wip fix dockerfile

.github/workflows/deploy.yml

@@ -0,0 +1,52 @@
+name: Deploy
+
+on:
+  push:
+    tags:
+      - 'preprod'
+      - 'production'
+
+
+jobs:
+  notify-argocd:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "impress,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/impress/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Call argocd github webhook
+        run: |
+          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_PRODUCTION_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_PRODUCTION_WEBHOOK_URL
+
+  start-test-on-preprod:
+    needs:
+      - notify-argocd
+    runs-on: ubuntu-latest
+    if: startsWith(github.event.ref, 'refs/tags/preprod')
+    steps:
+      -
+        name: Debug
+        run: |
+          echo "Start test when preprod is ready"

.github/workflows/docker-hub.yml

@@ -8,6 +8,9 @@ on:
       - 'main'
     tags:
       - 'v*'
+  pull_request:
+    branches:
+      - 'main'
 
 env:
   DOCKER_USER: 1001:127

.github/workflows/helmfile-linter.yaml

@@ -0,0 +1,22 @@
+name: Helmfile lint
+run-name: Helmfile lint
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  helmfile-lint:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/helmfile/helmfile:latest
+    steps:
+      -
+        uses: numerique-gouv/action-helmfile-lint@main
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          helmfile-src: "src/helm"
+          repositories: "impress,secrets"

CHANGELOG.md

@@ -9,52 +9,14 @@ and this project adheres to
 
 ## [Unreleased]
 
-## [1.7.0] - 2024-10-24
-
-## Added
-
-- 📝Contributing.md #352
-- 🌐(frontend) add localization to editor #368
-- ✨Public and restricted doc editable #357
-- ✨(frontend) Add full name if available #380
-
 ## Changed
 
-- ♻️(frontend) avoid documents indexing in search engine #372
-
-## Fixed
-
-- 🐛(backend) require right to manage document accesses to see invitations #369
-- 🐛(i18n) same frontend and backend language using shared cookies #365
-- 🐛(frontend) add default toolbar buttons #355
-- 🐛(frontend) throttle error correctly display #378
-
-## Removed
-
-- 🔥(helm) remove infra related codes #366
-
-
-## [1.6.0] - 2024-10-17
-
-## Added
-
-- ✨AI to doc editor #250
-- ✨(backend) allow uploading more types of attachments #309
-- ✨(frontend) add buttons to copy document to clipboard as HTML/Markdown #318
-
-## Changed
-
-- ♻️(frontend) more multi theme friendly #325
+- ♻️(frontend) More multi theme friendly #325
 - ♻️ Bootstrap frontend #257
-- ♻️ Add username in email #314
 
 ## Fixed
 
-- 🛂(backend) do not duplicate user when disabled
-- 🐛(frontend) invalidate queries after removing user #336
-- 🐛(backend) Fix dysfunctional permissions on document create #329
-- 🐛(backend) fix nginx docker container #340
-- 🐛(frontend) fix copy paste firefox #353
+🐛(frontend) invalidate queries after removing user #336
 
 
 ## [1.5.1] - 2024-10-10
@@ -63,6 +25,7 @@ and this project adheres to
 
 - 🐛(db) fix users duplicate #316
 
+
 ## [1.5.0] - 2024-10-09
 
 ## Added
@@ -235,9 +198,7 @@ and this project adheres to
 - 🚀 Impress, project to manage your documents easily and collaboratively.
 
 
-[unreleased]: https://github.com/numerique-gouv/impress/compare/v1.7.0...main
-[v1.7.0]: https://github.com/numerique-gouv/impress/releases/v1.7.0
-[v1.6.0]: https://github.com/numerique-gouv/impress/releases/v1.6.0
+[unreleased]: https://github.com/numerique-gouv/impress/compare/v1.5.1...main
 [1.5.1]: https://github.com/numerique-gouv/impress/releases/v1.5.1
 [1.5.0]: https://github.com/numerique-gouv/impress/releases/v1.5.0
 [1.4.0]: https://github.com/numerique-gouv/impress/releases/v1.4.0

CONTRIBUTING.md

@@ -1,79 +0,0 @@
-# Contributing to the Project
-
-Thank you for taking the time to contribute! Please follow these guidelines to ensure a smooth and productive workflow. 🚀🚀🚀
-
-To get started with the project, please refer to the [README.md](https://github.com/numerique-gouv/impress/blob/main/README.md) for detailed instructions.
-
-## Creating an Issue
-
-When creating an issue, please provide the following details:
-
-1.  **Title**: A concise and descriptive title for the issue.
-2.  **Description**: A detailed explanation of the issue, including relevant context or screenshots if applicable.
-3.  **Steps to Reproduce**: If the issue is a bug, include the steps needed to reproduce the problem.
-4.  **Expected vs. Actual Behavior**: Describe what you expected to happen and what actually happened.
-5.  **Labels**: Add appropriate labels to categorize the issue (e.g., bug, feature request, documentation).
-
-## Selecting an issue
-
-We use a [GitHub Project](https://github.com/orgs/numerique-gouv/projects/13) in order to prioritize our workload. 
-
-Please check in priority the issues that are in the **todo** column and have a higher priority (P0 -> P2). 
-
-## Commit Message Format
-
-All commit messages must adhere to the following format:
-
-`<gitmoji>(type) title description`
-
-*   <**gitmoji**>: Use a gitmoji to represent the purpose of the commit. For example, ✨ for adding a new feature or 🔥 for removing something, see the list here: <https://gitmoji.dev/>.
-*   **(type)**: Describe the type of change. Common types include `backend`, `frontend`, `CI`, `docker` etc...
-*   **title**: A short, descriptive title for the change, starting with a lowercase character.
-*   **description**: Include additional details about what was changed and why.
-
-### Example Commit Message
-
-```
-✨(frontend) add user authentication logic 
-
-Implemented login and signup features, and integrated OAuth2 for social login.
-```
-
-## Changelog Update
-
-Please add a line to the changelog describing your development. The changelog entry should include a brief summary of the changes, this helps in tracking changes effectively and keeping everyone informed. We usually include the title of the pull request, followed by the pull request ID to finish the log entry. The changelog line should be less than 80 characters in total.
-
-### Example Changelog Message
-```
-## [Unreleased]
-
-## Added
-
-- ✨(frontend) add AI to the project #321
-```
-
-## Pull Requests
-
-It is nice to add information about the purpose of the pull request to help reviewers understand the context and intent of the changes. If you can, add some pictures or a small video to show the changes.
-
-### Don't forget to: 
-- check your commits
-- check the linting: `make lint && make frontend-lint`
-- check the tests: `make test`
-- add a changelog entry
-
-Once all the required tests have passed, you can request a review from the project maintainers.
-
-## Code Style
-
-Please maintain consistency in code style. Run any linting tools available to make sure the code is clean and follows the project's conventions.
-
-## Tests
-
-Make sure that all new features or fixes have corresponding tests. Run the test suite before pushing your changes to ensure that nothing is broken.
-
-## Asking for Help
-
-If you need any help while contributing, feel free to open a discussion or ask for guidance in the issue tracker. We are more than happy to assist!
-
-Thank you for your contributions! 👍

