, hasNextPage, fetchNextPage } = useDocInvitationsInfinite({
+    docId: doc.id,
+  });
+
+  console.log('data', data);
+
+  const invitationsData: QuickSearchData<Invitation> = useMemo(() => {
+    const invitations = data?.pages.flatMap((page) => page.results) || [];
+    console.log('invitations', invitations);
+
+    return {
+      groupName: t('Pending invitations'),
+      elements: invitations,
+      endActions: hasNextPage
+        ? [
+            {
+              content: <Text data-testid="load-more-invitations" />,
+              onSelect: () => void fetchNextPage(),
+            },
+          ]
+        : undefined,
+    };
+  }, [data?.pages, fetchNextPage, hasNextPage, t]);
+
+  const showSeparator =
+    invitationsData.elements.length > 0 && membersData.elements.length > 0;
+
+  if (
+    invitationsData.elements.length === 0 &&
+    membersData.elements.length === 0
+  ) {
+    return null;
+  }
+
+  return (
+    <>
+      {hasInheritedShareContent && <HorizontalSeparator $withPadding={false} />}
+      {invitationsData.elements.length > 0 && (
+        <Box
+          aria-label={t('List invitation card')}
+          $padding={{ horizontal: 'base' }}
+          $margin={{ bottom: showSeparator ? 'md' : undefined }}
+        >
+          <QuickSearchGroup
+            group={invitationsData}
+            renderElement={(invitation) => (
+              <DocShareInvitationItem doc={doc} invitation={invitation} />
+            )}
+          />
+        </Box>
+      )}
+
+      {showSeparator && <HorizontalSeparator $withPadding={false} />}
+
+      <Box
+        aria-label={t('List members card')}
+        $padding={{ horizontal: 'base', bottom: '3xs' }}
+      >
+        <QuickSearchGroup
+          group={membersData}
+          renderElement={(access) => (
+            <DocShareMemberItem doc={doc} access={access} />
+          )}
+        />
+      </Box>
+    </>
   );
 };

src/frontend/apps/impress/src/features/docs/doc-share/components/DocShareModalFooter.tsx

@@ -10,9 +10,14 @@ import { DocVisibility } from './DocVisibility';
 type Props = {
   doc: Doc;
   onClose: () => void;
+  canEditVisibility?: boolean;
 };
 
-export const DocShareModalFooter = ({ doc, onClose }: Props) => {
+export const DocShareModalFooter = ({
+  doc,
+  onClose,
+  canEditVisibility = true,
+}: Props) => {
   const copyDocLink = useCopyDocLink(doc.id);
   const { t } = useTranslation();
   return (
@@ -22,10 +27,10 @@ export const DocShareModalFooter = ({ doc, onClose }: Props) => {
       `}
       className="--docs--doc-share-modal-footer"
     >
-      <HorizontalSeparator $withPadding={true} />
+      <HorizontalSeparator $withPadding={true} customPadding="12px" />
 
-      <DocVisibility doc={doc} />
-      <HorizontalSeparator />
+      <DocVisibility doc={doc} canEdit={canEditVisibility} />
+      <HorizontalSeparator customPadding="12px" />
 
       <Box
         $direction="row"

src/frontend/apps/impress/src/features/docs/doc-share/components/DocVisibility.tsx

@@ -1,5 +1,9 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
-import { useState } from 'react';
+import {
+  Button,
+  VariantType,
+  useToastProvider,
+} from '@openfun/cunningham-react';
+import { useCallback, useMemo, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { css } from 'styled-components';
 
@@ -17,27 +21,41 @@ import {
   KEY_LIST_DOC,
   LinkReach,
   LinkRole,
+  docLinkIsDesync,
+  getDocLinkReach,
   useUpdateDocLink,
 } from '@/features/docs';
 import { useResponsiveStore } from '@/stores';
 
 import { useTranslatedShareSettings } from '../hooks/';
 
+import Desync from './../assets/desynchro.svg';
+import Undo from './../assets/undo.svg';
+
 interface DocVisibilityProps {
   doc: Doc;
+  canEdit?: boolean;
 }
 
-export const DocVisibility = ({ doc }: DocVisibilityProps) => {
+export const DocVisibility = ({ doc, canEdit = true }: DocVisibilityProps) => {
   const { t } = useTranslation();
   const { toast } = useToastProvider();
   const { isDesktop } = useResponsiveStore();
   const { spacingsTokens, colorsTokens } = useCunninghamTheme();
-  const canManage = doc.abilities.accesses_manage;
-  const [linkReach, setLinkReach] = useState<LinkReach>(doc.link_reach);
-  const [docLinkRole, setDocLinkRole] = useState<LinkRole>(doc.link_role);
+  const canManage = doc.abilities.accesses_manage && canEdit;
+  const [linkReach, setLinkReach] = useState<LinkReach>(getDocLinkReach(doc));
+  const [docLinkRole, setDocLinkRole] = useState<LinkRole>(
+    doc.computed_link_role ?? LinkRole.READER,
+  );
+
   const { linkModeTranslations, linkReachChoices, linkReachTranslations } =
     useTranslatedShareSettings();
 
+  const description =
+    docLinkRole === LinkRole.READER
+      ? linkReachChoices[linkReach].descriptionReadOnly
+      : linkReachChoices[linkReach].descriptionEdit;
+
   const api = useUpdateDocLink({
     onSuccess: () => {
       toast(
@@ -51,38 +69,94 @@ export const DocVisibility = ({ doc }: DocVisibilityProps) => {
     listInvalideQueries: [KEY_LIST_DOC, KEY_DOC],
   });
 
-  const updateReach = (link_reach: LinkReach) => {
-    api.mutate({ id: doc.id, link_reach });
-    setLinkReach(link_reach);
-  };
+  const updateReach = useCallback(
+    (link_reach: LinkReach, link_role?: LinkRole) => {
+      const params: {
+        id: string;
+        link_reach: LinkReach;
+        link_role?: LinkRole;
+      } = {
+        id: doc.id,
+        link_reach,
+      };
 
