✨(backend) use batches in indexing task

Reduce the number of Find API calls by grouping all the latest changes
for indexation : send all the documents updated or deleted since the
triggering of the task.

Signed-off-by: Fabre Florian <ffabre@hybird.org>

.github/workflows/docker-hub.yml

@@ -59,14 +59,6 @@ jobs:
       -
         name: Checkout repository
         uses: actions/checkout@v4
-
-      - name: Checkout custom code repository
-        uses: actions/checkout@v4
-        with:
-          repository: 'AntoLC/docs-customized'
-          ref: 'main'
-          path: docs-custom
-
       -
         name: Docker meta
         id: meta
@@ -84,7 +76,7 @@ jobs:
         name: Run trivy scan
         uses: numerique-gouv/action-trivy-cache@main
         with:
-          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production --build-arg CUSTOM_CODE=docs-custom'
+          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
           docker-image-name: 'docker.io/lasuite/impress-frontend:${{ github.sha }}'
       -
         name: Build and push
@@ -95,7 +87,6 @@ jobs:
           target: frontend-production
           build-args: |
             DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-            CUSTOM_CODE=docs-custom
             PUBLISH_AS_MIT=false
           push: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview') }}
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/helmfile-linter.yaml

@@ -21,10 +21,10 @@ jobs:
       shell: bash
       run: |
         set -e
-        HELMFILE=src/helm/helmfile.yaml.gotmpl
+        HELMFILE=src/helm/helmfile.yaml
         environments=$(awk 'BEGIN {in_env=0} /^environments:/ {in_env=1; next} /^---/ {in_env=0} in_env && /^  [^ ]/ {gsub(/^  /,""); gsub(/:.*$/,""); print}' "$HELMFILE")
         for env in $environments; do
           echo "################### $env lint ###################"
-          helmfile -e $env lint -f $HELMFILE || exit 1
+          helmfile -e $env -f $HELMFILE lint || exit 1
           echo -e "\n"
-        done
+        done

.gitignore

@@ -43,6 +43,10 @@ venv.bak/
 env.d/development/*.local
 env.d/terraform
 
+# Docker
+compose.override.yml
+docker/auth/*.local
+
 # npm
 node_modules
 

CHANGELOG.md

@@ -8,44 +8,12 @@ and this project adheres to
 
 ### Fixed
 
-- ♿(frontend) improve accessibility:
-  - ♿(frontend) improve share modal button accessibility #1626
-
-## [3.10.0] - 2025-11-18
-
-### Added
-
-- ✨(export) enable ODT export for documents #1524
-- ✨(frontend) improve mobile UX by showing subdocs count #1540
-
-### Changed
-
-- ♻️(frontend) preserve @ character when esc is pressed after typing it #1512
-- ♻️(frontend) make summary button fixed to remain visible during scroll #1581
-- ♻️(frontend) pdf embed use full width #1526
-
-### Fixed
-
 - ♿(frontend) improve accessibility:
   - ♿(frontend) improve ARIA in doc grid and editor for a11y #1519
   - ♿(frontend) improve accessibility and styling of summary table #1528
-  - ♿(frontend) add focus trap and enter key support to remove doc modal #1531
-- 🐛(frontend) fix alignment of side menu #1597
-- 🐛(frontend) fix fallback translations with Trans #1620
-- 🐛(export) fix image overflow by limiting width to 600px during export #1525
-- 🐛(export) fix table cell alignment issue in exported documents #1582
-- 🐛(export) preserve image aspect ratio in PDF export #1622
-- 🐛(export) Export fails when paste with style #1552
-
-### Security
-
-- mitigate role escalation in the ask_for_access viewset #1580
-- 🐛(frontend) preserve left panel width on window resize #1588
-
-### Removed
-
-- 🔥(backend) remove api managing templates
-
+- 🐛(docx) fix image overflow by limiting width to 600px during export #1525
+- 🐛(frontend) preserve @ character when esc is pressed after typing it #1512
+- 🐛(frontend) fix pdf embed to use full width #1526
 
 ## [3.9.0] - 2025-11-10
 
@@ -54,7 +22,6 @@ and this project adheres to
 - ✨(frontend) create skeleton component for DocEditor #1491
 - ✨(frontend) add an EmojiPicker in the document tree and title #1381
 - ✨(frontend) ajustable left panel #1456
-- ✨ Add comments feature to the editor #1330
 
 ### Changed
 
@@ -66,6 +33,7 @@ and this project adheres to
 
 - 🐛(frontend) fix duplicate document entries in grid #1479
 - 🐛(backend) fix trashbin list #1520
+
 - ♿(frontend) improve accessibility:
   - ♿(frontend) remove empty alt on logo due to Axe a11y error #1516
 - 🐛(backend) fix s3 version_id validation #1543
@@ -123,6 +91,9 @@ and this project adheres to
   - ♿ update labels and shared document icon accessibility #1442
 - 🍱(frontend) Fonts GDPR compliants #1453
 - ♻️(service-worker) improve SW registration and update handling #1473
+- ✨(backend) add async indexation of documents on save (or access save) #1276
+- ✨(backend) add debounce mechanism to limit indexation jobs #1276
+- ✨(api) add API route to search for indexed documents in Find #1276
 
 ### Fixed
 
@@ -183,7 +154,6 @@ and this project adheres to
 
 ### Added
 
-- ✨(backend) Comments on text editor #1309
 - 👷(CI) add bundle size check job #1268
 - ✨(frontend) use title first emoji as doc icon in tree #1289
 
@@ -886,8 +856,7 @@ and this project adheres to
 - ✨(frontend) Coming Soon page (#67)
 - 🚀 Impress, project to manage your documents easily and collaboratively.
 
-[unreleased]: https://github.com/suitenumerique/docs/compare/v3.10.0...main
-[v3.10.0]: https://github.com/suitenumerique/docs/releases/v3.10.0
+[unreleased]: https://github.com/suitenumerique/docs/compare/v3.9.0...main
 [v3.9.0]: https://github.com/suitenumerique/docs/releases/v3.9.0
 [v3.8.2]: https://github.com/suitenumerique/docs/releases/v3.8.2
 [v3.8.1]: https://github.com/suitenumerique/docs/releases/v3.8.1

Makefile

@@ -247,6 +247,10 @@ demo: ## flush db then create a demo for load testing purpose
 	@$(MANAGE) create_demo
 .PHONY: demo
 
+index: ## index all documents to remote search
+	@$(MANAGE) index
+.PHONY: index
+
 # Nota bene: Black should come after isort just in case they don't agree...
 lint: ## lint back-end python sources
 lint: \

bin/fernetkey

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# shellcheck source=bin/_config.sh
+source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
+
+_dc_run app-dev python -c 'from cryptography.fernet import Fernet;import sys; sys.stdout.write("\n" + Fernet.generate_key().decode() + "\n");'

compose.yml

@@ -72,6 +72,11 @@ services:
       - env.d/development/postgresql.local
     ports:
       - "8071:8000"
+    networks:
+      default: {}
+      lasuite:
+        aliases:
+          - impress
     volumes:
       - ./src/backend:/app
       - ./data/static:/data/static
@@ -92,6 +97,9 @@ services:
     command: ["celery", "-A", "impress.celery_app", "worker", "-l", "DEBUG"]
     environment:
       - DJANGO_CONFIGURATION=Development
+    networks:
+      - default
+      - lasuite
     env_file:
       - env.d/development/common
       - env.d/development/common.local
@@ -107,6 +115,11 @@ services:
     image: nginx:1.25
     ports:
       - "8083:8083"
+    networks:
+      default: {}
+      lasuite:
+        aliases:
+          - nginx
     volumes:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
     depends_on:
@@ -217,3 +230,8 @@ services:
       kc_postgresql:
         condition: service_healthy
         restart: true
+
+networks:
+  lasuite:
+    name: lasuite-network
+    driver: bridge