Dockerfile

@@ -13,6 +13,9 @@ RUN apk update && \
 # ---- Back-end builder image ----
 FROM base AS back-builder
 
+RUN apk add \
+  cargo
+
 WORKDIR /builder
 
 # Copy required python dependencies
@@ -65,15 +68,14 @@ ENV PYTHONUNBUFFERED=1
 
 # Install required system libs
 RUN apk add \
-  cairo \
-  file \
-  font-noto \
-  font-noto-emoji \
   gettext \
-  gdk-pixbuf \
+  cairo \
   libffi-dev \
-  pandoc \
+  gdk-pixbuf \
   pango \
+  pandoc \
+  font-noto-emoji \
+  font-noto \
   shared-mime-info
 
 # Copy entrypoint

Makefile

@@ -122,7 +122,6 @@ logs: ## display app-dev logs (follow mode)
 
 run: ## start the wsgi (production) and development server
 	@$(COMPOSE) up --force-recreate -d celery-dev
-	@$(COMPOSE) up --force-recreate -d nginx
 	@$(COMPOSE) up --force-recreate -d y-provider
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_DB)
@@ -314,10 +313,6 @@ frontend-install: ## install the frontend locally
 	cd $(PATH_FRONT_IMPRESS) && yarn
 .PHONY: frontend-install
 
-frontend-lint: ## run the frontend linter
-	cd $(PATH_FRONT) && yarn lint
-.PHONY: frontend-lint
-
 run-frontend-development: ## Run the frontend in development mode
 	@$(COMPOSE) stop frontend-dev
 	cd $(PATH_FRONT_IMPRESS) && yarn dev

docker-compose.yml

@@ -63,6 +63,7 @@ services:
         - mailcatcher
         - redis
         - createbuckets
+        - nginx
   
   celery-dev:
     user: ${DOCKER_USER:-1000}
@@ -117,7 +118,6 @@ services:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
     depends_on:
       - keycloak
-      - app-dev
 
   frontend-dev:
     user: "${DOCKER_USER:-1000}"

env.d/development/common.dist

@@ -39,8 +39,3 @@ LOGOUT_REDIRECT_URL=http://localhost:3000
 
 OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8083", "http://localhost:3000"]
 OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
-
-# AI
-AI_BASE_URL=https://openaiendpoint.com
-AI_API_KEY=password
-AI_MODEL=llama

src/backend/core/api/permissions.py

@@ -1,12 +1,9 @@
 """Permission handlers for the impress core app."""
 
 from django.core import exceptions
-from django.db.models import Q
 
 from rest_framework import permissions
 
-from core.models import DocumentAccess, RoleChoices
-
 ACTION_FOR_METHOD_TO_PERMISSION = {
     "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
 }
@@ -62,38 +59,6 @@ class IsOwnedOrPublic(IsAuthenticated):
             return False
 
 
-class CanCreateInvitationPermission(permissions.BasePermission):
-    """
-    Custom permission class to handle permission checks for managing invitations.
-    """
-
-    def has_permission(self, request, view):
-        user = request.user
-
-        # Ensure the user is authenticated
-        if not (bool(request.auth) or request.user.is_authenticated):
-            return False
-
-        # Apply permission checks only for creation (POST requests)
-        if view.action != "create":
-            return True
-
-        # Check if resource_id is passed in the context
-        try:
-            document_id = view.kwargs["resource_id"]
-        except KeyError as exc:
-            raise exceptions.ValidationError(
-                "You must set a document ID in kwargs to manage document invitations."
-            ) from exc
-
-        # Check if the user has access to manage invitations (Owner/Admin roles)
-        return DocumentAccess.objects.filter(
-            Q(user=user) | Q(team__in=user.teams),
-            document=document_id,
-            role__in=[RoleChoices.OWNER, RoleChoices.ADMIN],
-        ).exists()
-
-
 class AccessPermission(permissions.BasePermission):
     """Permission class for access objects."""
 

src/backend/core/api/serializers.py

@@ -6,11 +6,9 @@ from django.conf import settings
 from django.db.models import Q
 from django.utils.translation import gettext_lazy as _
 
-import magic
 from rest_framework import exceptions, serializers
 
-from core import enums, models
-from core.services.ai_services import AI_ACTIONS
+from core import models
 
 
 class UserSerializer(serializers.ModelSerializer):
@@ -71,7 +69,6 @@ class BaseAccessSerializer(serializers.ModelSerializer):
             if not self.Meta.model.objects.filter(  # pylint: disable=no-member
                 Q(user=user) | Q(team__in=user.teams),
                 role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
-                **{self.Meta.resource_field_name: resource_id},  # pylint: disable=no-member
             ).exists():
                 raise exceptions.PermissionDenied(
                     "You are not allowed to manage accesses for this resource."
@@ -221,42 +218,16 @@ class FileUploadSerializer(serializers.Serializer):
                 f"File size exceeds the maximum limit of {max_size:d} MB."
             )
 