-  const updateLinkRole = (link_role: LinkRole) => {
-    api.mutate({ id: doc.id, link_role });
-    setDocLinkRole(link_role);
-  };
-
-  const linkReachOptions: DropdownMenuOption[] = Object.keys(
-    linkReachTranslations,
-  ).map((key) => ({
-    label: linkReachTranslations[key as LinkReach],
-    icon: linkReachChoices[key as LinkReach].icon,
-    callback: () => updateReach(key as LinkReach),
-    isSelected: linkReach === (key as LinkReach),
-  }));
-
-  const linkMode: DropdownMenuOption[] = Object.keys(linkModeTranslations).map(
-    (key) => ({
-      label: linkModeTranslations[key as LinkRole],
-      callback: () => updateLinkRole(key as LinkRole),
-      isSelected: docLinkRole === (key as LinkRole),
-    }),
+      api.mutate(params);
+      setLinkReach(link_reach);
+      if (link_role) {
+        params.link_role = link_role;
+        setDocLinkRole(link_role);
+      }
+    },
+    [api, doc.id],
   );
 
-  const showLinkRoleOptions = doc.link_reach !== LinkReach.RESTRICTED;
-  const description =
-    docLinkRole === LinkRole.READER
-      ? linkReachChoices[linkReach].descriptionReadOnly
-      : linkReachChoices[linkReach].descriptionEdit;
+  const updateLinkRole = useCallback(
+    (link_role: LinkRole) => {
+      api.mutate({ id: doc.id, link_role });
+      setDocLinkRole(link_role);
+    },
+    [api, doc.id],
+  );
+
+  const linkReachOptions: DropdownMenuOption[] = useMemo(() => {
+    return Object.values(LinkReach).map((key) => {
+      const isDisabled =
+        doc.abilities.link_select_options[key as LinkReach] === undefined;
+
+      return {
+        label: linkReachTranslations[key as LinkReach],
+        callback: () => updateReach(key as LinkReach),
+        isSelected: linkReach === (key as LinkReach),
+        disabled: isDisabled,
+      };
+    });
+  }, [doc, linkReach, linkReachTranslations, updateReach]);
+
+  const haveDisabledOptions = linkReachOptions.some(
+    (option) => option.disabled,
+  );
+
+  const showLinkRoleOptions = doc.computed_link_reach !== LinkReach.RESTRICTED;
+
+  const linkRoleOptions: DropdownMenuOption[] = useMemo(() => {
+    const options = doc.abilities.link_select_options[linkReach] ?? [];
+    return Object.values(LinkRole).map((key) => {
+      const isDisabled = !options.includes(key);
+      return {
+        label: linkModeTranslations[key],
+        callback: () => updateLinkRole(key),
+        isSelected: docLinkRole === key,
+        disabled: isDisabled,
+      };
+    });
+  }, [doc, docLinkRole, linkModeTranslations, updateLinkRole, linkReach]);
+
+  const haveDisabledLinkRoleOptions = linkRoleOptions.some(
+    (option) => option.disabled,
+  );
+
+  const undoDesync = () => {
+    const params: {
+      id: string;
+      link_reach: LinkReach;
+      link_role?: LinkRole;
+    } = {
+      id: doc.id,
+      link_reach: doc.ancestors_link_reach,
+    };
+    if (doc.ancestors_link_role) {
+      params.link_role = doc.ancestors_link_role;
+    }
+    api.mutate(params);
+    setLinkReach(doc.ancestors_link_reach);
+    if (doc.ancestors_link_role) {
+      setDocLinkRole(doc.ancestors_link_role);
+    }
+  };
+
+  const showDesync = useMemo(() => {
+    return docLinkIsDesync(doc);
+  }, [doc]);
 
   return (
     <Box
@@ -94,6 +168,38 @@ export const DocVisibility = ({ doc }: DocVisibilityProps) => {
       <Text $weight="700" $size="sm" $variation="700">
         {t('Link parameters')}
       </Text>
+      {showDesync && (
+        <Box
+          $background={colorsTokens['primary-100']}
+          $padding="3xs"
+          $direction="row"
+          $align="center"
+          $justify="space-between"
+          $gap={spacingsTokens['4xs']}
+          $color={colorsTokens['primary-800']}
+          $css={css`
+            border: 1px solid ${colorsTokens['primary-300']};
+            border-radius: ${spacingsTokens['2xs']};
+          `}
+        >
+          <Box $direction="row" $align="center" $gap={spacingsTokens['3xs']}>
+            <Desync />
+            <Text $size="xs" $theme="primary" $variation="800" $weight="400">
+              {t('Sharing rules differ from the parent page')}
+            </Text>
+          </Box>
+          {doc.abilities.accesses_manage && (
+            <Button
+              onClick={undoDesync}
+              size="small"
+              color="primary-text"
+              icon={<Undo />}
+            >
+              {t('Restore')}
+            </Button>
+          )}
+        </Box>
+      )}
       <Box
         $direction="row"
         $align="center"
@@ -115,6 +221,13 @@ export const DocVisibility = ({ doc }: DocVisibilityProps) => {
             `}
             disabled={!canManage}
             showArrow={true}
+            topMessage={
+              haveDisabledOptions
+                ? t(
+                    'You cannot restrict access to a subpage relative to its parent page.',
+                  )
+                : undefined
+            }
             options={linkReachOptions}
           >
             <Box $direction="row" $align="center" $gap={spacingsTokens['3xs']}>
@@ -145,7 +258,14 @@ export const DocVisibility = ({ doc }: DocVisibilityProps) => {
               <DropdownMenu
                 disabled={!canManage}
                 showArrow={true}
-                options={linkMode}
+                options={linkRoleOptions}
+                topMessage={
+                  haveDisabledLinkRoleOptions
+                    ? t(
+                        'You cannot restrict access to a subpage relative to its parent page.',
+                      )
+                    : undefined
+                }
                 label={t('Visibility mode')}
               >
                 <Text $weight="initial" $variation="600">