docs/architecture.md

@@ -12,6 +12,7 @@ flowchart TD
     Back --> DB("Database (PostgreSQL)")
     Back <--> Celery --> DB
     Back ----> S3("Minio (S3)")
+    Back -- REST API --> Find
 ```
 
 ### Architecture decision records

docs/env.md

@@ -93,6 +93,12 @@ These are the environment variables you can set for the `impress-backend` contai
 | OIDC_USERINFO_SHORTNAME_FIELD                   | OIDC token claims to create shortname                                                                                       | first_name                                                              |
 | POSTHOG_KEY                                     | Posthog key for analytics                                                                                                   |                                                                         |
 | REDIS_URL                                       | Cache url                                                                                                                   | redis://redis:6379/1                                                    |
+| SEARCH_INDEXER_CLASS                            | Class of the backend for document indexation & search                                                                       |                                                                         |
+| SEARCH_INDEXER_BATCH_SIZE                       | Size of each batch for indexation of all documents                                                                          | 100000                                                                  |
+| SEARCH_INDEXER_COUNTDOWN                        | Minimum debounce delay of indexation jobs (in seconds)                                                                      | 1                                                                       |
+| SEARCH_INDEXER_URL                              | Find application endpoint for indexation                                                                                    |                                                                         |
+| SEARCH_INDEXER_SECRET                           | Token for indexation queries                                                                                                |                                                                         |
+| SEARCH_INDEXER_QUERY_URL                        | Find application endpoint for search                                                                                        |                                                                         |
 | SENTRY_DSN                                      | Sentry host                                                                                                                 |                                                                         |
 | SESSION_COOKIE_AGE                              | duration of the cookie session                                                                                              | 60*60*12                                                                |
 | SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK |                                                                                                                             | false                                                                   |

docs/search.md

@@ -0,0 +1,39 @@
+# Setup the Find search for Impress
+
+This configuration will enable the fulltext search feature for Docs :
+- Each save on **core.Document** or **core.DocumentAccess** will trigger the indexer
+- The `api/v1.0/documents/search/` will work as a proxy with the Find API for fulltext search.
+
+## Create an index service for Docs
+
+Configure a **Service** for Docs application with these settings
+
+- **Name**: `docs`<br>_request.auth.name of the Docs application._
+- **Client id**: `impress`<br>_Name of the token audience or client_id of the Docs application._
+
+See [how-to-use-indexer.md](how-to-use-indexer.md) for details.
+
+## Configure settings of Docs
+
+Add those Django settings the Docs application to enable the feature.
+
+```shell
+SEARCH_INDEXER_CLASS="core.services.search_indexers.FindDocumentIndexer"
+SEARCH_INDEXER_COUNTDOWN=10  # Debounce delay in seconds for the indexer calls.
+
+# The token from service "docs" of Find application (development).
+SEARCH_INDEXER_SECRET="find-api-key-for-docs-with-exactly-50-chars-length"
+SEARCH_INDEXER_URL="http://find:8000/api/v1.0/documents/index/"
+
+# Search endpoint. Uses the OIDC token for authentication
+SEARCH_INDEXER_QUERY_URL="http://find:8000/api/v1.0/documents/search/"
+```
+
+We also need to enable the **OIDC Token** refresh or the authentication will fail quickly.
+
+```shell
+# Store OIDC tokens in the session
+OIDC_STORE_ACCESS_TOKEN = True  # Store the access token in the session
+OIDC_STORE_REFRESH_TOKEN = True  # Store the encrypted refresh token in the session
+OIDC_STORE_REFRESH_TOKEN_KEY = "your-32-byte-encryption-key=="  # Must be a valid Fernet key (32 url-safe base64-encoded bytes)
+```

docs/system-requirements.md

@@ -97,6 +97,17 @@ Production deployments differ significantly from development environments. The t
 | 5433      | PostgreSQL (Keycloak) |
 | 1081      | MailCatcher           |
 
+**With fulltext search service**
+
+| Port      | Service               |
+| --------- | --------------------- |
+| 8081      | Find (Django)         |
+| 9200      | Opensearch            |
+| 9600      | Opensearch admin      |
+| 5601      | Opensearch dashboard  |
+| 25432     | PostgreSQL (Find)     |
+
+
 ## 6. Sizing Guidelines
 
 **RAM** – start at 8 GB dev / 16 GB staging / 32 GB prod. Postgres and Keycloak are the first to OOM; scale them first.

env.d/development/common

@@ -36,6 +36,7 @@ OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/c
 OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/impress/protocol/openid-connect/auth
 OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/token
 OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/userinfo
+OIDC_OP_INTROSPECTION_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/token/introspect
 
 OIDC_RP_CLIENT_ID=impress
 OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
@@ -49,6 +50,14 @@ LOGOUT_REDIRECT_URL=http://localhost:3000
 OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8083", "http://localhost:3000"]
 OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
 
+# Store OIDC tokens in the session
+OIDC_STORE_ACCESS_TOKEN = True
+OIDC_STORE_REFRESH_TOKEN = True # Store the encrypted refresh token in the session.
+
+# Must be a valid Fernet key (32 url-safe base64-encoded bytes)
+# To create one, use the bin/fernetkey command.
+# OIDC_STORE_REFRESH_TOKEN_KEY="your-32-byte-encryption-key=="
+
 # AI
 AI_FEATURE_ENABLED=true
 AI_BASE_URL=https://openaiendpoint.com
@@ -68,4 +77,10 @@ Y_PROVIDER_API_BASE_URL=http://y-provider-development:4444/api/
 Y_PROVIDER_API_KEY=yprovider-api-key
 
 # Theme customization
-THEME_CUSTOMIZATION_CACHE_TIMEOUT=15
+THEME_CUSTOMIZATION_CACHE_TIMEOUT=15
+
+# Indexer (disabled)
+# SEARCH_INDEXER_CLASS="core.services.search_indexers.SearchIndexer"
+SEARCH_INDEXER_SECRET=find-api-key-for-docs-with-exactly-50-chars-length  # Key generated by create_demo in Find app.
+SEARCH_INDEXER_URL="http://find:8000/api/v1.0/documents/index/"
+SEARCH_INDEXER_QUERY_URL="http://find:8000/api/v1.0/documents/search/"

src/backend/core/api/permissions.py

@@ -171,19 +171,3 @@ class ResourceAccessPermission(IsAuthenticated):
 
         action = view.action
         return abilities.get(action, False)
-
-
-class CommentPermission(permissions.BasePermission):
-    """Permission class for comments."""
-
-    def has_permission(self, request, view):
-        """Check permission for a given object."""
-        if view.action in ["create", "list"]:
-            document_abilities = view.get_document_or_404().get_abilities(request.user)
-            return document_abilities["comment"]
-
-        return True
-
-    def has_object_permission(self, request, view, obj):
-        """Check permission for a given object."""
-        return obj.get_abilities(request.user).get(view.action, False)

src/backend/core/api/serializers.py

@@ -1,5 +1,4 @@
 """Client serializers for the impress core app."""
-# pylint: disable=too-many-lines
 
 import binascii
 import mimetypes
@@ -25,13 +24,22 @@ from core.services.converter_services import (
 class UserSerializer(serializers.ModelSerializer):
     """Serialize users."""
 
+    class Meta:
+        model = models.User
+        fields = ["id", "email", "full_name", "short_name", "language"]
+        read_only_fields = ["id", "email", "full_name", "short_name"]
+
+
+class UserLightSerializer(UserSerializer):
+    """Serialize users with limited fields."""
+
     full_name = serializers.SerializerMethodField(read_only=True)
     short_name = serializers.SerializerMethodField(read_only=True)
 
     class Meta:
         model = models.User
-        fields = ["id", "email", "full_name", "short_name", "language"]
-        read_only_fields = ["id", "email", "full_name", "short_name"]
+        fields = ["full_name", "short_name"]
+        read_only_fields = ["full_name", "short_name"]
 
     def get_full_name(self, instance):
         """Return the full name of the user."""
@@ -50,15 +58,6 @@ class UserSerializer(serializers.ModelSerializer):
         return instance.short_name
 
 
-class UserLightSerializer(UserSerializer):
-    """Serialize users with limited fields."""
-
-    class Meta:
-        model = models.User
-        fields = ["full_name", "short_name"]
-        read_only_fields = ["full_name", "short_name"]
-
-
 class TemplateAccessSerializer(serializers.ModelSerializer):
     """Serialize template accesses."""
 
@@ -787,9 +786,7 @@ class DocumentAskForAccessCreateSerializer(serializers.Serializer):
     """Serializer for creating a document ask for access."""
 
     role = serializers.ChoiceField(
-        choices=[
-            role for role in choices.RoleChoices if role != models.RoleChoices.OWNER
-        ],
+        choices=models.RoleChoices.choices,
         required=False,
         default=models.RoleChoices.READER,
     )
@@ -813,11 +810,11 @@ class DocumentAskForAccessSerializer(serializers.ModelSerializer):
         ]
         read_only_fields = ["id", "document", "user", "role", "created_at", "abilities"]
 
-    def get_abilities(self, instance) -> dict:
+    def get_abilities(self, invitation) -> dict:
         """Return abilities of the logged-in user on the instance."""
         request = self.context.get("request")
         if request:
-            return instance.get_abilities(request.user)
+            return invitation.get_abilities(request.user)
         return {}
 
 
@@ -894,122 +891,11 @@ class MoveDocumentSerializer(serializers.Serializer):
     )
 
 
-class ReactionSerializer(serializers.ModelSerializer):
-    """Serialize reactions."""
+class SearchDocumentSerializer(serializers.Serializer):
+    """Serializer for fulltext search requests through Find application"""
 
-    users = UserLightSerializer(many=True, read_only=True)
-
-    class Meta:
-        model = models.Reaction
-        fields = [
-            "id",
-            "emoji",
-            "created_at",
-            "users",
-        ]
-        read_only_fields = ["id", "created_at", "users"]
-
-
-class CommentSerializer(serializers.ModelSerializer):
-    """Serialize comments (nested under a thread) with reactions and abilities."""
-
-    user = UserLightSerializer(read_only=True)
-    abilities = serializers.SerializerMethodField()
-    reactions = ReactionSerializer(many=True, read_only=True)
-
-    class Meta:
-        model = models.Comment
-        fields = [
-            "id",
-            "user",
-            "body",
-            "created_at",
-            "updated_at",
-            "reactions",
-            "abilities",
-        ]
-        read_only_fields = [
-            "id",
-            "user",
-            "created_at",
-            "updated_at",
-            "reactions",
-            "abilities",
-        ]
-
-    def validate(self, attrs):
-        """Validate comment data."""
-
-        request = self.context.get("request")
-        user = getattr(request, "user", None)
-
-        attrs["thread_id"] = self.context["thread_id"]
-        attrs["user_id"] = user.id if user else None
-        return attrs
-
-    def get_abilities(self, obj):
-        """Return comment's abilities."""
-        request = self.context.get("request")
-        if request:
-            return obj.get_abilities(request.user)
-        return {}
-
-
-class ThreadSerializer(serializers.ModelSerializer):
-    """Serialize threads in a backward compatible shape for current frontend.
-
-    We expose a flatten representation where ``content`` maps to the first
-    comment's body. Creating a thread requires a ``content`` field which is
-    stored as the first comment.
-    """
-
-    creator = UserLightSerializer(read_only=True)
-    abilities = serializers.SerializerMethodField(read_only=True)
-    body = serializers.JSONField(write_only=True, required=True)
-    comments = serializers.SerializerMethodField(read_only=True)
-    comments = CommentSerializer(many=True, read_only=True)
-
-    class Meta:
-        model = models.Thread
-        fields = [
-            "id",
-            "body",
-            "created_at",
-            "updated_at",
-            "creator",
-            "abilities",
-            "comments",
-            "resolved",
-            "resolved_at",
-            "resolved_by",
-            "metadata",
-        ]
-        read_only_fields = [
-            "id",
-            "created_at",
-            "updated_at",
-            "creator",
-            "abilities",
-            "comments",
-            "resolved",
-            "resolved_at",
-            "resolved_by",
-            "metadata",
-        ]
-
-    def validate(self, attrs):
-        """Validate thread data."""
-        request = self.context.get("request")
-        user = getattr(request, "user", None)
-
-        attrs["document_id"] = self.context["resource_id"]
-        attrs["creator_id"] = user.id if user else None
-
-        return attrs
-
-    def get_abilities(self, thread):
-        """Return thread's abilities."""
-        request = self.context.get("request")
-        if request:
-            return thread.get_abilities(request.user)
-        return {}
+    q = serializers.CharField(required=True, allow_blank=False, trim_whitespace=True)
+    page_size = serializers.IntegerField(
+        required=False, min_value=1, max_value=50, default=20
+    )
+    page = serializers.IntegerField(required=False, min_value=1, default=1)

src/backend/core/api/viewsets.py

@@ -21,7 +21,7 @@ from django.db.models.expressions import RawSQL
 from django.db.models.functions import Left, Length
 from django.http import Http404, StreamingHttpResponse
 from django.urls import reverse
-from django.utils import timezone
+from django.utils.decorators import method_decorator
 from django.utils.functional import cached_property
 from django.utils.text import capfirst, slugify
 from django.utils.translation import gettext_lazy as _
@@ -32,6 +32,7 @@ from botocore.exceptions import ClientError
 from csp.constants import NONE
 from csp.decorators import csp_update
 from lasuite.malware_detection import malware_detection
+from lasuite.oidc_login.decorators import refresh_oidc_access_token
 from rest_framework import filters, status, viewsets
 from rest_framework import response as drf_response
 from rest_framework.permissions import AllowAny
@@ -48,6 +49,10 @@ from core.services.converter_services import (
 from core.services.converter_services import (
     YdocConverter,
 )
+from core.services.search_indexers import (
+    get_document_indexer,
+    get_visited_document_ids_of,
+)
 from core.tasks.mail import send_ask_for_access_mail
 from core.utils import extract_attachments, filter_descendants
 
@@ -374,6 +379,7 @@ class DocumentViewSet(
     list_serializer_class = serializers.ListDocumentSerializer
     trashbin_serializer_class = serializers.ListDocumentSerializer
     tree_serializer_class = serializers.ListDocumentSerializer
+    search_serializer_class = serializers.ListDocumentSerializer
 
     def get_queryset(self):
         """Get queryset performing all annotation and filtering on the document tree structure."""
@@ -1065,6 +1071,85 @@ class DocumentViewSet(
             {"id": str(duplicated_document.id)}, status=status.HTTP_201_CREATED
         )
 
+    def _search_simple(self, request, text):
+        """
+        Returns a queryset filtered by the content of the document title
+        """
+        # As the 'list' view we get a prefiltered queryset (deleted docs are excluded)
+        queryset = self.get_queryset()
+        filterset = DocumentFilter({"title": text}, queryset=queryset)
+
+        if not filterset.is_valid():
+            raise drf.exceptions.ValidationError(filterset.errors)
+
+        queryset = filterset.filter_queryset(queryset)
+
+        return self.get_response_for_queryset(
+            queryset.order_by("-updated_at"),
+            context={
+                "request": request,
+            },
+        )
+
+    def _search_fulltext(self, indexer, request, params):
+        """
+        Returns a queryset from the results the fulltext search of Find
+        """
+        access_token = request.session.get("oidc_access_token")
+        user = request.user
+        text = params.validated_data["q"]
+        queryset = models.Document.objects.all()
+
+        # Retrieve the documents ids from Find.
+        results = indexer.search(
+            text=text,
+            token=access_token,
+            visited=get_visited_document_ids_of(queryset, user),
+            page=1,
+            page_size=100,
+        )
+
+        docs_by_uuid = {str(d.pk): d for d in queryset.filter(pk__in=results)}
+        ordered_docs = [docs_by_uuid[id] for id in results]
+
+        page = self.paginate_queryset(ordered_docs)
+
+        serializer = self.get_serializer(
+            page if page else ordered_docs,
+            many=True,
+            context={
+                "request": request,
+            },
+        )
+
+        return self.get_paginated_response(serializer.data)
+
+    @drf.decorators.action(detail=False, methods=["get"], url_path="search")
+    @method_decorator(refresh_oidc_access_token)
+    def search(self, request, *args, **kwargs):
+        """
+        Returns a DRF response containing the filtered, annotated and ordered document list.
+
+        Applies filtering based on request parameter 'q' from `SearchDocumentSerializer`.
+        Depending of the configuration it can be:
+         - A fulltext search through the opensearch indexation app "find" if the backend is
+           enabled (see SEARCH_INDEXER_CLASS)
+         - A filtering by the model field 'title'.
+
+        The ordering is always by the most recent first.
+        """
+        params = serializers.SearchDocumentSerializer(data=request.query_params)
+        params.is_valid(raise_exception=True)
+
+        indexer = get_document_indexer()
+
+        if indexer:
+            return self._search_fulltext(indexer, request, params=params)
+
+        # The indexer is not configured, we fallback on a simple icontains filter by the
+        # model field 'title'.
+        return self._search_simple(request, text=params.validated_data["q"])
+
     @drf.decorators.action(detail=True, methods=["get"], url_path="versions")
     def versions_list(self, request, *args, **kwargs):
         """
@@ -1832,7 +1917,10 @@ class DocumentAccessViewSet(
 
 
 class TemplateViewSet(
+    drf.mixins.CreateModelMixin,
+    drf.mixins.DestroyModelMixin,
     drf.mixins.RetrieveModelMixin,
+    drf.mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
 ):
     """Template ViewSet"""
@@ -1888,6 +1976,100 @@ class TemplateViewSet(
         serializer = self.get_serializer(queryset, many=True)
         return drf.response.Response(serializer.data)
 
+    @transaction.atomic
+    def perform_create(self, serializer):
+        """Set the current user as owner of the newly created object."""
+        obj = serializer.save()
+        models.TemplateAccess.objects.create(
+            template=obj,
+            user=self.request.user,
+            role=models.RoleChoices.OWNER,
+        )
+
+
+class TemplateAccessViewSet(
+    ResourceAccessViewsetMixin,
+    drf.mixins.CreateModelMixin,
+    drf.mixins.DestroyModelMixin,
+    drf.mixins.RetrieveModelMixin,
+    drf.mixins.UpdateModelMixin,
+    viewsets.GenericViewSet,
+):
+    """
+    API ViewSet for all interactions with template accesses.
+
+    GET /api/v1.0/templates/<template_id>/accesses/:<template_access_id>
+        Return list of all template accesses related to the logged-in user or one
+        template access if an id is provided.
+
+    POST /api/v1.0/templates/<template_id>/accesses/ with expected data:
+        - user: str
+        - role: str [administrator|editor|reader]
+        Return newly created template access
+
+    PUT /api/v1.0/templates/<template_id>/accesses/<template_access_id>/ with expected data:
+        - role: str [owner|admin|editor|reader]
+        Return updated template access
+
+    PATCH /api/v1.0/templates/<template_id>/accesses/<template_access_id>/ with expected data:
+        - role: str [owner|admin|editor|reader]
+        Return partially updated template access
+
+    DELETE /api/v1.0/templates/<template_id>/accesses/<template_access_id>/
+        Delete targeted template access
+    """
+
+    lookup_field = "pk"
+    permission_classes = [permissions.ResourceAccessPermission]
+    throttle_scope = "template_access"
+    queryset = models.TemplateAccess.objects.select_related("user").all()
+    resource_field_name = "template"
+    serializer_class = serializers.TemplateAccessSerializer
+
+    @cached_property
+    def template(self):
+        """Get related template from resource ID in url."""
+        try:
+            return models.Template.objects.get(pk=self.kwargs["resource_id"])
+        except models.Template.DoesNotExist as excpt:
+            raise drf.exceptions.NotFound() from excpt
+
+    def list(self, request, *args, **kwargs):
+        """Restrict templates returned by the list endpoint"""
+        user = self.request.user
+        teams = user.teams
+        queryset = self.filter_queryset(self.get_queryset())
+
+        # Limit to resource access instances related to a resource THAT also has
+        # a resource access instance for the logged-in user (we don't want to list
+        # only the resource access instances pointing to the logged-in user)
+        queryset = queryset.filter(
+            db.Q(template__accesses__user=user)
+            | db.Q(template__accesses__team__in=teams),
+        ).distinct()
+
+        serializer = self.get_serializer(queryset, many=True)
+        return drf.response.Response(serializer.data)
+
+    def perform_create(self, serializer):
+        """
+        Actually create the new template access:
+        - Ensures the `template_id` is explicitly set from the URL.
+        - If the assigned role is `OWNER`, checks that the requesting user is an owner
+          of the document. This is the only permission check deferred until this step;
+          all other access checks are handled earlier in the permission lifecycle.
+        """
+        role = serializer.validated_data.get("role")
+        if (
+            role == choices.RoleChoices.OWNER
+            and self.template.get_role(self.request.user) != choices.RoleChoices.OWNER
+        ):
+            raise drf.exceptions.PermissionDenied(
+                "Only owners of a template can assign other users as owners."
+            )
+
+        serializer.save(template_id=self.kwargs["resource_id"])
+
 
 class InvitationViewset(
     drf.mixins.CreateModelMixin,
@@ -2066,18 +2248,7 @@ class DocumentAskForAccessViewSet(
         serializer = serializers.RoleSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
-        target_role = serializer.validated_data.get(
-            "role", document_ask_for_access.role
-        )
-        abilities = document_ask_for_access.get_abilities(request.user)
-
-        if target_role not in abilities["set_role_to"]:
-            return drf.response.Response(
-                {"detail": "You cannot accept a role higher than your own."},
-                status=drf.status.HTTP_400_BAD_REQUEST,
-            )
-
-        document_ask_for_access.accept(role=target_role)
+        document_ask_for_access.accept(role=serializer.validated_data.get("role"))
         return drf.response.Response(status=drf.status.HTTP_204_NO_CONTENT)
 
 
@@ -2151,132 +2322,3 @@ class ConfigView(drf.views.APIView):
             )
 
         return theme_customization
-
-
-class CommentViewSetMixin:
-    """Comment ViewSet Mixin."""
-
-    _document = None
-
-    def get_document_or_404(self):
-        """Get the document related to the viewset or raise a 404 error."""
-        if self._document is None:
-            try:
-                self._document = models.Document.objects.get(
-                    pk=self.kwargs["resource_id"],
-                )
-            except models.Document.DoesNotExist as e:
-                raise drf.exceptions.NotFound("Document not found.") from e
-        return self._document
-
-
-class ThreadViewSet(
-    ResourceAccessViewsetMixin,
-    CommentViewSetMixin,
-    drf.mixins.CreateModelMixin,
-    drf.mixins.ListModelMixin,
-    drf.mixins.RetrieveModelMixin,
-    drf.mixins.DestroyModelMixin,
-    viewsets.GenericViewSet,
-):
-    """Thread API: list/create threads and nested comment operations."""
-
-    permission_classes = [permissions.CommentPermission]
-    pagination_class = Pagination
-    serializer_class = serializers.ThreadSerializer
-    queryset = models.Thread.objects.select_related("creator", "document").filter(
-        resolved=False
-    )
-    resource_field_name = "document"
-
-    def perform_create(self, serializer):
-        """Create the first comment of the thread."""
-        body = serializer.validated_data["body"]
-        del serializer.validated_data["body"]
-        thread = serializer.save()
-
-        models.Comment.objects.create(
-            thread=thread,
-            user=self.request.user if self.request.user.is_authenticated else None,
-            body=body,
-        )
-
-    @drf.decorators.action(detail=True, methods=["post"], url_path="resolve")
-    def resolve(self, request, *args, **kwargs):
-        """Resolve a thread."""
-        thread = self.get_object()
-        if not thread.resolved:
-            thread.resolved = True
-            thread.resolved_at = timezone.now()
-            thread.resolved_by = request.user
-            thread.save(update_fields=["resolved", "resolved_at", "resolved_by"])
-        return drf.response.Response(status=status.HTTP_204_NO_CONTENT)
-
-
-class CommentViewSet(
-    CommentViewSetMixin,
-    viewsets.ModelViewSet,
-):
-    """Comment API: list/create comments and nested reaction operations."""
-
-    permission_classes = [permissions.CommentPermission]
-    pagination_class = Pagination
-    serializer_class = serializers.CommentSerializer
-    queryset = models.Comment.objects.select_related("user").all()
-
-    def get_queryset(self):
-        """Override to filter on related resource."""
-        return (
-            super()
-            .get_queryset()
-            .filter(
-                thread=self.kwargs["thread_id"],
-                thread__document=self.kwargs["resource_id"],
-            )
-        )
-
-    def get_serializer_context(self):
-        """Extra context provided to the serializer class."""
-        context = super().get_serializer_context()
-        context["document_id"] = self.kwargs["resource_id"]
-        context["thread_id"] = self.kwargs["thread_id"]
-        return context
-
-    @drf.decorators.action(
-        detail=True,
-        methods=["post", "delete"],
-    )
-    def reactions(self, request, *args, **kwargs):
-        """POST: add reaction; DELETE: remove reaction.
-
-        Emoji is expected in request.data['emoji'] for both operations.
-        """
-        comment = self.get_object()
-        serializer = serializers.ReactionSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-
-        if request.method == "POST":
-            reaction, created = models.Reaction.objects.get_or_create(
-                comment=comment,
-                emoji=serializer.validated_data["emoji"],
-            )
-            if not created and reaction.users.filter(id=request.user.id).exists():
-                return drf.response.Response(
-                    {"user_already_reacted": True}, status=status.HTTP_400_BAD_REQUEST
-                )
-            reaction.users.add(request.user)
-            return drf.response.Response(status=status.HTTP_201_CREATED)
-
-        # DELETE
-        try:
-            reaction = models.Reaction.objects.get(
-                comment=comment,
-                emoji=serializer.validated_data["emoji"],
-                users__in=[request.user],
-            )
-        except models.Reaction.DoesNotExist as e:
-            raise drf.exceptions.NotFound("Reaction not found.") from e
-        reaction.users.remove(request.user)
-        if not reaction.users.exists():
-            reaction.delete()
-        return drf.response.Response(status=status.HTTP_204_NO_CONTENT)

src/backend/core/apps.py

@@ -1,11 +1,19 @@
 """Impress Core application"""
-# from django.apps import AppConfig
-# from django.utils.translation import gettext_lazy as _
+
+from django.apps import AppConfig
+from django.utils.translation import gettext_lazy as _
 
 
-# class CoreConfig(AppConfig):
-#     """Configuration class for the impress core app."""
+class CoreConfig(AppConfig):
+    """Configuration class for the impress core app."""
 
-#     name = "core"
-#     app_label = "core"
-#     verbose_name = _("impress core application")
+    name = "core"
+    app_label = "core"
+    verbose_name = _("Impress core application")
+
+    def ready(self):
+        """
+        Import signals when the app is ready.
+        """
+        # pylint: disable=import-outside-toplevel, unused-import
+        from . import signals  # noqa: PLC0415

src/backend/core/choices.py

@@ -33,7 +33,6 @@ class LinkRoleChoices(PriorityTextChoices):
     """Defines the possible roles a link can offer on a document."""
 
     READER = "reader", _("Reader")  # Can read
-    COMMENTER = "commenter", _("Commenter")  # Can read and comment
     EDITOR = "editor", _("Editor")  # Can read and edit
 
 
@@ -41,7 +40,6 @@ class RoleChoices(PriorityTextChoices):
     """Defines the possible roles a user can have in a resource."""
 
     READER = "reader", _("Reader")  # Can read
-    COMMENTER = "commenter", _("Commenter")  # Can read and comment
     EDITOR = "editor", _("Editor")  # Can read and edit
     ADMIN = "administrator", _("Administrator")  # Can read, edit, delete and share
     OWNER = "owner", _("Owner")

src/backend/core/factories.py

@@ -256,49 +256,3 @@ class InvitationFactory(factory.django.DjangoModelFactory):
     document = factory.SubFactory(DocumentFactory)
     role = factory.fuzzy.FuzzyChoice([role[0] for role in models.RoleChoices.choices])
     issuer = factory.SubFactory(UserFactory)
-
-
-class ThreadFactory(factory.django.DjangoModelFactory):
-    """A factory to create threads for a document"""
-
-    class Meta:
-        model = models.Thread
-
-    document = factory.SubFactory(DocumentFactory)
-    creator = factory.SubFactory(UserFactory)
-
-
-class CommentFactory(factory.django.DjangoModelFactory):
-    """A factory to create comments for a thread"""
-
-    class Meta:
-        model = models.Comment
-
-    thread = factory.SubFactory(ThreadFactory)
-    user = factory.SubFactory(UserFactory)
-    body = factory.Faker("text")
-
-
-class ReactionFactory(factory.django.DjangoModelFactory):
-    """A factory to create reactions for a comment"""
-
-    class Meta:
-        model = models.Reaction
-
-    comment = factory.SubFactory(CommentFactory)
-    emoji = "test"
-
-    @factory.post_generation
-    def users(self, create, extracted, **kwargs):
-        """Add users to reaction from a given list of users or create one if not provided."""
-        if not create:
-            return
-
-        if not extracted:
-            # the factory is being created, but no users were provided
-            user = UserFactory()
-            self.users.add(user)
-            return
-
-        # Add the iterable of groups using bulk addition
-        self.users.add(*extracted)

src/backend/core/management/commands/index.py

@@ -0,0 +1,40 @@
+"""
+Handle search setup that needs to be done at bootstrap time.
+"""
+
+import logging
+import time
+
+from django.core.management.base import BaseCommand, CommandError
+
+from core.services.search_indexers import get_document_indexer
+
+logger = logging.getLogger("docs.search.bootstrap_search")
+
+
+class Command(BaseCommand):
+    """Index all documents to remote search service"""
+
+    help = __doc__
+
+    def handle(self, *args, **options):
+        """Launch and log search index generation."""
+        indexer = get_document_indexer()
+
+        if not indexer:
+            raise CommandError("The indexer is not enabled or properly configured.")
+
+        logger.info("Starting to regenerate Find index...")
+        start = time.perf_counter()
+
+        try:
+            count = indexer.index()
+        except Exception as err:
+            raise CommandError("Unable to regenerate index") from err
+
+        duration = time.perf_counter() - start
+        logger.info(
+            "Search index regenerated from %d document(s) in %.2f seconds.",
+            count,
+            duration,
+        )

src/backend/core/migrations/0026_comments.py

@@ -1,275 +0,0 @@
-# Generated by Django 5.2.6 on 2025-09-16 08:59
-
-import uuid
-
-import django.db.models.deletion
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("core", "0025_alter_user_short_name"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="document",
-            name="link_role",
-            field=models.CharField(
-                choices=[
-                    ("reader", "Reader"),
-                    ("commenter", "Commenter"),
-                    ("editor", "Editor"),
-                ],
-                default="reader",
-                max_length=20,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="documentaccess",
-            name="role",
-            field=models.CharField(
-                choices=[
-                    ("reader", "Reader"),
-                    ("commenter", "Commenter"),
-                    ("editor", "Editor"),
-                    ("administrator", "Administrator"),
-                    ("owner", "Owner"),
-                ],
-                default="reader",
-                max_length=20,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="documentaskforaccess",
-            name="role",
-            field=models.CharField(
-                choices=[
-                    ("reader", "Reader"),
-                    ("commenter", "Commenter"),
-                    ("editor", "Editor"),
-                    ("administrator", "Administrator"),
-                    ("owner", "Owner"),
-                ],
-                default="reader",
-                max_length=20,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="invitation",
-            name="role",
-            field=models.CharField(
-                choices=[
-                    ("reader", "Reader"),
-                    ("commenter", "Commenter"),
-                    ("editor", "Editor"),
-                    ("administrator", "Administrator"),
-                    ("owner", "Owner"),
-                ],
-                default="reader",
-                max_length=20,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="templateaccess",
-            name="role",
-            field=models.CharField(
-                choices=[
-                    ("reader", "Reader"),
-                    ("commenter", "Commenter"),
-                    ("editor", "Editor"),
-                    ("administrator", "Administrator"),
-                    ("owner", "Owner"),
-                ],
-                default="reader",
-                max_length=20,
-            ),
-        ),
-        migrations.CreateModel(
-            name="Thread",
-            fields=[
-                (
-                    "id",
-                    models.UUIDField(
-                        default=uuid.uuid4,
-                        editable=False,
-                        help_text="primary key for the record as UUID",
-                        primary_key=True,
-                        serialize=False,
-                        verbose_name="id",
-                    ),
-                ),
-                (
-                    "created_at",
-                    models.DateTimeField(
-                        auto_now_add=True,
-                        help_text="date and time at which a record was created",
-                        verbose_name="created on",
-                    ),
-                ),
-                (
-                    "updated_at",
-                    models.DateTimeField(
-                        auto_now=True,
-                        help_text="date and time at which a record was last updated",
-                        verbose_name="updated on",
-                    ),
-                ),
-                ("resolved", models.BooleanField(default=False)),
-                ("resolved_at", models.DateTimeField(blank=True, null=True)),
-                ("metadata", models.JSONField(blank=True, default=dict)),
-                (
-                    "creator",
-                    models.ForeignKey(
-                        blank=True,
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="threads",
-                        to=settings.AUTH_USER_MODEL,
-                    ),
-                ),
-                (
-                    "document",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="threads",
-                        to="core.document",
-                    ),
-                ),
-                (
-                    "resolved_by",
-                    models.ForeignKey(
-                        blank=True,
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="resolved_threads",
-                        to=settings.AUTH_USER_MODEL,
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Thread",
-                "verbose_name_plural": "Threads",
-                "db_table": "impress_thread",
-                "ordering": ("-created_at",),
-            },
-        ),
-        migrations.CreateModel(
-            name="Comment",
-            fields=[
-                (
-                    "id",
-                    models.UUIDField(
-                        default=uuid.uuid4,
-                        editable=False,
-                        help_text="primary key for the record as UUID",
-                        primary_key=True,
-                        serialize=False,
-                        verbose_name="id",
-                    ),
-                ),
-                (
-                    "created_at",
-                    models.DateTimeField(
-                        auto_now_add=True,
-                        help_text="date and time at which a record was created",
-                        verbose_name="created on",
-                    ),
-                ),
-                (
-                    "updated_at",
-                    models.DateTimeField(
-                        auto_now=True,
-                        help_text="date and time at which a record was last updated",
-                        verbose_name="updated on",
-                    ),
-                ),
-                ("body", models.JSONField()),
-                ("metadata", models.JSONField(blank=True, default=dict)),
-                (
-                    "user",
-                    models.ForeignKey(
-                        blank=True,
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="thread_comment",
-                        to=settings.AUTH_USER_MODEL,
-                    ),
-                ),
-                (
-                    "thread",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="comments",
-                        to="core.thread",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Comment",
-                "verbose_name_plural": "Comments",
-                "db_table": "impress_comment",
-                "ordering": ("created_at",),
-            },
-        ),
-        migrations.CreateModel(
-            name="Reaction",
-            fields=[
-                (
-                    "id",
-                    models.UUIDField(
-                        default=uuid.uuid4,
-                        editable=False,
-                        help_text="primary key for the record as UUID",
-                        primary_key=True,
-                        serialize=False,
-                        verbose_name="id",
-                    ),
-                ),
-                (
-                    "created_at",
-                    models.DateTimeField(
-                        auto_now_add=True,
-                        help_text="date and time at which a record was created",
-                        verbose_name="created on",
-                    ),
-                ),
-                (
-                    "updated_at",
-                    models.DateTimeField(
-                        auto_now=True,
-                        help_text="date and time at which a record was last updated",
-                        verbose_name="updated on",
-                    ),
-                ),
-                ("emoji", models.CharField(max_length=32)),
-                (
-                    "comment",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="reactions",
-                        to="core.comment",
-                    ),
-                ),
-                (
-                    "users",
-                    models.ManyToManyField(
-                        related_name="reactions", to=settings.AUTH_USER_MODEL
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Reaction",
-                "verbose_name_plural": "Reactions",
-                "db_table": "impress_comment_reaction",
-                "constraints": [
-                    models.UniqueConstraint(
-                        fields=("comment", "emoji"),
-                        name="unique_comment_emoji",
-                        violation_error_message="This emoji has already been reacted to this comment.",
-                    )
-                ],
-            },
-        ),
-    ]

src/backend/core/models.py

@@ -432,32 +432,35 @@ class Document(MP_Node, BaseModel):
     def save(self, *args, **kwargs):
         """Write content to object storage only if _content has changed."""
         super().save(*args, **kwargs)
-
         if self._content:
-            file_key = self.file_key
-            bytes_content = self._content.encode("utf-8")
+            self.save_content(self._content)
 
-            # Attempt to directly check if the object exists using the storage client.
-            try:
-                response = default_storage.connection.meta.client.head_object(
-                    Bucket=default_storage.bucket_name, Key=file_key
-                )
-            except ClientError as excpt:
-                # If the error is a 404, the object doesn't exist, so we should create it.
-                if excpt.response["Error"]["Code"] == "404":
-                    has_changed = True
-                else:
-                    raise
+    def save_content(self, content):
+        """Save content to object storage."""
+
+        file_key = self.file_key
+        bytes_content = content.encode("utf-8")
+
+        # Attempt to directly check if the object exists using the storage client.
+        try:
+            response = default_storage.connection.meta.client.head_object(
+                Bucket=default_storage.bucket_name, Key=file_key
+            )
+        except ClientError as excpt:
+            # If the error is a 404, the object doesn't exist, so we should create it.
+            if excpt.response["Error"]["Code"] == "404":
+                has_changed = True
             else:
-                # Compare the existing ETag with the MD5 hash of the new content.
-                has_changed = (
-                    response["ETag"].strip('"')
-                    != hashlib.md5(bytes_content).hexdigest()  # noqa: S324
-                )
+                raise
+        else:
+            # Compare the existing ETag with the MD5 hash of the new content.
+            has_changed = (
+                response["ETag"].strip('"') != hashlib.md5(bytes_content).hexdigest()  # noqa: S324
+            )
 
-            if has_changed:
-                content_file = ContentFile(bytes_content)
-                default_storage.save(file_key, content_file)
+        if has_changed:
+            content_file = ContentFile(bytes_content)
+            default_storage.save(file_key, content_file)
 
     def is_leaf(self):
         """
@@ -756,7 +759,6 @@ class Document(MP_Node, BaseModel):
         can_update = (
             is_owner_or_admin or role == RoleChoices.EDITOR
         ) and not is_deleted
-        can_comment = (can_update or role == RoleChoices.COMMENTER) and not is_deleted
         can_create_children = can_update and user.is_authenticated
         can_destroy = (
             is_owner
@@ -787,7 +789,6 @@ class Document(MP_Node, BaseModel):
             "children_list": can_get,
             "children_create": can_create_children,
             "collaboration_auth": can_get,
-            "comment": can_comment,
             "content": can_get,
             "cors_proxy": can_get,
             "descendants": can_get,
@@ -903,7 +904,8 @@ class Document(MP_Node, BaseModel):
 
         # Mark all descendants as soft deleted
         self.get_descendants().filter(ancestors_deleted_at__isnull=True).update(
-            ancestors_deleted_at=self.ancestors_deleted_at
+            ancestors_deleted_at=self.ancestors_deleted_at,
+            updated_at=self.updated_at,
         )
 
     @transaction.atomic
@@ -1148,12 +1150,7 @@ class DocumentAccess(BaseAccess):
             set_role_to = []
             if is_owner_or_admin:
                 set_role_to.extend(
-                    [
-                        RoleChoices.READER,
-                        RoleChoices.COMMENTER,
-                        RoleChoices.EDITOR,
-                        RoleChoices.ADMIN,
-                    ]
+                    [RoleChoices.READER, RoleChoices.EDITOR, RoleChoices.ADMIN]
                 )
             if role == RoleChoices.OWNER:
                 set_role_to.append(RoleChoices.OWNER)
@@ -1212,14 +1209,23 @@ class DocumentAskForAccess(BaseModel):
 
     def get_abilities(self, user):
         """Compute and return abilities for a given user."""
-        user_role = self.document.get_role(user)
-        is_admin_or_owner = user_role in PRIVILEGED_ROLES
+        roles = []
 
-        set_role_to = [
-            role
-            for role in RoleChoices.values
-            if RoleChoices.get_priority(role) <= RoleChoices.get_priority(user_role)
-        ]
+        if user.is_authenticated:
+            teams = user.teams
+            try:
+                roles = self.user_roles or []
+            except AttributeError:
+                try:
+                    roles = self.document.accesses.filter(
+                        models.Q(user=user) | models.Q(team__in=teams),