-        extension = file.name.rpartition(".")[-1] if "." in file.name else None
-
-        # Read the first few bytes to determine the MIME type accurately
-        mime = magic.Magic(mime=True)
-        magic_mime_type = mime.from_buffer(file.read(1024))
-        file.seek(0)  # Reset file pointer to the beginning after reading
-
-        self.context["is_unsafe"] = (
-            magic_mime_type in settings.DOCUMENT_UNSAFE_MIME_TYPES
-        )
-
-        extension_mime_type, _ = mimetypes.guess_type(file.name)
-
-        # Try guessing a coherent extension from the mimetype
-        if extension_mime_type != magic_mime_type:
-            self.context["is_unsafe"] = True
-
-        guessed_ext = mimetypes.guess_extension(magic_mime_type)
-        # Missing extensions or extensions longer than 5 characters (it's as long as an extension
-        # can be) are replaced by the extension we eventually guessed from mimetype.
-        if (extension is None or len(extension) > 5) and guessed_ext:
-            extension = guessed_ext[1:]
-
-        if extension is None:
-            raise serializers.ValidationError("Could not determine file extension.")
-
-        self.context["expected_extension"] = extension
+        # Validate file type
+        mime_type, _ = mimetypes.guess_type(file.name)
+        if mime_type not in settings.DOCUMENT_IMAGE_ALLOWED_MIME_TYPES:
+            mime_types = ", ".join(settings.DOCUMENT_IMAGE_ALLOWED_MIME_TYPES)
+            raise serializers.ValidationError(
+                f"File type '{mime_type:s}' is not allowed. Allowed types are: {mime_types:s}"
+            )
 
         return file
 
-    def validate(self, attrs):
-        """Override validate to add the computed extension to validated_data."""
-        attrs["expected_extension"] = self.context["expected_extension"]
-        attrs["is_unsafe"] = self.context["is_unsafe"]
-        return attrs
-
 
 class TemplateSerializer(BaseResourceSerializer):
     """Serialize templates."""
@@ -328,36 +299,48 @@ class InvitationSerializer(serializers.ModelSerializer):
         return {}
 
     def validate(self, attrs):
-        """Validate invitation data."""
+        """Validate and restrict invitation to new user based on email."""
+
         request = self.context.get("request")
         user = getattr(request, "user", None)
+        role = attrs.get("role")
 
-        attrs["document_id"] = self.context["resource_id"]
+        try:
+            document_id = self.context["resource_id"]
+        except KeyError as exc:
+            raise exceptions.ValidationError(
+                "You must set a document ID in kwargs to create a new document invitation."
+            ) from exc
 
-        # Only set the issuer if the instance is being created
-        if self.instance is None:
-            attrs["issuer"] = user
+        if not user and user.is_authenticated:
+            raise exceptions.PermissionDenied(
+                "Anonymous users are not allowed to create invitations."
+            )
 
-        return attrs
+        if not models.DocumentAccess.objects.filter(
+            Q(user=user) | Q(team__in=user.teams),
+            document=document_id,
+            role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
+        ).exists():
+            raise exceptions.PermissionDenied(
+                "You are not allowed to manage invitations for this document."
+            )
 
-    def validate_role(self, role):
-        """Custom validation for the role field."""
-        request = self.context.get("request")
-        user = getattr(request, "user", None)
-        document_id = self.context["resource_id"]
-
-        # If the role is OWNER, check if the user has OWNER access
-        if role == models.RoleChoices.OWNER:
-            if not models.DocumentAccess.objects.filter(
+        if (
+            role == models.RoleChoices.OWNER
+            and not models.DocumentAccess.objects.filter(
                 Q(user=user) | Q(team__in=user.teams),
                 document=document_id,
                 role=models.RoleChoices.OWNER,
-            ).exists():
-                raise serializers.ValidationError(
-                    "Only owners of a document can invite other users as owners."
-                )
+            ).exists()
+        ):
+            raise exceptions.PermissionDenied(
+                "Only owners of a document can invite other users as owners."
+            )
 
-        return role
+        attrs["document_id"] = document_id
+        attrs["issuer"] = user
+        return attrs
 
 
 class VersionFilterSerializer(serializers.Serializer):
@@ -367,33 +350,3 @@ class VersionFilterSerializer(serializers.Serializer):
     page_size = serializers.IntegerField(
         required=False, min_value=1, max_value=50, default=20
     )
-
-
-class AITransformSerializer(serializers.Serializer):
-    """Serializer for AI transform requests."""
-
-    action = serializers.ChoiceField(choices=AI_ACTIONS, required=True)
-    text = serializers.CharField(required=True)
-
-    def validate_text(self, value):
-        """Ensure the text field is not empty."""
-
-        if len(value.strip()) == 0:
-            raise serializers.ValidationError("Text field cannot be empty.")
-        return value
-
-
-class AITranslateSerializer(serializers.Serializer):
-    """Serializer for AI translate requests."""
-
-    language = serializers.ChoiceField(
-        choices=tuple(enums.ALL_LANGUAGES.items()), required=True
-    )
-    text = serializers.CharField(required=True)
-
-    def validate_text(self, value):
-        """Ensure the text field is not empty."""
-
-        if len(value.strip()) == 0:
-            raise serializers.ValidationError("Text field cannot be empty.")
-        return value

src/backend/core/api/utils.py

@@ -1,14 +1,8 @@
 """Util to generate S3 authorization headers for object storage access control"""
 
-import time
-from abc import ABC, abstractmethod
-
-from django.conf import settings
-from django.core.cache import cache
 from django.core.files.storage import default_storage
 
 import botocore
-from rest_framework.throttling import BaseThrottle
 
 
 def generate_s3_authorization_headers(key):
@@ -37,93 +31,3 @@ def generate_s3_authorization_headers(key):
     auth.add_auth(request)
 
     return request
-
-
-class AIBaseRateThrottle(BaseThrottle, ABC):
-    """Base throttle class for AI-related rate limiting with backoff."""
-
-    def __init__(self, rates):
-        """Initialize instance attributes with configurable rates."""
-        super().__init__()
-        self.rates = rates
-        self.cache_key = None
-        self.recent_requests_minute = 0
-        self.recent_requests_hour = 0
-        self.recent_requests_day = 0
-
-    @abstractmethod
-    def get_cache_key(self, request, view):
-        """Abstract method to generate cache key for throttling."""
-
-    def allow_request(self, request, view):
-        """Check if the request is allowed based on rate limits."""
-        self.cache_key = self.get_cache_key(request, view)
-        if not self.cache_key:
-            return True  # Allow if no cache key is generated
-
-        now = time.time()
-        history = cache.get(self.cache_key, [])
-        # Keep requests within the last 24 hours
-        history = [req for req in history if req > now - 86400]
-
-        # Calculate recent requests
-        self.recent_requests_minute = len([req for req in history if req > now - 60])
-        self.recent_requests_hour = len([req for req in history if req > now - 3600])
-        self.recent_requests_day = len(history)
-
-        # Check rate limits
-        if self.recent_requests_minute >= self.rates["minute"]:
-            return False
-        if self.recent_requests_hour >= self.rates["hour"]:
-            return False
-        if self.recent_requests_day >= self.rates["day"]:
-            return False
-
-        # Log the request
-        history.append(now)
-        cache.set(self.cache_key, history, timeout=86400)
-        return True
-
-    def wait(self):
-        """Implement a backoff strategy by increasing wait time based on limits hit."""
-        if self.recent_requests_day >= self.rates["day"]:
-            return 86400
-        if self.recent_requests_hour >= self.rates["hour"]:
-            return 3600
-        if self.recent_requests_minute >= self.rates["minute"]:
-            return 60
-        return None
-
-
-class AIDocumentRateThrottle(AIBaseRateThrottle):
-    """Throttle for limiting AI requests per document with backoff."""
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(settings.AI_DOCUMENT_RATE_THROTTLE_RATES)
-
-    def get_cache_key(self, request, view):
-        """Include document ID in the cache key."""
-        document_id = view.kwargs["pk"]
-        return f"document_{document_id}_throttle_ai"
-
-
-class AIUserRateThrottle(AIBaseRateThrottle):
-    """Throttle that limits requests per user or IP with backoff and rate limits."""
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(settings.AI_USER_RATE_THROTTLE_RATES)
-
-    def get_cache_key(self, request, view=None):
-        """Generate a cache key based on the user ID or IP for anonymous users."""
-        if request.user.is_authenticated:
-            return f"user_{request.user.id!s}_throttle_ai"
-        return f"anonymous_{self.get_ident(request)}_throttle_ai"
-
-    def get_ident(self, request):
-        """Return the request IP address."""
-        x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
-        return (
-            x_forwarded_for.split(",")[0]
-            if x_forwarded_for
-            else request.META.get("REMOTE_ADDR")
-        )