src/frontend/apps/impress/src/features/docs/doc-share/types.tsx

@@ -17,6 +17,14 @@ export interface Invitation {
   };
 }
 
+/**
+ * Type guard to check if an object is an Invitation
+ * Invitation has unique properties: email, issuer, is_expired, and document as a string
+ */
+export const isInvitation = (obj: unknown): obj is Invitation => {
+  return obj !== null && typeof obj === 'object' && 'issuer' in obj;
+};
+
 export enum OptionType {
   INVITATION = 'invitation',
   NEW_MEMBER = 'new_member',

src/frontend/apps/impress/src/features/docs/doc-tree/api/index.ts

@@ -0,0 +1 @@
+export * from './useDocChildren';

src/frontend/apps/impress/src/features/docs/doc-tree/api/useCreateChildren.tsx

@@ -0,0 +1,44 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
+import { Doc, KEY_LIST_DOC } from '../../doc-management';
+
+export type CreateDocParam = Pick<Doc, 'title'> & {
+  parentId: string;
+};
+
+export const createDocChildren = async ({
+  title,
+  parentId,
+}: CreateDocParam): Promise<Doc> => {
+  const response = await fetchAPI(`documents/${parentId}/children/`, {
+    method: 'POST',
+    body: JSON.stringify({
+      title,
+    }),
+  });
+
+  if (!response.ok) {
+    throw new APIError('Failed to create the doc', await errorCauses(response));
+  }
+
+  return response.json() as Promise<Doc>;
+};
+
+interface CreateDocProps {
+  onSuccess: (data: Doc) => void;
+}
+
+export function useCreateChildrenDoc({ onSuccess }: CreateDocProps) {
+  const queryClient = useQueryClient();
+  return useMutation<Doc, APIError, CreateDocParam>({
+    mutationFn: createDocChildren,
+    onSuccess: (data) => {
+      void queryClient.resetQueries({
+        queryKey: [KEY_LIST_DOC],
+      });
+      onSuccess(data);
+    },
+  });
+}

src/frontend/apps/impress/src/features/docs/doc-tree/api/useDetach.tsx

@@ -0,0 +1,51 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
+import { KEY_DOC, KEY_LIST_DOC } from '../../doc-management';
+
+export type DetachDocParam = {
+  documentId: string;
+  rootId: string;
+};
+
+enum POSITION_MOVE {
+  FIRST_CHILD = 'first-child',
+  LAST_CHILD = 'last-child',
+  FIRST_SIBLING = 'first-sibling',
+  LAST_SIBLING = 'last-sibling',
+  LEFT = 'left',
+  RIGHT = 'right',
+}
+
+export const detachDoc = async ({
+  documentId,
+  rootId,
+}: DetachDocParam): Promise<void> => {
+  const response = await fetchAPI(`documents/${documentId}/move/`, {
+    method: 'POST',
+    body: JSON.stringify({
+      target_document_id: rootId,
+      position: POSITION_MOVE.LAST_SIBLING,
+    }),
+  });
+
+  if (!response.ok) {
+    throw new APIError('Failed to move the doc', await errorCauses(response));
+  }
+
+  return response.json() as Promise<void>;
+};
+
+export function useDetachDoc() {
+  const queryClient = useQueryClient();
+  return useMutation<void, APIError, DetachDocParam>({
+    mutationFn: detachDoc,
+    onSuccess: (_data, variables) => {
+      void queryClient.invalidateQueries({ queryKey: [KEY_LIST_DOC] });
+      void queryClient.invalidateQueries({
+        queryKey: [KEY_DOC, { id: variables.documentId }],
+      });
+    },
+  });
+}

src/frontend/apps/impress/src/features/docs/doc-tree/api/useDocChildren.tsx

@@ -0,0 +1,58 @@
+import { UseQueryOptions, useQuery } from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI, useAPIInfiniteQuery } from '@/api';
+
+import { DocsResponse } from '../../doc-management';
+
+export type DocsChildrenParams = {
+  docId: string;
+  page?: number;
+  page_size?: number;
+};
+
+export const getDocChildren = async (
+  params: DocsChildrenParams,
+): Promise<DocsResponse> => {
+  const { docId, page, page_size } = params;
+  const searchParams = new URLSearchParams();
+
+  if (page) {
+    searchParams.set('page', page.toString());
+  }
+  if (page_size) {
+    searchParams.set('page_size', page_size.toString());
+  }
+
+  const response = await fetchAPI(
+    `documents/${docId}/children/?${searchParams.toString()}`,
+  );
+
+  if (!response.ok) {
+    throw new APIError(
+      'Failed to get the doc children',
+      await errorCauses(response),
+    );
+  }
+
+  return response.json() as Promise<DocsResponse>;
+};
+
+export const KEY_LIST_DOC_CHILDREN = 'doc-children';
+
+export function useDocChildren(
+  params: DocsChildrenParams,
+  queryConfig?: Omit<
+    UseQueryOptions<DocsResponse, APIError, DocsResponse>,
+    'queryKey' | 'queryFn'
+  >,
+) {
+  return useQuery<DocsResponse, APIError, DocsResponse>({
+    queryKey: [KEY_LIST_DOC_CHILDREN, params],
+    queryFn: () => getDocChildren(params),
+    ...queryConfig,
+  });
+}
+
+export const useInfiniteDocChildren = (params: DocsChildrenParams) => {
+  return useAPIInfiniteQuery(KEY_LIST_DOC_CHILDREN, getDocChildren, params);
+};