+                    ).values_list("role", flat=True)
+                except (self._meta.model.DoesNotExist, IndexError):
+                    roles = []
+
+        is_admin_or_owner = bool(
+            set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
+        )
 
         return {
             "destroy": is_admin_or_owner,
@@ -1227,7 +1233,6 @@ class DocumentAskForAccess(BaseModel):
             "partial_update": is_admin_or_owner,
             "retrieve": is_admin_or_owner,
             "accept": is_admin_or_owner,
-            "set_role_to": set_role_to,
         }
 
     def accept(self, role=None):
@@ -1277,153 +1282,6 @@ class DocumentAskForAccess(BaseModel):
         self.document.send_email(subject, [email], context, language)
 
 
-class Thread(BaseModel):
-    """Discussion thread attached to a document.
-
-    A thread groups one or many comments. For backward compatibility with the
-    existing frontend (useComments hook) we still expose a flattened serializer
-    that returns a "content" field representing the first comment's body.
-    """
-
-    document = models.ForeignKey(
-        Document,
-        on_delete=models.CASCADE,
-        related_name="threads",
-    )
-    creator = models.ForeignKey(
-        User,
-        on_delete=models.SET_NULL,
-        related_name="threads",
-        null=True,
-        blank=True,
-    )
-    resolved = models.BooleanField(default=False)
-    resolved_at = models.DateTimeField(null=True, blank=True)
-    resolved_by = models.ForeignKey(
-        User,
-        on_delete=models.SET_NULL,
-        related_name="resolved_threads",
-        null=True,
-        blank=True,
-    )
-    metadata = models.JSONField(default=dict, blank=True)
-
-    class Meta:
-        db_table = "impress_thread"
-        ordering = ("-created_at",)
-        verbose_name = _("Thread")
-        verbose_name_plural = _("Threads")
-
-    def __str__(self):
-        author = self.creator or _("Anonymous")
-        return f"Thread by {author!s} on {self.document!s}"
-
-    def get_abilities(self, user):
-        """Compute and return abilities for a given user (mirrors comment logic)."""
-        role = self.document.get_role(user)
-        doc_abilities = self.document.get_abilities(user)
-        read_access = doc_abilities.get("comment", False)
-        write_access = self.creator == user or role in [
-            RoleChoices.OWNER,
-            RoleChoices.ADMIN,
-        ]
-        return {
-            "destroy": write_access,
-            "update": write_access,
-            "partial_update": write_access,
-            "resolve": write_access,
-            "retrieve": read_access,
-        }
-
-    @property
-    def first_comment(self):
-        """Return the first createdcomment of the thread."""
-        return self.comments.order_by("created_at").first()
-
-
-class Comment(BaseModel):
-    """A comment belonging to a thread."""
-
-    thread = models.ForeignKey(
-        Thread,
-        on_delete=models.CASCADE,
-        related_name="comments",
-    )
-    user = models.ForeignKey(
-        User,
-        on_delete=models.SET_NULL,
-        related_name="thread_comment",
-        null=True,
-        blank=True,
-    )
-    body = models.JSONField()
-    metadata = models.JSONField(default=dict, blank=True)
-
-    class Meta:
-        db_table = "impress_comment"
-        ordering = ("created_at",)
-        verbose_name = _("Comment")
-        verbose_name_plural = _("Comments")
-
-    def __str__(self):
-        """Return the string representation of the comment."""
-        author = self.user or _("Anonymous")
-        return f"Comment by {author!s} on thread {self.thread_id}"
-
-    def get_abilities(self, user):
-        """Return the abilities of the comment."""
-        role = self.thread.document.get_role(user)
-        doc_abilities = self.thread.document.get_abilities(user)
-        read_access = doc_abilities.get("comment", False)
-        can_react = read_access and user.is_authenticated
-        write_access = self.user == user or role in [
-            RoleChoices.OWNER,
-            RoleChoices.ADMIN,
-        ]
-        return {
-            "destroy": write_access,
-            "update": write_access,
-            "partial_update": write_access,
-            "reactions": can_react,
-            "retrieve": read_access,
-        }
-
-
-class Reaction(BaseModel):
-    """Aggregated reactions for a given emoji on a comment.
-
-    We store one row per (comment, emoji) and maintain the list of user IDs who
-    reacted with that emoji. This matches the frontend interface where a
-    reaction exposes: emoji, createdAt (first reaction date) and userIds.
-    """
-
-    comment = models.ForeignKey(
-        Comment,
-        on_delete=models.CASCADE,
-        related_name="reactions",
-    )
-    emoji = models.CharField(max_length=32)
-    users = models.ManyToManyField(User, related_name="reactions")
-
-    class Meta:
-        db_table = "impress_comment_reaction"
-        constraints = [
-            models.UniqueConstraint(
-                fields=["comment", "emoji"],
-                name="unique_comment_emoji",
-                violation_error_message=_(
-                    "This emoji has already been reacted to this comment."
-                ),
-            ),
-        ]
-        verbose_name = _("Reaction")
-        verbose_name_plural = _("Reactions")
-
-    def __str__(self):
-        """Return the string representation of the reaction."""
-        return f"Reaction {self.emoji} on comment {self.comment.id}"
-
-
 class Template(BaseModel):
     """HTML and CSS code used for formatting the print around the MarkDown body."""
 

src/backend/core/services/search_indexers.py

@@ -0,0 +1,296 @@
+"""Document search index management utilities and indexers"""
+
+import logging
+from abc import ABC, abstractmethod
+from collections import defaultdict
+from functools import cache
+
+from django.conf import settings
+from django.contrib.auth.models import AnonymousUser
+from django.core.exceptions import ImproperlyConfigured
+from django.db.models import Subquery
+from django.utils.module_loading import import_string
+
+import requests
+
+from core import models, utils
+
+logger = logging.getLogger(__name__)
+
+
+@cache
+def get_document_indexer():
+    """Returns an instance of indexer service if enabled and properly configured."""
+    classpath = settings.SEARCH_INDEXER_CLASS
+
+    # For this usecase an empty indexer class is not an issue but a feature.
+    if not classpath:
+        logger.info("Document indexer is not configured (see SEARCH_INDEXER_CLASS)")
+        return None
+
+    try:
+        indexer_class = import_string(settings.SEARCH_INDEXER_CLASS)
+        return indexer_class()
+    except ImportError as err:
+        logger.error("SEARCH_INDEXER_CLASS setting is not valid : %s", err)
+    except ImproperlyConfigured as err:
+        logger.error("Document indexer is not properly configured : %s", err)
+
+    return None
+
+
+def get_batch_accesses_by_users_and_teams(paths):
+    """
+    Get accesses related to a list of document paths,
+    grouped by users and teams, including all ancestor paths.
+    """
+    ancestor_map = utils.get_ancestor_to_descendants_map(
+        paths, steplen=models.Document.steplen
+    )
+    ancestor_paths = list(ancestor_map.keys())
+
+    access_qs = models.DocumentAccess.objects.filter(
+        document__path__in=ancestor_paths
+    ).values("document__path", "user__sub", "team")
+
+    access_by_document_path = defaultdict(lambda: {"users": set(), "teams": set()})
+
+    for access in access_qs:
+        ancestor_path = access["document__path"]
+        user_sub = access["user__sub"]
+        team = access["team"]
+
+        for descendant_path in ancestor_map.get(ancestor_path, []):
+            if user_sub:
+                access_by_document_path[descendant_path]["users"].add(str(user_sub))
+            if team:
+                access_by_document_path[descendant_path]["teams"].add(team)
+
+    return dict(access_by_document_path)
+
+
+def get_visited_document_ids_of(queryset, user):
+    """
+    Returns the ids of the documents that have a linktrace to the user and NOT owned.
+    It will be use to limit the opensearch responses to the public documents already
+    "visited" by the user.
+    """
+    if isinstance(user, AnonymousUser):
+        return []
+
+    qs = models.LinkTrace.objects.filter(user=user)
+
+    docs = (
+        queryset.exclude(accesses__user=user)
+        .filter(
+            deleted_at__isnull=True,
+            ancestors_deleted_at__isnull=True,
+        )
+        .filter(pk__in=Subquery(qs.values("document_id")))
+        .order_by("pk")
+        .distinct("pk")
+    )
+
+    return [str(id) for id in docs.values_list("pk", flat=True)]
+
+
+class BaseDocumentIndexer(ABC):
+    """
+    Base class for document indexers.
+
+    Handles batching and access resolution. Subclasses must implement both
+    `serialize_document()` and `push()` to define backend-specific behavior.
+    """
+
+    def __init__(self, batch_size=None):
+        """
+        Initialize the indexer.
+
+        Args:
+            batch_size (int, optional): Number of documents per batch.
+                Defaults to settings.SEARCH_INDEXER_BATCH_SIZE.
+        """
+        self.batch_size = batch_size or settings.SEARCH_INDEXER_BATCH_SIZE
+        self.indexer_url = settings.SEARCH_INDEXER_URL
+        self.indexer_secret = settings.SEARCH_INDEXER_SECRET
+        self.search_url = settings.SEARCH_INDEXER_QUERY_URL
+
+        if not self.indexer_url:
+            raise ImproperlyConfigured(
+                "SEARCH_INDEXER_URL must be set in Django settings."
+            )
+
+        if not self.indexer_secret:
+            raise ImproperlyConfigured(
+                "SEARCH_INDEXER_SECRET must be set in Django settings."
+            )
+
+        if not self.search_url:
+            raise ImproperlyConfigured(
+                "SEARCH_INDEXER_QUERY_URL must be set in Django settings."
+            )
+
+    def index(self, queryset=None):
+        """
+        Fetch documents in batches, serialize them, and push to the search backend.
+        """
+        last_id = 0
+        count = 0
+        queryset = queryset or models.Document.objects.all()
+
+        while True:
+            documents_batch = list(
+                queryset.filter(
+                    id__gt=last_id,
+                ).order_by("id")[: self.batch_size]
+            )
+
+            if not documents_batch:
+                break
+
+            doc_paths = [doc.path for doc in documents_batch]
+            last_id = documents_batch[-1].id
+            accesses_by_document_path = get_batch_accesses_by_users_and_teams(doc_paths)
+
+            serialized_batch = [
+                self.serialize_document(document, accesses_by_document_path)
+                for document in documents_batch
+                if document.content or document.title
+            ]
+
+            self.push(serialized_batch)
+            count += len(serialized_batch)
+
+        return count
+
+    @abstractmethod
+    def serialize_document(self, document, accesses):
+        """
+        Convert a Document instance to a JSON-serializable format for indexing.
+
+        Must be implemented by subclasses.
+        """
+
+    @abstractmethod
+    def push(self, data):
+        """
+        Push a batch of serialized documents to the backend.
+
+        Must be implemented by subclasses.
+        """
+
+    # pylint: disable-next=too-many-arguments,too-many-positional-arguments
+    def search(self, text, token, visited=(), page=1, page_size=50):
+        """
+        Search for documents in Find app.
+        Ensure the same default ordering as "Docs" list : -updated_at
+
+        Returns ids of the documents
+
+        Args:
+            text (str): Text search content.
+            token (str): OIDC Authentication token.
+            visited (list, optional):
+                List of ids of active public documents with LinkTrace
+                Defaults to settings.SEARCH_INDEXER_BATCH_SIZE.
+            page (int, optional):
+                The page number to retrieve.
+                Defaults to 1 if not specified.
+            page_size (int, optional):
+                The number of results to return per page.
+                Defaults to 50 if not specified.
+        """
+        response = self.search_query(
+            data={
+                "q": text,
+                "visited": visited,
+                "services": ["docs"],
+                "page_number": page,
+                "page_size": page_size,
+                "order_by": "updated_at",
+                "order_direction": "desc",
+            },
+            token=token,
+        )
+
+        return [d["_id"] for d in response]
+
+    @abstractmethod
+    def search_query(self, data, token) -> dict:
+        """
+        Retrieve documents from the Find app API.
+
+        Must be implemented by subclasses.
+        """
+
+
+class SearchIndexer(BaseDocumentIndexer):
+    """
+    Document indexer that pushes documents to La Suite Find app.
+    """
+
+    def serialize_document(self, document, accesses):
+        """
+        Convert a Document to the JSON format expected by La Suite Find.
+
+        Args:
+            document (Document): The document instance.
+            accesses (dict): Mapping of document ID to user/team access.
+
+        Returns:
+            dict: A JSON-serializable dictionary.
+        """
+        doc_path = document.path
+        doc_content = document.content
+        text_content = utils.base64_yjs_to_text(doc_content) if doc_content else ""
+
+        return {
+            "id": str(document.id),
+            "title": document.title or "",
+            "content": text_content,
+            "depth": document.depth,
+            "path": document.path,
+            "numchild": document.numchild,
+            "created_at": document.created_at.isoformat(),
+            "updated_at": document.updated_at.isoformat(),
+            "users": list(accesses.get(doc_path, {}).get("users", set())),
+            "groups": list(accesses.get(doc_path, {}).get("teams", set())),
+            "reach": document.computed_link_reach,
+            "size": len(text_content.encode("utf-8")),
+            "is_active": not bool(document.ancestors_deleted_at),
+        }
+
+    def search_query(self, data, token) -> requests.Response:
+        """
+        Retrieve documents from the Find app API.
+
+        Args:
+            data (dict): search data
+            token (str): OICD token
+
+        Returns:
+            dict: A JSON-serializable dictionary.
+        """
+        response = requests.post(
+            self.search_url,
+            json=data,
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=10,
+        )
+        response.raise_for_status()
+        return response.json()
+
+    def push(self, data):
+        """
+        Push a batch of documents to the Find backend.
+
+        Args:
+            data (list): List of document dictionaries.
+        """
+        response = requests.post(
+            self.indexer_url,
+            json=data,
+            headers={"Authorization": f"Bearer {self.indexer_secret}"},
+            timeout=10,
+        )
+        response.raise_for_status()

src/backend/core/signals.py

@@ -0,0 +1,33 @@
+"""
+Declare and configure the signals for the impress core application
+"""
+
+from functools import partial
+
+from django.db import transaction
+from django.db.models import signals
+from django.dispatch import receiver
+
+from . import models
+from .tasks.search import trigger_batch_document_indexer
+
+
+@receiver(signals.post_save, sender=models.Document)
+def document_post_save(sender, instance, **kwargs):  # pylint: disable=unused-argument
+    """
+    Asynchronous call to the document indexer at the end of the transaction.
+    Note : Within the transaction we can have an empty content and a serialization
+    error.
+    """
+    transaction.on_commit(partial(trigger_batch_document_indexer, instance))
+
+
+@receiver(signals.post_save, sender=models.DocumentAccess)
+def document_access_post_save(sender, instance, created, **kwargs):  # pylint: disable=unused-argument
+    """
+    Asynchronous call to the document indexer at the end of the transaction.
+    """
+    if not created:
+        transaction.on_commit(
+            partial(trigger_batch_document_indexer, instance.document)
+        )

src/backend/core/tasks/search.py

@@ -0,0 +1,97 @@
+"""Trigger document indexation using celery task."""
+
+from logging import getLogger
+
+from django.conf import settings
+from django.core.cache import cache
+from django.db.models import Q
+
+from django_redis.cache import RedisCache
+
+from core import models
+from core.services.search_indexers import (
+    get_document_indexer,
+)
+
+from impress.celery_app import app
+
+logger = getLogger(__file__)
+
+
+@app.task
+def document_indexer_task(document_id):
+    """Celery Task : Sends indexation query for a document."""
+    indexer = get_document_indexer()
+
+    if indexer is None:
+        return
+
+    logger.info("Start document %s indexation", document_id)
+    indexer.index(models.Document.objects.filter(pk=document_id))
+
+
+def batch_indexer_throttle_acquire(timeout: int = 0, atomic: bool = True):
+    """
+    Enable the task throttle flag for a delay.
+    Uses redis locks if available to ensure atomic changes
+    """
+    key = "document-batch-indexer-throttle"
+
+    # Redis is used as cache database (not in tests). Use the lock feature here
+    # to ensure atomicity of changes to the throttle flag.
+    if isinstance(cache, RedisCache) and atomic:
+        with cache.locks(key):
+            return batch_indexer_throttle_acquire(timeout, atomic=False)
+
+    # Use add() here :
+    #   - set the flag and returns true if not exist
+    #   - do nothing and return false if exist
+    return cache.add(key, 1, timeout=timeout)
+
+
+@app.task
+def batch_document_indexer_task(timestamp):
+    """Celery Task : Sends indexation query for a batch of documents."""
+    indexer = get_document_indexer()
+
+    if indexer:
+        queryset = models.Document.objects.filter(
+            Q(updated_at__gte=timestamp)
+            | Q(deleted_at__gte=timestamp)
+            | Q(ancestors_deleted_at__gte=timestamp)
+        )
+
+        count = indexer.index(queryset)
+        logger.info("Indexed %d documents", count)
+
+
+def trigger_batch_document_indexer(item):
+    """
+    Trigger indexation task with debounce a delay set by the SEARCH_INDEXER_COUNTDOWN setting.
+
+    Args:
+        document (Document): The document instance.
+    """
+    countdown = int(settings.SEARCH_INDEXER_COUNTDOWN)
+
+    # DO NOT create a task if indexation if disabled
+    if not settings.SEARCH_INDEXER_CLASS:
+        return
+
+    if countdown > 0:
+        # Each time this method is called during a countdown, we increment the
+        # counter and each task decrease it, so the index be run only once.
+        if batch_indexer_throttle_acquire(timeout=countdown):
+            logger.info(
+                "Add task for batch document indexation from updated_at=%s in %d seconds",
+                item.updated_at.isoformat(),
+                countdown,
+            )
+
+            batch_document_indexer_task.apply_async(
+                args=[item.updated_at], countdown=countdown
+            )
+        else:
+            logger.info("Skip task for batch document %s indexation", item.pk)
+    else:
+        document_indexer_task.apply(args=[item.pk])

src/backend/core/tests/commands/test_index.py

@@ -0,0 +1,65 @@
+"""
+Unit test for `index` command.
+"""
+
+from operator import itemgetter
+from unittest import mock
+
+from django.core.management import CommandError, call_command
+from django.db import transaction
+
+import pytest
+
+from core import factories
+from core.services.search_indexers import SearchIndexer
+
+
+@pytest.mark.django_db
+@pytest.mark.usefixtures("indexer_settings")
+def test_index():
+    """Test the command `index` that run the Find app indexer for all the available documents."""
+    user = factories.UserFactory()
+    indexer = SearchIndexer()
+
+    with transaction.atomic():
+        doc = factories.DocumentFactory()
+        empty_doc = factories.DocumentFactory(title=None, content="")
+        no_title_doc = factories.DocumentFactory(title=None)
+
+        factories.UserDocumentAccessFactory(document=doc, user=user)
+        factories.UserDocumentAccessFactory(document=empty_doc, user=user)
+        factories.UserDocumentAccessFactory(document=no_title_doc, user=user)
+
+    accesses = {
+        str(doc.path): {"users": [user.sub]},
+        str(empty_doc.path): {"users": [user.sub]},
+        str(no_title_doc.path): {"users": [user.sub]},
+    }
+
+    with mock.patch.object(SearchIndexer, "push") as mock_push:
+        call_command("index")
+
+        push_call_args = [call.args[0] for call in mock_push.call_args_list]
+
+        # called once but with a batch of docs
+        mock_push.assert_called_once()
+
+        assert sorted(push_call_args[0], key=itemgetter("id")) == sorted(
+            [
+                indexer.serialize_document(doc, accesses),
+                indexer.serialize_document(no_title_doc, accesses),
+            ],
+            key=itemgetter("id"),
+        )
+
+
+@pytest.mark.django_db
+@pytest.mark.usefixtures("indexer_settings")
+def test_index_improperly_configured(indexer_settings):
+    """The command should raise an exception if the indexer is not configured"""
+    indexer_settings.SEARCH_INDEXER_CLASS = None
+
+    with pytest.raises(CommandError) as err:
+        call_command("index")
+
+    assert str(err.value) == "The indexer is not enabled or properly configured."

src/backend/core/tests/conftest.py

@@ -24,3 +24,30 @@ def mock_user_teams():
         "core.models.User.teams", new_callable=mock.PropertyMock
     ) as mock_teams:
         yield mock_teams
+
+
+@pytest.fixture(name="indexer_settings")
+def indexer_settings_fixture(settings):
+    """
+    Setup valid settings for the document indexer. Clear the indexer cache.
+    """
+
+    # pylint: disable-next=import-outside-toplevel
+    from core.services.search_indexers import (  # noqa: PLC0415
+        get_document_indexer,
+    )
+
+    get_document_indexer.cache_clear()
+
+    settings.SEARCH_INDEXER_CLASS = "core.services.search_indexers.SearchIndexer"
+    settings.SEARCH_INDEXER_SECRET = "ThisIsAKeyForTest"
+    settings.SEARCH_INDEXER_URL = "http://localhost:8081/api/v1.0/documents/index/"
+    settings.SEARCH_INDEXER_QUERY_URL = (
+        "http://localhost:8081/api/v1.0/documents/search/"
+    )
+    settings.SEARCH_INDEXER_COUNTDOWN = 1
+
+    yield settings
+
+    # clear cache to prevent issues with other tests
+    get_document_indexer.cache_clear()

src/backend/core/tests/documents/test_api_document_accesses.py

@@ -293,7 +293,6 @@ def test_api_document_accesses_retrieve_set_role_to_child():
     }
     assert result_dict[str(document_access_other_user.id)] == [
         "reader",
-        "commenter",
         "editor",
         "administrator",
         "owner",
@@ -302,7 +301,7 @@ def test_api_document_accesses_retrieve_set_role_to_child():
 
     # Add an access for the other user on the parent
     parent_access_other_user = factories.UserDocumentAccessFactory(
-        document=parent, user=other_user, role="commenter"
+        document=parent, user=other_user, role="editor"
     )
 
     response = client.get(f"/api/v1.0/documents/{document.id!s}/accesses/")
@@ -315,7 +314,6 @@ def test_api_document_accesses_retrieve_set_role_to_child():
         result["id"]: result["abilities"]["set_role_to"] for result in content
     }
     assert result_dict[str(document_access_other_user.id)] == [
-        "commenter",
         "editor",
         "administrator",
         "owner",
@@ -323,7 +321,6 @@ def test_api_document_accesses_retrieve_set_role_to_child():
     assert result_dict[str(parent_access.id)] == []
     assert result_dict[str(parent_access_other_user.id)] == [
         "reader",
-        "commenter",
         "editor",
         "administrator",
         "owner",
@@ -336,28 +333,28 @@ def test_api_document_accesses_retrieve_set_role_to_child():
         [
             ["administrator", "reader", "reader", "reader"],
             [
-                ["reader", "commenter", "editor", "administrator"],
+                ["reader", "editor", "administrator"],
                 [],
                 [],
-                ["reader", "commenter", "editor", "administrator"],
+                ["reader", "editor", "administrator"],
             ],
         ],
         [
             ["owner", "reader", "reader", "reader"],
             [
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
                 [],
                 [],
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
             ],
         ],
         [
             ["owner", "reader", "reader", "owner"],
             [
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
                 [],
                 [],
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
             ],
         ],
     ],
@@ -418,44 +415,44 @@ def test_api_document_accesses_list_authenticated_related_same_user(roles, resul
         [
             ["administrator", "reader", "reader", "reader"],
             [
-                ["reader", "commenter", "editor", "administrator"],
+                ["reader", "editor", "administrator"],
                 [],
                 [],
-                ["reader", "commenter", "editor", "administrator"],
+                ["reader", "editor", "administrator"],
             ],
         ],
         [
             ["owner", "reader", "reader", "reader"],
             [
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
                 [],
                 [],
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
             ],
         ],
         [
             ["owner", "reader", "reader", "owner"],
             [
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
                 [],
                 [],
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
             ],
         ],
         [
             ["reader", "reader", "reader", "owner"],
             [
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
                 [],
                 [],
-                ["reader", "commenter", "editor", "administrator", "owner"],
+                ["reader", "editor", "administrator", "owner"],
             ],
         ],
         [
             ["reader", "administrator", "reader", "editor"],
             [
-                ["reader", "commenter", "editor", "administrator"],
-                ["reader", "commenter", "editor", "administrator"],
+                ["reader", "editor", "administrator"],
+                ["reader", "editor", "administrator"],
                 [],
                 [],
             ],
@@ -463,7 +460,7 @@ def test_api_document_accesses_list_authenticated_related_same_user(roles, resul
         [
             ["editor", "editor", "administrator", "editor"],
             [
-                ["reader", "commenter", "editor", "administrator"],
+                ["reader", "editor", "administrator"],
                 [],
                 ["editor", "administrator"],
                 [],

src/backend/core/tests/documents/test_api_documents_ask_for_access.py

@@ -115,10 +115,7 @@ def test_api_documents_ask_for_access_create_authenticated_non_root_document():
     assert response.status_code == 404
 
 
-@pytest.mark.parametrize(
-    "role", [role for role in RoleChoices if role != RoleChoices.OWNER]
-)
-def test_api_documents_ask_for_access_create_authenticated_specific_role(role):
+def test_api_documents_ask_for_access_create_authenticated_specific_role():
     """
     Authenticated users should be able to create a document ask for access with a specific role.
     """
@@ -130,35 +127,17 @@ def test_api_documents_ask_for_access_create_authenticated_specific_role(role):
 
     response = client.post(
         f"/api/v1.0/documents/{document.id}/ask-for-access/",
-        data={"role": role},
+        data={"role": RoleChoices.EDITOR},
     )
     assert response.status_code == 201
 
     assert DocumentAskForAccess.objects.filter(
         document=document,
         user=user,
-        role=role,
+        role=RoleChoices.EDITOR,
     ).exists()
 
 
-def test_api_documents_ask_for_access_create_authenticated_owner_role():
-    """
-    Authenticated users should not be able to create a document ask for access with the owner role.
-    """
-    document = DocumentFactory()
-    user = UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/documents/{document.id}/ask-for-access/",
-        data={"role": RoleChoices.OWNER},
-    )
-    assert response.status_code == 400
-    assert response.json() == {"role": ['"owner" is not a valid choice.']}
-
-
 def test_api_documents_ask_for_access_create_authenticated_already_has_access():
     """Authenticated users with existing access can ask for access with a different role."""
     user = UserFactory()
@@ -287,7 +266,6 @@ def test_api_documents_ask_for_access_list_authenticated_own_request():
                     "update": False,
                     "partial_update": False,
                     "retrieve": False,
-                    "set_role_to": [],
                 },
             }
         ],
@@ -357,16 +335,6 @@ def test_api_documents_ask_for_access_list_owner_or_admin(role):
 
     response = client.get(f"/api/v1.0/documents/{document.id}/ask-for-access/")
     assert response.status_code == 200
-
-    expected_set_role_to = [
-        RoleChoices.READER,
-        RoleChoices.COMMENTER,
-        RoleChoices.EDITOR,
-        RoleChoices.ADMIN,
-    ]
-    if role == RoleChoices.OWNER:
-        expected_set_role_to.append(RoleChoices.OWNER)
-
     assert response.json() == {
         "count": 3,
         "next": None,
@@ -386,7 +354,6 @@ def test_api_documents_ask_for_access_list_owner_or_admin(role):
                     "update": True,
                     "partial_update": True,
                     "retrieve": True,
-                    "set_role_to": expected_set_role_to,
                 },
             }
             for document_ask_for_access in document_ask_for_accesses
@@ -479,14 +446,6 @@ def test_api_documents_ask_for_access_retrieve_owner_or_admin(role):
         f"/api/v1.0/documents/{document.id}/ask-for-access/{document_ask_for_access.id}/"
     )
     assert response.status_code == 200
-    expected_set_role_to = [
-        RoleChoices.READER,
-        RoleChoices.COMMENTER,
-        RoleChoices.EDITOR,
-        RoleChoices.ADMIN,
-    ]
-    if role == RoleChoices.OWNER:
-        expected_set_role_to.append(RoleChoices.OWNER)
     assert response.json() == {
         "id": str(document_ask_for_access.id),
         "document": str(document.id),
@@ -501,7 +460,6 @@ def test_api_documents_ask_for_access_retrieve_owner_or_admin(role):
             "update": True,
             "partial_update": True,
             "retrieve": True,
-            "set_role_to": expected_set_role_to,
         },
     }
 
@@ -791,53 +749,6 @@ def test_api_documents_ask_for_access_accept_authenticated_owner_or_admin_update
     assert document_access.role == RoleChoices.ADMIN
 
 
-def test_api_documents_ask_for_access_accept_admin_cannot_accept_owner_role():
-    """
-    Admin users should not be able to accept document ask for access with the owner role.
-    """
-    user = UserFactory()
-    document = DocumentFactory(users=[(user, RoleChoices.ADMIN)])
-    document_ask_for_access = DocumentAskForAccessFactory(
-        document=document, role=RoleChoices.READER
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/documents/{document.id}/ask-for-access/{document_ask_for_access.id}/accept/",
-        data={"role": RoleChoices.OWNER},
-    )
-    assert response.status_code == 400
-    assert response.json() == {
-        "detail": "You cannot accept a role higher than your own."
-    }
-
-
-def test_api_documents_ask_for_access_accept_owner_can_accept_owner_role():
-    """
-    Owner users should be able to accept document ask for access with the owner role.
-    """
-    user = UserFactory()
-    document = DocumentFactory(users=[(user, RoleChoices.OWNER)])
-    document_ask_for_access = DocumentAskForAccessFactory(
-        document=document, role=RoleChoices.READER
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.post(
-        f"/api/v1.0/documents/{document.id}/ask-for-access/{document_ask_for_access.id}/accept/",
-        data={"role": RoleChoices.OWNER},
-    )
-    assert response.status_code == 204
-
-    assert not DocumentAskForAccess.objects.filter(
-        id=document_ask_for_access.id
-    ).exists()
-
-
 @pytest.mark.parametrize("role", [RoleChoices.OWNER, RoleChoices.ADMIN])
 def test_api_documents_ask_for_access_accept_authenticated_non_root_document(role):
     """

src/backend/core/tests/documents/test_api_documents_comments.py

@@ -1,878 +0,0 @@
-"""Test API for comments on documents."""
-
-import random
-
-from django.contrib.auth.models import AnonymousUser
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-# List comments
-
-
-def test_list_comments_anonymous_user_public_document():
-    """Anonymous users should be allowed to list comments on a public document."""
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.COMMENTER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment1, comment2 = factories.CommentFactory.create_batch(2, thread=thread)
-    # other comments not linked to the document
-    factories.CommentFactory.create_batch(2)
-
-    response = APIClient().get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/"
-    )
-    assert response.status_code == 200
-    assert response.json() == {
-        "count": 2,
-        "next": None,
-        "previous": None,
-        "results": [
-            {
-                "id": str(comment1.id),
-                "body": comment1.body,
-                "created_at": comment1.created_at.isoformat().replace("+00:00", "Z"),
-                "updated_at": comment1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user": {
-                    "full_name": comment1.user.full_name,
-                    "short_name": comment1.user.short_name,
-                },
-                "abilities": comment1.get_abilities(AnonymousUser()),
-                "reactions": [],
-            },
-            {
-                "id": str(comment2.id),
-                "body": comment2.body,
-                "created_at": comment2.created_at.isoformat().replace("+00:00", "Z"),
-                "updated_at": comment2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user": {
-                    "full_name": comment2.user.full_name,
-                    "short_name": comment2.user.short_name,
-                },
-                "abilities": comment2.get_abilities(AnonymousUser()),
-                "reactions": [],
-            },
-        ],
-    }
-
-
-@pytest.mark.parametrize("link_reach", ["restricted", "authenticated"])
-def test_list_comments_anonymous_user_non_public_document(link_reach):
-    """Anonymous users should not be allowed to list comments on a non-public document."""
-    document = factories.DocumentFactory(
-        link_reach=link_reach, link_role=models.LinkRoleChoices.COMMENTER
-    )
-    thread = factories.ThreadFactory(document=document)
-    factories.CommentFactory(thread=thread)
-    # other comments not linked to the document
-    factories.CommentFactory.create_batch(2)
-
-    response = APIClient().get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/"
-    )
-    assert response.status_code == 401
-
-
-def test_list_comments_authenticated_user_accessible_document():
-    """Authenticated users should be allowed to list comments on an accessible document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.COMMENTER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment1 = factories.CommentFactory(thread=thread)
-    comment2 = factories.CommentFactory(thread=thread, user=user)
-    # other comments not linked to the document
-    factories.CommentFactory.create_batch(2)
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/"
-    )
-    assert response.status_code == 200
-    assert response.json() == {
-        "count": 2,
-        "next": None,
-        "previous": None,
-        "results": [
-            {
-                "id": str(comment1.id),
-                "body": comment1.body,
-                "created_at": comment1.created_at.isoformat().replace("+00:00", "Z"),
-                "updated_at": comment1.updated_at.isoformat().replace("+00:00", "Z"),
-                "user": {
-                    "full_name": comment1.user.full_name,
-                    "short_name": comment1.user.short_name,
-                },
-                "abilities": comment1.get_abilities(user),
-                "reactions": [],
-            },
-            {
-                "id": str(comment2.id),
-                "body": comment2.body,
-                "created_at": comment2.created_at.isoformat().replace("+00:00", "Z"),
-                "updated_at": comment2.updated_at.isoformat().replace("+00:00", "Z"),
-                "user": {
-                    "full_name": comment2.user.full_name,
-                    "short_name": comment2.user.short_name,
-                },
-                "abilities": comment2.get_abilities(user),
-                "reactions": [],
-            },
-        ],
-    }
-
-
-def test_list_comments_authenticated_user_non_accessible_document():
-    """Authenticated users should not be allowed to list comments on a non-accessible document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(link_reach="restricted")
-    thread = factories.ThreadFactory(document=document)
-    factories.CommentFactory(thread=thread)
-    # other comments not linked to the document
-    factories.CommentFactory.create_batch(2)
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/"
-    )
-    assert response.status_code == 403
-
-
-def test_list_comments_authenticated_user_not_enough_access():
-    """
-    Authenticated users should not be allowed to list comments on a document they don't have
-    comment access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.READER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    factories.CommentFactory(thread=thread)
-    # other comments not linked to the document
-    factories.CommentFactory.create_batch(2)
-
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/"
-    )
-    assert response.status_code == 403
-
-
-# Create comment
-
-
-def test_create_comment_anonymous_user_public_document():
-    """
-    Anonymous users should be allowed to create comments on a public document
-    with commenter link_role.
-    """
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.COMMENTER
-    )
-    thread = factories.ThreadFactory(document=document)
-    client = APIClient()
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/",
-        {"body": "test"},
-    )
-    assert response.status_code == 201
-
-    assert response.json() == {
-        "id": str(response.json()["id"]),
-        "body": "test",
-        "created_at": response.json()["created_at"],
-        "updated_at": response.json()["updated_at"],
-        "user": None,
-        "abilities": {
-            "destroy": False,
-            "update": False,
-            "partial_update": False,
-            "reactions": False,
-            "retrieve": True,
-        },
-        "reactions": [],
-    }
-
-
-def test_create_comment_anonymous_user_non_accessible_document():
-    """Anonymous users should not be allowed to create comments on a non-accessible document."""
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.READER
-    )
-    thread = factories.ThreadFactory(document=document)
-    client = APIClient()
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/",
-        {"body": "test"},
-    )
-
-    assert response.status_code == 401
-
-
-def test_create_comment_authenticated_user_accessible_document():
-    """Authenticated users should be allowed to create comments on an accessible document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.COMMENTER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/",
-        {"body": "test"},
-    )
-    assert response.status_code == 201
-
-    assert response.json() == {
-        "id": str(response.json()["id"]),
-        "body": "test",
-        "created_at": response.json()["created_at"],
-        "updated_at": response.json()["updated_at"],
-        "user": {
-            "full_name": user.full_name,
-            "short_name": user.short_name,
-        },
-        "abilities": {
-            "destroy": True,
-            "update": True,
-            "partial_update": True,
-            "reactions": True,
-            "retrieve": True,
-        },
-        "reactions": [],
-    }
-
-
-def test_create_comment_authenticated_user_not_enough_access():
-    """
-    Authenticated users should not be allowed to create comments on a document they don't have
-    comment access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.READER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/",
-        {"body": "test"},
-    )
-    assert response.status_code == 403
-
-
-# Retrieve comment
-
-
-def test_retrieve_comment_anonymous_user_public_document():
-    """Anonymous users should be allowed to retrieve comments on a public document."""
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.COMMENTER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 200
-    assert response.json() == {
-        "id": str(comment.id),
-        "body": comment.body,
-        "created_at": comment.created_at.isoformat().replace("+00:00", "Z"),
-        "updated_at": comment.updated_at.isoformat().replace("+00:00", "Z"),
-        "user": {
-            "full_name": comment.user.full_name,
-            "short_name": comment.user.short_name,
-        },
-        "reactions": [],
-        "abilities": comment.get_abilities(AnonymousUser()),
-    }
-
-
-def test_retrieve_comment_anonymous_user_non_accessible_document():
-    """Anonymous users should not be allowed to retrieve comments on a non-accessible document."""
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.READER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 401
-
-
-def test_retrieve_comment_authenticated_user_accessible_document():
-    """Authenticated users should be allowed to retrieve comments on an accessible document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.COMMENTER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 200
-
-
-def test_retrieve_comment_authenticated_user_not_enough_access():
-    """
-    Authenticated users should not be allowed to retrieve comments on a document they don't have
-    comment access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.READER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 403
-
-
-# Update comment
-
-
-def test_update_comment_anonymous_user_public_document():
-    """Anonymous users should not be allowed to update comments on a public document."""
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.COMMENTER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, body="test")
-    client = APIClient()
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/",
-        {"body": "other content"},
-    )
-    assert response.status_code == 401
-
-
-def test_update_comment_anonymous_user_non_accessible_document():
-    """Anonymous users should not be allowed to update comments on a non-accessible document."""
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.READER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, body="test")
-    client = APIClient()
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/",
-        {"body": "other content"},
-    )
-    assert response.status_code == 401
-
-
-def test_update_comment_authenticated_user_accessible_document():
-    """Authenticated users should not be able to update comments not their own."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted",
-        users=[
-            (
-                user,
-                random.choice(
-                    [models.LinkRoleChoices.COMMENTER, models.LinkRoleChoices.EDITOR]
-                ),
-            )
-        ],
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, body="test")
-    client = APIClient()
-    client.force_login(user)
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/",
-        {"body": "other content"},
-    )
-    assert response.status_code == 403
-
-
-def test_update_comment_authenticated_user_own_comment():
-    """Authenticated users should be able to update comments not their own."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted",
-        users=[
-            (
-                user,
-                random.choice(
-                    [models.LinkRoleChoices.COMMENTER, models.LinkRoleChoices.EDITOR]
-                ),
-            )
-        ],
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, body="test", user=user)
-    client = APIClient()
-    client.force_login(user)
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/",
-        {"body": "other content"},
-    )
-    assert response.status_code == 200
-
-    comment.refresh_from_db()
-    assert comment.body == "other content"
-
-
-def test_update_comment_authenticated_user_not_enough_access():
-    """
-    Authenticated users should not be allowed to update comments on a document they don't
-    have comment access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.READER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, body="test")
-    client = APIClient()
-    client.force_login(user)
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/",
-        {"body": "other content"},
-    )
-    assert response.status_code == 403
-
-
-def test_update_comment_authenticated_no_access():
-    """
-    Authenticated users should not be allowed to update comments on a document they don't
-    have access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(link_reach="restricted")
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, body="test")
-    client = APIClient()
-    client.force_login(user)
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/",
-        {"body": "other content"},
-    )
-    assert response.status_code == 403
-
-
-@pytest.mark.parametrize("role", [models.RoleChoices.ADMIN, models.RoleChoices.OWNER])
-def test_update_comment_authenticated_admin_or_owner_can_update_any_comment(role):
-    """
-    Authenticated users should be able to update comments on a document they don't have access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(users=[(user, role)])
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, body="test")
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/",
-        {"body": "other content"},
-    )
-    assert response.status_code == 200
-
-    comment.refresh_from_db()
-    assert comment.body == "other content"
-
-
-@pytest.mark.parametrize("role", [models.RoleChoices.ADMIN, models.RoleChoices.OWNER])
-def test_update_comment_authenticated_admin_or_owner_can_update_own_comment(role):
-    """
-    Authenticated users should be able to update comments on a document they don't have access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(users=[(user, role)])
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, body="test", user=user)
-    client = APIClient()
-    client.force_login(user)
-
-    response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/",
-        {"body": "other content"},
-    )
-    assert response.status_code == 200
-
-    comment.refresh_from_db()
-    assert comment.body == "other content"