src/backend/core/api/viewsets.py

@@ -1,5 +1,6 @@
 """API endpoints"""
 
+import os
 import re
 import uuid
 from urllib.parse import urlparse
@@ -21,7 +22,6 @@ from rest_framework import (
     decorators,
     exceptions,
     filters,
-    metadata,
     mixins,
     pagination,
     status,
@@ -31,8 +31,7 @@ from rest_framework import (
     response as drf_response,
 )
 
-from core import enums, models
-from core.services.ai_services import AIService
+from core import models
 
 from . import permissions, serializers, utils
 
@@ -304,23 +303,6 @@ class ResourceAccessViewsetMixin:
         serializer.save()
 
 
-class DocumentMetadata(metadata.SimpleMetadata):
-    """Custom metadata class to add information"""
-
-    def determine_metadata(self, request, view):
-        """Add language choices only for the list endpoint."""
-        simple_metadata = super().determine_metadata(request, view)
-
-        if request.path.endswith("/documents/"):
-            simple_metadata["actions"]["POST"]["language"] = {
-                "choices": [
-                    {"value": code, "display_name": name}
-                    for code, name in enums.ALL_LANGUAGES.items()
-                ]
-            }
-        return simple_metadata
-
-
 class DocumentViewSet(
     ResourceViewsetMixin,
     mixins.CreateModelMixin,
@@ -338,7 +320,6 @@ class DocumentViewSet(
     resource_field_name = "document"
     queryset = models.Document.objects.all()
     ordering = ["-updated_at"]
-    metadata_class = DocumentMetadata
 
     def list(self, request, *args, **kwargs):
         """Restrict resources returned by the list endpoint"""
@@ -475,7 +456,10 @@ class DocumentViewSet(
         serializer = serializers.LinkDocumentSerializer(
             document, data=request.data, partial=True
         )
-        serializer.is_valid(raise_exception=True)
+        if not serializer.is_valid():
+            return drf_response.Response(
+                serializer.errors, status=status.HTTP_400_BAD_REQUEST
+            )
 
         serializer.save()
         return drf_response.Response(serializer.data, status=status.HTTP_200_OK)
@@ -488,23 +472,19 @@ class DocumentViewSet(
 
         # Validate metadata in payload
         serializer = serializers.FileUploadSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
+        if not serializer.is_valid():
+            return drf_response.Response(
+                serializer.errors, status=status.HTTP_400_BAD_REQUEST
+            )
+        # Extract the file extension from the original filename
+        file = serializer.validated_data["file"]
+        extension = os.path.splitext(file.name)[1]
 
         # Generate a generic yet unique filename to store the image in object storage
         file_id = uuid.uuid4()
-        extension = serializer.validated_data["expected_extension"]
-        key = f"{document.key_base}/{ATTACHMENTS_FOLDER:s}/{file_id!s}.{extension:s}"
-
-        # Prepare metadata for storage
-        extra_args = {"Metadata": {"owner": str(request.user.id)}}
-        if serializer.validated_data["is_unsafe"]:
-            extra_args["Metadata"]["is_unsafe"] = "true"
-
-        file = serializer.validated_data["file"]
-        default_storage.connection.meta.client.upload_fileobj(
-            file, default_storage.bucket_name, key, ExtraArgs=extra_args
-        )
+        key = f"{document.key_base}/{ATTACHMENTS_FOLDER:s}/{file_id!s}{extension:s}"
 
+        default_storage.save(key, file)
         return drf_response.Response(
             {"file": f"{settings.MEDIA_URL:s}{key:s}"}, status=status.HTTP_201_CREATED
         )
@@ -551,63 +531,6 @@ class DocumentViewSet(
         request = utils.generate_s3_authorization_headers(f"{pk:s}/{attachment_key:s}")
         return drf_response.Response("authorized", headers=request.headers, status=200)
 
-    @decorators.action(
-        detail=True,
-        methods=["post"],
-        name="Apply a transformation action on a piece of text with AI",
-        url_path="ai-transform",
-        throttle_classes=[utils.AIDocumentRateThrottle, utils.AIUserRateThrottle],
-    )
-    def ai_transform(self, request, *args, **kwargs):
-        """
-        POST /api/v1.0/documents/<resource_id>/ai-transform
-        with expected data:
-        - text: str
-        - action: str [prompt, correct, rephrase, summarize]
-        Return JSON response with the processed text.
-        """
-        # Check permissions first
-        self.get_object()
-
-        serializer = serializers.AITransformSerializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-
-        text = serializer.validated_data["text"]
-        action = serializer.validated_data["action"]
-
-        response = AIService().transform(text, action)
-
-        return drf_response.Response(response, status=status.HTTP_200_OK)
-
-    @decorators.action(
-        detail=True,
-        methods=["post"],
-        name="Translate a piece of text with AI",
-        serializer_class=serializers.AITranslateSerializer,
-        url_path="ai-translate",
-        throttle_classes=[utils.AIDocumentRateThrottle, utils.AIUserRateThrottle],
-    )
-    def ai_translate(self, request, *args, **kwargs):
-        """
-        POST /api/v1.0/documents/<resource_id>/ai-translate
-        with expected data:
-        - text: str
-        - language: str [settings.LANGUAGES]
-        Return JSON response with the translated text.
-        """
-        # Check permissions first
-        self.get_object()
-
-        serializer = self.get_serializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-
-        text = serializer.validated_data["text"]
-        language = serializer.validated_data["language"]
-
-        response = AIService().translate(text, language)
-
-        return drf_response.Response(response, status=status.HTTP_200_OK)
-
 