src/frontend/apps/impress/src/features/docs/doc-tree/api/useDocTree.tsx

@@ -0,0 +1,44 @@
+import { UseQueryOptions, useQuery } from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
+import { Doc } from '../../doc-management';
+
+export type DocsTreeParams = {
+  docId: string;
+};
+
+export const getDocTree = async ({ docId }: DocsTreeParams): Promise<Doc> => {
+  const searchParams = new URLSearchParams();
+
+  const response = await fetchAPI(
+    `documents/${docId}/tree/?${searchParams.toString()}`,
+  );
+
+  if (!response.ok) {
+    throw new APIError(
+      'Failed to get the doc tree',
+      await errorCauses(response),
+    );
+  }
+
+  return response.json() as Promise<Doc>;
+};
+
+export const KEY_LIST_DOC_CHILDREN = 'doc-tree';
+
+export function useDocTree(
+  params: DocsTreeParams,
+  queryConfig?: Omit<
+    UseQueryOptions<Doc, APIError, Doc>,
+    'queryKey' | 'queryFn'
+  >,
+) {
+  return useQuery<Doc, APIError, Doc>({
+    queryKey: [KEY_LIST_DOC_CHILDREN, params],
+    queryFn: () => getDocTree(params),
+    staleTime: 0,
+    refetchOnWindowFocus: false,
+    ...queryConfig,
+  });
+}

src/frontend/apps/impress/src/features/docs/doc-tree/api/useMove.tsx

@@ -0,0 +1,36 @@
+import { TreeViewMoveModeEnum } from '@gouvfr-lasuite/ui-kit';
+import { useMutation } from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
+export type MoveDocParam = {
+  sourceDocumentId: string;
+  targetDocumentId: string;
+  position: TreeViewMoveModeEnum;
+};
+
+export const moveDoc = async ({
+  sourceDocumentId,
+  targetDocumentId,
+  position,
+}: MoveDocParam): Promise<void> => {
+  const response = await fetchAPI(`documents/${sourceDocumentId}/move/`, {
+    method: 'POST',
+    body: JSON.stringify({
+      target_document_id: targetDocumentId,
+      position,
+    }),
+  });
+
+  if (!response.ok) {
+    throw new APIError('Failed to move the doc', await errorCauses(response));
+  }
+
+  return response.json() as Promise<void>;
+};
+
+export function useMoveDoc() {
+  return useMutation<void, APIError, MoveDocParam>({
+    mutationFn: moveDoc,
+  });
+}

src/frontend/apps/impress/src/features/docs/doc-tree/assets/doc-extract-bold.svg

@@ -0,0 +1,10 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g id="doc-extract-bold">
+<g id="v">
+<path d="M6.55506 1.00488C5.47953 1.00488 4.65315 1.27911 4.09474 1.84468C3.54378 2.40996 3.27635 3.243 3.27635 4.32461V9.32492C3.27635 9.80842 3.66829 10.2004 4.15179 10.2004C4.63528 10.2004 5.02723 9.80841 5.02723 9.32492V4.35537C5.02723 3.84268 5.16053 3.44961 5.42713 3.17617C5.70057 2.8959 6.10389 2.75576 6.63709 2.75576H17.3627C17.8959 2.75576 18.2958 2.8959 18.5624 3.17617C18.8358 3.44961 18.9725 3.84268 18.9725 4.35537V19.849C18.9725 20.3617 18.8358 20.7548 18.5624 21.0282C18.2958 21.3017 17.8959 21.4384 17.3627 21.4384H6.15179C5.66829 21.4384 5.27635 21.8303 5.27635 22.3138C5.27635 22.7973 5.66829 23.1893 6.15179 23.1893H17.4447C18.5196 23.1893 19.3427 22.9188 19.8945 22.36C20.4531 21.8013 20.7234 20.9681 20.7234 19.8798V4.32461C20.7234 3.24283 20.4529 2.41014 19.895 1.84491C19.3433 1.27899 18.52 1.00488 17.4447 1.00488H6.55506Z" fill="#3A3A3A"/>
+<path d="M7.57952 6.92596C7.44484 6.78335 7.37791 6.60799 7.37791 6.40613C7.37791 6.20426 7.44493 6.03109 7.58152 5.8945C7.72454 5.75147 7.90435 5.68064 8.11365 5.68064H15.8964C16.0991 5.68064 16.2722 5.75171 16.408 5.89447C16.5508 6.03032 16.6219 6.20341 16.6219 6.40613C16.6219 6.60927 16.5506 6.78494 16.409 6.92701C16.273 7.07046 16.0996 7.14187 15.8964 7.14187H8.11365C7.90435 7.14187 7.72454 7.07104 7.58152 6.92801L7.57952 6.92596Z" fill="#3A3A3A"/>
+<path d="M7.57952 10.5046C7.44484 10.362 7.37791 10.1866 7.37791 9.98474C7.37791 9.78287 7.44493 9.6097 7.58152 9.47311C7.72454 9.33009 7.90435 9.25925 8.11365 9.25925H12.8964C13.0991 9.25925 13.2722 9.33033 13.408 9.47309C13.5508 9.60894 13.6219 9.78203 13.6219 9.98474C13.6219 10.1879 13.5506 10.3635 13.409 10.5056C13.273 10.6491 13.0996 10.7205 12.8964 10.7205H8.11365C7.90435 10.7205 7.72454 10.6497 7.58152 10.5066L7.57952 10.5046Z" fill="#3A3A3A"/>
+<path d="M9.00585 15.2969C9.25312 15.2969 9.46502 15.3871 9.63536 15.5651L9.63681 15.5667C9.80413 15.7492 9.89012 15.9622 9.89012 16.2018C9.89012 16.4476 9.80462 16.6615 9.63536 16.8385C9.46502 17.0166 9.25312 17.1067 9.00585 17.1067L3.8356 17.1068L2.55652 17.0467L3.17319 17.6476L3.99584 18.46C4.08854 18.538 4.15905 18.6324 4.20614 18.7423C4.25266 18.8508 4.27614 18.964 4.27614 19.0809C4.27614 19.3164 4.20319 19.5176 4.05259 19.6761L4.05078 19.6779C3.89321 19.8355 3.69523 19.9136 3.4641 19.9136C3.33425 19.9136 3.21525 19.887 3.10984 19.8309C3.00798 19.7833 2.91578 19.7133 2.83314 19.6232L0.305043 16.8784L0.303364 16.8765C0.203911 16.7628 0.128885 16.6522 0.0820713 16.5445C0.0268526 16.4404 0 16.3254 0 16.2018C0 16.0777 0.0270643 15.9624 0.0827236 15.8579C0.129533 15.7575 0.204382 15.6505 0.303343 15.5374L2.83314 12.7805C2.91656 12.6895 3.00961 12.619 3.11262 12.5715C3.21742 12.5231 3.33536 12.5004 3.4641 12.5004C3.69367 12.5004 3.89115 12.5739 4.04904 12.7238L4.05257 12.7276C4.20317 12.8861 4.27614 13.0873 4.27614 13.3227C4.27614 13.4397 4.25266 13.5528 4.20614 13.6614C4.15905 13.7713 4.08854 13.8656 3.99583 13.9437L3.17271 14.7565L2.55652 15.3569L3.8309 15.2969H9.00585Z" fill="#3A3A3A"/>
+</g>
+</g>
+</svg>