-
-
-# Delete comment
-
-
-def test_delete_comment_anonymous_user_public_document():
-    """Anonymous users should not be allowed to delete comments on a public document."""
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.COMMENTER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 401
-
-
-def test_delete_comment_anonymous_user_non_accessible_document():
-    """Anonymous users should not be allowed to delete comments on a non-accessible document."""
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.READER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 401
-
-
-def test_delete_comment_authenticated_user_accessible_document_own_comment():
-    """Authenticated users should be able to delete comments on an accessible document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.COMMENTER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, user=user)
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 204
-
-
-def test_delete_comment_authenticated_user_accessible_document_not_own_comment():
-    """Authenticated users should not be able to delete comments on an accessible document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.COMMENTER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 403
-
-
-@pytest.mark.parametrize("role", [models.RoleChoices.ADMIN, models.RoleChoices.OWNER])
-def test_delete_comment_authenticated_user_admin_or_owner_can_delete_any_comment(role):
-    """Authenticated users should be able to delete comments on a document they have access to."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(users=[(user, role)])
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 204
-
-
-@pytest.mark.parametrize("role", [models.RoleChoices.ADMIN, models.RoleChoices.OWNER])
-def test_delete_comment_authenticated_user_admin_or_owner_can_delete_own_comment(role):
-    """Authenticated users should be able to delete comments on a document they have access to."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(users=[(user, role)])
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread, user=user)
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 204
-
-
-def test_delete_comment_authenticated_user_not_enough_access():
-    """
-    Authenticated users should not be able to delete comments on a document they don't
-    have access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.LinkRoleChoices.READER)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/comments/{comment.id!s}/"
-    )
-    assert response.status_code == 403
-
-
-# Create reaction
-
-
-@pytest.mark.parametrize("link_role", models.LinkRoleChoices.values)
-def test_create_reaction_anonymous_user_public_document(link_role):
-    """No matter the link_role, an anonymous user can not react to a comment."""
-
-    document = factories.DocumentFactory(link_reach="public", link_role=link_role)
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 401
-
-
-def test_create_reaction_authenticated_user_public_document():
-    """
-    Authenticated users should not be able to reaction to a comment on a public document with
-    link_role reader.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.READER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 403
-
-
-def test_create_reaction_authenticated_user_accessible_public_document():
-    """
-    Authenticated users should be able to react to a comment on a public document.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="public", link_role=models.LinkRoleChoices.COMMENTER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 201
-
-    assert models.Reaction.objects.filter(
-        comment=comment, emoji="test", users__in=[user]
-    ).exists()
-
-
-def test_create_reaction_authenticated_user_connected_document_link_role_reader():
-    """
-    Authenticated users should not be able to react to a comment on a connected document
-    with link_role reader.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="authenticated", link_role=models.LinkRoleChoices.READER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 403
-
-
-@pytest.mark.parametrize(
-    "link_role",
-    [
-        role
-        for role in models.LinkRoleChoices.values
-        if role != models.LinkRoleChoices.READER
-    ],
-)
-def test_create_reaction_authenticated_user_connected_document(link_role):
-    """
-    Authenticated users should be able to react to a comment on a connected document.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="authenticated", link_role=link_role
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 201
-
-    assert models.Reaction.objects.filter(
-        comment=comment, emoji="test", users__in=[user]
-    ).exists()
-
-
-def test_create_reaction_authenticated_user_restricted_accessible_document():
-    """
-    Authenticated users should not be able to react to a comment on a restricted accessible document
-    they don't have access to.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(link_reach="restricted")
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 403
-
-
-def test_create_reaction_authenticated_user_restricted_accessible_document_role_reader():
-    """
-    Authenticated users should not be able to react to a comment on a restricted accessible
-    document with role reader.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", link_role=models.LinkRoleChoices.READER
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 403
-
-
-@pytest.mark.parametrize(
-    "role",
-    [role for role in models.RoleChoices.values if role != models.RoleChoices.READER],
-)
-def test_create_reaction_authenticated_user_restricted_accessible_document_role_commenter(
-    role,
-):
-    """
-    Authenticated users should be able to react to a comment on a restricted accessible document
-    with role commenter.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(link_reach="restricted", users=[(user, role)])
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    client = APIClient()
-    client.force_login(user)
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 201
-
-    assert models.Reaction.objects.filter(
-        comment=comment, emoji="test", users__in=[user]
-    ).exists()
-
-    response = client.post(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": "test"},
-    )
-    assert response.status_code == 400
-    assert response.json() == {"user_already_reacted": True}
-
-
-# Delete reaction
-
-
-def test_delete_reaction_not_owned_by_the_current_user():
-    """
-    Users should not be able to delete reactions not owned by the current user.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.RoleChoices.ADMIN)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    reaction = factories.ReactionFactory(comment=comment)
-
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": reaction.emoji},
-    )
-    assert response.status_code == 404
-
-
-def test_delete_reaction_owned_by_the_current_user():
-    """
-    Users should not be able to delete reactions not owned by the current user.
-    """
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_reach="restricted", users=[(user, models.RoleChoices.ADMIN)]
-    )
-    thread = factories.ThreadFactory(document=document)
-    comment = factories.CommentFactory(thread=thread)
-    reaction = factories.ReactionFactory(comment=comment)
-
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/threads/{thread.id!s}/"
-        f"comments/{comment.id!s}/reactions/",
-        {"emoji": reaction.emoji},
-    )
-    assert response.status_code == 404
-
-    reaction.refresh_from_db()
-    assert reaction.users.exists()

src/backend/core/tests/documents/test_api_documents_retrieve.py

@@ -36,7 +36,6 @@ def test_api_documents_retrieve_anonymous_public_standalone():
             "children_create": False,
             "children_list": True,
             "collaboration_auth": True,
-            "comment": document.link_role in ["commenter", "editor"],
             "cors_proxy": True,
             "content": True,
             "descendants": True,
@@ -47,8 +46,8 @@ def test_api_documents_retrieve_anonymous_public_standalone():
             "invite_owner": False,
             "link_configuration": False,
             "link_select_options": {
-                "authenticated": ["reader", "commenter", "editor"],
-                "public": ["reader", "commenter", "editor"],
+                "authenticated": ["reader", "editor"],
+                "public": ["reader", "editor"],
                 "restricted": None,
             },
             "mask": False,
@@ -114,7 +113,6 @@ def test_api_documents_retrieve_anonymous_public_parent():
             "children_create": False,
             "children_list": True,
             "collaboration_auth": True,
-            "comment": grand_parent.link_role in ["commenter", "editor"],
             "descendants": True,
             "cors_proxy": True,
             "content": True,
@@ -222,7 +220,6 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
             "children_create": document.link_role == "editor",
             "children_list": True,
             "collaboration_auth": True,
-            "comment": document.link_role in ["commenter", "editor"],
             "descendants": True,
             "cors_proxy": True,
             "content": True,
@@ -232,8 +229,8 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
             "invite_owner": False,
             "link_configuration": False,
             "link_select_options": {
-                "authenticated": ["reader", "commenter", "editor"],
-                "public": ["reader", "commenter", "editor"],
+                "authenticated": ["reader", "editor"],
+                "public": ["reader", "editor"],
                 "restricted": None,
             },
             "mask": True,
@@ -307,7 +304,6 @@ def test_api_documents_retrieve_authenticated_public_or_authenticated_parent(rea
             "children_create": grand_parent.link_role == "editor",
             "children_list": True,
             "collaboration_auth": True,
-            "comment": grand_parent.link_role in ["commenter", "editor"],
             "descendants": True,
             "cors_proxy": True,
             "content": True,
@@ -498,14 +494,13 @@ def test_api_documents_retrieve_authenticated_related_parent():
         "abilities": {
             "accesses_manage": access.role in ["administrator", "owner"],
             "accesses_view": True,
-            "ai_transform": access.role not in ["reader", "commenter"],
-            "ai_translate": access.role not in ["reader", "commenter"],
-            "attachment_upload": access.role not in ["reader", "commenter"],
-            "can_edit": access.role not in ["reader", "commenter"],
-            "children_create": access.role not in ["reader", "commenter"],
+            "ai_transform": access.role != "reader",
+            "ai_translate": access.role != "reader",
+            "attachment_upload": access.role != "reader",
+            "can_edit": access.role != "reader",
+            "children_create": access.role != "reader",
             "children_list": True,
             "collaboration_auth": True,
-            "comment": access.role != "reader",
             "descendants": True,
             "cors_proxy": True,
             "content": True,
@@ -521,11 +516,11 @@ def test_api_documents_retrieve_authenticated_related_parent():
             "media_auth": True,
             "media_check": True,
             "move": access.role in ["administrator", "owner"],
-            "partial_update": access.role not in ["reader", "commenter"],
+            "partial_update": access.role != "reader",
             "restore": access.role == "owner",
             "retrieve": True,
             "tree": True,
-            "update": access.role not in ["reader", "commenter"],
+            "update": access.role != "reader",
             "versions_destroy": access.role in ["administrator", "owner"],
             "versions_list": True,
             "versions_retrieve": True,

src/backend/core/tests/documents/test_api_documents_search.py

@@ -0,0 +1,426 @@
+"""
+Tests for Documents API endpoint in impress's core app: list
+"""
+
+import random
+from json import loads as json_loads
+
+from django.test import RequestFactory
+
+import pytest
+import responses
+from faker import Faker
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.services.search_indexers import get_document_indexer
+
+fake = Faker()
+pytestmark = pytest.mark.django_db
+
+
+def build_search_url(**kwargs):
+    """Build absolute uri for search endpoint with ORDERED query arguments"""
+    return (
+        RequestFactory()
+        .get("/api/v1.0/documents/search/", dict(sorted(kwargs.items())))
+        .build_absolute_uri()
+    )
+
+
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+@responses.activate
+def test_api_documents_search_anonymous(reach, role, indexer_settings):
+    """
+    Anonymous users should not be allowed to search documents whatever the
+    link reach and link role
+    """
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = "http://find/api/v1.0/search"
+
+    factories.DocumentFactory(link_reach=reach, link_role=role)
+
+    # Find response
+    responses.add(
+        responses.POST,
+        "http://find/api/v1.0/search",
+        json=[],
+        status=200,
+    )
+
+    response = APIClient().get("/api/v1.0/documents/search/", data={"q": "alpha"})
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 0,
+        "next": None,
+        "previous": None,
+        "results": [],
+    }
+
+
+def test_api_documents_search_endpoint_is_none(indexer_settings):
+    """
+    Missing SEARCH_INDEXER_QUERY_URL, so the indexer is not properly configured.
+    Should fallback on title filter
+    """
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = None
+
+    assert get_document_indexer() is None
+
+    user = factories.UserFactory()
+    document = factories.DocumentFactory(title="alpha")
+    access = factories.UserDocumentAccessFactory(document=document, user=user)
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/documents/search/", data={"q": "alpha"})
+
+    assert response.status_code == 200
+    content = response.json()
+    results = content.pop("results")
+    assert content == {
+        "count": 1,
+        "next": None,
+        "previous": None,
+    }
+    assert len(results) == 1
+    assert results[0] == {
+        "id": str(document.id),
+        "abilities": document.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
+        "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
+        "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
+        "link_reach": document.link_reach,
+        "link_role": document.link_role,
+        "nb_accesses_ancestors": 1,
+        "nb_accesses_direct": 1,
+        "numchild": 0,
+        "path": document.path,
+        "title": document.title,
+        "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "deleted_at": None,
+        "user_role": access.role,
+    }
+
+
+@responses.activate
+def test_api_documents_search_invalid_params(indexer_settings):
+    """Validate the format of documents as returned by the search view."""
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = "http://find/api/v1.0/search"
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/documents/search/")
+
+    assert response.status_code == 400
+    assert response.json() == {"q": ["This field is required."]}
+
+    response = client.get("/api/v1.0/documents/search/", data={"q": "    "})
+
+    assert response.status_code == 400
+    assert response.json() == {"q": ["This field may not be blank."]}
+
+    response = client.get(
+        "/api/v1.0/documents/search/", data={"q": "any", "page": "NaN"}
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {"page": ["A valid integer is required."]}
+
+
+@responses.activate
+def test_api_documents_search_format(indexer_settings):
+    """Validate the format of documents as returned by the search view."""
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = "http://find/api/v1.0/search"
+
+    assert get_document_indexer() is not None
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    user_a, user_b, user_c = factories.UserFactory.create_batch(3)
+    document = factories.DocumentFactory(
+        title="alpha",
+        users=(user_a, user_c),
+        link_traces=(user, user_b),
+    )
+    access = factories.UserDocumentAccessFactory(document=document, user=user)
+
+    # Find response
+    responses.add(
+        responses.POST,
+        "http://find/api/v1.0/search",
+        json=[
+            {"_id": str(document.pk)},
+        ],
+        status=200,
+    )
+    response = client.get("/api/v1.0/documents/search/", data={"q": "alpha"})
+
+    assert response.status_code == 200
+    content = response.json()
+    results = content.pop("results")
+    assert content == {
+        "count": 1,
+        "next": None,
+        "previous": None,
+    }
+    assert len(results) == 1
+    assert results[0] == {
+        "id": str(document.id),
+        "abilities": document.get_abilities(user),
+        "ancestors_link_reach": None,
+        "ancestors_link_role": None,
+        "computed_link_reach": document.computed_link_reach,
+        "computed_link_role": document.computed_link_role,
+        "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
+        "creator": str(document.creator.id),
+        "depth": 1,
+        "excerpt": document.excerpt,
+        "link_reach": document.link_reach,
+        "link_role": document.link_role,
+        "nb_accesses_ancestors": 3,
+        "nb_accesses_direct": 3,
+        "numchild": 0,
+        "path": document.path,
+        "title": document.title,
+        "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
+        "deleted_at": None,
+        "user_role": access.role,
+    }
+
+
+@responses.activate
+@pytest.mark.parametrize(
+    "pagination, status, expected",
+    (
+        (
+            {"page": 1, "page_size": 10},
+            200,
+            {
+                "count": 10,
+                "previous": None,
+                "next": None,
+                "range": (0, None),
+            },
+        ),
+        (
+            {},
+            200,
+            {
+                "count": 10,
+                "previous": None,
+                "next": None,
+                "range": (0, None),
+                "api_page_size": 21,  # default page_size is 20
+            },
+        ),
+        (
+            {"page": 2, "page_size": 10},
+            404,
+            {},
+        ),
+        (
+            {"page": 1, "page_size": 5},
+            200,
+            {
+                "count": 10,
+                "previous": None,
+                "next": {"page": 2, "page_size": 5},
+                "range": (0, 5),
+            },
+        ),
+        (
+            {"page": 2, "page_size": 5},
+            200,
+            {
+                "count": 10,
+                "previous": {"page_size": 5},
+                "next": None,
+                "range": (5, None),
+            },
+        ),
+        ({"page": 3, "page_size": 5}, 404, {}),
+    ),
+)
+def test_api_documents_search_pagination(
+    indexer_settings, pagination, status, expected
+):
+    """Documents should be ordered by descending "score" by default"""
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = "http://find/api/v1.0/search"
+
+    assert get_document_indexer() is not None
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    docs = factories.DocumentFactory.create_batch(10, title="alpha", users=[user])
+
+    docs_by_uuid = {str(doc.pk): doc for doc in docs}
+    api_results = [{"_id": id} for id in docs_by_uuid.keys()]
+
+    # reorder randomly to simulate score ordering
+    random.shuffle(api_results)
+
+    # Find response
+    # pylint: disable-next=assignment-from-none
+    api_search = responses.add(
+        responses.POST,
+        "http://find/api/v1.0/search",
+        json=api_results,
+        status=200,
+    )
+
+    response = client.get(
+        "/api/v1.0/documents/search/",
+        data={
+            "q": "alpha",
+            **pagination,
+        },
+    )
+
+    assert response.status_code == status
+
+    if response.status_code < 300:
+        previous_url = (
+            build_search_url(q="alpha", **expected["previous"])
+            if expected["previous"]
+            else None
+        )
+        next_url = (
+            build_search_url(q="alpha", **expected["next"])
+            if expected["next"]
+            else None
+        )
+        start, end = expected["range"]
+
+        content = response.json()
+
+        assert content["count"] == expected["count"]
+        assert content["previous"] == previous_url
+        assert content["next"] == next_url
+
+        results = content.pop("results")
+
+        # The find api results ordering by score is kept
+        assert [r["id"] for r in results] == [r["_id"] for r in api_results[start:end]]
+
+        # Check the query parameters.
+        assert api_search.call_count == 1
+        assert api_search.calls[0].response.status_code == 200
+        assert json_loads(api_search.calls[0].request.body) == {
+            "q": "alpha",
+            "visited": [],
+            "services": ["docs"],
+            "page_number": 1,
+            "page_size": 100,
+            "order_by": "updated_at",
+            "order_direction": "desc",
+        }
+
+
+@responses.activate
+@pytest.mark.parametrize(
+    "pagination, status, expected",
+    (
+        (
+            {"page": 1, "page_size": 10},
+            200,
+            {"count": 10, "previous": None, "next": None, "range": (0, None)},
+        ),
+        (
+            {},
+            200,
+            {"count": 10, "previous": None, "next": None, "range": (0, None)},
+        ),
+        (
+            {"page": 2, "page_size": 10},
+            404,
+            {},
+        ),
+        (
+            {"page": 1, "page_size": 5},
+            200,
+            {
+                "count": 10,
+                "previous": None,
+                "next": {"page": 2, "page_size": 5},
+                "range": (0, 5),
+            },
+        ),
+        (
+            {"page": 2, "page_size": 5},
+            200,
+            {
+                "count": 10,
+                "previous": {"page_size": 5},
+                "next": None,
+                "range": (5, None),
+            },
+        ),
+        ({"page": 3, "page_size": 5}, 404, {}),
+    ),
+)
+def test_api_documents_search_pagination_endpoint_is_none(
+    indexer_settings, pagination, status, expected
+):
+    """Documents should be ordered by descending "-updated_at" by default"""
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = None
+
+    assert get_document_indexer() is None
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    factories.DocumentFactory.create_batch(10, title="alpha", users=[user])
+
+    response = client.get(
+        "/api/v1.0/documents/search/",
+        data={
+            "q": "alpha",
+            **pagination,
+        },
+    )
+
+    assert response.status_code == status
+
+    if response.status_code < 300:
+        previous_url = (
+            build_search_url(q="alpha", **expected["previous"])
+            if expected["previous"]
+            else None
+        )
+        next_url = (
+            build_search_url(q="alpha", **expected["next"])
+            if expected["next"]
+            else None
+        )
+        queryset = models.Document.objects.order_by("-updated_at")
+        start, end = expected["range"]
+        expected_results = [str(d.pk) for d in queryset[start:end]]
+
+        content = response.json()
+
+        assert content["count"] == expected["count"]
+        assert content["previous"] == previous_url
+        assert content["next"] == next_url
+
+        results = content.pop("results")
+
+        assert [r["id"] for r in results] == expected_results

src/backend/core/tests/documents/test_api_documents_trashbin.py

@@ -81,7 +81,6 @@ def test_api_documents_trashbin_format():
             "collaboration_auth": False,
             "descendants": False,
             "cors_proxy": False,
-            "comment": False,
             "content": False,
             "destroy": False,
             "duplicate": False,
@@ -89,8 +88,8 @@ def test_api_documents_trashbin_format():
             "invite_owner": False,
             "link_configuration": False,
             "link_select_options": {
-                "authenticated": ["reader", "commenter", "editor"],
-                "public": ["reader", "commenter", "editor"],
+                "authenticated": ["reader", "editor"],
+                "public": ["reader", "editor"],
                 "restricted": None,
             },
             "mask": False,

src/backend/core/tests/templates/test_api_template_accesses.py

@@ -0,0 +1,799 @@
+"""
+Test template accesses API endpoints for users in impress's core app.
+"""
+
+import random
+from unittest import mock
+from uuid import uuid4
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.api import serializers
+from core.tests.conftest import TEAM, USER, VIA
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_template_accesses_list_anonymous():
+    """Anonymous users should not be allowed to list template accesses."""
+    template = factories.TemplateFactory()
+    factories.UserTemplateAccessFactory.create_batch(2, template=template)
+
+    response = APIClient().get(f"/api/v1.0/templates/{template.id!s}/accesses/")
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_template_accesses_list_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to list template accesses for a template
+    to which they are not related.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    factories.UserTemplateAccessFactory.create_batch(3, template=template)
+
+    # Accesses for other templates to which the user is related should not be listed either
+    other_access = factories.UserTemplateAccessFactory(user=user)
+    factories.UserTemplateAccessFactory(template=other_access.template)
+
+    response = client.get(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+    )
+    assert response.status_code == 200
+    assert response.json() == []
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_list_authenticated_related(via, mock_user_teams):
+    """
+    Authenticated users should be able to list template accesses for a template
+    to which they are directly related, whatever their role in the template.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    user_access = None
+    if via == USER:
+        user_access = models.TemplateAccess.objects.create(
+            template=template,
+            user=user,
+            role=random.choice(models.RoleChoices.values),
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        user_access = models.TemplateAccess.objects.create(
+            template=template,
+            team="lasuite",
+            role=random.choice(models.RoleChoices.values),
+        )
+
+    access1 = factories.TeamTemplateAccessFactory(template=template)
+    access2 = factories.UserTemplateAccessFactory(template=template)
+
+    # Accesses for other templates to which the user is related should not be listed either
+    other_access = factories.UserTemplateAccessFactory(user=user)
+    factories.UserTemplateAccessFactory(template=other_access.template)
+
+    response = client.get(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+    )
+
+    assert response.status_code == 200
+    content = response.json()
+    assert len(content) == 3
+    assert sorted(content, key=lambda x: x["id"]) == sorted(
+        [
+            {
+                "id": str(user_access.id),
+                "user": str(user.id) if via == "user" else None,
+                "team": "lasuite" if via == "team" else "",
+                "role": user_access.role,
+                "abilities": user_access.get_abilities(user),
+            },
+            {
+                "id": str(access1.id),
+                "user": None,
+                "team": access1.team,
+                "role": access1.role,
+                "abilities": access1.get_abilities(user),
+            },
+            {
+                "id": str(access2.id),
+                "user": str(access2.user.id),
+                "team": "",
+                "role": access2.role,
+                "abilities": access2.get_abilities(user),
+            },
+        ],
+        key=lambda x: x["id"],
+    )
+
+
+def test_api_template_accesses_retrieve_anonymous():
+    """
+    Anonymous users should not be allowed to retrieve a template access.
+    """
+    access = factories.UserTemplateAccessFactory()
+
+    response = APIClient().get(
+        f"/api/v1.0/templates/{access.template_id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_template_accesses_retrieve_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to retrieve a template access for
+    a template to which they are not related.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    access = factories.UserTemplateAccessFactory(template=template)
+
+    response = client.get(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+    )
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    # Accesses related to another template should be excluded even if the user is related to it
+    for access in [
+        factories.UserTemplateAccessFactory(),
+        factories.UserTemplateAccessFactory(user=user),
+    ]:
+        response = client.get(
+            f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+        )
+
+        assert response.status_code == 404
+        assert response.json() == {
+            "detail": "No TemplateAccess matches the given query."
+        }
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_teams):
+    """
+    A user who is related to a template should be allowed to retrieve the
+    associated template user accesses.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(template=template, team="lasuite")
+
+    access = factories.UserTemplateAccessFactory(template=template)
+
+    response = client.get(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": str(access.id),
+        "user": str(access.user.id),
+        "team": "",
+        "role": access.role,
+        "abilities": access.get_abilities(user),
+    }
+
+
+def test_api_template_accesses_update_anonymous():
+    """Anonymous users should not be allowed to update a template access."""
+    access = factories.UserTemplateAccessFactory()
+    old_values = serializers.TemplateAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.values),
+    }
+
+    api_client = APIClient()
+    for field, value in new_values.items():
+        response = api_client.put(
+            f"/api/v1.0/templates/{access.template_id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 401
+
+    access.refresh_from_db()
+    updated_values = serializers.TemplateAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+def test_api_template_accesses_update_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to update a template access for a template to which
+    they are not related.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    access = factories.UserTemplateAccessFactory()
+
+    old_values = serializers.TemplateAccessSerializer(instance=access).data
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.values),
+    }
+
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/templates/{access.template_id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 403
+
+    access.refresh_from_db()
+    updated_values = serializers.TemplateAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+@pytest.mark.parametrize("role", ["reader", "editor"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_update_authenticated_editor_or_reader(
+    via, role, mock_user_teams
+):
+    """Editors or readers of a template should not be allowed to update its accesses."""
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role=role
+        )
+
+    access = factories.UserTemplateAccessFactory(template=template)
+    old_values = serializers.TemplateAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.values),
+    }
+
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/templates/{access.template_id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 403
+
+    access.refresh_from_db()
+    updated_values = serializers.TemplateAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_update_administrator_except_owner(via, mock_user_teams):
+    """
+    A user who is a direct administrator in a template should be allowed to update a user
+    access for this template, as long as they don't try to set the role to owner.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(
+            template=template, user=user, role="administrator"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="administrator"
+        )
+
+    access = factories.UserTemplateAccessFactory(
+        template=template,
+        role=random.choice(["administrator", "editor", "reader"]),
+    )
+
+    old_values = serializers.TemplateAccessSerializer(instance=access).data
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(["administrator", "editor", "reader"]),
+    }
+
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+
+        if (
+            new_data["role"] == old_values["role"]
+        ):  # we are not really updating the role
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TemplateAccessSerializer(instance=access).data
+        if field == "role":
+            assert updated_values == {**old_values, "role": new_values["role"]}
+        else:
+            assert updated_values == old_values
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_update_administrator_from_owner(via, mock_user_teams):
+    """
+    A user who is an administrator in a template, should not be allowed to update
+    the user access of an "owner" for this template.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(
+            template=template, user=user, role="administrator"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="administrator"
+        )
+
+    other_user = factories.UserFactory()
+    access = factories.UserTemplateAccessFactory(
+        template=template, user=other_user, role="owner"
+    )
+
+    old_values = serializers.TemplateAccessSerializer(instance=access).data
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.values),
+    }
+
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+            data={**old_values, field: value},
+            format="json",
+        )
+
+        assert response.status_code == 403
+        access.refresh_from_db()
+        updated_values = serializers.TemplateAccessSerializer(instance=access).data
+        assert updated_values == old_values
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_update_administrator_to_owner(via, mock_user_teams):
+    """
+    A user who is an administrator in a template, should not be allowed to update
+    the user access of another user to grant template ownership.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(
+            template=template, user=user, role="administrator"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="administrator"
+        )
+
+    other_user = factories.UserFactory()
+    access = factories.UserTemplateAccessFactory(
+        template=template,
+        user=other_user,
+        role=random.choice(["administrator", "editor", "reader"]),
+    )
+
+    old_values = serializers.TemplateAccessSerializer(instance=access).data
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": "owner",
+    }
+
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+        # We are not allowed or not really updating the role
+        if field == "role" or new_data["role"] == old_values["role"]:
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TemplateAccessSerializer(instance=access).data
+        assert updated_values == old_values
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_update_owner(via, mock_user_teams):
+    """
+    A user who is an owner in a template should be allowed to update
+    a user access for this template whatever the role.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="owner"
+        )
+
+    factories.UserFactory()
+    access = factories.UserTemplateAccessFactory(
+        template=template,
+    )
+
+    old_values = serializers.TemplateAccessSerializer(instance=access).data
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.values),
+    }
+
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+
+        if (
+            new_data["role"] == old_values["role"]
+        ):  # we are not really updating the role
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TemplateAccessSerializer(instance=access).data
+
+        if field == "role":
+            assert updated_values == {**old_values, "role": new_values["role"]}
+        else:
+            assert updated_values == old_values
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_update_owner_self(via, mock_user_teams):
+    """
+    A user who is owner of a template should be allowed to update
+    their own user access provided there are other owners in the template.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        access = factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="owner"
+        )
+    else:
+        access = factories.UserTemplateAccessFactory(
+            template=template, user=user, role="owner"
+        )
+
+    old_values = serializers.TemplateAccessSerializer(instance=access).data
+    new_role = random.choice(["administrator", "editor", "reader"])
+
+    response = client.put(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+        data={**old_values, "role": new_role},
+        format="json",
+    )
+
+    assert response.status_code == 403
+    access.refresh_from_db()
+    assert access.role == "owner"
+
+    # Add another owner and it should now work
+    factories.UserTemplateAccessFactory(template=template, role="owner")
+
+    response = client.put(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+        data={**old_values, "role": new_role},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    access.refresh_from_db()
+    assert access.role == new_role
+
+
+# Delete
+
+
+def test_api_template_accesses_delete_anonymous():
+    """Anonymous users should not be allowed to destroy a template access."""
+    access = factories.UserTemplateAccessFactory()
+
+    response = APIClient().delete(
+        f"/api/v1.0/templates/{access.template_id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 401
+    assert models.TemplateAccess.objects.count() == 1
+
+
+def test_api_template_accesses_delete_authenticated():
+    """
+    Authenticated users should not be allowed to delete a template access for a
+    template to which they are not related.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    access = factories.UserTemplateAccessFactory()
+
+    response = client.delete(
+        f"/api/v1.0/templates/{access.template_id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TemplateAccess.objects.count() == 2
+
+
+@pytest.mark.parametrize("role", ["reader", "editor"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_teams):
+    """
+    Authenticated users should not be allowed to delete a template access for a
+    template in which they are a simple editor or reader.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role=role
+        )
+
+    access = factories.UserTemplateAccessFactory(template=template)
+
+    assert models.TemplateAccess.objects.count() == 3
+    assert models.TemplateAccess.objects.filter(user=access.user).exists()
+
+    response = client.delete(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TemplateAccess.objects.count() == 3
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_delete_administrators_except_owners(
+    via, mock_user_teams
+):
+    """
+    Users who are administrators in a template should be allowed to delete an access
+    from the template provided it is not ownership.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(
+            template=template, user=user, role="administrator"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="administrator"
+        )
+
+    access = factories.UserTemplateAccessFactory(
+        template=template, role=random.choice(["reader", "editor", "administrator"])
+    )
+
+    assert models.TemplateAccess.objects.count() == 2
+    assert models.TemplateAccess.objects.filter(user=access.user).exists()
+
+    response = client.delete(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 204
+    assert models.TemplateAccess.objects.count() == 1
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_teams):
+    """
+    Users who are administrators in a template should not be allowed to delete an ownership
+    access from the template.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(
+            template=template, user=user, role="administrator"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="administrator"
+        )
+
+    access = factories.UserTemplateAccessFactory(template=template, role="owner")
+
+    assert models.TemplateAccess.objects.count() == 3
+    assert models.TemplateAccess.objects.filter(user=access.user).exists()
+
+    response = client.delete(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TemplateAccess.objects.count() == 3
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_delete_owners(via, mock_user_teams):
+    """
+    Users should be able to delete the template access of another user
+    for a template of which they are owner.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="owner"
+        )
+
+    access = factories.UserTemplateAccessFactory(template=template)
+
+    assert models.TemplateAccess.objects.count() == 2
+    assert models.TemplateAccess.objects.filter(user=access.user).exists()
+
+    response = client.delete(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 204
+    assert models.TemplateAccess.objects.count() == 1
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_delete_owners_last_owner(via, mock_user_teams):
+    """
+    It should not be possible to delete the last owner access from a template
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    access = None
+    if via == USER:
+        access = factories.UserTemplateAccessFactory(
+            template=template, user=user, role="owner"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        access = factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="owner"
+        )
+
+    assert models.TemplateAccess.objects.count() == 2
+    response = client.delete(
+        f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TemplateAccess.objects.count() == 2
+
+
+def test_api_template_accesses_throttling(settings):
+    """Test api template accesses throttling."""
+    current_rate = settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["template_access"]
+    settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["template_access"] = "2/minute"
+    template = factories.TemplateFactory()
+    user = factories.UserFactory()
+    factories.UserTemplateAccessFactory(
+        template=template, user=user, role="administrator"
+    )
+    client = APIClient()
+    client.force_login(user)
+    for _i in range(2):
+        response = client.get(f"/api/v1.0/templates/{template.id!s}/accesses/")
+        assert response.status_code == 200
+    with mock.patch("core.api.throttling.capture_message") as mock_capture_message:
+        response = client.get(f"/api/v1.0/templates/{template.id!s}/accesses/")
+        assert response.status_code == 429
+        mock_capture_message.assert_called_once_with(
+            "Rate limit exceeded for scope template_access", "warning"
+        )
+    settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["template_access"] = current_rate

src/backend/core/tests/templates/test_api_template_accesses_create.py

@@ -0,0 +1,206 @@
+"""
+Test template accesses create API endpoint for users in impress's core app.
+"""
+
+import random
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.tests.conftest import TEAM, USER, VIA
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_template_accesses_create_anonymous():
+    """Anonymous users should not be allowed to create template accesses."""
+    template = factories.TemplateFactory()
+
+    other_user = factories.UserFactory()
+    response = APIClient().post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "template": str(template.id),
+            "role": random.choice(models.RoleChoices.values),
+        },
+        format="json",
+    )
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+    assert models.TemplateAccess.objects.exists() is False
+
+
+def test_api_template_accesses_create_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to create template accesses for a template to
+    which they are not related.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+    template = factories.TemplateFactory()
+
+    response = client.post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert not models.TemplateAccess.objects.filter(user=other_user).exists()
+
+
+@pytest.mark.parametrize("role", ["reader", "editor"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_create_authenticated_editor_or_reader(
+    via, role, mock_user_teams
+):
+    """Editors or readers of a template should not be allowed to create template accesses."""
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role=role
+        )
+
+    other_user = factories.UserFactory()
+
+    for new_role in [role[0] for role in models.RoleChoices.choices]:
+        response = client.post(
+            f"/api/v1.0/templates/{template.id!s}/accesses/",
+            {
+                "user": str(other_user.id),
+                "role": new_role,
+            },
+            format="json",
+        )
+
+        assert response.status_code == 403
+
+    assert not models.TemplateAccess.objects.filter(user=other_user).exists()
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_create_authenticated_administrator(via, mock_user_teams):
+    """
+    Administrators of a template should be able to create template accesses
+    except for the "owner" role.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(
+            template=template, user=user, role="administrator"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="administrator"
+        )
+
+    other_user = factories.UserFactory()
+
+    # It should not be allowed to create an owner access
+    response = client.post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": "owner",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Only owners of a template can assign other users as owners."
+    }
+
+    # It should be allowed to create a lower access
+    role = random.choice(
+        [role[0] for role in models.RoleChoices.choices if role[0] != "owner"]
+    )
+
+    response = client.post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.TemplateAccess.objects.filter(user=other_user).count() == 1
+    new_template_access = models.TemplateAccess.objects.filter(user=other_user).get()
+    assert response.json() == {
+        "abilities": new_template_access.get_abilities(user),
+        "id": str(new_template_access.id),
+        "team": "",
+        "role": role,
+        "user": str(other_user.id),
+    }
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_create_authenticated_owner(via, mock_user_teams):
+    """
+    Owners of a template should be able to create template accesses whatever the role.
+    """
+    user = factories.UserFactory(with_owned_template=True)
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="owner"
+        )
+
+    other_user = factories.UserFactory()
+
+    role = random.choice([role[0] for role in models.RoleChoices.choices])