 class DocumentAccessViewSet(
     ResourceAccessViewsetMixin,
@@ -653,12 +576,8 @@ class DocumentAccessViewSet(
         """Add a new access to the document and send an email to the new added user."""
         access = serializer.save()
         language = self.request.headers.get("Content-Language", "en-us")
-
         access.document.email_invitation(
-            language,
-            access.user.email,
-            access.role,
-            self.request.user,
+            language, access.user.email, access.role, self.request.user.email
         )
 
 
@@ -807,10 +726,7 @@ class InvitationViewset(
 
     lookup_field = "id"
     pagination_class = Pagination
-    permission_classes = [
-        permissions.CanCreateInvitationPermission,
-        permissions.AccessPermission,
-    ]
+    permission_classes = [permissions.IsAuthenticated, permissions.AccessPermission]
     queryset = (
         models.Invitation.objects.all()
         .select_related("document")
@@ -845,16 +761,10 @@ class InvitationViewset(
             )
 
             queryset = (
-                # The logged-in user should be administrator or owner to see its accesses
+                # The logged-in user should be part of a document to see its accesses
                 queryset.filter(
-                    Q(
-                        document__accesses__user=user,
-                        document__accesses__role__in=models.PRIVILEGED_ROLES,
-                    )
-                    | Q(
-                        document__accesses__team__in=teams,
-                        document__accesses__role__in=models.PRIVILEGED_ROLES,
-                    ),
+                    Q(document__accesses__user=user)
+                    | Q(document__accesses__team__in=teams),
                 )
                 # Abilities are computed based on logged-in user's role and
                 # the user role on each document access
@@ -868,7 +778,6 @@ class InvitationViewset(
         invitation = serializer.save()
 
         language = self.request.headers.get("Content-Language", "en-us")
-
         invitation.document.email_invitation(
-            language, invitation.email, invitation.role, self.request.user
+            language, invitation.email, invitation.role, self.request.user.email
         )

src/backend/core/authentication/backends.py

@@ -84,8 +84,6 @@ class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
         user = self.get_existing_user(sub, email)
 
         if user:
-            if not user.is_active:
-                raise SuspiciousOperation(_("User account is disabled"))
             self.update_user_if_needed(user, claims)
         elif self.get_settings("OIDC_CREATE_USER", True):
             user = User.objects.create(sub=sub, password="!", **claims)  # noqa: S106
@@ -103,11 +101,11 @@ class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
     def get_existing_user(self, sub, email):
         """Fetch existing user by sub or email."""
         try:
-            return User.objects.get(sub=sub)
+            return User.objects.get(sub=sub, is_active=True)
         except User.DoesNotExist:
             if email and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION:
                 try:
-                    return User.objects.get(email=email)
+                    return User.objects.get(email=email, is_active=True)
                 except User.DoesNotExist:
                     pass
         return None

src/backend/core/enums.py

@@ -2,11 +2,15 @@
 Core application enums declaration
 """
 
-from django.conf import global_settings
+from django.conf import global_settings, settings
 from django.utils.translation import gettext_lazy as _
 
-# In Django's code base, `LANGUAGES` is set by default with all supported languages.
-# We can use it for the choice of languages which should not be limited to the few languages
-# active in the app.
+# Django sets `LANGUAGES` by default with all supported languages. We can use it for
+# the choice of languages which should not be limited to the few languages active in
+# the app.
 # pylint: disable=no-member
-ALL_LANGUAGES = {language: _(name) for language, name in global_settings.LANGUAGES}
+ALL_LANGUAGES = getattr(
+    settings,
+    "ALL_LANGUAGES",
+    [(language, _(name)) for language, name in global_settings.LANGUAGES],
+)

src/backend/core/factories.py

@@ -27,24 +27,6 @@ class UserFactory(factory.django.DjangoModelFactory):
     language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
     password = make_password("password")
 
-    @factory.post_generation
-    def with_owned_document(self, create, extracted, **kwargs):
-        """
-        Create a document for which the user is owner to check
-        that there is no interference
-        """
-        if create and (extracted is True):
-            UserDocumentAccessFactory(user=self, role="owner")
-
-    @factory.post_generation
-    def with_owned_template(self, create, extracted, **kwargs):
-        """
-        Create a template for which the user is owner to check
-        that there is no interference
-        """
-        if create and (extracted is True):
-            UserTemplateAccessFactory(user=self, role="owner")
-
 
 class DocumentFactory(factory.django.DjangoModelFactory):
     """A factory to create documents"""

src/backend/core/models.py

@@ -72,9 +72,6 @@ class RoleChoices(models.TextChoices):
     OWNER = "owner", _("Owner")
 
 
-PRIVILEGED_ROLES = [RoleChoices.ADMIN, RoleChoices.OWNER]
-
-
 class LinkReachChoices(models.TextChoices):
     """Defines types of access for links"""
 
@@ -511,13 +508,10 @@ class Document(BaseModel):
         can_get = bool(roles)
 
         return {
-            "ai_transform": is_owner_or_admin or is_editor,
-            "ai_translate": is_owner_or_admin or is_editor,
             "attachment_upload": is_owner_or_admin or is_editor,
             "destroy": RoleChoices.OWNER in roles,
             "link_configuration": is_owner_or_admin,
             "manage_accesses": is_owner_or_admin,
-            "invite_owner": RoleChoices.OWNER in roles,
             "partial_update": is_owner_or_admin or is_editor,
             "retrieve": can_get,
             "update": is_owner_or_admin or is_editor,
@@ -526,18 +520,15 @@ class Document(BaseModel):
             "versions_retrieve": can_get_versions,
         }
 
-    def email_invitation(self, language, email, role, sender):
+    def email_invitation(self, language, email, role, username_sender):
         """Send email invitation."""
 