src/frontend/apps/impress/src/features/docs/doc-tree/assets/sub-page-logo.svg

@@ -0,0 +1,3 @@
+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M5.40918 4.69434C5.28613 4.69434 5.18359 4.65332 5.10156 4.57129C5.02409 4.48926 4.98535 4.389 4.98535 4.27051C4.98535 4.15202 5.02409 4.05404 5.10156 3.97656C5.18359 3.89453 5.28613 3.85352 5.40918 3.85352H10.5977C10.7161 3.85352 10.8141 3.89453 10.8916 3.97656C10.9736 4.05404 11.0146 4.15202 11.0146 4.27051C11.0146 4.389 10.9736 4.48926 10.8916 4.57129C10.8141 4.65332 10.7161 4.69434 10.5977 4.69434H5.40918ZM5.40918 7.08008C5.28613 7.08008 5.18359 7.03906 5.10156 6.95703C5.02409 6.875 4.98535 6.77474 4.98535 6.65625C4.98535 6.53776 5.02409 6.43978 5.10156 6.3623C5.18359 6.28027 5.28613 6.23926 5.40918 6.23926H10.5977C10.7161 6.23926 10.8141 6.28027 10.8916 6.3623C10.9736 6.43978 11.0146 6.53776 11.0146 6.65625C11.0146 6.77474 10.9736 6.875 10.8916 6.95703C10.8141 7.03906 10.7161 7.08008 10.5977 7.08008H5.40918ZM5.40918 9.46582C5.28613 9.46582 5.18359 9.42708 5.10156 9.34961C5.02409 9.26758 4.98535 9.1696 4.98535 9.05566C4.98535 8.93262 5.02409 8.83008 5.10156 8.74805C5.18359 8.66602 5.28613 8.625 5.40918 8.625H7.86328C7.98633 8.625 8.08659 8.66602 8.16406 8.74805C8.24609 8.83008 8.28711 8.93262 8.28711 9.05566C8.28711 9.1696 8.24609 9.26758 8.16406 9.34961C8.08659 9.42708 7.98633 9.46582 7.86328 9.46582H5.40918ZM2.25098 13.2529V2.88281C2.25098 2.17188 2.42643 1.63639 2.77734 1.27637C3.13281 0.916341 3.66374 0.736328 4.37012 0.736328H11.6299C12.3363 0.736328 12.8649 0.916341 13.2158 1.27637C13.5713 1.63639 13.749 2.17188 13.749 2.88281V13.2529C13.749 13.9684 13.5713 14.5039 13.2158 14.8594C12.8649 15.2148 12.3363 15.3926 11.6299 15.3926H4.37012C3.66374 15.3926 3.13281 15.2148 2.77734 14.8594C2.42643 14.5039 2.25098 13.9684 2.25098 13.2529ZM3.35156 13.2324C3.35156 13.5742 3.44043 13.8363 3.61816 14.0186C3.80046 14.2008 4.06934 14.292 4.4248 14.292H11.5752C11.9307 14.292 12.1973 14.2008 12.375 14.0186C12.5573 13.8363 12.6484 13.5742 12.6484 13.2324V2.90332C12.6484 2.56152 12.5573 2.29948 12.375 2.11719C12.1973 1.93034 11.9307 1.83691 11.5752 1.83691H4.4248C4.06934 1.83691 3.80046 1.93034 3.61816 2.11719C3.44043 2.29948 3.35156 2.56152 3.35156 2.90332V13.2324Z" fill="#8585F6"/>
+</svg>

src/frontend/apps/impress/src/features/docs/doc-tree/components/DocSubPageItem.tsx