+
+    response = client.post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.TemplateAccess.objects.filter(user=other_user).count() == 1
+    new_template_access = models.TemplateAccess.objects.filter(user=other_user).get()
+    assert response.json() == {
+        "id": str(new_template_access.id),
+        "user": str(other_user.id),
+        "team": "",
+        "role": role,
+        "abilities": new_template_access.get_abilities(user),
+    }

src/backend/core/tests/templates/test_api_templates_create.py

@@ -42,5 +42,7 @@ def test_api_templates_create_authenticated():
         format="json",
     )
 
-    assert response.status_code == 405
-    assert not Template.objects.exists()
+    assert response.status_code == 201
+    template = Template.objects.get()
+    assert template.title == "my template"
+    assert template.accesses.filter(role="owner", user=user).exists()

src/backend/core/tests/templates/test_api_templates_delete.py

@@ -8,6 +8,7 @@ import pytest
 from rest_framework.test import APIClient
 
 from core import factories, models
+from core.tests.conftest import TEAM, USER, VIA
 
 pytestmark = pytest.mark.django_db
 
@@ -24,7 +25,7 @@ def test_api_templates_delete_anonymous():
     assert models.Template.objects.count() == 1
 
 
-def test_api_templates_delete_not_implemented():
+def test_api_templates_delete_authenticated_unrelated():
     """
     Authenticated users should not be allowed to delete a template to which they are not
     related.
@@ -35,11 +36,72 @@ def test_api_templates_delete_not_implemented():
     client.force_login(user)
 
     is_public = random.choice([True, False])
-    template = factories.TemplateFactory(is_public=is_public, users=[(user, "owner")])
+    template = factories.TemplateFactory(is_public=is_public)
 
     response = client.delete(
         f"/api/v1.0/templates/{template.id!s}/",
     )
 
-    assert response.status_code == 405
+    assert response.status_code == 403 if is_public else 404
     assert models.Template.objects.count() == 1
+
+
+@pytest.mark.parametrize("role", ["reader", "editor", "administrator"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_templates_delete_authenticated_member_or_administrator(
+    via, role, mock_user_teams
+):
+    """
+    Authenticated users should not be allowed to delete a template for which they are
+    only a member or administrator.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role=role
+        )
+
+    response = client.delete(
+        f"/api/v1.0/templates/{template.id}/",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+    assert models.Template.objects.count() == 1
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_templates_delete_authenticated_owner(via, mock_user_teams):
+    """
+    Authenticated users should be able to delete a template they own.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="owner"
+        )
+
+    response = client.delete(
+        f"/api/v1.0/templates/{template.id}/",
+    )
+
+    assert response.status_code == 204
+    assert models.Template.objects.exists() is False

src/backend/core/tests/templates/test_api_templates_update.py

@@ -2,11 +2,14 @@
 Tests for Templates API endpoint in impress's core app: update
 """
 
+import random
+
 import pytest
 from rest_framework.test import APIClient
 
 from core import factories
 from core.api import serializers
+from core.tests.conftest import TEAM, USER, VIA
 
 pytestmark = pytest.mark.django_db
 
@@ -14,6 +17,7 @@ pytestmark = pytest.mark.django_db
 def test_api_templates_update_anonymous():
     """Anonymous users should not be allowed to update a template."""
     template = factories.TemplateFactory()
+    old_template_values = serializers.TemplateSerializer(instance=template).data
 
     new_template_values = serializers.TemplateSerializer(
         instance=factories.TemplateFactory()
@@ -24,18 +28,145 @@ def test_api_templates_update_anonymous():
         format="json",
     )
     assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+    template.refresh_from_db()
+    template_values = serializers.TemplateSerializer(instance=template).data
+    assert template_values == old_template_values
 
 
-def test_api_templates_update_not_implemented():
+def test_api_templates_update_authenticated_unrelated():
     """
-    Authenticated users should not be allowed to update a template.
+    Authenticated users should not be allowed to update a template to which they are not related.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    template = factories.TemplateFactory(users=[(user, "owner")])
+    template = factories.TemplateFactory(is_public=False)
+    old_template_values = serializers.TemplateSerializer(instance=template).data
+
+    new_template_values = serializers.TemplateSerializer(
+        instance=factories.TemplateFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/templates/{template.id!s}/",
+        new_template_values,
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    template.refresh_from_db()
+    template_values = serializers.TemplateSerializer(instance=template).data
+    assert template_values == old_template_values
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_templates_update_authenticated_readers(via, mock_user_teams):
+    """
+    Users who are readers of a template should not be allowed to update it.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role="reader")
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="reader"
+        )
+
+    old_template_values = serializers.TemplateSerializer(instance=template).data
+
+    new_template_values = serializers.TemplateSerializer(
+        instance=factories.TemplateFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/templates/{template.id!s}/",
+        new_template_values,
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    template.refresh_from_db()
+    template_values = serializers.TemplateSerializer(instance=template).data
+    assert template_values == old_template_values
+
+
+@pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_templates_update_authenticated_editor_or_administrator_or_owner(
+    via, role, mock_user_teams
+):
+    """Administrator or owner of a template should be allowed to update it."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role=role
+        )
+
+    old_template_values = serializers.TemplateSerializer(instance=template).data
+
+    new_template_values = serializers.TemplateSerializer(
+        instance=factories.TemplateFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/templates/{template.id!s}/",
+        new_template_values,
+        format="json",
+    )
+    assert response.status_code == 200
+
+    template.refresh_from_db()
+    template_values = serializers.TemplateSerializer(instance=template).data
+    for key, value in template_values.items():
+        if key in ["id", "accesses"]:
+            assert value == old_template_values[key]
+        else:
+            assert value == new_template_values[key]
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_templates_update_authenticated_owners(via, mock_user_teams):
+    """Administrators of a template should be allowed to update it."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="owner"
+        )
+
+    old_template_values = serializers.TemplateSerializer(instance=template).data
 
     new_template_values = serializers.TemplateSerializer(
         instance=factories.TemplateFactory()
@@ -45,10 +176,55 @@ def test_api_templates_update_not_implemented():
         f"/api/v1.0/templates/{template.id!s}/", new_template_values, format="json"
     )
 
-    assert response.status_code == 405
+    assert response.status_code == 200
+    template.refresh_from_db()
+    template_values = serializers.TemplateSerializer(instance=template).data
+    for key, value in template_values.items():
+        if key in ["id", "accesses"]:
+            assert value == old_template_values[key]
+        else:
+            assert value == new_template_values[key]
 
-    response = client.patch(
-        f"/api/v1.0/templates/{template.id!s}/", new_template_values, format="json"
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_templates_update_administrator_or_owner_of_another(via, mock_user_teams):
+    """
+    Being administrator or owner of a template should not grant authorization to update
+    another template.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(
+            template=template, user=user, role=random.choice(["administrator", "owner"])
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template,
+            team="lasuite",
+            role=random.choice(["administrator", "owner"]),
+        )
+
+    is_public = random.choice([True, False])
+    template = factories.TemplateFactory(title="Old title", is_public=is_public)
+    old_template_values = serializers.TemplateSerializer(instance=template).data
+
+    new_template_values = serializers.TemplateSerializer(
+        instance=factories.TemplateFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/templates/{template.id!s}/",
+        new_template_values,
+        format="json",
     )
 
-    assert response.status_code == 405
+    assert response.status_code == 403 if is_public else 404
+
+    template.refresh_from_db()
+    template_values = serializers.TemplateSerializer(instance=template).data
+    assert template_values == old_template_values

src/backend/core/tests/test_api_users.py

@@ -278,35 +278,6 @@ def test_api_users_retrieve_me_authenticated():
     }
 
 
-def test_api_users_retrieve_me_authenticated_empty_name():
-    """
-    Authenticated users should be able to retrieve their own user via the "/users/me" path.
-    when no name is provided, the full name and short name should be the email without the domain.
-    """
-    user = factories.UserFactory(
-        email="test_foo@test.com",
-        full_name=None,
-        short_name=None,
-    )
-
-    client = APIClient()
-    client.force_login(user)
-
-    factories.UserFactory.create_batch(2)
-    response = client.get(
-        "/api/v1.0/users/me/",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {
-        "id": str(user.id),
-        "email": "test_foo@test.com",
-        "full_name": "test_foo",
-        "language": user.language,
-        "short_name": "test_foo",
-    }
-
-
 def test_api_users_retrieve_anonymous():
     """Anonymous users should not be allowed to retrieve a user."""
     client = APIClient()

src/backend/core/tests/test_models_comment.py

@@ -1,283 +0,0 @@
-"""Test the comment model."""
-
-import random
-
-from django.contrib.auth.models import AnonymousUser
-
-import pytest
-
-from core import factories
-from core.models import LinkReachChoices, LinkRoleChoices, RoleChoices
-
-pytestmark = pytest.mark.django_db
-
-
-@pytest.mark.parametrize(
-    "role,can_comment",
-    [
-        (LinkRoleChoices.READER, False),
-        (LinkRoleChoices.COMMENTER, True),
-        (LinkRoleChoices.EDITOR, True),
-    ],
-)
-def test_comment_get_abilities_anonymous_user_public_document(role, can_comment):
-    """Anonymous users cannot comment on a document."""
-    document = factories.DocumentFactory(
-        link_role=role, link_reach=LinkReachChoices.PUBLIC
-    )
-    comment = factories.CommentFactory(thread__document=document)
-    user = AnonymousUser()
-
-    assert comment.get_abilities(user) == {
-        "destroy": False,
-        "update": False,
-        "partial_update": False,
-        "reactions": False,
-        "retrieve": can_comment,
-    }
-
-
-@pytest.mark.parametrize(
-    "link_reach", [LinkReachChoices.RESTRICTED, LinkReachChoices.AUTHENTICATED]
-)
-def test_comment_get_abilities_anonymous_user_restricted_document(link_reach):
-    """Anonymous users cannot comment on a restricted document."""
-    document = factories.DocumentFactory(link_reach=link_reach)
-    comment = factories.CommentFactory(thread__document=document)
-    user = AnonymousUser()
-
-    assert comment.get_abilities(user) == {
-        "destroy": False,
-        "update": False,
-        "partial_update": False,
-        "reactions": False,
-        "retrieve": False,
-    }
-
-
-@pytest.mark.parametrize(
-    "link_role,link_reach,can_comment",
-    [
-        (LinkRoleChoices.READER, LinkReachChoices.PUBLIC, False),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.PUBLIC, True),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.PUBLIC, True),
-        (LinkRoleChoices.READER, LinkReachChoices.RESTRICTED, False),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.RESTRICTED, False),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.RESTRICTED, False),
-        (LinkRoleChoices.READER, LinkReachChoices.AUTHENTICATED, False),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.AUTHENTICATED, True),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.AUTHENTICATED, True),
-    ],
-)
-def test_comment_get_abilities_user_reader(link_role, link_reach, can_comment):
-    """Readers cannot comment on a document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_role=link_role, link_reach=link_reach, users=[(user, RoleChoices.READER)]
-    )
-    comment = factories.CommentFactory(thread__document=document)
-
-    assert comment.get_abilities(user) == {
-        "destroy": False,
-        "update": False,
-        "partial_update": False,
-        "reactions": can_comment,
-        "retrieve": can_comment,
-    }
-
-
-@pytest.mark.parametrize(
-    "link_role,link_reach,can_comment",
-    [
-        (LinkRoleChoices.READER, LinkReachChoices.PUBLIC, False),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.PUBLIC, True),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.PUBLIC, True),
-        (LinkRoleChoices.READER, LinkReachChoices.RESTRICTED, False),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.RESTRICTED, False),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.RESTRICTED, False),
-        (LinkRoleChoices.READER, LinkReachChoices.AUTHENTICATED, False),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.AUTHENTICATED, True),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.AUTHENTICATED, True),
-    ],
-)
-def test_comment_get_abilities_user_reader_own_comment(
-    link_role, link_reach, can_comment
-):
-    """User with reader role on a document has all accesses to its own comment."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_role=link_role, link_reach=link_reach, users=[(user, RoleChoices.READER)]
-    )
-    comment = factories.CommentFactory(
-        thread__document=document, user=user if can_comment else None
-    )
-
-    assert comment.get_abilities(user) == {
-        "destroy": can_comment,
-        "update": can_comment,
-        "partial_update": can_comment,
-        "reactions": can_comment,
-        "retrieve": can_comment,
-    }
-
-
-@pytest.mark.parametrize(
-    "link_role,link_reach",
-    [
-        (LinkRoleChoices.READER, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.READER, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.READER, LinkReachChoices.AUTHENTICATED),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.AUTHENTICATED),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.AUTHENTICATED),
-    ],
-)
-def test_comment_get_abilities_user_commenter(link_role, link_reach):
-    """Commenters can comment on a document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_role=link_role,
-        link_reach=link_reach,
-        users=[(user, RoleChoices.COMMENTER)],
-    )
-    comment = factories.CommentFactory(thread__document=document)
-
-    assert comment.get_abilities(user) == {
-        "destroy": False,
-        "update": False,
-        "partial_update": False,
-        "reactions": True,
-        "retrieve": True,
-    }
-
-
-@pytest.mark.parametrize(
-    "link_role,link_reach",
-    [
-        (LinkRoleChoices.READER, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.READER, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.READER, LinkReachChoices.AUTHENTICATED),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.AUTHENTICATED),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.AUTHENTICATED),
-    ],
-)
-def test_comment_get_abilities_user_commenter_own_comment(link_role, link_reach):
-    """Commenters have all accesses to its own comment."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_role=link_role,
-        link_reach=link_reach,
-        users=[(user, RoleChoices.COMMENTER)],
-    )
-    comment = factories.CommentFactory(thread__document=document, user=user)
-
-    assert comment.get_abilities(user) == {
-        "destroy": True,
-        "update": True,
-        "partial_update": True,
-        "reactions": True,
-        "retrieve": True,
-    }
-
-
-@pytest.mark.parametrize(
-    "link_role,link_reach",
-    [
-        (LinkRoleChoices.READER, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.READER, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.READER, LinkReachChoices.AUTHENTICATED),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.AUTHENTICATED),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.AUTHENTICATED),
-    ],
-)
-def test_comment_get_abilities_user_editor(link_role, link_reach):
-    """Editors can comment on a document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_role=link_role, link_reach=link_reach, users=[(user, RoleChoices.EDITOR)]
-    )
-    comment = factories.CommentFactory(thread__document=document)
-
-    assert comment.get_abilities(user) == {
-        "destroy": False,
-        "update": False,
-        "partial_update": False,
-        "reactions": True,
-        "retrieve": True,
-    }
-
-
-@pytest.mark.parametrize(
-    "link_role,link_reach",
-    [
-        (LinkRoleChoices.READER, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.PUBLIC),
-        (LinkRoleChoices.READER, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.RESTRICTED),
-        (LinkRoleChoices.READER, LinkReachChoices.AUTHENTICATED),
-        (LinkRoleChoices.COMMENTER, LinkReachChoices.AUTHENTICATED),
-        (LinkRoleChoices.EDITOR, LinkReachChoices.AUTHENTICATED),
-    ],
-)
-def test_comment_get_abilities_user_editor_own_comment(link_role, link_reach):
-    """Editors have all accesses to its own comment."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(
-        link_role=link_role, link_reach=link_reach, users=[(user, RoleChoices.EDITOR)]
-    )
-    comment = factories.CommentFactory(thread__document=document, user=user)
-
-    assert comment.get_abilities(user) == {
-        "destroy": True,
-        "update": True,
-        "partial_update": True,
-        "reactions": True,
-        "retrieve": True,
-    }
-
-
-def test_comment_get_abilities_user_admin():
-    """Admins have all accesses to a comment."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(users=[(user, RoleChoices.ADMIN)])
-    comment = factories.CommentFactory(
-        thread__document=document, user=random.choice([user, None])
-    )
-
-    assert comment.get_abilities(user) == {
-        "destroy": True,
-        "update": True,
-        "partial_update": True,
-        "reactions": True,
-        "retrieve": True,
-    }
-
-
-def test_comment_get_abilities_user_owner():
-    """Owners have all accesses to a comment."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(users=[(user, RoleChoices.OWNER)])
-    comment = factories.CommentFactory(
-        thread__document=document, user=random.choice([user, None])
-    )
-
-    assert comment.get_abilities(user) == {
-        "destroy": True,
-        "update": True,
-        "partial_update": True,
-        "reactions": True,
-        "retrieve": True,
-    }

src/backend/core/tests/test_models_document_accesses.py

@@ -123,7 +123,7 @@ def test_models_document_access_get_abilities_for_owner_of_self_allowed():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator", "owner"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -166,7 +166,7 @@ def test_models_document_access_get_abilities_for_owner_of_self_last_on_child(
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator", "owner"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -183,7 +183,7 @@ def test_models_document_access_get_abilities_for_owner_of_owner():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator", "owner"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -200,7 +200,7 @@ def test_models_document_access_get_abilities_for_owner_of_administrator():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator", "owner"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -217,7 +217,7 @@ def test_models_document_access_get_abilities_for_owner_of_editor():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator", "owner"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -234,7 +234,7 @@ def test_models_document_access_get_abilities_for_owner_of_reader():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator", "owner"],
+        "set_role_to": ["reader", "editor", "administrator", "owner"],
     }
 
 
@@ -271,7 +271,7 @@ def test_models_document_access_get_abilities_for_administrator_of_administrator
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator"],
+        "set_role_to": ["reader", "editor", "administrator"],
     }
 
 
@@ -288,7 +288,7 @@ def test_models_document_access_get_abilities_for_administrator_of_editor():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator"],
+        "set_role_to": ["reader", "editor", "administrator"],
     }
 
 
@@ -305,7 +305,7 @@ def test_models_document_access_get_abilities_for_administrator_of_reader():
         "retrieve": True,
         "update": True,
         "partial_update": True,
-        "set_role_to": ["reader", "commenter", "editor", "administrator"],
+        "set_role_to": ["reader", "editor", "administrator"],
     }
 
 

src/backend/core/tests/test_models_documents.py

@@ -134,13 +134,10 @@ def test_models_documents_soft_delete(depth):
     [
         (True, "restricted", "reader"),
         (True, "restricted", "editor"),
-        (True, "restricted", "commenter"),
         (False, "restricted", "reader"),
         (False, "restricted", "editor"),
-        (False, "restricted", "commenter"),
         (False, "authenticated", "reader"),
         (False, "authenticated", "editor"),
-        (False, "authenticated", "commenter"),
     ],
 )
 def test_models_documents_get_abilities_forbidden(
@@ -168,7 +165,6 @@ def test_models_documents_get_abilities_forbidden(
         "destroy": False,
         "duplicate": False,
         "favorite": False,
-        "comment": False,
         "invite_owner": False,
         "mask": False,
         "media_auth": False,
@@ -176,8 +172,8 @@ def test_models_documents_get_abilities_forbidden(
         "move": False,
         "link_configuration": False,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "partial_update": False,
@@ -227,7 +223,6 @@ def test_models_documents_get_abilities_reader(
         "children_create": False,
         "children_list": True,
         "collaboration_auth": True,
-        "comment": False,
         "descendants": True,
         "cors_proxy": True,
         "content": True,
@@ -237,78 +232,8 @@ def test_models_documents_get_abilities_reader(
         "invite_owner": False,
         "link_configuration": False,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
-            "restricted": None,
-        },
-        "mask": is_authenticated,
-        "media_auth": True,
-        "media_check": True,
-        "move": False,
-        "partial_update": False,
-        "restore": False,
-        "retrieve": True,
-        "tree": True,
-        "update": False,
-        "versions_destroy": False,
-        "versions_list": False,
-        "versions_retrieve": False,
-    }
-    nb_queries = 1 if is_authenticated else 0
-    with django_assert_num_queries(nb_queries):
-        assert document.get_abilities(user) == expected_abilities
-
-    document.soft_delete()
-    document.refresh_from_db()
-    assert all(
-        value is False
-        for key, value in document.get_abilities(user).items()
-        if key not in ["link_select_options", "ancestors_links_definition"]
-    )
-
-
-@override_settings(
-    AI_ALLOW_REACH_FROM=random.choice(["public", "authenticated", "restricted"])
-)
-@pytest.mark.parametrize(
-    "is_authenticated,reach",
-    [
-        (True, "public"),
-        (False, "public"),
-        (True, "authenticated"),
-    ],
-)
-def test_models_documents_get_abilities_commenter(
-    is_authenticated, reach, django_assert_num_queries
-):
-    """
-    Check abilities returned for a document giving commenter role to link holders
-    i.e anonymous users or authenticated users who have no specific role on the document.
-    """
-    document = factories.DocumentFactory(link_reach=reach, link_role="commenter")
-    user = factories.UserFactory() if is_authenticated else AnonymousUser()
-    expected_abilities = {
-        "accesses_manage": False,
-        "accesses_view": False,
-        "ai_transform": False,
-        "ai_translate": False,
-        "attachment_upload": False,
-        "can_edit": False,
-        "children_create": False,
-        "children_list": True,
-        "collaboration_auth": True,
-        "comment": True,
-        "content": True,
-        "descendants": True,
-        "cors_proxy": True,
-        "destroy": False,
-        "duplicate": is_authenticated,
-        "favorite": is_authenticated,
-        "invite_owner": False,
-        "link_configuration": False,
-        "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "mask": is_authenticated,
@@ -364,7 +289,6 @@ def test_models_documents_get_abilities_editor(
         "children_create": is_authenticated,
         "children_list": True,
         "collaboration_auth": True,
-        "comment": True,
         "descendants": True,
         "cors_proxy": True,
         "content": True,
@@ -374,8 +298,8 @@ def test_models_documents_get_abilities_editor(
         "invite_owner": False,
         "link_configuration": False,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "mask": is_authenticated,
@@ -420,7 +344,6 @@ def test_models_documents_get_abilities_owner(django_assert_num_queries):
         "children_create": True,
         "children_list": True,
         "collaboration_auth": True,
-        "comment": True,
         "descendants": True,
         "cors_proxy": True,
         "content": True,
@@ -430,8 +353,8 @@ def test_models_documents_get_abilities_owner(django_assert_num_queries):
         "invite_owner": True,
         "link_configuration": True,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "mask": True,
@@ -462,7 +385,6 @@ def test_models_documents_get_abilities_owner(django_assert_num_queries):
         "children_create": False,
         "children_list": False,
         "collaboration_auth": False,
-        "comment": False,
         "descendants": False,
         "cors_proxy": False,
         "content": False,
@@ -472,8 +394,8 @@ def test_models_documents_get_abilities_owner(django_assert_num_queries):
         "invite_owner": False,
         "link_configuration": False,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "mask": False,
@@ -508,7 +430,6 @@ def test_models_documents_get_abilities_administrator(django_assert_num_queries)
         "children_create": True,
         "children_list": True,
         "collaboration_auth": True,
-        "comment": True,
         "descendants": True,
         "cors_proxy": True,
         "content": True,
@@ -518,8 +439,8 @@ def test_models_documents_get_abilities_administrator(django_assert_num_queries)
         "invite_owner": False,
         "link_configuration": True,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "mask": True,
@@ -564,7 +485,6 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         "children_create": True,
         "children_list": True,
         "collaboration_auth": True,
-        "comment": True,
         "descendants": True,
         "cors_proxy": True,
         "content": True,
@@ -574,8 +494,8 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         "invite_owner": False,
         "link_configuration": False,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "mask": True,
@@ -627,8 +547,6 @@ def test_models_documents_get_abilities_reader_user(
         "children_create": access_from_link,
         "children_list": True,
         "collaboration_auth": True,
-        "comment": document.link_reach != "restricted"
-        and document.link_role in ["commenter", "editor"],
         "descendants": True,
         "cors_proxy": True,
         "content": True,
@@ -638,73 +556,8 @@ def test_models_documents_get_abilities_reader_user(
         "invite_owner": False,
         "link_configuration": False,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
-            "restricted": None,
-        },
-        "mask": True,
-        "media_auth": True,
-        "media_check": True,
-        "move": False,
-        "partial_update": access_from_link,
-        "restore": False,
-        "retrieve": True,
-        "tree": True,
-        "update": access_from_link,
-        "versions_destroy": False,
-        "versions_list": True,
-        "versions_retrieve": True,
-    }
-
-    with override_settings(AI_ALLOW_REACH_FROM=ai_access_setting):
-        with django_assert_num_queries(1):
-            assert document.get_abilities(user) == expected_abilities
-
-        document.soft_delete()
-        document.refresh_from_db()
-        assert all(
-            value is False
-            for key, value in document.get_abilities(user).items()
-            if key not in ["link_select_options", "ancestors_links_definition"]
-        )
-
-
-@pytest.mark.parametrize("ai_access_setting", ["public", "authenticated", "restricted"])
-def test_models_documents_get_abilities_commenter_user(
-    ai_access_setting, django_assert_num_queries
-):
-    """Check abilities returned for the commenter of a document."""
-    user = factories.UserFactory()
-    document = factories.DocumentFactory(users=[(user, "commenter")])
-
-    access_from_link = (
-        document.link_reach != "restricted" and document.link_role == "editor"
-    )
-
-    expected_abilities = {
-        "accesses_manage": False,
-        "accesses_view": True,
-        # If you get your editor rights from the link role and not your access role
-        # You should not access AI if it's restricted to users with specific access
-        "ai_transform": access_from_link and ai_access_setting != "restricted",
-        "ai_translate": access_from_link and ai_access_setting != "restricted",
-        "attachment_upload": access_from_link,
-        "can_edit": access_from_link,
-        "children_create": access_from_link,
-        "children_list": True,
-        "collaboration_auth": True,
-        "comment": True,
-        "content": True,
-        "descendants": True,
-        "cors_proxy": True,
-        "destroy": False,
-        "duplicate": True,
-        "favorite": True,
-        "invite_owner": False,
-        "link_configuration": False,
-        "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "mask": True,
@@ -754,7 +607,6 @@ def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
         "children_create": False,
         "children_list": True,
         "collaboration_auth": True,
-        "comment": False,
         "descendants": True,
         "cors_proxy": True,
         "content": True,
@@ -764,8 +616,8 @@ def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
         "invite_owner": False,
         "link_configuration": False,
         "link_select_options": {
-            "authenticated": ["reader", "commenter", "editor"],
-            "public": ["reader", "commenter", "editor"],
+            "authenticated": ["reader", "editor"],
+            "public": ["reader", "editor"],
             "restricted": None,
         },
         "mask": True,
@@ -1468,14 +1320,7 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
             "public",
             "reader",
             {
-                "public": ["reader", "commenter", "editor"],
-            },
-        ),
-        (
-            "public",
-            "commenter",
-            {
-                "public": ["commenter", "editor"],
+                "public": ["reader", "editor"],
             },
         ),
         ("public", "editor", {"public": ["editor"]}),
@@ -1483,16 +1328,8 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
             "authenticated",
             "reader",
             {
-                "authenticated": ["reader", "commenter", "editor"],
-                "public": ["reader", "commenter", "editor"],
-            },
-        ),
-        (
-            "authenticated",
-            "commenter",
-            {
-                "authenticated": ["commenter", "editor"],
-                "public": ["commenter", "editor"],
+                "authenticated": ["reader", "editor"],
+                "public": ["reader", "editor"],
             },
         ),
         (
@@ -1505,17 +1342,8 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
             "reader",
             {
                 "restricted": None,
-                "authenticated": ["reader", "commenter", "editor"],
-                "public": ["reader", "commenter", "editor"],
-            },
-        ),
-        (
-            "restricted",
-            "commenter",
-            {
-                "restricted": None,
-                "authenticated": ["commenter", "editor"],
-                "public": ["commenter", "editor"],
+                "authenticated": ["reader", "editor"],
+                "public": ["reader", "editor"],
             },
         ),
         (
@@ -1532,15 +1360,15 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
             "public",
             None,
             {
-                "public": ["reader", "commenter", "editor"],
+                "public": ["reader", "editor"],
             },
         ),
         (
             None,
             "reader",
             {
-                "public": ["reader", "commenter", "editor"],
-                "authenticated": ["reader", "commenter", "editor"],
+                "public": ["reader", "editor"],
+                "authenticated": ["reader", "editor"],
                 "restricted": None,
             },
         ),
@@ -1548,8 +1376,8 @@ def test_models_documents_restore_complex_bis(django_assert_num_queries):
             None,
             None,
             {
-                "public": ["reader", "commenter", "editor"],
-                "authenticated": ["reader", "commenter", "editor"],
+                "public": ["reader", "editor"],
+                "authenticated": ["reader", "editor"],
                 "restricted": None,
             },
         ),

src/backend/core/tests/test_models_documents_indexer.py

@@ -0,0 +1,441 @@
+"""
+Unit tests for the Document model
+"""
+# pylint: disable=too-many-lines
+
+from operator import itemgetter
+from unittest import mock
+
+from django.core.cache import cache
+from django.db import transaction
+
+import pytest
+
+from core import factories, models
+from core.services.search_indexers import SearchIndexer
+
+pytestmark = pytest.mark.django_db
+
+
+def reset_batch_indexer_throttle():
+    """Reset throttle flag"""
+    cache.delete("document-batch-indexer-throttle")
+
+
+@pytest.fixture(autouse=True)
+def reset_throttle():
+    """Reset throttle flag before each test"""
+    reset_batch_indexer_throttle()
+    yield
+    reset_batch_indexer_throttle()
+
+
+@mock.patch.object(SearchIndexer, "push")
+@pytest.mark.usefixtures("indexer_settings")
+@pytest.mark.django_db(transaction=True)
+def test_models_documents_post_save_indexer(mock_push):
+    """Test indexation task on document creation"""
+    with transaction.atomic():
+        doc1, doc2, doc3 = factories.DocumentFactory.create_batch(3)
+
+    accesses = {}
+    data = [call.args[0] for call in mock_push.call_args_list]
+
+    indexer = SearchIndexer()
+
+    assert len(data) == 1
+
+    # One call
+    assert sorted(data[0], key=itemgetter("id")) == sorted(
+        [
+            indexer.serialize_document(doc1, accesses),
+            indexer.serialize_document(doc2, accesses),
+            indexer.serialize_document(doc3, accesses),
+        ],
+        key=itemgetter("id"),
+    )
+
+    # The throttle counters should be reset
+    assert cache.get("document-batch-indexer-throttle") == 1
+
+
+@pytest.mark.django_db(transaction=True)
+def test_models_documents_post_save_indexer_no_batches(indexer_settings):
+    """Test indexation task on doculment creation, no throttle"""
+    indexer_settings.SEARCH_INDEXER_COUNTDOWN = 0
+
+    with mock.patch.object(SearchIndexer, "push") as mock_push:
+        with transaction.atomic():
+            doc1, doc2, doc3 = factories.DocumentFactory.create_batch(3)
+
+    accesses = {}
+    data = [call.args[0] for call in mock_push.call_args_list]
+
+    indexer = SearchIndexer()
+
+    # 3 calls
+    assert len(data) == 3
+    # one document per call
+    assert [len(d) for d in data] == [1] * 3
+    # all documents are indexed
+    assert sorted([d[0] for d in data], key=itemgetter("id")) == sorted(
+        [
+            indexer.serialize_document(doc1, accesses),
+            indexer.serialize_document(doc2, accesses),
+            indexer.serialize_document(doc3, accesses),
+        ],
+        key=itemgetter("id"),
+    )
+
+    # The throttle counters should be reset
+    assert cache.get("file-batch-indexer-throttle") is None
+
+
+@mock.patch.object(SearchIndexer, "push")
+@pytest.mark.django_db(transaction=True)
+def test_models_documents_post_save_indexer_not_configured(mock_push, indexer_settings):
+    """Task should not start an indexation when disabled"""
+    indexer_settings.SEARCH_INDEXER_CLASS = None
+
+    user = factories.UserFactory()
+
+    with transaction.atomic():
+        doc = factories.DocumentFactory()
+        factories.UserDocumentAccessFactory(document=doc, user=user)
+
+    assert mock_push.assert_not_called
+
+
+@mock.patch.object(SearchIndexer, "push")
+@pytest.mark.django_db(transaction=True)
+def test_models_documents_post_save_indexer_wrongly_configured(
+    mock_push, indexer_settings
+):
+    """Task should not start an indexation when disabled"""
+    indexer_settings.SEARCH_INDEXER_URL = None
+
+    user = factories.UserFactory()
+
+    with transaction.atomic():
+        doc = factories.DocumentFactory()
+        factories.UserDocumentAccessFactory(document=doc, user=user)
+
+    assert mock_push.assert_not_called
+
+
+@mock.patch.object(SearchIndexer, "push")
+@pytest.mark.usefixtures("indexer_settings")
+@pytest.mark.django_db(transaction=True)
+def test_models_documents_post_save_indexer_with_accesses(mock_push):
+    """Test indexation task on document creation"""
+    user = factories.UserFactory()
+
+    with transaction.atomic():
+        doc1, doc2, doc3 = factories.DocumentFactory.create_batch(3)
+
+        factories.UserDocumentAccessFactory(document=doc1, user=user)
+        factories.UserDocumentAccessFactory(document=doc2, user=user)
+        factories.UserDocumentAccessFactory(document=doc3, user=user)
+
+    accesses = {
+        str(doc1.path): {"users": [user.sub]},
+        str(doc2.path): {"users": [user.sub]},
+        str(doc3.path): {"users": [user.sub]},
+    }
+
+    data = [call.args[0] for call in mock_push.call_args_list]
+
+    indexer = SearchIndexer()
+
+    assert len(data) == 1
+    assert sorted(data[0], key=itemgetter("id")) == sorted(
+        [
+            indexer.serialize_document(doc1, accesses),
+            indexer.serialize_document(doc2, accesses),
+            indexer.serialize_document(doc3, accesses),
+        ],
+        key=itemgetter("id"),
+    )
+
+
+@mock.patch.object(SearchIndexer, "push")
+@pytest.mark.usefixtures("indexer_settings")
+@pytest.mark.django_db(transaction=True)
+def test_models_documents_post_save_indexer_deleted(mock_push):
+    """Indexation task on deleted or ancestor_deleted documents"""
+    user = factories.UserFactory()
+
+    with transaction.atomic():
+        doc = factories.DocumentFactory(
+            link_reach=models.LinkReachChoices.AUTHENTICATED
+        )
+        main_doc = factories.DocumentFactory(
+            link_reach=models.LinkReachChoices.AUTHENTICATED
+        )
+        child_doc = factories.DocumentFactory(
+            parent=main_doc,
+            link_reach=models.LinkReachChoices.AUTHENTICATED,
+        )
+
+        factories.UserDocumentAccessFactory(document=doc, user=user)
+        factories.UserDocumentAccessFactory(document=main_doc, user=user)
+        factories.UserDocumentAccessFactory(document=child_doc, user=user)
+
+    # Manually reset the throttle flag here or the next indexation will be ignored for 1 second
+    reset_batch_indexer_throttle()
+
+    with transaction.atomic():
+        main_doc_deleted = models.Document.objects.get(pk=main_doc.pk)
+        main_doc_deleted.soft_delete()
+
+    child_doc_deleted = models.Document.objects.get(pk=child_doc.pk)
+
+    main_doc_deleted.refresh_from_db()
+    child_doc_deleted.refresh_from_db()
+
+    assert main_doc_deleted.deleted_at is not None
+    assert child_doc_deleted.ancestors_deleted_at is not None
+
+    assert child_doc_deleted.deleted_at is None
+    assert child_doc_deleted.ancestors_deleted_at is not None
+
+    accesses = {
+        str(doc.path): {"users": [user.sub]},
+        str(main_doc_deleted.path): {"users": [user.sub]},
+        str(child_doc_deleted.path): {"users": [user.sub]},
+    }
+
+    data = [call.args[0] for call in mock_push.call_args_list]
+
+    indexer = SearchIndexer()
+
+    assert len(data) == 2
+
+    # First indexation on document creation
+    assert sorted(data[0], key=itemgetter("id")) == sorted(
+        [
+            indexer.serialize_document(doc, accesses),
+            indexer.serialize_document(main_doc, accesses),
+            indexer.serialize_document(child_doc, accesses),
+        ],
+        key=itemgetter("id"),
+    )
+
+    # Even deleted items are re-indexed : only update their status in the future
+    assert sorted(data[1], key=itemgetter("id")) == sorted(
+        [
+            indexer.serialize_document(main_doc_deleted, accesses),  # soft_delete()
+            indexer.serialize_document(child_doc_deleted, accesses),
+        ],
+        key=itemgetter("id"),
+    )
+
+
+@pytest.mark.django_db(transaction=True)
+@pytest.mark.usefixtures("indexer_settings")
+def test_models_documents_indexer_hard_deleted():
+    """Indexation task on hard deleted document"""
+    user = factories.UserFactory()
+
+    with transaction.atomic():
+        doc = factories.DocumentFactory(
+            link_reach=models.LinkReachChoices.AUTHENTICATED
+        )
+        factories.UserDocumentAccessFactory(document=doc, user=user)
+
+    # Call task on deleted document.
+    with mock.patch.object(SearchIndexer, "push") as mock_push:
+        doc.delete()
+
+    # Hard delete document are not re-indexed.
+    assert mock_push.assert_not_called
+
+
+@mock.patch.object(SearchIndexer, "push")
+@pytest.mark.usefixtures("indexer_settings")
+@pytest.mark.django_db(transaction=True)
+def test_models_documents_post_save_indexer_restored(mock_push):
+    """Restart indexation task on restored documents"""
+    user = factories.UserFactory()
+
+    with transaction.atomic():
+        doc = factories.DocumentFactory(
+            link_reach=models.LinkReachChoices.AUTHENTICATED
+        )
+        doc_deleted = factories.DocumentFactory(
+            link_reach=models.LinkReachChoices.AUTHENTICATED
+        )
+        doc_ancestor_deleted = factories.DocumentFactory(
+            parent=doc_deleted,
+            link_reach=models.LinkReachChoices.AUTHENTICATED,
+        )
+
+        factories.UserDocumentAccessFactory(document=doc, user=user)
+        factories.UserDocumentAccessFactory(document=doc_deleted, user=user)
+        factories.UserDocumentAccessFactory(document=doc_ancestor_deleted, user=user)
+
+        doc_deleted.soft_delete()
+
+    doc_deleted.refresh_from_db()
+    doc_ancestor_deleted.refresh_from_db()
+
+    assert doc_deleted.deleted_at is not None
+    assert doc_deleted.ancestors_deleted_at is not None
+
+    assert doc_ancestor_deleted.deleted_at is None
+    assert doc_ancestor_deleted.ancestors_deleted_at is not None
+
+    # Manually reset the throttle flag here or the next indexation will be ignored for 1 second
+    reset_batch_indexer_throttle()
+
+    with transaction.atomic():
+        doc_restored = models.Document.objects.get(pk=doc_deleted.pk)
+        doc_restored.restore()
+
+    doc_ancestor_restored = models.Document.objects.get(pk=doc_ancestor_deleted.pk)
+
+    assert doc_restored.deleted_at is None
+    assert doc_restored.ancestors_deleted_at is None
+
+    assert doc_ancestor_restored.deleted_at is None
+    assert doc_ancestor_restored.ancestors_deleted_at is None
+
+    accesses = {
+        str(doc.path): {"users": [user.sub]},
+        str(doc_deleted.path): {"users": [user.sub]},
+        str(doc_ancestor_deleted.path): {"users": [user.sub]},
+    }
+
+    data = [call.args[0] for call in mock_push.call_args_list]
+
+    indexer = SearchIndexer()
+
+    # All docs are re-indexed
+    assert len(data) == 2
+
+    # First indexation on items creation & soft delete (in the same transaction)
+    assert sorted(data[0], key=itemgetter("id")) == sorted(
+        [
+            indexer.serialize_document(doc, accesses),
+            indexer.serialize_document(doc_deleted, accesses),
+            indexer.serialize_document(doc_ancestor_deleted, accesses),
+        ],
+        key=itemgetter("id"),
+    )
+
+    # Restored items are re-indexed : only update their status in the future
+    assert sorted(data[1], key=itemgetter("id")) == sorted(
+        [
+            indexer.serialize_document(doc_restored, accesses),  # restore()
+            indexer.serialize_document(doc_ancestor_restored, accesses),
+        ],
+        key=itemgetter("id"),
+    )
+
+
+@pytest.mark.django_db(transaction=True)
+@pytest.mark.usefixtures("indexer_settings")
+def test_models_documents_post_save_indexer_throttle():
+    """Test indexation task skipping on document update"""
+    indexer = SearchIndexer()
+    user = factories.UserFactory()
+
+    with mock.patch.object(SearchIndexer, "push"):
+        with transaction.atomic():
+            docs = factories.DocumentFactory.create_batch(5, users=(user,))
+
+    accesses = {str(item.path): {"users": [user.sub]} for item in docs}
+
+    with mock.patch.object(SearchIndexer, "push") as mock_push:
+        # Simulate 1 running task
+        cache.set("document-batch-indexer-throttle", 1)
+
+        # save doc to trigger the indexer, but nothing should be done since
+        # the flag is up
+        with transaction.atomic():
+            docs[0].save()
+            docs[2].save()
+            docs[3].save()
+
+        assert [call.args[0] for call in mock_push.call_args_list] == []
+
+    with mock.patch.object(SearchIndexer, "push") as mock_push:
+        # No waiting task
+        cache.delete("document-batch-indexer-throttle")
+
+        with transaction.atomic():
+            docs[0].save()
+            docs[2].save()
+            docs[3].save()
+
+        data = [call.args[0] for call in mock_push.call_args_list]
+
+        # One call
+        assert len(data) == 1
+
+        assert sorted(data[0], key=itemgetter("id")) == sorted(
+            [
+                indexer.serialize_document(docs[0], accesses),
+                indexer.serialize_document(docs[2], accesses),
+                indexer.serialize_document(docs[3], accesses),
+            ],
+            key=itemgetter("id"),
+        )
+
+
+@pytest.mark.django_db(transaction=True)
+@pytest.mark.usefixtures("indexer_settings")
+def test_models_documents_access_post_save_indexer():
+    """Test indexation task on DocumentAccess update"""