-        sender_name = sender.full_name or sender.email
         domain = Site.objects.get_current().domain
 
         try:
             with override(language):
-                title = _(
-                    "%(sender_name)s shared a document with you: %(document)s"
-                ) % {
-                    "sender_name": sender_name,
+                title = _("%(username)s shared a document with you: %(document)s") % {
+                    "username": username_sender,
                     "document": self.title,
                 }
                 template_vars = {
@@ -545,10 +536,7 @@ class Document(BaseModel):
                     "domain": domain,
                     "document": self,
                     "link": f"{domain}/docs/{self.id}/",
-                    "sender_name": sender_name,
-                    "sender_name_email": f"{sender.full_name} ({sender.email})"
-                    if sender.full_name
-                    else sender.email,
+                    "username": username_sender,
                     "role": RoleChoices(role).label.lower(),
                 }
                 msg_html = render_to_string("mail/html/invitation.html", template_vars)
@@ -884,6 +872,8 @@ class Invitation(BaseModel):
 
     def get_abilities(self, user):
         """Compute and return abilities for a given user."""
+        can_delete = False
+        can_update = False
         roles = []
 
         if user.is_authenticated:
@@ -898,13 +888,17 @@ class Invitation(BaseModel):
                 except (self._meta.model.DoesNotExist, IndexError):
                     roles = []
 
-        is_admin_or_owner = bool(
-            set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
-        )
+            can_delete = bool(
+                set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
+            )
+
+            can_update = bool(
+                set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
+            )
 
         return {
-            "destroy": is_admin_or_owner,
-            "update": is_admin_or_owner,
-            "partial_update": is_admin_or_owner,
-            "retrieve": is_admin_or_owner,
+            "destroy": can_delete,
+            "update": can_update,
+            "partial_update": can_update,
+            "retrieve": bool(roles),
         }

src/backend/core/services/ai_services.py

@@ -1,89 +0,0 @@
-"""AI services."""
-
-import json
-import re
-
-from django.conf import settings
-from django.core.exceptions import ImproperlyConfigured
-
-from openai import OpenAI
-
-from core import enums
-
-AI_ACTIONS = {
-    "prompt": (
-        "Answer the prompt in markdown format. Return JSON: "
-        '{"answer": "Your markdown answer"}. '
-        "Do not provide any other information."
-    ),
-    "correct": (
-        "Correct grammar and spelling of the markdown text, "
-        "preserving language and markdown formatting. "
-        'Return JSON: {"answer": "your corrected markdown text"}. '
-        "Do not provide any other information."
-    ),
-    "rephrase": (
-        "Rephrase the given markdown text, "
-        "preserving language and markdown formatting. "
-        'Return JSON: {"answer": "your rephrased markdown text"}. '
-        "Do not provide any other information."
-    ),
-    "summarize": (
-        "Summarize the markdown text, preserving language and markdown formatting. "
-        'Return JSON: {"answer": "your markdown summary"}. '
-        "Do not provide any other information."
-    ),
-}
-
-AI_TRANSLATE = (
-    "Translate the markdown text to {language:s}, preserving markdown formatting. "
-    'Return JSON: {{"answer": "your translated markdown text in {language:s}"}}. '
-    "Do not provide any other information."
-)
-
-
-class AIService:
-    """Service class for AI-related operations."""
-
-    def __init__(self):
-        """Ensure that the AI configuration is set properly."""
-        if (
-            settings.AI_BASE_URL is None
-            or settings.AI_API_KEY is None
-            or settings.AI_MODEL is None
-        ):
-            raise ImproperlyConfigured("AI configuration not set")
-        self.client = OpenAI(base_url=settings.AI_BASE_URL, api_key=settings.AI_API_KEY)
-
-    def call_ai_api(self, system_content, text):
-        """Helper method to call the OpenAI API and process the response."""
-        response = self.client.chat.completions.create(
-            model=settings.AI_MODEL,
-            response_format={"type": "json_object"},
-            messages=[
-                {"role": "system", "content": system_content},
-                {"role": "user", "content": json.dumps({"markdown_input": text})},
-            ],
-        )
-
-        content = response.choices[0].message.content
-        sanitized_content = re.sub(r"(?<!\\)\n", "\\\\n", content)
-        sanitized_content = re.sub(r"(?<!\\)\t", "\\\\t", sanitized_content)
-
-        json_response = json.loads(sanitized_content)
-
-        if "answer" not in json_response:
-            raise RuntimeError("AI response does not contain an answer")
-
-        return json_response
-
-    def transform(self, text, action):
-        """Transform text based on specified action."""
-        system_content = AI_ACTIONS[action]
-        return self.call_ai_api(system_content, text)
-
-    def translate(self, text, language):
-        """Translate text to a specified language."""
-        language_display = enums.ALL_LANGUAGES.get(language, language)
-        system_content = AI_TRANSLATE.format(language=language_display)
-        return self.call_ai_api(system_content, text)

src/backend/core/tests/authentication/test_backends.py

@@ -305,63 +305,3 @@ def test_authentication_get_userinfo_invalid_response():
         match="Invalid response format or token verification failed",
     ):
         oidc_backend.get_userinfo("fake_access_token", None, None)
-
-
-def test_authentication_getter_existing_disabled_user_via_sub(
-    django_assert_num_queries, monkeypatch
-):
-    """
-    If an existing user matches the sub but is disabled,
-    an error should be raised and a user should not be created.
-    """
-
-    klass = OIDCAuthenticationBackend()
-    db_user = UserFactory(is_active=False)
-
-    def get_userinfo_mocked(*args):
-        return {
-            "sub": db_user.sub,
-            "email": db_user.email,
-            "first_name": "John",
-            "last_name": "Doe",
-        }
-
-    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
-
-    with (
-        django_assert_num_queries(1),
-        pytest.raises(SuspiciousOperation, match="User account is disabled"),
-    ):
-        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
-
-    assert models.User.objects.count() == 1
-
-
-def test_authentication_getter_existing_disabled_user_via_email(
-    django_assert_num_queries, monkeypatch
-):
-    """
-    If an existing user does not matches the sub but matches the email and is disabled,
-    an error should be raised and a user should not be created.
-    """
-
-    klass = OIDCAuthenticationBackend()
-    db_user = UserFactory(is_active=False)
-
-    def get_userinfo_mocked(*args):
-        return {
-            "sub": "random",
-            "email": db_user.email,
-            "first_name": "John",
-            "last_name": "Doe",
-        }
-
-    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
-
-    with (
-        django_assert_num_queries(2),
-        pytest.raises(SuspiciousOperation, match="User account is disabled"),
-    ):
-        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
-
-    assert models.User.objects.count() == 1