@@ -0,0 +1,181 @@
+import {
+  TreeViewItem,
+  TreeViewNodeProps,
+  useTreeContext,
+} from '@gouvfr-lasuite/ui-kit';
+import { useRouter } from 'next/navigation';
+import { useEffect, useRef, useState } from 'react';
+import { css } from 'styled-components';
+
+import { Box, Icon, Text } from '@/components';
+import { useCunninghamTheme } from '@/cunningham';
+import {
+  Doc,
+  KEY_SUB_PAGE,
+  useDoc,
+  useTrans,
+} from '@/features/docs/doc-management';
+import { useLeftPanelStore } from '@/features/left-panel';
+
+import Logo from './../assets/sub-page-logo.svg';
+import { DocTreeItemActions } from './DocTreeItemActions';
+
+const ItemTextCss = css`
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: initial;
+  display: -webkit-box;
+  line-clamp: 1;
+  -webkit-line-clamp: 1;
+  -webkit-box-orient: vertical;
+`;
+
+type Props = TreeViewNodeProps<Doc>;
+export const DocSubPageItem = (props: Props) => {
+  const doc = props.node.data.value as Doc;
+  const treeContext = useTreeContext<Doc>();
+  const { untitledDocument } = useTrans(doc);
+  const { node } = props;
+  const { spacingsTokens } = useCunninghamTheme();
+  const [actionsOpen, setActionsOpen] = useState(false);
+
+  const router = useRouter();
+  const { togglePanel } = useLeftPanelStore();
+
+  const isInitialLoad = useRef(false);
+  const { data: docQuery } = useDoc(
+    { id: doc.id },
+    {
+      initialData: doc,
+      queryKey: [KEY_SUB_PAGE, { id: doc.id }],
+      refetchOnMount: false,
+      refetchOnWindowFocus: false,
+    },
+  );
+
+  useEffect(() => {
+    if (docQuery && isInitialLoad.current === true) {
+      treeContext?.treeData.updateNode(docQuery.id, docQuery);
+    }
+
+    if (docQuery) {
+      isInitialLoad.current = true;
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [docQuery]);
+
+  const afterCreate = (createdDoc: Doc) => {
+    const actualChildren = node.data.children ?? [];
+
+    if (actualChildren.length === 0) {
+      treeContext?.treeData
+        .handleLoadChildren(node?.data.value.id)
+        .then((allChildren) => {
+          node.open();
+
+          router.push(`/docs/${createdDoc.id}`);
+          treeContext?.treeData.setChildren(node.data.value.id, allChildren);
+          treeContext?.treeData.setSelectedNode(createdDoc);
+          togglePanel();
+        })
+        .catch(console.error);
+    } else {
+      const newDoc = {
+        ...createdDoc,
+        children: [],
+        childrenCount: 0,
+        parentId: node.id,
+      };
+      treeContext?.treeData.addChild(node.data.value.id, newDoc);
+      node.open();
+      router.push(`/docs/${createdDoc.id}`);
+      treeContext?.treeData.setSelectedNode(newDoc);
+      togglePanel();
+    }
+  };
+
+  return (
+    <Box
+      className="--docs-sub-page-item"
+      $css={css`
+        background-color: ${actionsOpen
+          ? 'var(--c--theme--colors--greyscale-100)'
+          : 'var(--c--theme--colors--greyscale-000)'};
+
+        .light-doc-item-actions {
+          display: ${actionsOpen ? 'flex' : 'none'};
+        }
+
+        &:hover {
+          background-color: var(--c--theme--colors--greyscale-100);
+          border-radius: 4px;
+
+          .light-doc-item-actions {
+            display: flex;
+          }
+        }
+      `}
+    >
+      <TreeViewItem
+        {...props}
+        onClick={() => {
+          treeContext?.treeData.setSelectedNode(props.node.data.value as Doc);
+          router.push(`/docs/${props.node.data.value.id}`);
+        }}
+      >
+        <Box
+          data-testid={`doc-sub-page-item-${props.node.data.value.id}`}
+          $width="100%"
+          $direction="row"
+          $gap={spacingsTokens['xs']}
+          role="button"
+          tabIndex={0}
+          $align="center"
+          $minHeight="24px"
+        >
+          <Box $width="16px" $height="16px">
+            <Logo />
+          </Box>
+
+          <Box
+            $direction="row"
+            $align="center"
+            $css={css`
+              display: flex;
+              flex-direction: row;
+              width: 100%;
+              gap: 0.5rem;
+              align-items: center;
+            `}
+          >
+            <Text $css={ItemTextCss} $size="sm" $variation="1000">
+              {doc.title || untitledDocument}
+            </Text>
+            {doc.nb_accesses_direct >= 1 && (
+              <Icon
+                variant="filled"
+                iconName="group"
+                $size="16px"
+                $variation="400"
+              />
+            )}
+          </Box>
+
+          <Box
+            $direction="row"
+            $align="center"
+            className="light-doc-item-actions"
+          >
+            <DocTreeItemActions
+              doc={doc}
+              isOpen={actionsOpen}
+              onOpenChange={setActionsOpen}
+              parentId={node.data.parentKey}
+              onCreateSuccess={afterCreate}
+            />
+          </Box>
+        </Box>
+      </TreeViewItem>
+    </Box>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-tree/components/DocTree.tsx