+    users = factories.UserFactory.create_batch(3)
+
+    with mock.patch.object(SearchIndexer, "push"):
+        with transaction.atomic():
+            doc = factories.DocumentFactory(users=users)
+            doc_accesses = models.DocumentAccess.objects.filter(document=doc).order_by(
+                "user__sub"
+            )
+
+    reset_batch_indexer_throttle()
+
+    with mock.patch.object(SearchIndexer, "push") as mock_push:
+        with transaction.atomic():
+            for doc_access in doc_accesses:
+                doc_access.save()
+
+        data = [call.args[0] for call in mock_push.call_args_list]
+
+        # One call
+        assert len(data) == 1
+
+        assert [d["id"] for d in data[0]] == [str(doc.pk)]
+
+
+@pytest.mark.django_db(transaction=True)
+def test_models_items_access_post_save_indexer_no_throttle(indexer_settings):
+    """Test indexation task on ItemAccess update, no throttle"""
+    indexer_settings.SEARCH_INDEXER_COUNTDOWN = 0
+
+    users = factories.UserFactory.create_batch(3)
+
+    with transaction.atomic():
+        doc = factories.DocumentFactory(users=users)
+        doc_accesses = models.DocumentAccess.objects.filter(document=doc).order_by(
+            "user__sub"
+        )
+
+    reset_batch_indexer_throttle()
+
+    with mock.patch.object(SearchIndexer, "push") as mock_push:
+        with transaction.atomic():
+            for doc_access in doc_accesses:
+                doc_access.save()
+
+        data = [call.args[0] for call in mock_push.call_args_list]
+
+        # 3 calls
+        assert len(data) == 3
+        # one document per call
+        assert [len(d) for d in data] == [1] * 3
+        # the same document is indexed 3 times
+        assert [d[0]["id"] for d in data] == [str(doc.pk)] * 3

src/backend/core/tests/test_services_search_indexers.py

@@ -0,0 +1,540 @@
+"""Tests for Documents search indexers"""
+
+from functools import partial
+from json import dumps as json_dumps
+from unittest.mock import patch
+
+from django.contrib.auth.models import AnonymousUser
+from django.core.exceptions import ImproperlyConfigured
+from django.utils.module_loading import import_string
+
+import pytest
+import responses
+from requests import HTTPError
+
+from core import factories, models, utils
+from core.services.search_indexers import (
+    BaseDocumentIndexer,
+    SearchIndexer,
+    get_document_indexer,
+    get_visited_document_ids_of,
+)
+
+pytestmark = pytest.mark.django_db
+
+
+class FakeDocumentIndexer(BaseDocumentIndexer):
+    """Fake indexer for test purpose"""
+
+    def serialize_document(self, document, accesses):
+        return {}
+
+    def push(self, data):
+        pass
+
+    def search_query(self, data, token):
+        return {}
+
+
+def test_services_search_indexer_class_invalid(indexer_settings):
+    """
+    Should raise RuntimeError if SEARCH_INDEXER_CLASS cannot be imported.
+    """
+    indexer_settings.SEARCH_INDEXER_CLASS = "unknown.Unknown"
+
+    assert get_document_indexer() is None
+
+
+def test_services_search_indexer_class(indexer_settings):
+    """
+    Import indexer class defined in setting SEARCH_INDEXER_CLASS.
+    """
+    indexer_settings.SEARCH_INDEXER_CLASS = (
+        "core.tests.test_services_search_indexers.FakeDocumentIndexer"
+    )
+
+    assert isinstance(
+        get_document_indexer(),
+        import_string("core.tests.test_services_search_indexers.FakeDocumentIndexer"),
+    )
+
+
+def test_services_search_indexer_is_configured(indexer_settings):
+    """
+    Should return true only when the indexer class and other configuration settings
+    are valid.
+    """
+    indexer_settings.SEARCH_INDEXER_CLASS = None
+
+    # None
+    get_document_indexer.cache_clear()
+    assert not get_document_indexer()
+
+    # Empty
+    indexer_settings.SEARCH_INDEXER_CLASS = ""
+
+    get_document_indexer.cache_clear()
+    assert not get_document_indexer()
+
+    # Valid class
+    indexer_settings.SEARCH_INDEXER_CLASS = (
+        "core.services.search_indexers.SearchIndexer"
+    )
+
+    get_document_indexer.cache_clear()
+    assert get_document_indexer() is not None
+
+    indexer_settings.SEARCH_INDEXER_URL = ""
+
+    # Invalid url
+    get_document_indexer.cache_clear()
+    assert not get_document_indexer()
+
+
+def test_services_search_indexer_url_is_none(indexer_settings):
+    """
+    Indexer should raise RuntimeError if SEARCH_INDEXER_URL is None or empty.
+    """
+    indexer_settings.SEARCH_INDEXER_URL = None
+
+    with pytest.raises(ImproperlyConfigured) as exc_info:
+        SearchIndexer()
+
+    assert "SEARCH_INDEXER_URL must be set in Django settings." in str(exc_info.value)
+
+
+def test_services_search_indexer_url_is_empty(indexer_settings):
+    """
+    Indexer should raise RuntimeError if SEARCH_INDEXER_URL is empty string.
+    """
+    indexer_settings.SEARCH_INDEXER_URL = ""
+
+    with pytest.raises(ImproperlyConfigured) as exc_info:
+        SearchIndexer()
+
+    assert "SEARCH_INDEXER_URL must be set in Django settings." in str(exc_info.value)
+
+
+def test_services_search_indexer_secret_is_none(indexer_settings):
+    """
+    Indexer should raise RuntimeError if SEARCH_INDEXER_SECRET is None.
+    """
+    indexer_settings.SEARCH_INDEXER_SECRET = None
+
+    with pytest.raises(ImproperlyConfigured) as exc_info:
+        SearchIndexer()
+
+    assert "SEARCH_INDEXER_SECRET must be set in Django settings." in str(
+        exc_info.value
+    )
+
+
+def test_services_search_indexer_secret_is_empty(indexer_settings):
+    """
+    Indexer should raise RuntimeError if SEARCH_INDEXER_SECRET is empty string.
+    """
+    indexer_settings.SEARCH_INDEXER_SECRET = ""
+
+    with pytest.raises(ImproperlyConfigured) as exc_info:
+        SearchIndexer()
+
+    assert "SEARCH_INDEXER_SECRET must be set in Django settings." in str(
+        exc_info.value
+    )
+
+
+def test_services_search_endpoint_is_none(indexer_settings):
+    """
+    Indexer should raise RuntimeError if SEARCH_INDEXER_QUERY_URL is None.
+    """
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = None
+
+    with pytest.raises(ImproperlyConfigured) as exc_info:
+        SearchIndexer()
+
+    assert "SEARCH_INDEXER_QUERY_URL must be set in Django settings." in str(
+        exc_info.value
+    )
+
+
+def test_services_search_endpoint_is_empty(indexer_settings):
+    """
+    Indexer should raise RuntimeError if SEARCH_INDEXER_QUERY_URL is empty.
+    """
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = ""
+
+    with pytest.raises(ImproperlyConfigured) as exc_info:
+        SearchIndexer()
+
+    assert "SEARCH_INDEXER_QUERY_URL must be set in Django settings." in str(
+        exc_info.value
+    )
+
+
+@pytest.mark.usefixtures("indexer_settings")
+def test_services_search_indexers_serialize_document_returns_expected_json():
+    """
+    It should serialize documents with correct metadata and access control.
+    """
+    user_a, user_b = factories.UserFactory.create_batch(2)
+    document = factories.DocumentFactory()
+    factories.DocumentFactory(parent=document)
+
+    factories.UserDocumentAccessFactory(document=document, user=user_a)
+    factories.UserDocumentAccessFactory(document=document, user=user_b)
+    factories.TeamDocumentAccessFactory(document=document, team="team1")
+    factories.TeamDocumentAccessFactory(document=document, team="team2")
+
+    accesses = {
+        document.path: {
+            "users": {str(user_a.sub), str(user_b.sub)},
+            "teams": {"team1", "team2"},
+        }
+    }
+
+    indexer = SearchIndexer()
+    result = indexer.serialize_document(document, accesses)
+
+    assert set(result.pop("users")) == {str(user_a.sub), str(user_b.sub)}
+    assert set(result.pop("groups")) == {"team1", "team2"}
+    assert result == {
+        "id": str(document.id),
+        "title": document.title,
+        "depth": 1,
+        "path": document.path,
+        "numchild": 1,
+        "content": utils.base64_yjs_to_text(document.content),
+        "created_at": document.created_at.isoformat(),
+        "updated_at": document.updated_at.isoformat(),
+        "reach": document.link_reach,
+        "size": 13,
+        "is_active": True,
+    }
+
+
+@pytest.mark.usefixtures("indexer_settings")
+def test_services_search_indexers_serialize_document_deleted():
+    """Deleted documents are marked as just in the serialized json."""
+    parent = factories.DocumentFactory()
+    document = factories.DocumentFactory(parent=parent)
+
+    parent.soft_delete()
+    document.refresh_from_db()
+
+    indexer = SearchIndexer()
+    result = indexer.serialize_document(document, {})
+
+    assert result["is_active"] is False
+
+
+@pytest.mark.usefixtures("indexer_settings")
+def test_services_search_indexers_serialize_document_empty():
+    """Empty documents returns empty content in the serialized json."""
+    document = factories.DocumentFactory(content="", title=None)
+
+    indexer = SearchIndexer()
+    result = indexer.serialize_document(document, {})
+
+    assert result["content"] == ""
+    assert result["title"] == ""
+
+
+@responses.activate
+def test_services_search_indexers_index_errors(indexer_settings):
+    """
+    Documents indexing response handling on Find API HTTP errors.
+    """
+    factories.DocumentFactory()
+
+    indexer_settings.SEARCH_INDEXER_URL = "http://app-find/api/v1.0/documents/index/"
+
+    responses.add(
+        responses.POST,
+        "http://app-find/api/v1.0/documents/index/",
+        status=401,
+        body=json_dumps({"message": "Authentication failed."}),
+    )
+
+    with pytest.raises(HTTPError):
+        SearchIndexer().index()
+
+
+@patch.object(SearchIndexer, "push")
+def test_services_search_indexers_batches_pass_only_batch_accesses(
+    mock_push, indexer_settings
+):
+    """
+    Documents indexing should be processed in batches,
+    and only the access data relevant to each batch should be used.
+    """
+    indexer_settings.SEARCH_INDEXER_BATCH_SIZE = 2
+    documents = factories.DocumentFactory.create_batch(5)
+
+    # Attach a single user access to each document
+    expected_user_subs = {}
+    for document in documents:
+        access = factories.UserDocumentAccessFactory(document=document)
+        expected_user_subs[str(document.id)] = str(access.user.sub)
+
+    assert SearchIndexer().index() == 5
+
+    # Should be 3 batches: 2 + 2 + 1
+    assert mock_push.call_count == 3
+
+    seen_doc_ids = set()
+
+    for call in mock_push.call_args_list:
+        batch = call.args[0]
+        assert isinstance(batch, list)
+
+        for doc_json in batch:
+            doc_id = doc_json["id"]
+            seen_doc_ids.add(doc_id)
+
+            # Only one user expected per document
+            assert doc_json["users"] == [expected_user_subs[doc_id]]
+            assert doc_json["groups"] == []
+
+    # Make sure all 5 documents were indexed
+    assert seen_doc_ids == {str(d.id) for d in documents}
+
+
+@patch.object(SearchIndexer, "push")
+@pytest.mark.usefixtures("indexer_settings")
+def test_services_search_indexers_ignore_empty_documents(mock_push):
+    """
+    Documents indexing should be processed in batches,
+    and only the access data relevant to each batch should be used.
+    """
+    document = factories.DocumentFactory()
+    factories.DocumentFactory(content="", title="")
+    empty_title = factories.DocumentFactory(title="")
+    empty_content = factories.DocumentFactory(content="")
+
+    assert SearchIndexer().index() == 3
+
+    assert mock_push.call_count == 1
+
+    # Make sure only not eempty documents are indexed
+    results = {doc["id"] for doc in mock_push.call_args[0][0]}
+    assert results == {
+        str(d.id)
+        for d in (
+            document,
+            empty_content,
+            empty_title,
+        )
+    }
+
+
+@patch.object(SearchIndexer, "push")
+@pytest.mark.usefixtures("indexer_settings")
+def test_services_search_indexers_ancestors_link_reach(mock_push):
+    """Document accesses and reach should take into account ancestors link reaches."""
+    great_grand_parent = factories.DocumentFactory(link_reach="restricted")
+    grand_parent = factories.DocumentFactory(
+        parent=great_grand_parent, link_reach="authenticated"
+    )
+    parent = factories.DocumentFactory(parent=grand_parent, link_reach="public")
+    document = factories.DocumentFactory(parent=parent, link_reach="restricted")
+
+    assert SearchIndexer().index() == 4
+
+    results = {doc["id"]: doc for doc in mock_push.call_args[0][0]}
+    assert len(results) == 4
+    assert results[str(great_grand_parent.id)]["reach"] == "restricted"
+    assert results[str(grand_parent.id)]["reach"] == "authenticated"
+    assert results[str(parent.id)]["reach"] == "public"
+    assert results[str(document.id)]["reach"] == "public"
+
+
+@patch.object(SearchIndexer, "push")
+@pytest.mark.usefixtures("indexer_settings")
+def test_services_search_indexers_ancestors_users(mock_push):
+    """Document accesses and reach should include users from ancestors."""
+    user_gp, user_p, user_d = factories.UserFactory.create_batch(3)
+
+    grand_parent = factories.DocumentFactory(users=[user_gp])
+    parent = factories.DocumentFactory(parent=grand_parent, users=[user_p])
+    document = factories.DocumentFactory(parent=parent, users=[user_d])
+
+    assert SearchIndexer().index() == 3
+
+    results = {doc["id"]: doc for doc in mock_push.call_args[0][0]}
+    assert len(results) == 3
+    assert results[str(grand_parent.id)]["users"] == [str(user_gp.sub)]
+    assert set(results[str(parent.id)]["users"]) == {str(user_gp.sub), str(user_p.sub)}
+    assert set(results[str(document.id)]["users"]) == {
+        str(user_gp.sub),
+        str(user_p.sub),
+        str(user_d.sub),
+    }
+
+
+@patch.object(SearchIndexer, "push")
+@pytest.mark.usefixtures("indexer_settings")
+def test_services_search_indexers_ancestors_teams(mock_push):
+    """Document accesses and reach should include teams from ancestors."""
+    grand_parent = factories.DocumentFactory(teams=["team_gp"])
+    parent = factories.DocumentFactory(parent=grand_parent, teams=["team_p"])
+    document = factories.DocumentFactory(parent=parent, teams=["team_d"])
+
+    assert SearchIndexer().index() == 3
+
+    results = {doc["id"]: doc for doc in mock_push.call_args[0][0]}
+    assert len(results) == 3
+    assert results[str(grand_parent.id)]["groups"] == ["team_gp"]
+    assert set(results[str(parent.id)]["groups"]) == {"team_gp", "team_p"}
+    assert set(results[str(document.id)]["groups"]) == {"team_gp", "team_p", "team_d"}
+
+
+@patch("requests.post")
+def test_push_uses_correct_url_and_data(mock_post, indexer_settings):
+    """
+    push() should call requests.post with the correct URL from settings
+    the timeout set to 10 seconds and the data as JSON.
+    """
+    indexer_settings.SEARCH_INDEXER_URL = "http://example.com/index"
+
+    indexer = SearchIndexer()
+    sample_data = [{"id": "123", "title": "Test"}]
+
+    mock_response = mock_post.return_value
+    mock_response.raise_for_status.return_value = None  # No error
+
+    indexer.push(sample_data)
+
+    mock_post.assert_called_once()
+    args, kwargs = mock_post.call_args
+
+    assert args[0] == indexer_settings.SEARCH_INDEXER_URL
+    assert kwargs.get("json") == sample_data
+    assert kwargs.get("timeout") == 10
+
+
+def test_get_visited_document_ids_of():
+    """
+    get_visited_document_ids_of() returns the ids of the documents viewed
+    by the user BUT without specific access configuration (like public ones)
+    """
+    user = factories.UserFactory()
+    other = factories.UserFactory()
+    anonymous = AnonymousUser()
+    queryset = models.Document.objects.all()
+
+    assert not get_visited_document_ids_of(queryset, anonymous)
+    assert not get_visited_document_ids_of(queryset, user)
+
+    doc1, doc2, _ = factories.DocumentFactory.create_batch(3)
+
+    create_link = partial(models.LinkTrace.objects.create, user=user, is_masked=False)
+
+    create_link(document=doc1)
+    create_link(document=doc2)
+
+    # The third document is not visited
+    assert sorted(get_visited_document_ids_of(queryset, user)) == sorted(
+        [str(doc1.pk), str(doc2.pk)]
+    )
+
+    factories.UserDocumentAccessFactory(user=other, document=doc1)
+    factories.UserDocumentAccessFactory(user=user, document=doc2)
+
+    # The second document have an access for the user
+    assert get_visited_document_ids_of(queryset, user) == [str(doc1.pk)]
+
+
+@pytest.mark.usefixtures("indexer_settings")
+def test_get_visited_document_ids_of_deleted():
+    """
+    get_visited_document_ids_of() returns the ids of the documents viewed
+    by the user if they are not deleted.
+    """
+    user = factories.UserFactory()
+    anonymous = AnonymousUser()
+    queryset = models.Document.objects.all()
+
+    assert not get_visited_document_ids_of(queryset, anonymous)
+    assert not get_visited_document_ids_of(queryset, user)
+
+    doc = factories.DocumentFactory()
+    doc_deleted = factories.DocumentFactory()
+    doc_ancestor_deleted = factories.DocumentFactory(parent=doc_deleted)
+
+    create_link = partial(models.LinkTrace.objects.create, user=user, is_masked=False)
+
+    create_link(document=doc)
+    create_link(document=doc_deleted)
+    create_link(document=doc_ancestor_deleted)
+
+    # The all documents are visited
+    assert sorted(get_visited_document_ids_of(queryset, user)) == sorted(
+        [str(doc.pk), str(doc_deleted.pk), str(doc_ancestor_deleted.pk)]
+    )
+
+    doc_deleted.soft_delete()
+
+    # Only the first document is not deleted
+    assert get_visited_document_ids_of(queryset, user) == [str(doc.pk)]
+
+
+@responses.activate
+def test_services_search_indexers_search_errors(indexer_settings):
+    """
+    Documents indexing response handling on Find API HTTP errors.
+    """
+    factories.DocumentFactory()
+
+    indexer_settings.SEARCH_INDEXER_QUERY_URL = (
+        "http://app-find/api/v1.0/documents/search/"
+    )
+
+    responses.add(
+        responses.POST,
+        "http://app-find/api/v1.0/documents/search/",
+        status=401,
+        body=json_dumps({"message": "Authentication failed."}),
+    )
+
+    with pytest.raises(HTTPError):
+        SearchIndexer().search("alpha", token="mytoken")
+
+
+@patch("requests.post")
+def test_services_search_indexers_search(mock_post, indexer_settings):
+    """
+    search() should call requests.post to SEARCH_INDEXER_QUERY_URL with the
+    document ids from linktraces.
+    """
+    user = factories.UserFactory()
+    indexer = SearchIndexer()
+
+    mock_response = mock_post.return_value
+    mock_response.raise_for_status.return_value = None  # No error
+
+    doc1, doc2, _ = factories.DocumentFactory.create_batch(3)
+
+    create_link = partial(models.LinkTrace.objects.create, user=user, is_masked=False)
+
+    create_link(document=doc1)
+    create_link(document=doc2)
+
+    visited = get_visited_document_ids_of(models.Document.objects.all(), user)
+
+    indexer.search("alpha", visited=visited, token="mytoken")
+
+    args, kwargs = mock_post.call_args
+
+    assert args[0] == indexer_settings.SEARCH_INDEXER_QUERY_URL
+
+    query_data = kwargs.get("json")
+    assert query_data["q"] == "alpha"
+    assert sorted(query_data["visited"]) == sorted([str(doc1.pk), str(doc2.pk)])
+    assert query_data["services"] == ["docs"]
+    assert query_data["page_number"] == 1
+    assert query_data["page_size"] == 50
+    assert query_data["order_by"] == "updated_at"
+    assert query_data["order_direction"] == "desc"
+
+    assert kwargs.get("headers") == {"Authorization": "Bearer mytoken"}
+    assert kwargs.get("timeout") == 10

src/backend/core/tests/test_utils.py

@@ -75,3 +75,28 @@ def test_utils_extract_attachments():
     base64_string = base64.b64encode(update).decode("utf-8")
     # image_key2 is missing the "/media/" part and shouldn't get extracted
     assert utils.extract_attachments(base64_string) == [image_key1, image_key3]
+
+
+def test_utils_get_ancestor_to_descendants_map_single_path():
+    """Test ancestor mapping of a single path."""
+    paths = ["000100020005"]
+    result = utils.get_ancestor_to_descendants_map(paths, steplen=4)
+
+    assert result == {
+        "0001": {"000100020005"},
+        "00010002": {"000100020005"},
+        "000100020005": {"000100020005"},
+    }
+
+
+def test_utils_get_ancestor_to_descendants_map_multiple_paths():
+    """Test ancestor mapping of multiple paths with shared prefixes."""
+    paths = ["000100020005", "00010003"]
+    result = utils.get_ancestor_to_descendants_map(paths, steplen=4)
+
+    assert result == {
+        "0001": {"000100020005", "00010003"},
+        "00010002": {"000100020005"},
+        "000100020005": {"000100020005"},
+        "00010003": {"00010003"},
+    }

src/backend/core/urls.py

@@ -26,22 +26,20 @@ document_related_router.register(
     viewsets.InvitationViewset,
     basename="invitations",
 )
-document_related_router.register(
-    "threads",
-    viewsets.ThreadViewSet,
-    basename="threads",
-)
+
 document_related_router.register(
     "ask-for-access",
     viewsets.DocumentAskForAccessViewSet,
     basename="ask_for_access",
 )
 
-thread_related_router = DefaultRouter()
-thread_related_router.register(
-    "comments",
-    viewsets.CommentViewSet,
-    basename="comments",
+
+# - Routes nested under a template
+template_related_router = DefaultRouter()
+template_related_router.register(
+    "accesses",
+    viewsets.TemplateAccessViewSet,
+    basename="template_accesses",
 )
 
 
@@ -57,8 +55,8 @@ urlpatterns = [
                     include(document_related_router.urls),
                 ),
                 re_path(
-                    r"^documents/(?P<resource_id>[0-9a-z-]*)/threads/(?P<thread_id>[0-9a-z-]*)/",
-                    include(thread_related_router.urls),
+                    r"^templates/(?P<resource_id>[0-9a-z-]*)/",
+                    include(template_related_router.urls),
                 ),
             ]
         ),

src/backend/core/utils.py

@@ -2,6 +2,7 @@
 
 import base64
 import re
+from collections import defaultdict
 
 import pycrdt
 from bs4 import BeautifulSoup
@@ -9,6 +10,27 @@ from bs4 import BeautifulSoup
 from core import enums
 
 
+def get_ancestor_to_descendants_map(paths, steplen):
+    """
+    Given a list of document paths, return a mapping of ancestor_path -> set of descendant_paths.
+
+    Each path is assumed to use materialized path format with fixed-length segments.
+
+    Args:
+        paths (list of str): List of full document paths.
+        steplen (int): Length of each path segment.
+
+    Returns:
+        dict[str, set[str]]: Mapping from ancestor path to its descendant paths (including itself).
+    """
+    ancestor_map = defaultdict(set)
+    for path in paths:
+        for i in range(steplen, len(path) + 1, steplen):
+            ancestor = path[:i]
+            ancestor_map[ancestor].add(path)
+    return ancestor_map
+
+
 def filter_descendants(paths, root_paths, skip_sorting=False):
     """
     Filters paths to keep only those that are descendants of any path in root_paths.

src/backend/demo/management/commands/create_demo.py

@@ -1,16 +1,19 @@
 # ruff: noqa: S311, S106
 """create_demo management command"""
 
+import base64
 import logging
 import math
 import random
 import time
 from collections import defaultdict
+from uuid import uuid4
 
 from django import db
 from django.conf import settings
 from django.core.management.base import BaseCommand, CommandError
 
+import pycrdt
 from faker import Faker
 
 from core import models
@@ -27,6 +30,16 @@ def random_true_with_probability(probability):
     return random.random() < probability
 
 
+def get_ydoc_for_text(text):
+    """Return a ydoc from plain text for demo purposes."""
+    ydoc = pycrdt.Doc()
+    paragraph = pycrdt.XmlElement("p", {}, [pycrdt.XmlText(text)])
+    fragment = pycrdt.XmlFragment([paragraph])
+    ydoc["document-store"] = fragment
+    update = ydoc.get_update()
+    return base64.b64encode(update).decode("utf-8")
+
+
 class BulkQueue:
     """A utility class to create Django model instances in bulk by just pushing to a queue."""
 
@@ -48,7 +61,7 @@ class BulkQueue:
         self.queue[objects[0]._meta.model.__name__] = []  # noqa: SLF001
 
     def push(self, obj):
-        """Add a model instance to queue to that it gets created in bulk."""
+        """Add a model instance to queue so that it gets created in bulk."""
         objects = self.queue[obj._meta.model.__name__]  # noqa: SLF001
         objects.append(obj)
         if len(objects) > self.BATCH_SIZE:
@@ -139,17 +152,19 @@ def create_demo(stdout):
             # pylint: disable=protected-access
             key = models.Document._int2str(i)  # noqa: SLF001
             padding = models.Document.alphabet[0] * (models.Document.steplen - len(key))
-            queue.push(
-                models.Document(
-                    depth=1,
-                    path=f"{padding}{key}",
-                    creator_id=random.choice(users_ids),
-                    title=fake.sentence(nb_words=4),
-                    link_reach=models.LinkReachChoices.AUTHENTICATED
-                    if random_true_with_probability(0.5)
-                    else random.choice(models.LinkReachChoices.values),
-                )
+            title = fake.sentence(nb_words=4)
+            document = models.Document(
+                id=uuid4(),
+                depth=1,
+                path=f"{padding}{key}",
+                creator_id=random.choice(users_ids),
+                title=title,
+                link_reach=models.LinkReachChoices.AUTHENTICATED
+                if random_true_with_probability(0.5)
+                else random.choice(models.LinkReachChoices.values),
             )
+            document.save_content(get_ydoc_for_text(f"Content for {title:s}"))
+            queue.push(document)
 
         queue.flush()
 

src/backend/impress/settings.py

@@ -99,6 +99,28 @@ class Base(Configuration):
     }
     DEFAULT_AUTO_FIELD = "django.db.models.AutoField"
 
+    # Search
+    SEARCH_INDEXER_CLASS = values.Value(
+        default=None,
+        environ_name="SEARCH_INDEXER_CLASS",
+        environ_prefix=None,
+    )
+    SEARCH_INDEXER_BATCH_SIZE = values.IntegerValue(
+        default=100_000, environ_name="SEARCH_INDEXER_BATCH_SIZE", environ_prefix=None
+    )
+    SEARCH_INDEXER_URL = values.Value(
+        default=None, environ_name="SEARCH_INDEXER_URL", environ_prefix=None
+    )
+    SEARCH_INDEXER_COUNTDOWN = values.IntegerValue(
+        default=1, environ_name="SEARCH_INDEXER_COUNTDOWN", environ_prefix=None
+    )
+    SEARCH_INDEXER_SECRET = values.Value(
+        default=None, environ_name="SEARCH_INDEXER_SECRET", environ_prefix=None
+    )
+    SEARCH_INDEXER_QUERY_URL = values.Value(
+        default=None, environ_name="SEARCH_INDEXER_QUERY_URL", environ_prefix=None
+    )
+
     # Static files (CSS, JavaScript, Images)
     STATIC_URL = "/static/"
     STATIC_ROOT = os.path.join(DATA_DIR, "static")

src/backend/locale/br_FR/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Breton\n"
 "Language: br_FR\n"
@@ -234,8 +234,8 @@ msgstr "implijer"
 msgid "users"
 msgstr "implijerien"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "titl"
 
@@ -311,8 +311,8 @@ msgstr "An implijer-mañ a zo dija er restr-mañ."
 msgid "This team is already in this document."
 msgstr "Ar skipailh-mañ a zo dija en restr-mañ."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "An implijer pe ar skipailh a rank bezañ termenet, ket an daou avat."
 
@@ -328,78 +328,78 @@ msgstr "Goulennoù tizhout ar restr"
 msgid "This user has already asked for access to this document."
 msgstr "An implijer en deus goulennet tizhout ar restr-mañ."
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr "{name} en defe c'hoant da dizhout ar restr-mañ!"
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr "{name} en defe c'hoant da dizhout ar restr da-heul:"
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr "{name} en defe c'hoant da dizhout ar restr: {title}"
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "deskrivadur"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "kod"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "css"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "publik"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "M'eo foran ar patrom-mañ hag implijus gant n'eus forzh piv."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Patrom"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Patromoù"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "Liamm patrom/implijer"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "Liammoù patrom/implijer"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "An implijer-mañ a zo dija er patrom-mañ."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Ar skipailh-mañ a zo dija er patrom-mañ."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "postel"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Pedadenn d'ur restr"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Pedadennoù d'ur restr"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Ar postel-mañ a zo liammet ouzh un implijer enskrivet."
 

src/backend/locale/de_DE/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: German\n"
 "Language: de_DE\n"
@@ -234,8 +234,8 @@ msgstr "Benutzer"
 msgid "users"
 msgstr "Benutzer"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "Titel"
 
@@ -311,8 +311,8 @@ msgstr "Dieser Benutzer befindet sich bereits in diesem Dokument."
 msgid "This team is already in this document."
 msgstr "Dieses Team befindet sich bereits in diesem Dokument."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "Benutzer oder Team müssen gesetzt werden, nicht beides."
 
@@ -328,78 +328,78 @@ msgstr ""
 msgid "This user has already asked for access to this document."
 msgstr ""
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr ""
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr ""
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr ""
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "Beschreibung"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "Code"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "CSS"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "öffentlich"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "Ob diese Vorlage für jedermann öffentlich ist."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Vorlage"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Vorlagen"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "Vorlage/Benutzer-Beziehung"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "Vorlage/Benutzerbeziehungen"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "Dieser Benutzer ist bereits in dieser Vorlage."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Dieses Team ist bereits in diesem Template."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "E-Mail-Adresse"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Einladung zum Dokument"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Dokumenteinladungen"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Diese E-Mail ist bereits einem registrierten Benutzer zugeordnet."
 

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
 "Language: en_US\n"
@@ -234,8 +234,8 @@ msgstr ""
 msgid "users"
 msgstr ""
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr ""
 
@@ -311,8 +311,8 @@ msgstr ""
 msgid "This team is already in this document."
 msgstr ""
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr ""
 
@@ -328,78 +328,78 @@ msgstr ""
 msgid "This user has already asked for access to this document."
 msgstr ""
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr ""
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr ""
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr ""
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr ""
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr ""
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr ""
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr ""
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr ""
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr ""
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr ""
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr ""
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr ""
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr ""
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr ""
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr ""
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr ""
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr ""
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr ""
 

src/backend/locale/es_ES/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Spanish\n"
 "Language: es_ES\n"
@@ -234,8 +234,8 @@ msgstr "usuario"
 msgid "users"
 msgstr "usuarios"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "título"
 
@@ -311,8 +311,8 @@ msgstr "Este usuario ya forma parte del documento."
 msgid "This team is already in this document."
 msgstr "Este equipo ya forma parte del documento."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "Debe establecerse un usuario o un equipo, no ambos."
 
@@ -328,78 +328,78 @@ msgstr "Solicitud de accesos"
 msgid "This user has already asked for access to this document."
 msgstr "Este usuario ya ha solicitado acceso a este documento."
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr "¡{name} desea acceder a un documento!"
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr "{name} desea acceso al siguiente documento:"
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr "{name} está pidiendo acceso al documento: {title}"
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "descripción"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "código"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "css"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "público"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "Si esta plantilla es pública para que cualquiera la utilice."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Plantilla"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Plantillas"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "Relación plantilla/usuario"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "Relaciones plantilla/usuario"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "Este usuario ya forma parte de la plantilla."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Este equipo ya se encuentra en esta plantilla."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "dirección de correo electrónico"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Invitación al documento"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Invitaciones a documentos"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Este correo electrónico está asociado a un usuario registrado."
 

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: French\n"
 "Language: fr_FR\n"
@@ -234,8 +234,8 @@ msgstr "utilisateur"
 msgid "users"
 msgstr "utilisateurs"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "titre"
 
@@ -311,8 +311,8 @@ msgstr "Cet utilisateur est déjà dans ce document."
 msgid "This team is already in this document."
 msgstr "Cette équipe est déjà dans ce document."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "L'utilisateur ou l'équipe doivent être définis, pas les deux."
 
@@ -328,78 +328,78 @@ msgstr "Demande d'accès au document"
 msgid "This user has already asked for access to this document."
 msgstr "Cet utilisateur a déjà demandé l'accès à ce document."
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr "{name} souhaiterait accéder au document suivant !"
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr "{name} souhaiterait accéder au document suivant :"
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr "{name} demande l'accès au document : {title}"
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "description"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "code"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "CSS"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "public"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "Si ce modèle est public, utilisable par n'importe qui."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Modèle"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Modèles"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "Relation modèle/utilisateur"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "Relations modèle/utilisateur"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "Cet utilisateur est déjà dans ce modèle."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Cette équipe est déjà modèle."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "adresse e-mail"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Invitation à un document"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Invitations à un document"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Cette adresse email est déjà associée à un utilisateur inscrit."
 

src/backend/locale/it_IT/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Italian\n"
 "Language: it_IT\n"
@@ -234,8 +234,8 @@ msgstr "utente"
 msgid "users"
 msgstr "utenti"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "titolo"
 
@@ -311,8 +311,8 @@ msgstr "Questo utente è già presente in questo documento."
 msgid "This team is already in this document."
 msgstr "Questo team è già presente in questo documento."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr ""
 
@@ -328,78 +328,78 @@ msgstr ""
 msgid "This user has already asked for access to this document."
 msgstr ""
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr ""
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr ""
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr ""
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "descrizione"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "code"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "css"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "pubblico"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "Indica se questo modello è pubblico per chiunque."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Modello"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Modelli"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr ""
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr ""
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "Questo utente è già in questo modello."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Questo team è già in questo modello."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "indirizzo e-mail"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Invito al documento"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Inviti al documento"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Questa email è già associata a un utente registrato."
 

src/backend/locale/nl_NL/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Dutch\n"
 "Language: nl_NL\n"
@@ -234,8 +234,8 @@ msgstr "gebruiker"
 msgid "users"
 msgstr "gebruikers"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "titel"
 
@@ -311,8 +311,8 @@ msgstr "De gebruiker bestaat al in dit document."
 msgid "This team is already in this document."
 msgstr "Dit team bestaat al in dit document."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "Een gebruiker of team moet gekozen worden, maar niet beide."
 
@@ -328,78 +328,78 @@ msgstr "Document verzoekt om toegangen"
 msgid "This user has already asked for access to this document."
 msgstr "Deze gebruiker heeft al om toegang tot dit document gevraagd."
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr "{name} verzoekt toegang tot een document!"
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr "{name} verzoekt toegang tot het volgende document:"
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr "{name} verzoekt toegang tot het document: {title}"
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "omschrijving"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "code"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "css"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "publiek"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "Of dit sjabloon door iedereen publiekelijk te gebruiken is."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Sjabloon"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Sjabloon"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "Sjabloon/gebruiker relatie"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "Sjabloon/gebruiker relaties"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "De gebruiker bestaat al in dit sjabloon."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Het team bestaat al in dit sjabloon."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "e-mailadres"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Document uitnodiging"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Document uitnodigingen"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Deze email is al geassocieerd met een geregistreerde gebruiker."
 

src/backend/locale/pt_PT/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Portuguese\n"
 "Language: pt_PT\n"
@@ -234,8 +234,8 @@ msgstr ""
 msgid "users"
 msgstr ""
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr ""
 
@@ -311,8 +311,8 @@ msgstr ""
 msgid "This team is already in this document."
 msgstr ""
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr ""
 
@@ -328,78 +328,78 @@ msgstr ""
 msgid "This user has already asked for access to this document."
 msgstr ""
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr ""
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr ""
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr ""
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr ""
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr ""
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr ""
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr ""
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr ""
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr ""
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr ""
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr ""
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr ""
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr ""
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr ""
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr ""
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr ""
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr ""
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr ""
 

src/backend/locale/ru_RU/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Russian\n"
 "Language: ru_RU\n"
@@ -234,8 +234,8 @@ msgstr "пользователь"
 msgid "users"
 msgstr "пользователи"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "заголовок"
 
@@ -311,8 +311,8 @@ msgstr "Этот пользователь уже имеет доступ к эт
 msgid "This team is already in this document."
 msgstr "Эта команда уже имеет доступ к этому документу."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "Может быть выбран либо пользователь, либо команда, но не оба варианта сразу."
 
@@ -328,78 +328,78 @@ msgstr "Документ запрашивает доступы"
 msgid "This user has already asked for access to this document."
 msgstr "Этот пользователь уже запросил доступ к этому документу."
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr "{name} хочет получить доступ к документу!"
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr "{name} хочет получить доступ к следующему документу:"
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr "{name} запрашивает доступ к документу: {title}"
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "описание"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "код"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "css"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "доступно всем"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "Этот шаблон доступен всем пользователям."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Шаблон"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Шаблоны"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "Отношение шаблон/пользователь"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "Отношения шаблон/пользователь"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "Этот пользователь уже указан в этом шаблоне."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Эта команда уже указана в этом шаблоне."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "адрес электронной почты"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Приглашение для документа"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Приглашения для документов"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Этот адрес уже связан с зарегистрированным пользователем."
 

src/backend/locale/sl_SI/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Slovenian\n"
 "Language: sl_SI\n"
@@ -234,8 +234,8 @@ msgstr "uporabnik"
 msgid "users"
 msgstr "uporabniki"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "naslov"
 
@@ -311,8 +311,8 @@ msgstr "Ta uporabnik je že v tem dokumentu."
 msgid "This team is already in this document."
 msgstr "Ta ekipa je že v tem dokumentu."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "Nastaviti je treba bodisi uporabnika ali ekipo, a ne obojega."
 
@@ -328,78 +328,78 @@ msgstr ""
 msgid "This user has already asked for access to this document."
 msgstr ""
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr ""
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr ""
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr ""
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "opis"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "koda"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "css"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "javno"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "Ali je ta predloga javna za uporabo."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Predloga"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Predloge"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "Odnos predloga/uporabnik"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "Odnosi med predlogo in uporabnikom"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "Ta uporabnik je že v tej predlogi."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Ta ekipa je že v tej predlogi."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "elektronski naslov"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Vabilo na dokument"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Vabila na dokument"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Ta e-poštni naslov je že povezan z registriranim uporabnikom."
 

src/backend/locale/sv_SE/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Swedish\n"
 "Language: sv_SE\n"
@@ -234,8 +234,8 @@ msgstr ""
 msgid "users"
 msgstr ""
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr ""
 
@@ -311,8 +311,8 @@ msgstr ""
 msgid "This team is already in this document."
 msgstr ""
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr ""
 
@@ -328,78 +328,78 @@ msgstr ""
 msgid "This user has already asked for access to this document."
 msgstr ""
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr ""
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr ""
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr ""
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr ""
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr ""
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr ""
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr ""
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr ""
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr ""