src/backend/core/tests/documents/test_api_document_accesses.py

@@ -149,7 +149,7 @@ def test_api_document_accesses_retrieve_authenticated_unrelated():
     Authenticated users should not be allowed to retrieve a document access for
     a document to which they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -246,7 +246,7 @@ def test_api_document_accesses_update_authenticated_unrelated():
     Authenticated users should not be allowed to update a document access for a document to which
     they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -279,7 +279,7 @@ def test_api_document_accesses_update_authenticated_reader_or_editor(
     via, role, mock_user_teams
 ):
     """Readers or editors of a document should not be allowed to update its accesses."""
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -321,7 +321,7 @@ def test_api_document_accesses_update_administrator_except_owner(via, mock_user_
     A user who is a direct administrator in a document should be allowed to update a user
     access for this document, as long as they don't try to set the role to owner.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -378,7 +378,7 @@ def test_api_document_accesses_update_administrator_from_owner(via, mock_user_te
     A user who is an administrator in a document, should not be allowed to update
     the user access of an "owner" for this document.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -425,7 +425,7 @@ def test_api_document_accesses_update_administrator_to_owner(via, mock_user_team
     A user who is an administrator in a document, should not be allowed to update
     the user access of another user to grant document ownership.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -479,7 +479,7 @@ def test_api_document_accesses_update_owner(via, mock_user_teams):
     A user who is an owner in a document should be allowed to update
     a user access for this document whatever the role.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -535,7 +535,7 @@ def test_api_document_accesses_update_owner_self(via, mock_user_teams):
     A user who is owner of a document should be allowed to update
     their own user access provided there are other owners in the document.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -605,7 +605,7 @@ def test_api_document_accesses_delete_authenticated():
     Authenticated users should not be allowed to delete a document access for a
     document to which they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -617,7 +617,7 @@ def test_api_document_accesses_delete_authenticated():
     )
 
     assert response.status_code == 403
-    assert models.DocumentAccess.objects.count() == 2
+    assert models.DocumentAccess.objects.count() == 1
 
 
 @pytest.mark.parametrize("role", ["reader", "editor"])
@@ -627,7 +627,7 @@ def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_team
     Authenticated users should not be allowed to delete a document access for a
     document in which they are a simple reader or editor.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -643,7 +643,7 @@ def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_team
 
     access = factories.UserDocumentAccessFactory(document=document)
 
-    assert models.DocumentAccess.objects.count() == 3
+    assert models.DocumentAccess.objects.count() == 2
     assert models.DocumentAccess.objects.filter(user=access.user).exists()
 
     response = client.delete(
@@ -651,7 +651,7 @@ def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_team
     )
 
     assert response.status_code == 403
-    assert models.DocumentAccess.objects.count() == 3
+    assert models.DocumentAccess.objects.count() == 2
 
 
 @pytest.mark.parametrize("via", VIA)
@@ -699,7 +699,7 @@ def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_tea
     Users who are administrators in a document should not be allowed to delete an ownership
     access from the document.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -717,7 +717,7 @@ def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_tea
 
     access = factories.UserDocumentAccessFactory(document=document, role="owner")
 
-    assert models.DocumentAccess.objects.count() == 3
+    assert models.DocumentAccess.objects.count() == 2
     assert models.DocumentAccess.objects.filter(user=access.user).exists()
 
     response = client.delete(
@@ -725,7 +725,7 @@ def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_tea
     )
 
     assert response.status_code == 403
-    assert models.DocumentAccess.objects.count() == 3
+    assert models.DocumentAccess.objects.count() == 2
 
 
 @pytest.mark.parametrize("via", VIA)
@@ -766,7 +766,7 @@ def test_api_document_accesses_delete_owners_last_owner(via, mock_user_teams):
     """
     It should not be possible to delete the last owner access from a document
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -783,10 +783,10 @@ def test_api_document_accesses_delete_owners_last_owner(via, mock_user_teams):
             document=document, team="lasuite", role="owner"
         )
 
-    assert models.DocumentAccess.objects.count() == 2
+    assert models.DocumentAccess.objects.count() == 1
     response = client.delete(
         f"/api/v1.0/documents/{document.id!s}/accesses/{access.id!s}/",
     )
 
     assert response.status_code == 403
-    assert models.DocumentAccess.objects.count() == 2
+    assert models.DocumentAccess.objects.count() == 1

src/backend/core/tests/documents/test_api_document_accesses_create.py

@@ -18,13 +18,13 @@ pytestmark = pytest.mark.django_db
 
 def test_api_document_accesses_create_anonymous():
     """Anonymous users should not be allowed to create document accesses."""
+    user = factories.UserFactory()
     document = factories.DocumentFactory()
 
-    other_user = factories.UserFactory()
     response = APIClient().post(
         f"/api/v1.0/documents/{document.id!s}/accesses/",
         {
-            "user_id": str(other_user.id),
+            "user": str(user.id),
             "document": str(document.id),
             "role": random.choice(models.RoleChoices.choices)[0],
         },
@@ -43,7 +43,7 @@ def test_api_document_accesses_create_authenticated_unrelated():
     Authenticated users should not be allowed to create document accesses for a document to
     which they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -54,7 +54,7 @@ def test_api_document_accesses_create_authenticated_unrelated():
     response = client.post(
         f"/api/v1.0/documents/{document.id!s}/accesses/",
         {
-            "user_id": str(other_user.id),
+            "user": str(other_user.id),
         },
         format="json",
     )
@@ -69,7 +69,7 @@ def test_api_document_accesses_create_authenticated_reader_or_editor(
     via, role, mock_user_teams
 ):
     """Readers or editors of a document should not be allowed to create document accesses."""
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -89,7 +89,7 @@ def test_api_document_accesses_create_authenticated_reader_or_editor(
         response = client.post(
             f"/api/v1.0/documents/{document.id!s}/accesses/",
             {
-                "user_id": str(other_user.id),
+                "user": str(other_user.id),
                 "role": new_role,
             },
             format="json",
@@ -107,7 +107,7 @@ def test_api_document_accesses_create_authenticated_administrator(via, mock_user
     except for the "owner" role.
     An email should be sent to the accesses to notify them of the adding.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -129,7 +129,7 @@ def test_api_document_accesses_create_authenticated_administrator(via, mock_user
     response = client.post(
         f"/api/v1.0/documents/{document.id!s}/accesses/",
         {
-            "user_id": str(other_user.id),
+            "user": str(other_user.id),
             "role": "owner",
         },
         format="json",
@@ -171,10 +171,7 @@ def test_api_document_accesses_create_authenticated_administrator(via, mock_user
     email = mail.outbox[0]
     assert email.to == [other_user["email"]]
     email_content = " ".join(email.body.split())
-    assert (
-        f"{user.full_name} shared a document with you: {document.title}"
-        in email_content
-    )
+    assert f"{user.email} shared a document with you: {document.title}" in email_content
     assert "docs/" + str(document.id) + "/" in email_content
 