@@ -0,0 +1,251 @@
+import {
+  OpenMap,
+  TreeView,
+  TreeViewMoveResult,
+  useTreeContext,
+} from '@gouvfr-lasuite/ui-kit';
+import { useRouter } from 'next/navigation';
+import { useEffect, useRef, useState } from 'react';
+import { css } from 'styled-components';
+
+import { Box, StyledLink } from '@/components';
+import { useCunninghamTheme } from '@/cunningham';
+
+import { Doc, KEY_SUB_PAGE, useDoc, useDocStore } from '../../doc-management';
+import { SimpleDocItem } from '../../docs-grid';
+import { useDocTree } from '../api/useDocTree';
+import { useMoveDoc } from '../api/useMove';
+import { canDrag, canDrop, serializeDocToSubPage } from '../utils';
+
+import { DocSubPageItem } from './DocSubPageItem';
+import { DocTreeItemActions } from './DocTreeItemActions';
+
+type DocTreeProps = {
+  initialTargetId: string;
+};
+export const DocTree = ({ initialTargetId }: DocTreeProps) => {
+  const { spacingsTokens } = useCunninghamTheme();
+
+  const [rootActionsOpen, setRootActionsOpen] = useState(false);
+  const treeContext = useTreeContext<Doc>();
+  const { currentDoc } = useDocStore();
+  const router = useRouter();
+
+  const previousDocId = useRef<string | null>(initialTargetId);
+
+  const { data: rootNode } = useDoc(
+    { id: treeContext?.root?.id ?? '' },
+    {
+      enabled: !!treeContext?.root?.id,
+      initialData: treeContext?.root ?? undefined,
+      queryKey: [KEY_SUB_PAGE, { id: treeContext?.root?.id ?? '' }],
+      refetchOnMount: false,
+      refetchOnWindowFocus: false,
+    },
+  );
+
+  const [initialOpenState, setInitialOpenState] = useState<OpenMap | undefined>(
+    undefined,
+  );
+
+  const { mutate: moveDoc } = useMoveDoc();
+
+  const { data } = useDocTree({
+    docId: initialTargetId,
+  });
+
+  const handleMove = (result: TreeViewMoveResult) => {
+    moveDoc({
+      sourceDocumentId: result.sourceId,
+      targetDocumentId: result.targetModeId,
+      position: result.mode,
+    });
+    treeContext?.treeData.handleMove(result);
+  };
+
+  useEffect(() => {
+    if (!data) {
+      return;
+    }
+
+    const { children: rootChildren, ...root } = data;
+    const children = rootChildren ?? [];
+    treeContext?.setRoot(root);
+    const initialOpenState: OpenMap = {};
+    initialOpenState[root.id] = true;
+    const serialize = (children: Doc[]) => {
+      children.forEach((child) => {
+        child.childrenCount = child.numchild ?? 0;
+        if (child?.children?.length && child?.children?.length > 0) {
+          initialOpenState[child.id] = true;
+        }
+        serialize(child.children ?? []);
+      });
+    };
+    serialize(children);
+
+    treeContext?.treeData.resetTree(children);
+    setInitialOpenState(initialOpenState);
+    if (initialTargetId === root.id) {
+      treeContext?.treeData.setSelectedNode(root);
+    } else {
+      treeContext?.treeData.selectNodeById(initialTargetId);
+    }
+
+    // Because treeData change in the treeContext, we have a infinite loop
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [data, initialTargetId]);
+
+  useEffect(() => {
+    if (
+      !currentDoc ||
+      (previousDocId.current && previousDocId.current === currentDoc.id)
+    ) {
+      return;
+    }
+
+    const item = treeContext?.treeData.getNode(currentDoc?.id ?? '');
+    if (!item && currentDoc.id !== rootNode?.id) {
+      treeContext?.treeData.resetTree([]);
+      treeContext?.setRoot(currentDoc);
+      treeContext?.setInitialTargetId(currentDoc.id);
+    } else if (item) {
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      const { children, ...rest } = currentDoc;
+      treeContext?.treeData.updateNode(
+        currentDoc.id,
+        serializeDocToSubPage(rest),
+      );
+    }
+    if (currentDoc?.id && currentDoc?.id !== previousDocId.current) {
+      previousDocId.current = currentDoc?.id;
+    }
+
+    treeContext?.treeData.setSelectedNode(currentDoc);
+
+    // we don't need to run this effect on every change of treeContext.data because it cause an infinite loop
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [currentDoc, rootNode?.id]);
+
+  const rootIsSelected =
+    treeContext?.treeData.selectedNode?.id === treeContext?.root?.id;
+
+  if (!initialTargetId || !treeContext) {
+    return null;
+  }
+
+  return (
+    <Box
+      data-testid="doc-tree"
+      $height="100%"
+      $css={css`
+        .c__tree-view--container {
+          z-index: 1;
+          margin-top: -10px;
+        }
+      `}
+    >
+      <Box
+        $padding={{ horizontal: 'sm', top: 'sm', bottom: '4px' }}
+        $css={css`
+          z-index: 2;
+        `}
+      >
+        <Box
+          data-testid="doc-tree-root-item"
+          $css={css`
+            padding: ${spacingsTokens['2xs']};
+            border-radius: 4px;
+            width: 100%;
+            background-color: ${rootIsSelected || rootActionsOpen
+              ? 'var(--c--theme--colors--greyscale-100)'
+              : 'transparent'};
+
+            &:hover {
+              background-color: var(--c--theme--colors--greyscale-100);
+            }
+
+            .doc-tree-root-item-actions {
+              display: 'flex';
+              opacity: ${rootActionsOpen ? '1' : '0'};
+
+              &:has(.isOpen) {
+                opacity: 1;
+              }
+            }
+            &:hover {
+              .doc-tree-root-item-actions {
+                opacity: 1;
+              }
+            }
+          `}
+        >
+          {treeContext.root !== null && rootNode && (
+            <StyledLink
+              $css={css`
+                width: 100%;
+              `}
+              href={`/docs/${treeContext.root.id}`}
+              onClick={(e) => {
+                e.stopPropagation();
+                e.preventDefault();
+                treeContext.treeData.setSelectedNode(
+                  treeContext.root ?? undefined,
+                );
+                router.push(`/docs/${treeContext?.root?.id}`);
+              }}
+            >
+              <Box $direction="row" $align="center" $width="100%">
+                <SimpleDocItem doc={rootNode} showAccesses={true} />
+                <div className="doc-tree-root-item-actions">
+                  <DocTreeItemActions
+                    doc={rootNode}
+                    onCreateSuccess={(createdDoc) => {
+                      const newDoc = {
+                        ...createdDoc,
+                        children: [],
+                        childrenCount: 0,
+                        parentId: treeContext.root?.id ?? undefined,
+                      };
+                      treeContext?.treeData.addChild(null, newDoc);
+                    }}
+                    isOpen={rootActionsOpen}
+                    onOpenChange={setRootActionsOpen}
+                  />
+                </div>
+              </Box>
+            </StyledLink>
+          )}
+        </Box>
+      </Box>
+
+      {initialOpenState && treeContext.treeData.nodes.length > 0 && (
+        <TreeView
+          initialOpenState={initialOpenState}
+          afterMove={handleMove}
+          selectedNodeId={
+            treeContext.treeData.selectedNode?.id ??
+            treeContext.initialTargetId ??
+            undefined
+          }
+          canDrop={({ parentNode }) => {
+            if (!rootNode) {
+              return false;
+            }
+            const parentDoc = parentNode?.data.value as Doc;
+            if (!parentDoc) {
+              return canDrop(rootNode);
+            }
+            return canDrop(parentDoc);
+          }}
+          canDrag={(node) => {
+            const doc = node.value as Doc;
+            return canDrag(doc);
+          }}
+          rootNodeId={treeContext.root?.id ?? ''}
+          renderNode={DocSubPageItem}
+        />
+      )}
+    </Box>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-tree/components/DocTreeItemActions.tsx