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr ""
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr ""
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr ""
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr ""
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr ""
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "e-postadress"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Bjud in dokument"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Inbjudningar dokument"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Denna e-postadress är redan associerad med en registrerad användare."
 

src/backend/locale/tr_TR/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Turkish\n"
 "Language: tr_TR\n"
@@ -234,8 +234,8 @@ msgstr ""
 msgid "users"
 msgstr ""
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr ""
 
@@ -311,8 +311,8 @@ msgstr ""
 msgid "This team is already in this document."
 msgstr ""
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr ""
 
@@ -328,78 +328,78 @@ msgstr ""
 msgid "This user has already asked for access to this document."
 msgstr ""
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr ""
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr ""
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr ""
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr ""
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr ""
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr ""
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr ""
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr ""
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr ""
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr ""
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr ""
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr ""
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr ""
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr ""
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr ""
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr ""
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr ""
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr ""
 

src/backend/locale/uk_UA/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Ukrainian\n"
 "Language: uk_UA\n"
@@ -234,8 +234,8 @@ msgstr "користувач"
 msgid "users"
 msgstr "користувачі"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "заголовок"
 
@@ -311,8 +311,8 @@ msgstr "Цей користувач вже має доступ до цього
 msgid "This team is already in this document."
 msgstr "Ця команда вже має доступ до цього документа."
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "Вкажіть користувача або команду, а не обох."
 
@@ -328,78 +328,78 @@ msgstr "Запит доступу для документа"
 msgid "This user has already asked for access to this document."
 msgstr "Цей користувач вже попросив доступ до цього документа."
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr "{name} хоче отримати доступ до документа!"
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr "{name} бажає отримати доступ до наступного документа:"
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr "{name} запитує доступ до документа: {title}"
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "опис"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "код"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "css"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "публічне"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "Чи є цей шаблон публічним для будь-кого користувача."
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "Шаблон"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "Шаблони"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "Відношення шаблон/користувач"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "Відношення шаблон/користувач"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "Цей користувач вже має доступ до цього шаблону."
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "Ця команда вже має доступ до цього шаблону."
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "електронна адреса"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "Запрошення до редагування документа"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "Запрошення до редагування документів"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "Ця електронна пошта вже пов'язана з зареєстрованим користувачем."
 

src/backend/locale/zh_CN/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-docs\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-17 08:04+0000\n"
-"PO-Revision-Date: 2025-11-19 10:13\n"
+"POT-Creation-Date: 2025-10-23 11:01+0000\n"
+"PO-Revision-Date: 2025-11-10 09:54\n"
 "Last-Translator: \n"
 "Language-Team: Chinese Simplified\n"
 "Language: zh_CN\n"
@@ -234,8 +234,8 @@ msgstr "用户"
 msgid "users"
 msgstr "个用户"
 
-#: build/lib/core/models.py:361 build/lib/core/models.py:1276
-#: core/models.py:361 core/models.py:1276
+#: build/lib/core/models.py:361 build/lib/core/models.py:1284
+#: core/models.py:361 core/models.py:1284
 msgid "title"
 msgstr "标题"
 
@@ -311,8 +311,8 @@ msgstr "该用户已在此文档中。"
 msgid "This team is already in this document."
 msgstr "该团队已在此文档中。"
 
-#: build/lib/core/models.py:1045 build/lib/core/models.py:1362
-#: core/models.py:1045 core/models.py:1362
+#: build/lib/core/models.py:1045 build/lib/core/models.py:1370
+#: core/models.py:1045 core/models.py:1370
 msgid "Either user or team must be set, not both."
 msgstr "必须设置用户或团队之一，不能同时设置两者。"
 
@@ -328,78 +328,78 @@ msgstr "文档需要访问权限"
 msgid "This user has already asked for access to this document."
 msgstr "用户已申请该文档的访问权限。"
 
-#: build/lib/core/models.py:1255 core/models.py:1255
+#: build/lib/core/models.py:1263 core/models.py:1263
 #, python-brace-format
 msgid "{name} would like access to a document!"
 msgstr "{name} 申请访问文档！"
 
-#: build/lib/core/models.py:1259 core/models.py:1259
+#: build/lib/core/models.py:1267 core/models.py:1267
 #, python-brace-format
 msgid "{name} would like access to the following document:"
 msgstr "{name} 申请访问以下文档："
 
-#: build/lib/core/models.py:1265 core/models.py:1265
+#: build/lib/core/models.py:1273 core/models.py:1273
 #, python-brace-format
 msgid "{name} is asking for access to the document: {title}"
 msgstr "{name}申请文档：{title}的访问权限"
 
-#: build/lib/core/models.py:1277 core/models.py:1277
+#: build/lib/core/models.py:1285 core/models.py:1285
 msgid "description"
 msgstr "说明"
 
-#: build/lib/core/models.py:1278 core/models.py:1278
+#: build/lib/core/models.py:1286 core/models.py:1286
 msgid "code"
 msgstr "代码"
 
-#: build/lib/core/models.py:1279 core/models.py:1279
+#: build/lib/core/models.py:1287 core/models.py:1287
 msgid "css"
 msgstr "css"
 
-#: build/lib/core/models.py:1281 core/models.py:1281
+#: build/lib/core/models.py:1289 core/models.py:1289
 msgid "public"
 msgstr "公开"
 
-#: build/lib/core/models.py:1283 core/models.py:1283
+#: build/lib/core/models.py:1291 core/models.py:1291
 msgid "Whether this template is public for anyone to use."
 msgstr "该模板是否公开供任何人使用。"
 
-#: build/lib/core/models.py:1289 core/models.py:1289
+#: build/lib/core/models.py:1297 core/models.py:1297
 msgid "Template"
 msgstr "模板"
 
-#: build/lib/core/models.py:1290 core/models.py:1290
+#: build/lib/core/models.py:1298 core/models.py:1298
 msgid "Templates"
 msgstr "模板"
 
-#: build/lib/core/models.py:1343 core/models.py:1343
+#: build/lib/core/models.py:1351 core/models.py:1351
 msgid "Template/user relation"
 msgstr "模板/用户关系"
 
-#: build/lib/core/models.py:1344 core/models.py:1344
+#: build/lib/core/models.py:1352 core/models.py:1352
 msgid "Template/user relations"
 msgstr "模板/用户关系集"
 
-#: build/lib/core/models.py:1350 core/models.py:1350
+#: build/lib/core/models.py:1358 core/models.py:1358
 msgid "This user is already in this template."
 msgstr "该用户已在此模板中。"
 
-#: build/lib/core/models.py:1356 core/models.py:1356
+#: build/lib/core/models.py:1364 core/models.py:1364
 msgid "This team is already in this template."
 msgstr "该团队已在此模板中。"
 
-#: build/lib/core/models.py:1433 core/models.py:1433
+#: build/lib/core/models.py:1441 core/models.py:1441
 msgid "email address"
 msgstr "电子邮件地址"
 
-#: build/lib/core/models.py:1452 core/models.py:1452
+#: build/lib/core/models.py:1460 core/models.py:1460
 msgid "Document invitation"
 msgstr "文档邀请"
 
-#: build/lib/core/models.py:1453 core/models.py:1453
+#: build/lib/core/models.py:1461 core/models.py:1461
 msgid "Document invitations"
 msgstr "文档邀请"
 
-#: build/lib/core/models.py:1473 core/models.py:1473
+#: build/lib/core/models.py:1481 core/models.py:1481
 msgid "This email is already associated to a registered user."
 msgstr "此电子邮件已经与现有注册用户关联。"
 

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "impress"
-version = "3.10.0"
+version = "3.9.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -26,15 +26,15 @@ readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
     "beautifulsoup4==4.14.2",
-    "boto3==1.40.74",
+    "boto3==1.40.59",
     "Brotli==1.2.0",
     "celery[redis]==5.5.3",
     "django-configurations==2.5.1",
     "django-cors-headers==4.9.0",
-    "django-countries==8.1.0",
+    "django-countries==7.6.1",
     "django-csp==4.0",
     "django-filter==25.2",
-    "django-lasuite[all]==0.0.18",
+    "django-lasuite[all]==0.0.16",
     "django-parler==2.3",
     "django-redis==6.0.0",
     "django-storages[s3]==1.14.6",
@@ -42,24 +42,24 @@ dependencies = [
     "django==5.2.8",
     "django-treebeard==4.7.1",
     "djangorestframework==3.16.1",
-    "drf_spectacular==0.29.0",
+    "drf_spectacular==0.28.0",
     "dockerflow==2024.4.2",
     "easy_thumbnails==2.10.1",
     "factory_boy==3.3.3",
     "gunicorn==23.0.0",
     "jsonschema==4.25.1",
     "lxml==6.0.2",
-    "markdown==3.10",
+    "markdown==3.9",
     "mozilla-django-oidc==4.0.1",
     "nested-multipart-parser==1.6.0",
-    "openai==2.8.0",
+    "openai==2.6.1",
     "psycopg[binary]==3.2.12",
-    "pycrdt==0.12.43", 
+    "pycrdt==0.12.42", 
     "PyJWT==2.10.1",
     "python-magic==0.4.27",
     "redis<6.0.0",
     "requests==2.32.5",
-    "sentry-sdk==2.44.0",
+    "sentry-sdk==2.42.1",
     "whitenoise==6.11.0",
 ]
 
@@ -76,17 +76,17 @@ dev = [
     "drf-spectacular-sidecar==2025.10.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.7.0",
-    "pyfakefs==5.10.2",
+    "ipython==9.6.0",
+    "pyfakefs==5.10.0",
     "pylint-django==2.6.1",
     "pylint<4.0.0",
     "pytest-cov==7.0.0",
     "pytest-django==4.11.1",
-    "pytest==9.0.1",
+    "pytest==8.4.2",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
     "responses==0.25.8",
-    "ruff==0.14.5",
+    "ruff==0.14.2",
     "types-requests==2.32.4.20250913",
 ]
 

src/frontend/Dockerfile

@@ -47,15 +47,6 @@ ENV NEXT_PUBLIC_SW_DEACTIVATED=${SW_DEACTIVATED}
 ARG PUBLISH_AS_MIT
 ENV NEXT_PUBLIC_PUBLISH_AS_MIT=${PUBLISH_AS_MIT}
 
-ARG CUSTOM_CODE
-COPY ./${CUSTOM_CODE} /tmp/custom_code
-RUN if [ -n "$CUSTOM_CODE" ] && [ -d "/tmp/custom_code" ] && [ "$(ls -A /tmp/custom_code)" ]; then \
-        echo "Custom code provided. Replacing files from $CUSTOM_CODE..."; \
-        cp -Rv /tmp/custom_code/${CUSTOM_CODE}/* .; \
-    else \
-        echo "No custom code provided. Skipping replacement..."; \
-    fi
-
 RUN yarn build
 
 # ---- Front-end image ----

src/frontend/apps/e2e/__tests__/app-impress/doc-comments.spec.ts

@@ -1,295 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-import { createDoc, getOtherBrowserName, verifyDocName } from './utils-common';
-import { writeInEditor } from './utils-editor';
-import {
-  addNewMember,
-  connectOtherUserToDoc,
-  updateRoleUser,
-  updateShareLink,
-} from './utils-share';
-
-test.beforeEach(async ({ page }) => {
-  await page.goto('/');
-});
-
-test.describe('Doc Comments', () => {
-  test('it checks comments with 2 users in real time', async ({
-    page,
-    browserName,
-  }) => {
-    const [docTitle] = await createDoc(page, 'comment-doc', browserName, 1);
-
-    // We share the doc with another user
-    const otherBrowserName = getOtherBrowserName(browserName);
-    await page.getByRole('button', { name: 'Share' }).click();
-    await addNewMember(page, 0, 'Administrator', otherBrowserName);
-
-    await expect(
-      page
-        .getByRole('listbox', { name: 'Suggestions' })
-        .getByText(new RegExp(otherBrowserName)),
-    ).toBeVisible();
-
-    await page.getByRole('button', { name: 'close' }).click();
-
-    // We add a comment with the first user
-    const editor = await writeInEditor({ page, text: 'Hello World' });
-    await editor.getByText('Hello').selectText();
-    await page.getByRole('button', { name: 'Comment' }).click();
-
-    const thread = page.locator('.bn-thread');
-    await thread.getByRole('paragraph').first().fill('This is a comment');
-    await thread.locator('[data-test="save"]').click();
-    await expect(thread.getByText('This is a comment').first()).toBeHidden();
-
-    await editor.getByText('Hello').click();
-
-    await thread.getByText('This is a comment').first().hover();
-
-    // We add a reaction with the first user
-    await thread.locator('[data-test="addreaction"]').first().click();
-    await page.getByRole('button', { name: '👍' }).click();
-
-    await expect(
-      thread.getByRole('img', { name: 'E2E Chromium' }).first(),
-    ).toBeVisible();
-    await expect(thread.getByText('This is a comment').first()).toBeVisible();
-    await expect(thread.getByText(`E2E ${browserName}`).first()).toBeVisible();
-    await expect(thread.locator('.bn-comment-reaction')).toHaveText('👍1');
-
-    const urlCommentDoc = page.url();
-
-    const { otherPage, cleanup } = await connectOtherUserToDoc({
-      otherBrowserName,
-      docUrl: urlCommentDoc,
-      docTitle,
-    });
-
-    const otherEditor = otherPage.locator('.ProseMirror');
-    await otherEditor.getByText('Hello').click();
-    const otherThread = otherPage.locator('.bn-thread');
-
-    await otherThread.getByText('This is a comment').first().hover();
-    await otherThread.locator('[data-test="addreaction"]').first().click();
-    await otherPage.getByRole('button', { name: '👍' }).click();
-
-    // We check that the comment made by the first user is visible for the second user
-    await expect(
-      otherThread.getByText('This is a comment').first(),
-    ).toBeVisible();
-    await expect(
-      otherThread.getByText(`E2E ${browserName}`).first(),
-    ).toBeVisible();
-    await expect(otherThread.locator('.bn-comment-reaction')).toHaveText('👍2');
-
-    // We add a comment with the second user
-    await otherThread
-      .getByRole('paragraph')
-      .last()
-      .fill('This is a comment from the other user');
-    await otherThread.locator('[data-test="save"]').click();
-
-    // We check that the second user can see the comment he just made
-    await expect(
-      otherThread.getByRole('img', { name: `E2E ${otherBrowserName}` }).first(),
-    ).toBeVisible();
-    await expect(
-      otherThread.getByText('This is a comment from the other user').first(),
-    ).toBeVisible();
-    await expect(
-      otherThread.getByText(`E2E ${otherBrowserName}`).first(),
-    ).toBeVisible();
-
-    // We check that the first user can see the comment made by the second user in real time
-    await expect(
-      thread.getByText('This is a comment from the other user').first(),
-    ).toBeVisible();
-    await expect(
-      thread.getByText(`E2E ${otherBrowserName}`).first(),
-    ).toBeVisible();
-
-    await cleanup();
-  });
-
-  test('it checks the comments interactions', async ({ page, browserName }) => {
-    await createDoc(page, 'comment-interaction', browserName, 1);
-
-    // Checks add react reaction
-    const editor = page.locator('.ProseMirror');
-    await editor.locator('.bn-block-outer').last().fill('Hello World');
-    await editor.getByText('Hello').selectText();
-    await page.getByRole('button', { name: 'Comment' }).click();
-
-    const thread = page.locator('.bn-thread');
-    await thread.getByRole('paragraph').first().fill('This is a comment');
-    await thread.locator('[data-test="save"]').click();
-    await expect(thread.getByText('This is a comment').first()).toBeHidden();
-
-    // Check background color changed
-    await expect(editor.getByText('Hello')).toHaveCSS(
-      'background-color',
-      'rgba(237, 180, 0, 0.4)',
-    );
-    await editor.getByText('Hello').click();
-
-    await thread.getByText('This is a comment').first().hover();
-
-    // We add a reaction with the first user
-    await thread.locator('[data-test="addreaction"]').first().click();
-    await page.getByRole('button', { name: '👍' }).click();
-
-    await expect(thread.locator('.bn-comment-reaction')).toHaveText('👍1');
-
-    // Edit Comment
-    await thread.getByText('This is a comment').first().hover();
-    await thread.locator('[data-test="moreactions"]').first().click();
-    await thread.getByRole('menuitem', { name: 'Edit comment' }).click();
-    const commentEditor = thread.getByText('This is a comment').first();
-    await commentEditor.fill('This is an edited comment');
-    const saveBtn = thread.getByRole('button', { name: 'Save' });
-    await saveBtn.click();
-    await expect(saveBtn).toBeHidden();
-    await expect(
-      thread.getByText('This is an edited comment').first(),
-    ).toBeVisible();
-    await expect(thread.getByText('This is a comment').first()).toBeHidden();
-
-    // Add second comment
-    await thread.getByRole('paragraph').last().fill('This is a second comment');
-    await thread.getByRole('button', { name: 'Save' }).click();
-    await expect(
-      thread.getByText('This is an edited comment').first(),
-    ).toBeVisible();
-    await expect(
-      thread.getByText('This is a second comment').first(),
-    ).toBeVisible();
-
-    // Delete second comment
-    await thread.getByText('This is a second comment').first().hover();
-    await thread.locator('[data-test="moreactions"]').first().click();
-    await thread.getByRole('menuitem', { name: 'Delete comment' }).click();
-    await expect(
-      thread.getByText('This is a second comment').first(),
-    ).toBeHidden();
-
-    // Resolve thread
-    await thread.getByText('This is an edited comment').first().hover();
-    await thread.locator('[data-test="resolve"]').click();
-    await expect(thread).toBeHidden();
-    await expect(editor.getByText('Hello')).toHaveCSS(
-      'background-color',
-      'rgba(0, 0, 0, 0)',
-    );
-  });
-
-  test('it checks the comments abilities', async ({ page, browserName }) => {
-    test.slow();
-
-    const [docTitle] = await createDoc(page, 'comment-doc', browserName, 1);
-
-    // We share the doc with another user
-    const otherBrowserName = getOtherBrowserName(browserName);
-
-    // Add a new member with editor role
-    await page.getByRole('button', { name: 'Share' }).click();
-    await addNewMember(page, 0, 'Editor', otherBrowserName);
-
-    await expect(
-      page
-        .getByRole('listbox', { name: 'Suggestions' })
-        .getByText(new RegExp(otherBrowserName)),
-    ).toBeVisible();
-
-    const urlCommentDoc = page.url();
-
-    const { otherPage, cleanup } = await connectOtherUserToDoc({
-      otherBrowserName,
-      docUrl: urlCommentDoc,
-      docTitle,
-    });
-
-    const otherEditor = await writeInEditor({
-      page: otherPage,
-      text: 'Hello, I can edit the document',
-    });
-    await expect(
-      otherEditor.getByText('Hello, I can edit the document'),
-    ).toBeVisible();
-    await otherEditor.getByText('Hello').selectText();
-    await otherPage.getByRole('button', { name: 'Comment' }).click();
-    const otherThread = otherPage.locator('.bn-thread');
-    await otherThread
-      .getByRole('paragraph')
-      .first()
-      .fill('I can add a comment');
-    await otherThread.locator('[data-test="save"]').click();
-    await expect(
-      otherThread.getByText('I can add a comment').first(),
-    ).toBeHidden();
-
-    await expect(otherEditor.getByText('Hello')).toHaveCSS(
-      'background-color',
-      'rgba(237, 180, 0, 0.4)',
-    );
-
-    // We change the role of the second user to reader
-    await updateRoleUser(page, 'Reader', `user.test@${otherBrowserName}.test`);
-
-    // With the reader role, the second user cannot see comments
-    await otherPage.reload();
-    await verifyDocName(otherPage, docTitle);
-
-    await expect(otherEditor.getByText('Hello')).toHaveCSS(
-      'background-color',
-      'rgba(0, 0, 0, 0)',
-    );
-    await otherEditor.getByText('Hello').click();
-    await expect(otherThread).toBeHidden();
-    await otherEditor.getByText('Hello').selectText();
-    await expect(
-      otherPage.getByRole('button', { name: 'Comment' }),
-    ).toBeHidden();
-
-    await otherPage.reload();
-
-    // Change the link role of the doc to set it in commenting mode
-    await updateShareLink(page, 'Public', 'Editing');
-
-    // Anonymous user can see and add comments
-    await otherPage.getByRole('button', { name: 'Logout' }).click();
-
-    await otherPage.goto(urlCommentDoc);
-
-    await verifyDocName(otherPage, docTitle);
-
-    await expect(otherEditor.getByText('Hello')).toHaveCSS(
-      'background-color',
-      'rgba(237, 180, 0, 0.4)',
-    );
-    await otherEditor.getByText('Hello').click();
-    await expect(
-      otherThread.getByText('I can add a comment').first(),
-    ).toBeVisible();
-
-    await otherThread
-      .locator('.ProseMirror.bn-editor[contenteditable="true"]')
-      .getByRole('paragraph')
-      .first()
-      .fill('Comment by anonymous user');
-    await otherThread.locator('[data-test="save"]').click();
-
-    await expect(
-      otherThread.getByText('Comment by anonymous user').first(),
-    ).toBeVisible();
-
-    await expect(
-      otherThread.getByRole('img', { name: `Anonymous` }).first(),
-    ).toBeVisible();
-
-    await otherThread.getByText('Comment by anonymous user').first().hover();
-    await expect(otherThread.locator('[data-test="moreactions"]')).toBeHidden();
-
-    await cleanup();
-  });
-});

src/frontend/apps/e2e/__tests__/app-impress/doc-export.spec.ts

@@ -31,7 +31,7 @@ test.describe('Doc Export', () => {
 
     await expect(page.getByTestId('modal-export-title')).toBeVisible();
     await expect(
-      page.getByText('Download your document in a .docx, .odt or .pdf format.'),
+      page.getByText('Download your document in a .docx or .pdf format.'),
     ).toBeVisible();
     await expect(
       page.getByRole('combobox', { name: 'Template' }),
@@ -142,51 +142,6 @@ test.describe('Doc Export', () => {
     expect(download.suggestedFilename()).toBe(`${randomDoc}.docx`);
   });
 
-  test('it exports the doc to odt', async ({ page, browserName }) => {
-    const [randomDoc] = await createDoc(page, 'doc-editor-odt', browserName, 1);
-
-    await verifyDocName(page, randomDoc);
-
-    await page.locator('.ProseMirror.bn-editor').click();
-    await page.locator('.ProseMirror.bn-editor').fill('Hello World ODT');
-
-    await page.keyboard.press('Enter');
-    await page.locator('.bn-block-outer').last().fill('/');
-    await page.getByText('Resizable image with caption').click();
-
-    const fileChooserPromise = page.waitForEvent('filechooser');
-    await page.getByText('Upload image').click();
-
-    const fileChooser = await fileChooserPromise;
-    await fileChooser.setFiles(path.join(__dirname, 'assets/test.svg'));
-
-    const image = page
-      .locator('.--docs--editor-container img.bn-visual-media')
-      .first();
-
-    await expect(image).toBeVisible();
-
-    await page
-      .getByRole('button', {
-        name: 'Export the document',
-      })
-      .click();
-
-    await page.getByRole('combobox', { name: 'Format' }).click();
-    await page.getByRole('option', { name: 'Odt' }).click();
-
-    await expect(page.getByTestId('doc-export-download-button')).toBeVisible();
-
-    const downloadPromise = page.waitForEvent('download', (download) => {
-      return download.suggestedFilename().includes(`${randomDoc}.odt`);
-    });
-
-    void page.getByTestId('doc-export-download-button').click();
-
-    const download = await downloadPromise;
-    expect(download.suggestedFilename()).toBe(`${randomDoc}.odt`);
-  });
-
   /**
    * This test tell us that the export to pdf is working with images
    * but it does not tell us if the images are being displayed correctly
@@ -487,68 +442,4 @@ test.describe('Doc Export', () => {
     const pdfText = await pdfParse.getText();
     expect(pdfText.text).toContain(randomDoc);
   });
-
-  test('it exports the doc with interlinking to odt', async ({
-    page,
-    browserName,
-  }) => {
-    const [randomDoc] = await createDoc(
-      page,
-      'export-interlinking-odt',
-      browserName,
-      1,
-    );
-
-    await verifyDocName(page, randomDoc);
-
-    const { name: docChild } = await createRootSubPage(
-      page,
-      browserName,
-      'export-interlink-child-odt',
-    );
-
-    await verifyDocName(page, docChild);
-
-    await page.locator('.bn-block-outer').last().fill('/');
-    await page.getByText('Link a doc').first().click();
-
-    const input = page.locator(
-      "span[data-inline-content-type='interlinkingSearchInline'] input",
-    );
-    const searchContainer = page.locator('.quick-search-container');
-
-    await input.fill('export-interlink');
-
-    await expect(searchContainer).toBeVisible();
-    await expect(searchContainer.getByText(randomDoc)).toBeVisible();
-
-    // We are in docChild, we want to create a link to randomDoc (parent)
-    await searchContainer.getByText(randomDoc).click();
-
-    // Search the interlinking link in the editor (not in the document tree)
-    const editor = page.locator('.ProseMirror.bn-editor');
-    const interlink = editor.getByRole('button', {
-      name: randomDoc,
-    });
-
-    await expect(interlink).toBeVisible();
-
-    await page
-      .getByRole('button', {
-        name: 'Export the document',
-      })
-      .click();
-
-    await page.getByRole('combobox', { name: 'Format' }).click();
-    await page.getByRole('option', { name: 'Odt' }).click();
-
-    const downloadPromise = page.waitForEvent('download', (download) => {
-      return download.suggestedFilename().includes(`${docChild}.odt`);
-    });
-
-    void page.getByTestId('doc-export-download-button').click();
-
-    const download = await downloadPromise;
-    expect(download.suggestedFilename()).toBe(`${docChild}.odt`);
-  });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-member-create.spec.ts

@@ -84,7 +84,7 @@ test.describe('Document create member', () => {
 
     // Validate
     await page.getByRole('menuitem', { name: 'Administrator' }).click();
-    await page.getByRole('button', { name: /^Invite / }).click();
+    await page.getByRole('button', { name: 'Invite' }).click();
 
     // Check invitation added
     await expect(
@@ -135,7 +135,7 @@ test.describe('Document create member', () => {
       (response) =>
         response.url().includes('/invitations/') && response.status() === 201,
     );
-    await page.getByRole('button', { name: /^Invite / }).click();
+    await page.getByRole('button', { name: 'Invite' }).click();
 
     // Check invitation sent
 
@@ -154,7 +154,7 @@ test.describe('Document create member', () => {
         response.url().includes('/invitations/') && response.status() === 400,
     );
 
-    await page.getByRole('button', { name: /^Invite / }).click();
+    await page.getByRole('button', { name: 'Invite' }).click();
     await expect(
       page.getByText(`"${email}" is already invited to the document.`),
     ).toBeVisible();
@@ -191,7 +191,7 @@ test.describe('Document create member', () => {
         response.url().includes('/invitations/') && response.status() === 201,
     );
 
-    await page.getByRole('button', { name: /^Invite / }).click();
+    await page.getByRole('button', { name: 'Invite' }).click();
 
     // Check invitation sent
     const responseCreateInvitation = await responsePromiseCreateInvitation;

src/frontend/apps/e2e/__tests__/app-impress/doc-member-list.spec.ts

@@ -160,9 +160,6 @@ test.describe('Document list members', () => {
       `You are the sole owner of this group, make another member the group owner before you can change your own role or be removed from your document.`,
     );
     await expect(soloOwner).toBeVisible();
-    await expect(
-      page.getByRole('menuitem', { name: 'Administrator' }),
-    ).toBeDisabled();
 
     await list.click({
       force: true, // Force click to close the dropdown
@@ -189,17 +186,9 @@ test.describe('Document list members', () => {
     await list.click();
     await expect(currentUserRole).toBeVisible();
 
-    await newUserRoles.click();
-    await expect(page.getByRole('menuitem', { name: 'Owner' })).toBeDisabled();
-    await list.click({
-      force: true, // Force click to close the dropdown
-    });
-
     await currentUserRole.click();
     await page.getByRole('menuitem', { name: 'Reader' }).click();
-    await list.click({
-      force: true, // Force click to close the dropdown
-    });
+    await list.click();
     await expect(currentUserRole).toBeHidden();
   });
 

src/frontend/apps/e2e/__tests__/app-impress/home.spec.ts

@@ -27,33 +27,6 @@ test.describe('Home page', () => {
     // Check the titles
     const h2 = page.locator('h2');
     await expect(h2.getByText('Govs ❤️ Open Source.')).toBeVisible();
-    await expect(page.getByText('Docs is built on top of')).toBeVisible();
-    await expect(
-      page.getByRole('link', {
-        name: 'Django Rest Framework',
-      }),
-    ).toHaveAttribute('href', 'https://www.django-rest-framework.org/');
-    await expect(page.getByText('You can easily self-host Docs')).toBeVisible();
-    await expect(
-      page
-        .getByRole('link', {
-          name: 'licence',
-        })
-        .first(),
-    ).toHaveAttribute(
-      'href',
-      'https://github.com/suitenumerique/docs/blob/main/LICENSE',
-    );
-    await expect(
-      page.getByText('Docs is the result of a joint effort lead by the French'),
-    ).toBeVisible();
-    await expect(
-      page
-        .getByRole('link', {
-          name: 'Zendis',
-        })
-        .first(),
-    ).toHaveAttribute('href', 'https://zendis.de/');
     await expect(
       h2.getByText('Collaborative writing, Simplified.'),
     ).toBeVisible();

src/frontend/apps/e2e/__tests__/app-impress/utils-common.ts

@@ -70,14 +70,6 @@ export const keyCloakSignIn = async (
   await page.click('button[type="submit"]', { force: true });
 };
 
-export const getOtherBrowserName = (browserName: BrowserName) => {
-  const otherBrowserName = BROWSERS.find((b) => b !== browserName);
-  if (!otherBrowserName) {
-    throw new Error('No alternative browser found');
-  }
-  return otherBrowserName;
-};
-
 export const randomName = (name: string, browserName: string, length: number) =>
   Array.from({ length }, (_el, index) => {
     return `${browserName}-${Math.floor(Math.random() * 10000)}-${index}-${name}`;
@@ -133,9 +125,7 @@ export const verifyDocName = async (page: Page, docName: string) => {
   try {
     await expect(
       page.getByRole('textbox', { name: 'Document title' }),
-    ).toContainText(docName, {
-      timeout: 1000,
-    });
+    ).toContainText(docName);
   } catch {
     await expect(page.getByRole('heading', { name: docName })).toBeVisible();
   }

src/frontend/apps/e2e/__tests__/app-impress/utils-share.ts

@@ -1,20 +1,20 @@
 import { Page, chromium, expect } from '@playwright/test';
 
 import {
+  BROWSERS,
   BrowserName,
-  getOtherBrowserName,
   keyCloakSignIn,
   verifyDocName,
 } from './utils-common';
 
-export type Role = 'Administrator' | 'Owner' | 'Editor' | 'Reader';
+export type Role = 'Administrator' | 'Owner' | 'Member' | 'Editor' | 'Reader';
 export type LinkReach = 'Private' | 'Connected' | 'Public';
 export type LinkRole = 'Reading' | 'Editing';
 
 export const addNewMember = async (
   page: Page,
   index: number,
-  role: Role,
+  role: 'Administrator' | 'Owner' | 'Editor' | 'Reader',
   fillText = 'user.test',
 ) => {
   const responsePromiseSearchUser = page.waitForResponse(
@@ -40,7 +40,7 @@ export const addNewMember = async (
   // Choose a role
   await page.getByLabel('doc-role-dropdown').click();
   await page.getByRole('menuitem', { name: role }).click();
-  await page.getByRole('button', { name: /^Invite / }).click();
+  await page.getByRole('button', { name: 'Invite' }).click();
 
   return users[index].email;
 };
@@ -88,30 +88,21 @@ export const updateRoleUser = async (
  * @param docTitle The title of the document (optional).
  * @returns An object containing the other browser, context, and page.
  */
-type ConnectOtherUserToDocParams = {
-  docUrl: string;
-  docTitle?: string;
-  withoutSignIn?: boolean;
-} & (
-  | {
-      otherBrowserName: BrowserName;
-      browserName?: never;
-    }
-  | {
-      browserName: BrowserName;
-      otherBrowserName?: never;
-    }
-);
-
 export const connectOtherUserToDoc = async ({
   browserName,
   docUrl,
   docTitle,
-  otherBrowserName: _otherBrowserName,
   withoutSignIn,
-}: ConnectOtherUserToDocParams) => {
-  const otherBrowserName =
-    _otherBrowserName || getOtherBrowserName(browserName);
+}: {
+  browserName: BrowserName;
+  docUrl: string;
+  docTitle?: string;
+  withoutSignIn?: boolean;
+}) => {
+  const otherBrowserName = BROWSERS.find((b) => b !== browserName);
+  if (!otherBrowserName) {
+    throw new Error('No alternative browser found');
+  }
 
   const otherBrowser = await chromium.launch({ headless: true });
   const otherContext = await otherBrowser.newContext({

src/frontend/apps/e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-e2e",
-  "version": "3.10.0",
+  "version": "3.9.0",
   "repository": "https://github.com/suitenumerique/docs",
   "author": "DINUM",
   "license": "MIT",

src/frontend/apps/impress/cunningham.ts

@@ -98,8 +98,8 @@ const dsfrTheme = {
       },
       font: {
         families: {
-          base: 'Marianne, Inter, Roboto Flex Variable, sans-serif',
-          accent: 'Marianne, Inter, Roboto Flex Variable, sans-serif',
+          base: 'Marianne',
+          accent: 'Marianne',
         },
       },
     },

src/frontend/apps/impress/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-impress",
-  "version": "3.10.0",
+  "version": "3.9.0",
   "repository": "https://github.com/suitenumerique/docs",
   "author": "DINUM",
   "license": "MIT",
@@ -19,14 +19,13 @@
   },
   "dependencies": {
     "@ag-media/react-pdf-table": "2.0.3",
-    "@blocknote/code-block": "0.42.3",
-    "@blocknote/core": "0.42.3",
-    "@blocknote/mantine": "0.42.3",
-    "@blocknote/react": "0.42.3",
-    "@blocknote/xl-docx-exporter": "0.42.3",
-    "@blocknote/xl-multi-column": "0.42.3",
-    "@blocknote/xl-odt-exporter": "0.42.3",
-    "@blocknote/xl-pdf-exporter": "0.42.3",
+    "@blocknote/code-block": "0.41.1",
+    "@blocknote/core": "0.41.1",
+    "@blocknote/mantine": "0.41.1",
+    "@blocknote/react": "0.41.1",
+    "@blocknote/xl-docx-exporter": "0.41.1",
+    "@blocknote/xl-multi-column": "0.41.1",
+    "@blocknote/xl-pdf-exporter": "0.41.1",
     "@dnd-kit/core": "6.3.1",
     "@dnd-kit/modifiers": "9.0.0",
     "@emoji-mart/data": "1.2.1",
@@ -43,7 +42,7 @@
     "@react-pdf/renderer": "4.3.1",
     "@sentry/nextjs": "10.22.0",
     "@tanstack/react-query": "5.90.6",
-    "@tiptap/extensions": "*",
+    "@tiptap/extensions": "3.10.1",
     "canvg": "4.0.3",
     "clsx": "2.1.1",
     "cmdk": "1.1.1",
@@ -62,7 +61,7 @@
     "react": "*",
     "react-aria-components": "1.13.0",
     "react-dom": "*",
-    "react-i18next": "16.3.3",
+    "react-i18next": "16.2.3",
     "react-intersection-observer": "10.0.0",
     "react-resizable-panels": "3.0.6",
     "react-select": "5.10.2",

src/frontend/apps/impress/src/components/dropdown-menu/DropdownMenu.tsx

@@ -12,7 +12,6 @@ import { css } from 'styled-components';
 
 import { Box, BoxButton, BoxProps, DropButton, Icon, Text } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
-import { useKeyboardAction } from '@/hooks';
 
 import { useDropdownKeyboardNav } from './hook/useDropdownKeyboardNav';
 
@@ -58,7 +57,6 @@ export const DropdownMenu = ({
   testId,
 }: PropsWithChildren<DropdownMenuProps>) => {
   const { spacingsTokens, colorsTokens } = useCunninghamTheme();
-  const keyboardAction = useKeyboardAction();
   const [isOpen, setIsOpen] = useState(opened ?? false);
   const [focusedIndex, setFocusedIndex] = useState(-1);
   const blockButtonRef = useRef<HTMLDivElement>(null);
@@ -95,14 +93,6 @@ export const DropdownMenu = ({
     }
   }, [isOpen, options]);
 
-  const triggerOption = useCallback(
-    (option: DropdownMenuOption) => {
-      onOpenChange?.(false);
-      void option.callback?.();
-    },
-    [onOpenChange],
-  );
-
   if (disabled) {
     return children;
   }
@@ -180,9 +170,9 @@ export const DropdownMenu = ({
                 onClick={(event) => {
                   event.preventDefault();
                   event.stopPropagation();
-                  triggerOption(option);
+                  onOpenChange?.(false);
+                  void option.callback?.();
                 }}
-                onKeyDown={keyboardAction(() => triggerOption(option))}
                 key={option.label}
                 $align="center"
                 $justify="space-between"

src/frontend/apps/impress/src/cunningham/cunningham-tokens.css

@@ -556,10 +556,8 @@
   --c--theme--logo--widthHeader: 110px;
   --c--theme--logo--widthFooter: 220px;
   --c--theme--logo--alt: gouvernement logo;
-  --c--theme--font--families--base:
-    marianne, inter, roboto flex variable, sans-serif;
-  --c--theme--font--families--accent:
-    marianne, inter, roboto flex variable, sans-serif;
+  --c--theme--font--families--base: marianne;
+  --c--theme--font--families--accent: marianne;
   --c--components--la-gaufre: true;
   --c--components--home-proconnect: true;
   --c--components--favicon--ico: /assets/favicon-dsfr.ico;

src/frontend/apps/impress/src/cunningham/cunningham-tokens.ts

@@ -436,12 +436,7 @@ export const tokens = {
           widthFooter: '220px',
           alt: 'Gouvernement Logo',
         },
-        font: {
-          families: {
-            base: 'Marianne, Inter, Roboto Flex Variable, sans-serif',
-            accent: 'Marianne, Inter, Roboto Flex Variable, sans-serif',
-          },
-        },
+        font: { families: { base: 'Marianne', accent: 'Marianne' } },
       },
       components: {
         'la-gaufre': true,

src/frontend/apps/impress/src/features/auth/api/types.ts

@@ -13,5 +13,3 @@ export interface User {
   short_name: string;
   language?: string;
 }
-
-export type UserLight = Pick<User, 'full_name' | 'short_name'>;

src/frontend/apps/impress/src/features/auth/components/AvatarSvg.tsx

@@ -1,49 +0,0 @@
-import React from 'react';
-
-import { Box, BoxType } from '@/components';
-
-type AvatarSvgProps = {
-  initials: string;
-  background: string;
-  fontFamily?: string;
-} & BoxType;
-
-export const AvatarSvg: React.FC<AvatarSvgProps> = ({
-  initials,
-  background,
-  fontFamily,
-  ...props
-}) => (
-  <Box
-    as="svg"
-    xmlns="http://www.w3.org/2000/svg"
-    width="24"
-    height="24"
-    viewBox="0 0 24 24"
-    {...props}
-  >
-    <rect
-      x="0.5"
-      y="0.5"
-      width="23"
-      height="23"
-      rx="11.5"
-      ry="11.5"
-      fill={background}
-      stroke="rgba(255,255,255,0.5)"
-      strokeWidth="1"
-    />
-    <text
-      x="50%"
-      y="50%"
-      dy="0.35em"
-      textAnchor="middle"
-      fontSize="10"
-      fontWeight="600"
-      fill="rgba(255,255,255,0.9)"
-      fontFamily={fontFamily || 'Arial'}
-    >
-      {initials}
-    </text>
-  </Box>
-);

src/frontend/apps/impress/src/features/auth/components/UserAvatar.tsx

@@ -1,70 +0,0 @@
-import { renderToStaticMarkup } from 'react-dom/server';
-
-import { tokens } from '@/cunningham';
-
-import { AvatarSvg } from './AvatarSvg';
-
-const colors = tokens.themes.default.theme.colors;
-
-const avatarsColors = [
-  colors['blue-500'],
-  colors['brown-500'],
-  colors['cyan-500'],
-  colors['gold-500'],
-  colors['green-500'],
-  colors['olive-500'],
-  colors['orange-500'],
-  colors['pink-500'],
-  colors['purple-500'],
-  colors['yellow-500'],
-];
-
-const getColorFromName = (name: string) => {
-  let hash = 0;
-  for (let i = 0; i < name.length; i++) {
-    hash = name.charCodeAt(i) + ((hash << 5) - hash);
-  }
-  return avatarsColors[Math.abs(hash) % avatarsColors.length];
-};
-
-const getInitialFromName = (name: string) => {
-  const splitName = name?.split(' ');
-  return (splitName[0]?.charAt(0) || '?') + (splitName?.[1]?.charAt(0) || '');
-};
-
-type UserAvatarProps = {
-  fullName?: string;
-  background?: string;
-};
-
-export const UserAvatar = ({ fullName, background }: UserAvatarProps) => {
-  const name = fullName?.trim() || '?';
-
-  return (
-    <AvatarSvg
-      className="--docs--user-avatar"
-      initials={getInitialFromName(name).toUpperCase()}
-      background={background || getColorFromName(name)}
-    />
-  );
-};
-
-export const avatarUrlFromName = (
-  fullName?: string,
-  fontFamily?: string,
-): string => {
-  const name = fullName?.trim() || '?';
-  const initials = getInitialFromName(name).toUpperCase();
-  const background = getColorFromName(name);
-
-  const svgMarkup = renderToStaticMarkup(
-    <AvatarSvg
-      className="--docs--user-avatar"
-      initials={initials}
-      background={background}
-      fontFamily={fontFamily}
-    />,
-  );
-
-  return `data:image/svg+xml;charset=UTF-8,${encodeURIComponent(svgMarkup)}`;
-};

src/frontend/apps/impress/src/features/auth/components/index.ts

@@ -1,3 +1,2 @@
 export * from './Auth';
 export * from './ButtonLogin';
-export * from './UserAvatar';

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteEditor.tsx

@@ -12,16 +12,13 @@ import { BlockNoteView } from '@blocknote/mantine';
 import '@blocknote/mantine/style.css';
 import { useCreateBlockNote } from '@blocknote/react';
 import { HocuspocusProvider } from '@hocuspocus/provider';
-import { useEffect, useMemo, useRef } from 'react';
+import { useEffect, useRef } from 'react';
 import { useTranslation } from 'react-i18next';
-import { css } from 'styled-components';
 import * as Y from 'yjs';
 
 import { Box, TextErrors } from '@/components';
-import { useCunninghamTheme } from '@/cunningham';
 import { Doc, useProviderStore } from '@/docs/doc-management';
-import { avatarUrlFromName, useAuth } from '@/features/auth';
-import { useResponsiveStore } from '@/stores';
+import { useAuth } from '@/features/auth';
 
 import {
   useHeadings,
@@ -37,7 +34,6 @@ import { randomColor } from '../utils';
 
 import { BlockNoteSuggestionMenu } from './BlockNoteSuggestionMenu';
 import { BlockNoteToolbar } from './BlockNoteToolBar/BlockNoteToolbar';
-import { cssComments, useComments } from './comments/';
 import {
   AccessibleImageBlock,
   CalloutBlock,
@@ -83,11 +79,8 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
   const { user } = useAuth();
   const { setEditor } = useEditorStore();
   const { t } = useTranslation();
-  const { themeTokens } = useCunninghamTheme();
-  const { isDesktop } = useResponsiveStore();
   const { isSynced: isConnectedToCollabServer } = useProviderStore();
   const refEditorContainer = useRef<HTMLDivElement>(null);
-  const canSeeComment = doc.abilities.comment && isDesktop;
 
   useSaveDoc(doc.id, provider.document, isConnectedToCollabServer);
   const { i18n } = useTranslation();
@@ -95,25 +88,16 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
 
   const { uploadFile, errorAttachment } = useUploadFile(doc.id);
 
-  const collabName = user?.full_name || user?.email;
-  const cursorName = collabName || t('Anonymous');
+  const collabName = user?.full_name || user?.email || t('Anonymous');
   const showCursorLabels: 'always' | 'activity' | (string & {}) = 'activity';
 
-  const threadStore = useComments(doc.id, canSeeComment, user);
-
-  const currentUserAvatarUrl = useMemo(() => {
-    if (canSeeComment) {
-      return avatarUrlFromName(collabName, themeTokens?.font?.families?.base);
-    }
-  }, [canSeeComment, collabName, themeTokens?.font?.families?.base]);
-
   const editor: DocsBlockNoteEditor = useCreateBlockNote(
     {
       collaboration: {
         provider: provider,
         fragment: provider.document.getXmlFragment('document-store'),
         user: {
-          name: cursorName,
+          name: collabName,
           color: randomColor(),
         },
         /**
@@ -154,28 +138,11 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
         },
         showCursorLabels: showCursorLabels as 'always' | 'activity',
       },
-      comments: { threadStore },
       dictionary: {
         ...locales[lang as keyof typeof locales],
         multi_column:
           multiColumnLocales?.[lang as keyof typeof multiColumnLocales],
       },
-      resolveUsers: async (userIds) => {
-        return Promise.resolve(
-          userIds.map((encodedURIUserId) => {
-            const fullName = decodeURIComponent(encodedURIUserId);
-
-            return {
-              id: encodedURIUserId,
-              username: fullName || t('Anonymous'),
-              avatarUrl: avatarUrlFromName(
-                fullName,
-                themeTokens?.font?.families?.base,
-              ),
-            };
-          }),
-        );
-      },
       tables: {
         splitCells: true,
         cellBackgroundColor: true,
@@ -185,7 +152,7 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
       uploadFile,
       schema: blockNoteSchema,
     },
-    [cursorName, lang, provider, uploadFile, threadStore],
+    [collabName, lang, provider, uploadFile],
   );
 
   useHeadings(editor);
@@ -203,13 +170,7 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
   }, [setEditor, editor]);
 
   return (
-    <Box
-      ref={refEditorContainer}
-      $css={css`
-        ${cssEditor};
-        ${cssComments(canSeeComment, currentUserAvatarUrl)}
-      `}
-    >
+    <Box ref={refEditorContainer} $css={cssEditor}>
       {errorAttachment && (
         <Box $margin={{ bottom: 'big', top: 'none', horizontal: 'large' }}>
           <TextErrors
@@ -219,13 +180,12 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
           />
         </Box>
       )}
+
       <BlockNoteView
-        className="--docs--main-editor"
         editor={editor}
         formattingToolbar={false}
         slashMenu={false}
         theme="light"
-        comments={canSeeComment}
         aria-label={t('Document editor')}
       >
         <BlockNoteSuggestionMenu />
@@ -236,17 +196,11 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
 };
 
 interface BlockNoteReaderProps {
-  docId: Doc['id'];
   initialContent: Y.XmlFragment;
 }
 
-export const BlockNoteReader = ({
-  docId,
-  initialContent,
-}: BlockNoteReaderProps) => {
-  const { user } = useAuth();
+export const BlockNoteReader = ({ initialContent }: BlockNoteReaderProps) => {
   const { setEditor } = useEditorStore();
-  const threadStore = useComments(docId, false, user);
   const { t } = useTranslation();
   const editor = useCreateBlockNote(
     {
@@ -259,10 +213,6 @@ export const BlockNoteReader = ({
         provider: undefined,
       },
       schema: blockNoteSchema,
-      comments: { threadStore },
-      resolveUsers: async () => {
-        return Promise.resolve([]);
-      },
     },
     [initialContent],
   );
@@ -278,21 +228,14 @@ export const BlockNoteReader = ({
   useHeadings(editor);
 
   return (
-    <Box
-      $css={css`
-        ${cssEditor};
-        ${cssComments(false)}
-      `}
-    >
+    <Box $css={cssEditor}>
       <BlockNoteView
-        className="--docs--main-editor"
         editor={editor}
         editable={false}
         theme="light"
         aria-label={t('Document version viewer')}
         formattingToolbar={false}
         slashMenu={false}
-        comments={false}
       />
     </Box>
   );

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteToolBar/BlockNoteToolbar.tsx

@@ -10,7 +10,6 @@ import { useTranslation } from 'react-i18next';
 
 import { useConfig } from '@/core/config/api';
 
-import { CommentToolbarButton } from '../comments/CommentToolbarButton';
 import { getCalloutFormattingToolbarItems } from '../custom-blocks';
 
 import { AIGroupButton } from './AIButton';
@@ -26,12 +25,10 @@ export const BlockNoteToolbar = () => {
   const { data: conf } = useConfig();
 
   const toolbarItems = useMemo(() => {
-    let toolbarItems = getFormattingToolbarItems([
+    const toolbarItems = getFormattingToolbarItems([
       ...blockTypeSelectItems(dict),
       getCalloutFormattingToolbarItems(t),
     ]);
-
-    // Find the index of the file download button
     const fileDownloadButtonIndex = toolbarItems.findIndex(
       (item) =>
         typeof item === 'object' &&
@@ -39,8 +36,6 @@ export const BlockNoteToolbar = () => {
         'key' in item &&
         (item as { key: string }).key === 'fileDownloadButton',
     );
-
-    // Replace the default file download button with our custom FileDownloadButton
     if (fileDownloadButtonIndex !== -1) {
       toolbarItems.splice(
         fileDownloadButtonIndex,
@@ -55,22 +50,12 @@ export const BlockNoteToolbar = () => {
       );
     }
 
-    // Remove default Comment button
-    toolbarItems = toolbarItems.filter((item) => {
-      if (typeof item === 'object' && item !== null && 'key' in item) {
-        return item.key !== 'addCommentButton';
-      }
-      return true;
-    });
-
     return toolbarItems;
   }, [dict, t]);
 
   const formattingToolbar = useCallback(() => {
     return (
       <FormattingToolbar>
-        <CommentToolbarButton />
-
         {toolbarItems}
 
         {/* Extra button to do some AI powered actions */}

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteToolBar/MarkdownButton.tsx

@@ -6,9 +6,6 @@ import {
 import { forEach, isArray } from 'lodash';
 import React, { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
-import { css } from 'styled-components';
-
-import { Text } from '@/components';
 
 type Block = {
   type: string;
@@ -86,18 +83,8 @@ export function MarkdownButton() {
       mainTooltip={t('Convert Markdown')}
       onClick={handleConvertMarkdown}
       className="--docs--editor-markdown-button"
-      label="M"
-      icon={
-        <Text
-          aria-hidden={true}
-          $css={css`
-            font-family: var(--c--theme--font--families--base);
-          `}
-          $weight="bold"
-        >
-          M
-        </Text>
-      }
-    />
+    >
+      M
+    </Components.FormattingToolbar.Button>
   );
 }

src/frontend/apps/impress/src/features/docs/doc-editor/components/DocEditor.tsx

@@ -99,7 +99,6 @@ export const DocEditor = ({ doc }: DocEditorProps) => {
     <>
       {isDesktop && (
         <Box
-          $height="100vh"
           $position="absolute"
           $css={css`
             top: 72px;
@@ -117,7 +116,6 @@ export const DocEditor = ({ doc }: DocEditorProps) => {
               initialContent={provider.document.getXmlFragment(
                 'document-store',
               )}
-              docId={doc.id}
             />
           ) : (
             <BlockNoteEditor doc={doc} provider={provider} />

src/frontend/apps/impress/src/features/docs/doc-editor/components/comments/CommentToolbarButton.tsx

@@ -1,69 +0,0 @@
-import { useBlockNoteEditor, useComponentsContext } from '@blocknote/react';
-import { useTranslation } from 'react-i18next';
-import { css } from 'styled-components';
-
-import { Box, Icon } from '@/components';
-import { useCunninghamTheme } from '@/cunningham';
-import { useDocStore } from '@/features/docs/doc-management';
-
-import {
-  DocsBlockSchema,
-  DocsInlineContentSchema,
-  DocsStyleSchema,
-} from '../../types';
-
-export const CommentToolbarButton = () => {
-  const Components = useComponentsContext();
-  const { currentDoc } = useDocStore();
-  const { t } = useTranslation();
-  const { spacingsTokens, colorsTokens } = useCunninghamTheme();
-
-  const editor = useBlockNoteEditor<
-    DocsBlockSchema,
-    DocsInlineContentSchema,
-    DocsStyleSchema
-  >();
-
-  if (!editor.isEditable || !Components || !currentDoc?.abilities.comment) {
-    return null;
-  }
-
-  return (
-    <Box $direction="row" className="--docs--comment-toolbar-button">
-      <Components.Generic.Toolbar.Button
-        className="bn-button"
-        onClick={() => {
-          editor.comments?.startPendingComment();
-        }}
-        aria-haspopup="dialog"
-      >
-        <Box
-          $direction="row"
-          $align="center"
-          $gap={spacingsTokens['xs']}
-          $padding={{ right: '2xs' }}
-        >
-          <Icon
-            iconName="comment"
-            className="--docs--icon-bg"
-            $theme="greyscale"
-            $variation="600"
-            $padding="0.15rem"
-            $size="16px"
-            $color={colorsTokens['greyscale-600']}
-          />
-          {t('Comment')}
-        </Box>
-      </Components.Generic.Toolbar.Button>
-      <Box
-        $background={colorsTokens['greyscale-100']}
-        $width="1px"
-        $height="70%"
-        $margin={{ left: '2px' }}
-        $css={css`
-          align-self: center;
-        `}
-      />
-    </Box>
-  );
-};

src/frontend/apps/impress/src/features/docs/doc-editor/components/comments/DocsThreadStore.tsx

@@ -1,569 +0,0 @@
-import { CommentBody, ThreadStore } from '@blocknote/core/comments';
-import type { Awareness } from 'y-protocols/awareness';
-
-import { APIError, APIList, errorCauses, fetchAPI } from '@/api';
-import { Doc } from '@/features/docs/doc-management';
-
-import { useEditorStore } from '../../stores';
-
-import { DocsThreadStoreAuth } from './DocsThreadStoreAuth';
-import {
-  ClientCommentData,
-  ClientThreadData,
-  ServerComment,
-  ServerReaction,
-  ServerThread,
-} from './types';
-
-type ServerThreadListResponse = APIList<ServerThread>;
-
-export class DocsThreadStore extends ThreadStore {
-  protected static COMMENTS_PING = 'commentsPing';
-  protected threads: Map<string, ClientThreadData> = new Map();
-  private subscribers = new Set<
-    (threads: Map<string, ClientThreadData>) => void
-  >();
-  private awareness?: Awareness;
-  private lastPingAt = 0;
-  private pingTimer?: ReturnType<typeof setTimeout>;
-
-  constructor(
-    protected docId: Doc['id'],
-    awareness: Awareness | undefined,
-    protected docAuth: DocsThreadStoreAuth,
-  ) {
-    super(docAuth);
-
-    if (docAuth.canSee) {
-      this.awareness = awareness;
-      this.awareness?.on('update', this.onAwarenessUpdate);
-      void this.refreshThreads();
-    }
-  }
-
-  public destroy() {
-    this.awareness?.off('update', this.onAwarenessUpdate);
-    if (this.pingTimer) {
-      clearTimeout(this.pingTimer);
-    }
-  }
-
-  private onAwarenessUpdate = async ({
-    added,
-    updated,
-  }: {
-    added: number[];
-    updated: number[];
-  }) => {
-    if (!this.awareness) {
-      return;
-    }
-    const states = this.awareness.getStates();
-    const listClientIds = [...added, ...updated];
-    for (const clientId of listClientIds) {
-      // Skip our own client ID
-      if (clientId === this.awareness.clientID) {
-        continue;
-      }
-
-      const state = states.get(clientId) as
-        | {
-            [DocsThreadStore.COMMENTS_PING]?: {
-              at: number;
-              docId: string;
-              isResolving: boolean;
-              threadId: string;
-            };
-          }
-        | undefined;
-
-      const ping = state?.commentsPing;
-
-      // Skip if no ping information is available
-      if (!ping) {
-        continue;
-      }
-
-      // Skip if the document ID doesn't match
-      if (ping.docId !== this.docId) {
-        continue;
-      }
-
-      // Skip if the ping timestamp is past
-      if (ping.at <= this.lastPingAt) {
-        continue;
-      }
-
-      this.lastPingAt = ping.at;
-
-      // If we know the threadId, schedule a targeted refresh. Otherwise, fall back to full refresh.
-      if (ping.threadId) {
-        await this.refreshThread(ping.threadId);
-      } else {
-        await this.refreshThreads();
-      }
-    }
-  };
-
-  /**
-   * To ping the other clients for updates on a specific thread
-   * @param threadId
-   */
-  private ping(threadId?: string) {
-    this.awareness?.setLocalStateField(DocsThreadStore.COMMENTS_PING, {
-      at: Date.now(),
-      docId: this.docId,
-      threadId,
-    });
-  }
-
-  /**
-   * Notifies all subscribers about the current thread state
-   */
-  private notifySubscribers() {
-    // Always emit a new Map reference to help consumers detect changes
-    const threads = new Map(this.threads);
-    this.subscribers.forEach((cb) => {
-      try {
-        cb(threads);
-      } catch (e) {
-        console.warn('DocsThreadStore subscriber threw', e);
-      }
-    });
-  }
-
-  private upsertClientThreadData(thread: ClientThreadData) {
-    const next = new Map(this.threads);
-    next.set(thread.id, thread);
-    this.threads = next;
-  }
-
-  private removeThread(threadId: string) {
-    const next = new Map(this.threads);
-    next.delete(threadId);
-    this.threads = next;
-  }
-
-  /**
-   * To subscribe to thread updates
-   * @param cb
-   * @returns
-   */
-  public subscribe(cb: (threads: Map<string, ClientThreadData>) => void) {
-    if (!this.docAuth.canSee) {
-      return () => {};
-    }
-
-    this.subscribers.add(cb);
-
-    // Emit initial state asynchronously to avoid running during editor init
-    setTimeout(() => {
-      if (this.subscribers.has(cb)) {
-        cb(this.getThreads());
-      }
-    }, 0);
-
-    return () => {
-      this.subscribers.delete(cb);
-    };
-  }
-
-  public addThreadToDocument = (options: {
-    threadId: string;
-    selection: {
-      prosemirror: {
-        head: number;
-        anchor: number;
-      };
-      yjs: {
-        head: unknown;
-        anchor: unknown;
-      };
-    };
-  }) => {
-    const { threadId } = options;
-    const { editor } = useEditorStore.getState();
-
-    // Should not happen
-    if (!editor) {
-      console.warn('Editor to add thread not ready');
-      return Promise.resolve();
-    }
-
-    editor._tiptapEditor
-      .chain()
-      .focus?.()
-      .setMark?.('comment', { orphan: false, threadId })
-      .run?.();
-
-    return Promise.resolve();
-  };
-
-  public createThread = async (options: {
-    initialComment: {
-      body: CommentBody;
-      metadata?: unknown;
-    };
-    metadata?: unknown;
-  }) => {
-    const response = await fetchAPI(`documents/${this.docId}/threads/`, {
-      method: 'POST',
-      body: JSON.stringify({
-        body: options.initialComment.body,
-      }),
-    });
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to create thread in document',
-        await errorCauses(response),
-      );
-    }
-
-    const thread = (await response.json()) as ServerThread;
-    const threadData: ClientThreadData = serverThreadToClientThread(thread);
-    this.upsertClientThreadData(threadData);
-    this.notifySubscribers();
-    this.ping(threadData.id);
-    return threadData;
-  };
-
-  public getThread(threadId: string) {
-    const thread = this.threads.get(threadId);
-    if (!thread) {
-      throw new Error('Thread not found');
-    }
-
-    return thread;
-  }
-
-  public getThreads(): Map<string, ClientThreadData> {
-    if (!this.docAuth.canSee) {
-      return new Map();
-    }
-
-    return this.threads;
-  }
-
-  public async refreshThread(threadId: string) {
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${threadId}/`,
-      { method: 'GET' },
-    );
-
-    // If not OK and 404, the thread might have been deleted but the
-    // thread modal is still open, so we close it to avoid side effects
-    if (response.status === 404) {
-      // use escape key event to close the thread modal
-      document.dispatchEvent(
-        new KeyboardEvent('keydown', {
-          key: 'Escape',
-          code: 'Escape',
-          keyCode: 27,
-          bubbles: true,
-          cancelable: true,
-        }),
-      );
-
-      await this.refreshThreads();
-      return;
-    }
-
-    if (!response.ok) {
-      throw new APIError(
-        `Failed to fetch thread ${threadId}`,
-        await errorCauses(response),
-      );
-    }
-
-    const serverThread = (await response.json()) as ServerThread;
-
-    const clientThread = serverThreadToClientThread(serverThread);
-    this.upsertClientThreadData(clientThread);
-    this.notifySubscribers();
-  }
-
-  public async refreshThreads(): Promise<void> {
-    const response = await fetchAPI(`documents/${this.docId}/threads/`, {
-      method: 'GET',
-    });
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to get threads in document',
-        await errorCauses(response),
-      );
-    }
-
-    const threads = (await response.json()) as ServerThreadListResponse;
-    const next = new Map<string, ClientThreadData>();
-    threads.results.forEach((thread) => {
-      const threadData: ClientThreadData = serverThreadToClientThread(thread);
-      next.set(thread.id, threadData);
-    });
-    this.threads = next;
-    this.notifySubscribers();
-  }
-
-  public addComment = async (options: {
-    comment: {
-      body: CommentBody;
-      metadata?: unknown;
-    };
-    threadId: string;
-  }) => {
-    const { threadId } = options;
-
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${threadId}/comments/`,
-      {
-        method: 'POST',
-        body: JSON.stringify({
-          body: options.comment.body,
-        }),
-      },
-    );
-
-    if (!response.ok) {
-      throw new APIError('Failed to add comment ', await errorCauses(response));
-    }
-
-    const comment = (await response.json()) as ServerComment;
-
-    // Optimistically update local thread with new comment
-    const existing = this.threads.get(threadId);
-    if (existing) {
-      const updated: ClientThreadData = {
-        ...existing,
-        updatedAt: new Date(comment.updated_at || comment.created_at),
-        comments: [...existing.comments, serverCommentToClientComment(comment)],
-      };
-      this.upsertClientThreadData(updated);
-      this.notifySubscribers();
-    } else {
-      // Fallback to fetching the thread if we don't have it locally
-      await this.refreshThread(threadId);
-    }
-    this.ping(threadId);
-    return serverCommentToClientComment(comment);
-  };
-
-  public updateComment = async (options: {
-    comment: {
-      body: CommentBody;
-      metadata?: unknown;
-    };
-    threadId: string;
-    commentId: string;
-  }) => {
-    const { threadId, commentId, comment } = options;
-
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${threadId}/comments/${commentId}/`,
-      {
-        method: 'PUT',
-        body: JSON.stringify({
-          body: comment.body,
-        }),
-      },
-    );
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to add thread to document',
-        await errorCauses(response),
-      );
-    }
-
-    await this.refreshThread(threadId);
-    this.ping(threadId);
-
-    return;
-  };
-
-  public deleteComment = async (options: {
-    threadId: string;
-    commentId: string;
-    softDelete?: boolean;
-  }) => {
-    const { threadId, commentId } = options;
-
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${threadId}/comments/${commentId}/`,
-      {
-        method: 'DELETE',
-      },
-    );
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to delete comment',
-        await errorCauses(response),
-      );
-    }
-
-    // Optimistically remove the comment locally if we have the thread
-    const existing = this.threads.get(threadId);
-    if (existing) {
-      const updated: ClientThreadData = {
-        ...existing,
-        updatedAt: new Date(),
-        comments: existing.comments.filter((c) => c.id !== commentId),
-      };
-      this.upsertClientThreadData(updated);
-      this.notifySubscribers();
-    } else {
-      // Fallback to fetching the thread
-      await this.refreshThread(threadId);
-    }
-    this.ping(threadId);
-  };
-
-  /**
-   * UI not implemented
-   * @param _options
-   */
-  public deleteThread = async (_options: { threadId: string }) => {
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${_options.threadId}/`,
-      {
-        method: 'DELETE',
-      },
-    );
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to delete thread',
-        await errorCauses(response),
-      );
-    }
-
-    // Remove locally and notify; no need to refetch everything
-    this.removeThread(_options.threadId);
-    this.notifySubscribers();
-    this.ping(_options.threadId);
-  };
-
-  public resolveThread = async (_options: { threadId: string }) => {
-    const { threadId } = _options;
-
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${threadId}/resolve/`,
-      { method: 'POST' },
-    );
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to resolve thread',
-        await errorCauses(response),
-      );
-    }
-
-    await this.refreshThreads();
-    this.ping(threadId);
-  };
-
-  /**
-   * Todo: Not implemented backend side
-   * @returns
-   * @throws
-   */
-  public unresolveThread = async (_options: { threadId: string }) => {
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${_options.threadId}/unresolve/`,
-      { method: 'POST' },
-    );
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to unresolve thread',
-        await errorCauses(response),
-      );
-    }
-
-    await this.refreshThread(_options.threadId);
-    this.ping(_options.threadId);
-  };
-
-  public addReaction = async (options: {
-    threadId: string;
-    commentId: string;
-    emoji: string;
-  }) => {
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${options.threadId}/comments/${options.commentId}/reactions/`,
-      {
-        method: 'POST',
-        body: JSON.stringify({ emoji: options.emoji }),
-      },
-    );
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to add reaction to comment',
-        await errorCauses(response),
-      );
-    }
-
-    await this.refreshThread(options.threadId);
-    this.notifySubscribers();
-    this.ping(options.threadId);
-  };
-
-  public deleteReaction = async (options: {
-    threadId: string;
-    commentId: string;
-    emoji: string;
-  }) => {
-    const response = await fetchAPI(
-      `documents/${this.docId}/threads/${options.threadId}/comments/${options.commentId}/reactions/`,
-      { method: 'DELETE', body: JSON.stringify({ emoji: options.emoji }) },
-    );
-
-    if (!response.ok) {
-      throw new APIError(
-        'Failed to delete reaction from comment',
-        await errorCauses(response),
-      );
-    }
-
-    await this.refreshThread(options.threadId);
-    this.notifySubscribers();
-    this.ping(options.threadId);
-  };
-}
-
-const serverReactionToReactionData = (r: ServerReaction) => {
-  return {
-    emoji: r.emoji,
-    createdAt: new Date(r.created_at),
-    userIds: r.users?.map((user) =>
-      encodeURIComponent(user.full_name || ''),
-    ) || [''],
-  };
-};
-
-const serverCommentToClientComment = (c: ServerComment): ClientCommentData => ({
-  type: 'comment',
-  id: c.id,
-  userId: encodeURIComponent(c.user?.full_name || ''),
-  body: c.body,
-  createdAt: new Date(c.created_at),
-  updatedAt: new Date(c.updated_at),
-  reactions: (c.reactions ?? []).map(serverReactionToReactionData),
-  metadata: { abilities: c.abilities },
-});
-
-const serverThreadToClientThread = (t: ServerThread): ClientThreadData => ({
-  type: 'thread',
-  id: t.id,
-  createdAt: new Date(t.created_at),
-  updatedAt: new Date(t.updated_at),
-  comments: (t.comments ?? []).map(serverCommentToClientComment),
-  resolved: t.resolved,
-  resolvedUpdatedAt: t.resolved_updated_at
-    ? new Date(t.resolved_updated_at)
-    : undefined,
-  resolvedBy: t.resolved_by || undefined,
-  metadata: { abilities: t.abilities, metadata: t.metadata },
-});

src/frontend/apps/impress/src/features/docs/doc-editor/components/comments/DocsThreadStoreAuth.tsx

@@ -1,94 +0,0 @@
-import { ThreadStoreAuth } from '@blocknote/core/comments';
-
-import { ClientCommentData, ClientThreadData } from './types';
-
-export class DocsThreadStoreAuth extends ThreadStoreAuth {
-  constructor(
-    private readonly userId: string,
-    public canSee: boolean,
-  ) {
-    super();
-  }
-
-  canCreateThread(): boolean {
-    return true;
-  }
-
-  canAddComment(_thread: ClientThreadData): boolean {
-    return true;
-  }
-
-  canUpdateComment(comment: ClientCommentData): boolean {
-    if (
-      comment.metadata.abilities.partial_update &&
-      comment.userId === this.userId
-    ) {
-      return true;
-    }
-
-    return false;
-  }
-
-  canDeleteComment(comment: ClientCommentData): boolean {
-    if (comment.metadata.abilities.destroy) {
-      return true;
-    }
-
-    return false;
-  }
-
-  canDeleteThread(thread: ClientThreadData): boolean {
-    if (thread.metadata.abilities.destroy) {
-      return true;
-    }
-
-    return false;
-  }
-
-  canResolveThread(thread: ClientThreadData): boolean {
-    if (thread.metadata.abilities.resolve) {
-      return true;
-    }
-
-    return false;
-  }
-
-  /**
-   * Not implemented backend side
-   * @param _thread
-   * @returns
-   */
-  canUnresolveThread(_thread: ClientThreadData): boolean {
-    return false;
-  }
-
-  canAddReaction(comment: ClientCommentData, emoji?: string): boolean {
-    if (!comment.metadata.abilities.reactions) {
-      return false;
-    }
-
-    if (!emoji) {
-      return true;
-    }
-
-    return !comment.reactions.some(
-      (reaction) =>
-        reaction.emoji === emoji && reaction.userIds.includes(this.userId),
-    );
-  }
-
-  canDeleteReaction(comment: ClientCommentData, emoji?: string): boolean {
-    if (!comment.metadata.abilities.reactions) {
-      return false;
-    }
-
-    if (!emoji) {
-      return true;
-    }
-
-    return comment.reactions.some(
-      (reaction) =>
-        reaction.emoji === emoji && reaction.userIds.includes(this.userId),
-    );
-  }
-}

src/frontend/apps/impress/src/features/docs/doc-editor/components/comments/index.ts

@@ -1,3 +0,0 @@
-export * from './CommentToolbarButton';
-export * from './styles';
-export * from './useComments';

src/frontend/apps/impress/src/features/docs/doc-editor/components/comments/styles.tsx

@@ -1,214 +0,0 @@
-import { css } from 'styled-components';
-
-export const cssComments = (
-  canSeeComment: boolean,
-  currentUserAvatarUrl?: string,
-) => css`
-  & .--docs--main-editor,
-  & .--docs--main-editor .ProseMirror {
-    // Comments marks in the editor
-    .bn-editor {
-      .bn-thread-mark:not([data-orphan='true']),
-      .bn-thread-mark-selected:not([data-orphan='true']) {
-        background: ${canSeeComment ? '#EDB40066' : 'transparent'};
-        color: var(--c--theme--colors--greyscale-700);
-      }
-    }
-
-    em-emoji-picker {
-      box-shadow: 0px 6px 18px 0px #00001229;
-      min-height: 420px;
-    }
-
-    // Thread modal
-    .bn-thread {
-      width: 400px;
-      padding: 8px;
-      box-shadow: 0px 6px 18px 0px #00001229;
-      margin-left: 20px;
-      gap: 0;
-      overflow: auto;
-      max-height: 500px;
-
-      .bn-default-styles {
-        font-family: var(--c--theme--font--families--base);
-      }
-
-      .bn-block {
-        font-size: 14px;
-      }
-
-      .bn-inline-content:has(> .ProseMirror-trailingBreak:only-child):before {
-        font-style: normal;
-        font-size: 14px;
-      }
-
-      // Remove tooltip
-      *[role='tooltip'] {
-        display: none;
-      }
-
-      .bn-thread-comment {
-        padding: 8px;
-
-        & .bn-editor {
-          padding-left: 32px;
-          .bn-inline-content {
-            color: var(--c--theme--colors--greyscale-700);
-          }
-        }
-
-        // Emoji
-        & .bn-badge-group {
-          padding-left: 32px;
-          .bn-badge label {
-            padding: 0 4px;
-            background: none;
-            border: 1px solid var(--c--theme--colors--greyscale-300);
-            border-radius: 4px;
-            height: 24px;
-          }
-        }
-
-        // Top bar (Name / Date / Actions) when actions displayed
-        &:has(.bn-comment-actions) {
-          & > .mantine-Group-root {
-            max-width: 70%;
-            right: 0.3rem !important;
-            top: 0.3rem !important;
-          }
-
-          .bn-menu-dropdown {
-            box-shadow: 0px 0px 6px 0px #0000911a;
-          }
-        }
-
-        // Top bar (Name / Date / Actions)
-        & > .mantine-Group-root {
-          flex-wrap: nowrap;
-          max-width: 100%;
-          gap: 0.5rem;
-
-          // Date
-          span.mantine-focus-auto {
-            display: inline-block;
-          }
-
-          .bn-comment-actions {
-            background: transparent;
-            border: none;
-
-            .mantine-Button-root {
-              background-color: transparent;
-
-              &:hover {
-                background-color: var(--c--theme--colors--greyscale-100);
-              }
-            }
-
-            button[role='menuitem'] svg {
-              color: var(--c--theme--colors--greyscale-600);
-            }
-          }
-
-          & svg {
-            color: var(--c--theme--colors--info-600);
-          }
-        }
-
-        // Actions button edit comment
-        .bn-container + .bn-comment-actions-wrapper {
-          .bn-comment-actions {
-            flex-direction: row-reverse;
-            background: none;
-            border: none;
-            gap: 0.4rem !important;
-
-            & > button {
-              height: 24px;
-              padding-inline: 4px;
-
-              &[data-test='save'] {
-                border: 1px solid var(--c--theme--colors--info-600);
-                background: var(--c--theme--colors--info-600);
-                color: white;
-              }
-
-              &[data-test='cancel'] {
-                background: white;
-                border: 1px solid var(--c--theme--colors--greyscale-300);
-                color: var(--c--theme--colors--info-600);
-              }
-            }
-          }
-        }
-      }
-
-      // Input to add a new comment
-      .bn-thread-composer,
-      &:has(> .bn-comment-editor + .bn-comment-actions-wrapper) {
-        padding: 0.5rem 8px;
-        flex-direction: row;
-        gap: 10px;
-
-        .bn-container.bn-comment-editor {
-          min-width: 0;
-        }
-
-        &::before {
-          content: '';
-          width: 26px;
-          height: 26px;
-          flex: 0 0 26px;
-          background-image: ${currentUserAvatarUrl
-            ? `url("${currentUserAvatarUrl}")`
-            : 'none'};
-          background-position: center;
-          background-repeat: no-repeat;
-          background-size: cover;
-        }
-      }
-
-      // Actions button send comment
-      .bn-thread-composer .bn-comment-actions-wrapper,
-      &:not(.selected) .bn-comment-actions-wrapper {
-        flex-basis: fit-content;
-
-        .bn-action-toolbar.bn-comment-actions {
-          border: none;
-
-          button {
-            font-size: 0;
-            background: var(--c--theme--colors--info-600);
-            width: 24px;
-            height: 24px;
-            padding: 0;
-
-            &:disabled {
-              background: var(--c--theme--colors--greyscale-300);
-            }
-
-            & .mantine-Button-label::before {
-              content: '🡡';
-              font-size: 13px;
-              color: var(--c--theme--colors--greyscale-100);
-            }
-          }
-        }
-      }
-
-      // Input first comment
-      &:not(.selected) {
-        gap: 0.5rem;
-
-        .bn-container.bn-comment-editor {
-          min-width: 0;
-
-          .ProseMirror.bn-editor {
-            cursor: text;
-          }
-        }
-      }
-    }
-  }
-`;

src/frontend/apps/impress/src/features/docs/doc-editor/components/comments/types.ts

@@ -1,55 +0,0 @@
-import { CommentData, ThreadData } from '@blocknote/core/comments';
-
-import { UserLight } from '@/features/auth';
-
-export interface CommentAbilities {
-  destroy: boolean;
-  update: boolean;
-  partial_update: boolean;
-  retrieve: boolean;
-  reactions: boolean;
-}
-export interface ThreadAbilities {
-  destroy: boolean;
-  update: boolean;
-  partial_update: boolean;
-  retrieve: boolean;
-  resolve: boolean;
-}
-
-export interface ServerReaction {
-  emoji: string;
-  created_at: string;
-  users: UserLight[] | null;
-}
-
-export interface ServerComment {
-  id: string;
-  user: UserLight | null;
-  body: unknown;
-  created_at: string;
-  updated_at: string;
-  reactions: ServerReaction[];
-  abilities: CommentAbilities;
-}
-
-export interface ServerThread {
-  id: string;
-  created_at: string;
-  updated_at: string;
-  user: UserLight | null;
-  resolved: boolean;
-  resolved_updated_at: string | null;
-  resolved_by: string | null;
-  metadata: unknown;
-  comments: ServerComment[];
-  abilities: ThreadAbilities;
-}
-
-export type ClientCommentData = Omit<CommentData, 'metadata'> & {
-  metadata: { abilities: CommentAbilities };
-};
-
-export type ClientThreadData = Omit<ThreadData, 'metadata'> & {
-  metadata: { abilities: ThreadAbilities; metadata: unknown };
-};

src/frontend/apps/impress/src/features/docs/doc-editor/components/comments/useComments.ts

@@ -1,33 +0,0 @@
-import { useEffect, useMemo } from 'react';
-
-import { User } from '@/features/auth';
-import { Doc, useProviderStore } from '@/features/docs/doc-management';
-
-import { DocsThreadStore } from './DocsThreadStore';
-import { DocsThreadStoreAuth } from './DocsThreadStoreAuth';
-
-export function useComments(
-  docId: Doc['id'],
-  canComment: boolean,
-  user: User | null | undefined,
-) {
-  const { provider } = useProviderStore();
-  const threadStore = useMemo(() => {
-    return new DocsThreadStore(
-      docId,
-      provider?.awareness ?? undefined,
-      new DocsThreadStoreAuth(
-        encodeURIComponent(user?.full_name || ''),
-        canComment,
-      ),
-    );
-  }, [docId, canComment, provider?.awareness, user?.full_name]);
-
-  useEffect(() => {
-    return () => {
-      threadStore?.destroy();
-    };
-  }, [threadStore]);
-
-  return threadStore;
-}

src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/CalloutBlock.tsx

@@ -173,4 +173,5 @@ export const getCalloutFormattingToolbarItems = (
   name: t('Callout'),
   type: 'callout',
   icon: () => <Icon iconName="lightbulb" $size="16px" />,
+  isSelected: (block) => block.type === 'callout',
 });

src/frontend/apps/impress/src/features/docs/doc-editor/styles.tsx

@@ -7,155 +7,153 @@ export const cssEditor = css`
     height: 100%;
   }
 
+  & .ProseMirror {
+    /**
+     * WCAG Accessibility contrast fixes for BlockNote editor
+     */
+    .bn-block-content[data-is-empty-and-focused][data-content-type='paragraph']
+      .bn-inline-content:has(> .ProseMirror-trailingBreak:only-child)::before {
+      color: #767676 !important;
+      font-weight: 400;
+    }
+
+    /**
+     * Ensure long placeholder text is truncated with ellipsis
+     */
+    .bn-block-content[data-is-empty-and-focused][data-content-type='paragraph']
+      .bn-inline-content:has(> .ProseMirror-trailingBreak:only-child)::before {
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      overflow: hidden;
+      width: inherit;
+      height: inherit;
+    }
+    .bn-block-content[data-is-empty-and-focused][data-content-type='paragraph']
+      .bn-inline-content:has(> .ProseMirror-trailingBreak:only-child) {
+      position: relative;
+    }
+
+    /**
+     * Ensure images with unsafe URLs are not interactive
+     */
+    img.bn-visual-media[src*='-unsafe'] {
+      pointer-events: none;
+    }
+
+    /**
+     * Collaboration cursor styles
+     */
+    .collaboration-cursor-custom__base {
+      position: relative;
+    }
+    .collaboration-cursor-custom__caret {
+      position: absolute;
+      height: 100%;
+      width: 2px;
+      bottom: 4%;
+      left: -1px;
+    }
+    .collaboration-cursor-custom__label {
+      color: #0d0d0d;
+      font-size: 12px;
+      font-weight: 600;
+      -webkit-user-select: none;
+      -moz-user-select: none;
+      user-select: none;
+      position: absolute;
+      top: -17px;
+      left: 0px;
+      padding: 0px 6px;
+      border-radius: 0px;
+      white-space: nowrap;
+      transition: clip-path 0.3s ease-in-out;
+      border-radius: 4px 4px 4px 0;
+      box-shadow: inset -2px 2px 6px #ffffff00;
+      clip-path: polygon(0 85%, 4% 85%, 4% 100%, 0% 100%);
+    }
+    .collaboration-cursor-custom__base[data-active]
+      .collaboration-cursor-custom__label {
+      pointer-events: none;
+      box-shadow: inset -2px 2px 6px #ffffff88;
+      clip-path: polygon(0 0, 100% 0%, 100% 100%, 0% 100%);
+    }
+
+    /**
+     * Side menu
+     */
+    .bn-side-menu[data-block-type='heading'][data-level='1'] {
+      height: 50px;
+    }
+    .bn-side-menu[data-block-type='heading'][data-level='2'] {
+      height: 43px;
+    }
+    .bn-side-menu[data-block-type='heading'][data-level='3'] {
+      height: 35px;
+    }
+    .bn-side-menu[data-block-type='divider'] {
+      height: 38px;
+    }
+    .bn-side-menu .mantine-UnstyledButton-root svg {
+      color: #767676 !important;
+    }
+
+    /**
+     * Callout, Paragraph and Heading blocks
+     */
+    .bn-block {
+      border-radius: var(--c--theme--spacings--3xs);
+    }
+    .bn-block-outer {
+      border-radius: var(--c--theme--spacings--3xs);
+    }
+    .bn-block > .bn-block-content[data-background-color] {
+      padding: var(--c--theme--spacings--3xs) var(--c--theme--spacings--3xs);
+      border-radius: var(--c--theme--spacings--3xs);
+    }
+    .bn-block-content[data-content-type='checkListItem'][data-checked='true']
+      .bn-inline-content {
+      text-decoration: none;
+    }
+    h1 {
+      font-size: 1.875rem;
+    }
+    h2 {
+      font-size: 1.5rem;
+    }
+    h3 {
+      font-size: 1.25rem;
+    }
+    a {
+      color: var(--c--theme--colors--greyscale-600);
+      cursor: pointer;
+    }
+    .bn-block-group
+      .bn-block-group
+      .bn-block-outer:not([data-prev-depth-changed]):before {
+      border-left: none;
+    }
+  }
+
   & .bn-editor {
     color: var(--c--theme--colors--greyscale-700);
-  }
 
-  /**
-  * WCAG Accessibility contrast fixes for BlockNote editor
-  */
-  .bn-block-content[data-is-empty-and-focused][data-content-type='paragraph']
-    .bn-inline-content:has(> .ProseMirror-trailingBreak:only-child)::before {
-    color: #767676 !important;
-    font-weight: 400;
-  }
+    /**
+    * Quotes
+    */
+    blockquote {
+      border-left: 4px solid var(--c--theme--colors--greyscale-300);
+      font-style: italic;
+    }
 
-  /**
-  * Ensure long placeholder text is truncated with ellipsis
-  */
-  .bn-block-content[data-is-empty-and-focused][data-content-type='paragraph']
-    .bn-inline-content:has(> .ProseMirror-trailingBreak:only-child)::before {
-    text-overflow: ellipsis;
-    white-space: nowrap;
-    overflow: hidden;
-    width: inherit;
-    height: inherit;
-  }
-  .bn-block-content[data-is-empty-and-focused][data-content-type='paragraph']
-    .bn-inline-content:has(> .ProseMirror-trailingBreak:only-child) {
-    position: relative;
-  }
-
-  /**
-  * Ensure images with unsafe URLs are not interactive
-  */
-  img.bn-visual-media[src*='-unsafe'] {
-    pointer-events: none;
-  }
-
-  /**
-  * Collaboration cursor styles
-  */
-  .collaboration-cursor-custom__base {
-    position: relative;
-  }
-  .collaboration-cursor-custom__caret {
-    position: absolute;
-    height: 100%;
-    width: 2px;
-    bottom: 4%;
-    left: -1px;
-  }
-  .collaboration-cursor-custom__label {
-    color: #0d0d0d;
-    font-size: 12px;
-    font-weight: 600;
-    -webkit-user-select: none;
-    -moz-user-select: none;
-    user-select: none;
-    position: absolute;
-    top: -17px;
-    left: 0px;
-    padding: 0px 6px;
-    border-radius: 0px;
-    white-space: nowrap;
-    transition: clip-path 0.3s ease-in-out;
-    border-radius: 4px 4px 4px 0;
-    box-shadow: inset -2px 2px 6px #ffffff00;
-    clip-path: polygon(0 85%, 4% 85%, 4% 100%, 0% 100%);
-  }
-  .collaboration-cursor-custom__base[data-active]
-    .collaboration-cursor-custom__label {
-    pointer-events: none;
-    box-shadow: inset -2px 2px 6px #ffffff88;
-    clip-path: polygon(0 0, 100% 0%, 100% 100%, 0% 100%);
-  }
-
-  /**
-  * Side menu
-  */
-  .bn-side-menu[data-block-type='heading'][data-level='1'] {
-    height: 54px;
-  }
-  .bn-side-menu[data-block-type='heading'][data-level='2'] {
-    height: 43px;
-  }
-  .bn-side-menu[data-block-type='heading'][data-level='3'] {
-    height: 35px;
-  }
-  .bn-side-menu[data-block-type='divider'] {
-    height: 38px;
-  }
-  .bn-side-menu .mantine-UnstyledButton-root svg {
-    color: #767676 !important;
-  }
-
-  /**
-  * Callout, Paragraph and Heading blocks
-  */
-  .bn-block {
-    border-radius: var(--c--theme--spacings--3xs);
-  }
-  .bn-block-outer {
-    border-radius: var(--c--theme--spacings--3xs);
-  }
-  .bn-block > .bn-block-content[data-background-color] {
-    padding: var(--c--theme--spacings--3xs) var(--c--theme--spacings--3xs);
-    border-radius: var(--c--theme--spacings--3xs);
-  }
-  .bn-block-content[data-content-type='checkListItem'][data-checked='true']
-    .bn-inline-content {
-    text-decoration: none;
-  }
-  h1 {
-    font-size: 1.875rem;
-  }
-  h2 {
-    font-size: 1.5rem;
-  }
-  h3 {
-    font-size: 1.25rem;
-  }
-  a {
-    color: var(--c--theme--colors--greyscale-600);
-    cursor: pointer;
-  }
-  .bn-block-group
-    .bn-block-group
-    .bn-block-outer:not([data-prev-depth-changed]):before {
-    border-left: none;
-  }
-
-  .bn-toolbar {
-    max-width: 95vw;
-  }
-
-  /**
-  * Quotes
-  */
-  blockquote {
-    border-left: 4px solid var(--c--theme--colors--greyscale-300);
-    font-style: italic;
-  }
-
-  /**
-  * Divider
-  */
-  [data-content-type='divider'] hr {
-    background: #d3d2cf;
-    margin: 1rem 0;
-    width: 100%;
-    border: 1px solid #d3d2cf;
+    /**
+     * Divider
+    */
+    [data-content-type='divider'] hr {
+      background: #d3d2cf;
+      margin: 1rem 0;
+      width: 100%;
+      border: 1px solid #d3d2cf;
+    }
   }
 
   & .bn-block-outer:not(:first-child) {

src/frontend/apps/impress/src/features/docs/doc-export/blocks-mapping/calloutODT.tsx

@@ -1,32 +0,0 @@
-import React from 'react';
-
-import { DocsExporterODT } from '../types';
-import { odtRegisterParagraphStyleForBlock } from '../utils';
-
-export const blockMappingCalloutODT: DocsExporterODT['mappings']['blockMapping']['callout'] =
-  (block, exporter) => {
-    // Map callout to paragraph with emoji prefix
-    const emoji = block.props.emoji || '💡';
-
-    // Transform inline content (text, bold, links, etc.)
-    const inlineContent = exporter.transformInlineContent(block.content);
-
-    // Resolve background and alignment → create a dedicated paragraph style
-    const styleName = odtRegisterParagraphStyleForBlock(
-      exporter,
-      {
-        backgroundColor: block.props.backgroundColor,
-        textAlignment: block.props.textAlignment,
-      },
-      { paddingCm: 0.42 },
-    );
-
-    return React.createElement(
-      'text:p',
-      {
-        'text:style-name': styleName,
-      },
-      `${emoji} `,
-      ...inlineContent,
-    );
-  };

src/frontend/apps/impress/src/features/docs/doc-export/blocks-mapping/imageDocx.tsx

@@ -31,10 +31,15 @@ export const blockMappingImageDocx: DocsExporterDocx['mappings']['blockMapping']
       const svgText = await blob.text();
       const FALLBACK_SIZE = 536;
       previewWidth = previewWidth || blob.size || FALLBACK_SIZE;
-
-      const result = await convertSvgToPng(svgText, previewWidth);
-      pngConverted = result.png;
-      dimensions = { width: result.width, height: result.height };
+      pngConverted = await convertSvgToPng(svgText, previewWidth);
+      const img = new Image();
+      img.src = pngConverted;
+      await new Promise((resolve) => {
+        img.onload = () => {
+          dimensions = { width: img.width, height: img.height };
+          resolve(null);
+        };
+      });
     } else {
       dimensions = await getImageDimensions(blob);
     }

src/frontend/apps/impress/src/features/docs/doc-export/blocks-mapping/imageODT.tsx

@@ -1,135 +0,0 @@
-import React from 'react';
-
-import { DocsExporterODT } from '../types';
-import { convertSvgToPng, odtRegisterParagraphStyleForBlock } from '../utils';
-
-const MAX_WIDTH = 600;
-
-export const blockMappingImageODT: DocsExporterODT['mappings']['blockMapping']['image'] =
-  async (block, exporter) => {
-    try {
-      const blob = await exporter.resolveFile(block.props.url);
-
-      if (!blob || !blob.type) {
-        console.warn(`Failed to resolve image: ${block.props.url}`);
-        return null;
-      }
-
-      let pngConverted: string | undefined;
-      let dimensions: { width: number; height: number } | undefined;
-      let previewWidth = block.props.previewWidth || undefined;
-
-      if (!blob.type.includes('image')) {
-        console.warn(`Not an image type: ${blob.type}`);
-        return null;
-      }
-
-      if (blob.type.includes('svg')) {
-        const svgText = await blob.text();
-        const FALLBACK_SIZE = 536;
-        previewWidth = previewWidth || blob.size || FALLBACK_SIZE;
-
-        const result = await convertSvgToPng(svgText, previewWidth);
-        pngConverted = result.png;
-        dimensions = { width: result.width, height: result.height };
-      } else {
-        dimensions = await getImageDimensions(blob);
-      }
-
-      if (!dimensions) {
-        return null;
-      }
-
-      const { width, height } = dimensions;
-
-      if (previewWidth && previewWidth > MAX_WIDTH) {
-        previewWidth = MAX_WIDTH;
-      }
-
-      // Convert image to base64 for ODT embedding
-      const arrayBuffer = pngConverted
-        ? await (await fetch(pngConverted)).arrayBuffer()
-        : await blob.arrayBuffer();
-      const base64 = btoa(
-        Array.from(new Uint8Array(arrayBuffer))
-          .map((byte) => String.fromCharCode(byte))
-          .join(''),
-      );
-
-      const finalWidth = previewWidth || width;
-      const finalHeight = ((previewWidth || width) / width) * height;
-
-      const baseParagraphProps = {
-        backgroundColor: block.props.backgroundColor,
-        textAlignment: block.props.textAlignment,
-      };
-
-      const paragraphStyleName = odtRegisterParagraphStyleForBlock(
-        exporter,
-        baseParagraphProps,
-        { paddingCm: 0 },
-      );
-
-      // Convert pixels to cm (ODT uses cm for dimensions)
-      const widthCm = finalWidth / 37.795275591;
-      const heightCm = finalHeight / 37.795275591;
-
-      // Create ODT image structure using React.createElement
-      const frame = React.createElement(
-        'text:p',
-        {
-          'text:style-name': paragraphStyleName,
-        },
-        React.createElement(
-          'draw:frame',
-          {
-            'draw:name': `Image${Date.now()}`,
-            'text:anchor-type': 'as-char',
-            'svg:width': `${widthCm}cm`,
-            'svg:height': `${heightCm}cm`,
-          },
-          React.createElement(
-            'draw:image',
-            {
-              xlinkType: 'simple',
-              xlinkShow: 'embed',
-              xlinkActuate: 'onLoad',
-            },
-            React.createElement('office:binary-data', {}, base64),
-          ),
-        ),
-      );
-
-      // Add caption if present
-      if (block.props.caption) {
-        const captionStyleName = odtRegisterParagraphStyleForBlock(
-          exporter,
-          baseParagraphProps,
-          { paddingCm: 0, parentStyleName: 'Caption' },
-        );
-
-        return [
-          frame,
-          React.createElement(
-            'text:p',
-            { 'text:style-name': captionStyleName },
-            block.props.caption,
-          ),
-        ];
-      }
-
-      return frame;
-    } catch (error) {
-      console.error(`Error processing image for ODT export:`, error);
-      return null;
-    }
-  };
-
-async function getImageDimensions(blob: Blob) {
-  if (typeof window !== 'undefined') {
-    const bmp = await createImageBitmap(blob);
-    const { width, height } = bmp;
-    bmp.close();
-    return { width, height };
-  }
-}

src/frontend/apps/impress/src/features/docs/doc-export/blocks-mapping/imagePDF.tsx

@@ -6,14 +6,12 @@ import { convertSvgToPng } from '../utils';
 
 const PIXELS_PER_POINT = 0.75;
 const FONT_SIZE = 16;
-const MAX_WIDTH = 600;
 
 export const blockMappingImagePDF: DocsExporterPDF['mappings']['blockMapping']['image'] =
   async (block, exporter) => {
     const blob = await exporter.resolveFile(block.props.url);
     let pngConverted: string | undefined;
-    let dimensions: { width: number; height: number } | undefined;
-    let previewWidth = block.props.previewWidth || undefined;
+    let width = block.props.previewWidth || undefined;
 
     if (!blob.type.includes('image')) {
       return <View wrap={false} />;
@@ -22,33 +20,16 @@ export const blockMappingImagePDF: DocsExporterPDF['mappings']['blockMapping']['
     if (blob.type.includes('svg')) {
       const svgText = await blob.text();
       const FALLBACK_SIZE = 536;
-      previewWidth = previewWidth || FALLBACK_SIZE;
-
-      const result = await convertSvgToPng(svgText, previewWidth);
-      pngConverted = result.png;
-      dimensions = { width: result.width, height: result.height };
-    } else {
-      dimensions = await getImageDimensions(blob);
+      width = width || blob.size || FALLBACK_SIZE;
+      pngConverted = await convertSvgToPng(svgText, width);
     }
 
-    if (!dimensions) {
-      return <View wrap={false} />;
-    }
-
-    const { width, height } = dimensions;
-
-    // Ensure the final width never exceeds MAX_WIDTH to prevent images
-    // from overflowing the page width in the exported document
-    const finalWidth = Math.min(previewWidth || width, MAX_WIDTH);
-    const finalHeight = (finalWidth / width) * height;
-
     return (
       <View wrap={false}>
         <Image
           src={pngConverted || blob}
           style={{
-            width: finalWidth * PIXELS_PER_POINT,
-            height: finalHeight * PIXELS_PER_POINT,
+            width: width ? width * PIXELS_PER_POINT : undefined,
             maxWidth: '100%',
           }}
         />
@@ -57,21 +38,6 @@ export const blockMappingImagePDF: DocsExporterPDF['mappings']['blockMapping']['
     );
   };
 
-async function getImageDimensions(blob: Blob) {
-  if (typeof window !== 'undefined') {
-    const url = URL.createObjectURL(blob);
-    const img = document.createElement('img');
-    img.src = url;
-
-    return new Promise<{ width: number; height: number }>((resolve) => {
-      img.onload = () => {
-        URL.revokeObjectURL(url);
-        resolve({ width: img.naturalWidth, height: img.naturalHeight });
-      };
-    });
-  }
-}
-
 function caption(
   props: Partial<DefaultProps & { caption: string; previewWidth: number }>,
 ) {

src/frontend/apps/impress/src/features/docs/doc-export/blocks-mapping/index.ts

@@ -1,14 +1,11 @@
 export * from './calloutDocx';
-export * from './calloutODT';
 export * from './calloutPDF';
 export * from './headingPDF';
 export * from './imageDocx';
-export * from './imageODT';
 export * from './imagePDF';
 export * from './paragraphPDF';
 export * from './quoteDocx';
 export * from './quotePDF';
 export * from './tablePDF';
-export * from './uploadLoaderDocx';
-export * from './uploadLoaderODT';
 export * from './uploadLoaderPDF';
+export * from './uploadLoaderDocx';