@@ -0,0 +1,171 @@
+import {
+  DropdownMenu,
+  DropdownMenuOption,
+  useTreeContext,
+} from '@gouvfr-lasuite/ui-kit';
+import { useModal } from '@openfun/cunningham-react';
+import { useRouter } from 'next/router';
+import { Fragment } from 'react';
+import { useTranslation } from 'react-i18next';
+import { css } from 'styled-components';
+
+import { Box, BoxButton, Icon } from '@/components';
+
+import { Doc, ModalRemoveDoc, useCopyDocLink } from '../../doc-management';
+import { useCreateChildrenDoc } from '../api/useCreateChildren';
+import { useDetachDoc } from '../api/useDetach';
+import MoveDocIcon from '../assets/doc-extract-bold.svg';
+import { useTreeUtils } from '../hooks';
+import { isOwnerOrAdmin } from '../utils';
+
+type DocTreeItemActionsProps = {
+  doc: Doc;
+  parentId?: string | null;
+  onCreateSuccess?: (newDoc: Doc) => void;
+  isOpen?: boolean;
+  onOpenChange?: (isOpen: boolean) => void;
+};
+
+export const DocTreeItemActions = ({
+  doc,
+  parentId,
+  onCreateSuccess,
+  isOpen,
+  onOpenChange,
+}: DocTreeItemActionsProps) => {
+  const router = useRouter();
+  const { t } = useTranslation();
+  const deleteModal = useModal();
+
+  const copyLink = useCopyDocLink(doc.id);
+  const canUpdate = isOwnerOrAdmin(doc);
+  const { isCurrentParent } = useTreeUtils(doc);
+  const { mutate: detachDoc } = useDetachDoc();
+  const treeContext = useTreeContext<Doc>();
+
+  const handleDetachDoc = () => {
+    if (!treeContext?.root) {
+      return;
+    }
+
+    detachDoc(
+      { documentId: doc.id, rootId: treeContext.root.id },
+      {
+        onSuccess: () => {
+          treeContext.treeData.deleteNode(doc.id);
+          if (treeContext.root) {
+            treeContext.treeData.setSelectedNode(treeContext.root);
+            void router.push(`/docs/${treeContext.root.id}`);
+          }
+        },
+      },
+    );
+  };
+
+  const options: DropdownMenuOption[] = [
+    {
+      label: t('Copy link'),
+      icon: <Icon iconName="link" $size="24px" />,
+      callback: copyLink,
+    },
+    ...(!isCurrentParent
+      ? [
+          {
+            label: t('Move to my docs'),
+            isDisabled: !canUpdate,
+            icon: (
+              <Box
+                $css={css`
+                  transform: scale(0.8);
+                `}
+              >
+                <MoveDocIcon />
+              </Box>
+            ),
+            callback: handleDetachDoc,
+          },
+        ]
+      : []),
+    {
+      label: t('Delete'),
+      isDisabled: !canUpdate,
+      icon: <Icon iconName="delete" $size="24px" />,
+      callback: deleteModal.open,
+    },
+  ];
+
+  const { mutate: createChildrenDoc } = useCreateChildrenDoc({
+    onSuccess: (newDoc) => {
+      onCreateSuccess?.(newDoc);
+      void router.push(`/docs/${newDoc.id}`);
+    },
+  });
+
+  const afterDelete = () => {
+    if (parentId) {
+      treeContext?.treeData.deleteNode(doc.id);
+      void router.push(`/docs/${parentId}`);
+    } else if (doc.id === treeContext?.root?.id && !parentId) {
+      void router.push(`/docs/`);
+    } else if (treeContext && treeContext.root) {
+      treeContext?.treeData.deleteNode(doc.id);
+      void router.push(`/docs/${treeContext.root.id}`);
+    }
+  };
+
+  return (
+    <Fragment>
+      <Box
+        $direction="row"
+        $align="center"
+        className="--docs--doc-tree-item-actions"
+        $gap="4px"
+      >
+        <DropdownMenu
+          options={options}
+          isOpen={isOpen}
+          onOpenChange={onOpenChange}
+        >
+          <Icon
+            onClick={(e) => {
+              e.stopPropagation();
+              e.preventDefault();
+              onOpenChange?.(!isOpen);
+            }}
+            iconName="more_horiz"
+            variant="filled"
+            $theme="primary"
+            $variation="600"
+          />
+        </DropdownMenu>
+        {canUpdate && (
+          <BoxButton
+            onClick={(e) => {
+              e.stopPropagation();
+              e.preventDefault();
+
+              createChildrenDoc({
+                parentId: doc.id,
+              });
+            }}
+            color="primary"
+          >
+            <Icon
+              variant="filled"
+              $variation="800"
+              $theme="primary"
+              iconName="add_box"
+            />
+          </BoxButton>
+        )}
+      </Box>
+      {deleteModal.isOpen && (
+        <ModalRemoveDoc
+          onClose={deleteModal.onClose}
+          doc={doc}
+          afterDelete={afterDelete}
+        />
+      )}
+    </Fragment>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-tree/hooks/index.ts

@@ -0,0 +1 @@
+export * from './useTreeUtils';

src/frontend/apps/impress/src/features/docs/doc-tree/hooks/useTreeUtils.tsx

@@ -0,0 +1,13 @@
+import { useTreeContext } from '@gouvfr-lasuite/ui-kit';
+
+import { Doc } from '@/docs/doc-management';
+
+export const useTreeUtils = (doc: Doc) => {
+  const treeContext = useTreeContext<Doc>();
+
+  return {
+    isParent: doc.nb_accesses_ancestors <= 1, // it is a parent
+    isChild: doc.nb_accesses_ancestors > 1, // it is a child
+    isCurrentParent: treeContext?.root?.id === doc.id || doc.depth === 1, // it can be a child but not for the current user
+  } as const;
+};

src/frontend/apps/impress/src/features/docs/doc-tree/index.ts

@@ -0,0 +1,3 @@
+export * from './api';
+export * from './hooks';
+export * from './utils';