 
@@ -228,8 +225,5 @@ def test_api_document_accesses_create_authenticated_owner(via, mock_user_teams):
     email = mail.outbox[0]
     assert email.to == [other_user["email"]]
     email_content = " ".join(email.body.split())
-    assert (
-        f"{user.full_name} shared a document with you: {document.title}"
-        in email_content
-    )
+    assert f"{user.email} shared a document with you: {document.title}" in email_content
     assert "docs/" + str(document.id) + "/" in email_content

src/backend/core/tests/documents/test_api_document_versions.py

@@ -39,7 +39,7 @@ def test_api_document_versions_list_authenticated_unrelated(reach):
     Authenticated users should not be allowed to list document versions for a document
     to which they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -231,7 +231,7 @@ def test_api_document_versions_retrieve_authenticated_unrelated(reach):
     Authenticated users should not be allowed to retrieve specific versions for a
     document to which they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -475,7 +475,7 @@ def test_api_document_versions_delete_authenticated(reach):
     Authenticated users should not be allowed to delete a document version for a
     public document to which they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -500,7 +500,7 @@ def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_team
     Authenticated users should not be allowed to delete a document version for a
     document in which they are a simple reader or editor.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)

src/backend/core/tests/documents/test_api_documents_ai_transform.py

@@ -1,346 +0,0 @@
-"""
-Test AI transform API endpoint for users in impress's core app.
-"""
-
-from unittest.mock import MagicMock, patch
-
-from django.core.cache import cache
-from django.test import override_settings
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories
-from core.tests.conftest import TEAM, USER, VIA
-
-pytestmark = pytest.mark.django_db
-
-
-@pytest.fixture(autouse=True)
-def clear_cache():
-    """Fixture to clear the cache before each test."""
-    cache.clear()
-
-
-@pytest.fixture
-def ai_settings():
-    """Fixture to set AI settings."""
-    with override_settings(
-        AI_BASE_URL="http://example.com", AI_API_KEY="test-key", AI_MODEL="llama"
-    ):
-        yield
-
-
-@pytest.mark.parametrize(
-    "reach, role",
-    [
-        ("restricted", "reader"),
-        ("restricted", "editor"),
-        ("authenticated", "reader"),
-        ("authenticated", "editor"),
-        ("public", "reader"),
-    ],
-)
-def test_api_documents_ai_transform_anonymous_forbidden(reach, role):
-    """
-    Anonymous users should not be able to request AI transform if the link reach
-    and role don't allow it.
-    """
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = APIClient().post(url, {"text": "hello", "action": "prompt"})
-
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_anonymous_success(mock_create):
-    """
-    Anonymous users should be able to request AI transform to a document
-    if the link reach and role permit it.
-    """
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = APIClient().post(url, {"text": "Hello", "action": "summarize"})
-
-    assert response.status_code == 200
-    assert response.json() == {"answer": "Salut"}
-    mock_create.assert_called_once_with(
-        model="llama",
-        response_format={"type": "json_object"},
-        messages=[
-            {
-                "role": "system",
-                "content": (
-                    "Summarize the markdown text, preserving language and markdown formatting. "
-                    'Return JSON: {"answer": "your markdown summary"}. Do not provide any other '
-                    "information."
-                ),
-            },
-            {"role": "user", "content": '{"markdown_input": "Hello"}'},
-        ],
-    )
-
-
-@pytest.mark.parametrize(
-    "reach, role",
-    [
-        ("restricted", "reader"),
-        ("restricted", "editor"),
-        ("authenticated", "reader"),
-        ("public", "reader"),
-    ],
-)
-def test_api_documents_ai_transform_authenticated_forbidden(reach, role):
-    """
-    Users who are not related to a document can't request AI transform if the
-    link reach and role don't allow it.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = client.post(url, {"text": "Hello", "action": "prompt"})
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
-
-
-@pytest.mark.parametrize(
-    "reach, role",
-    [
-        ("authenticated", "editor"),
-        ("public", "editor"),
-    ],
-)
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_authenticated_success(mock_create, reach, role):
-    """
-    Autenticated who are not related to a document should be able to request AI transform
-    if the link reach and role permit it.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = client.post(url, {"text": "Hello", "action": "prompt"})
-
-    assert response.status_code == 200
-    assert response.json() == {"answer": "Salut"}
-    mock_create.assert_called_once_with(
-        model="llama",
-        response_format={"type": "json_object"},
-        messages=[
-            {
-                "role": "system",
-                "content": (
-                    'Answer the prompt in markdown format. Return JSON: {"answer": '
-                    '"Your markdown answer"}. Do not provide any other information.'
-                ),
-            },
-            {"role": "user", "content": '{"markdown_input": "Hello"}'},
-        ],
-    )
-
-
-@pytest.mark.parametrize("via", VIA)
-def test_api_documents_ai_transform_reader(via, mock_user_teams):
-    """
-    Users who are simple readers on a document should not be allowed to request AI transform.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_role="reader")
-    if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role="reader"
-        )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = client.post(url, {"text": "Hello", "action": "prompt"})
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
-
-
-@pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
-@pytest.mark.parametrize("via", VIA)
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_success(mock_create, via, role, mock_user_teams):
-    """
-    Editors, administrators and owners of a document should be able to request AI transform.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory()
-    if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role=role
-        )
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = client.post(url, {"text": "Hello", "action": "prompt"})
-
-    assert response.status_code == 200
-    assert response.json() == {"answer": "Salut"}
-    mock_create.assert_called_once_with(
-        model="llama",
-        response_format={"type": "json_object"},
-        messages=[
-            {
-                "role": "system",
-                "content": (
-                    'Answer the prompt in markdown format. Return JSON: {"answer": '
-                    '"Your markdown answer"}. Do not provide any other information.'
-                ),
-            },
-            {"role": "user", "content": '{"markdown_input": "Hello"}'},
-        ],
-    )
-
-
-def test_api_documents_ai_transform_empty_text():
-    """The text should not be empty when requesting AI transform."""
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = client.post(url, {"text": " ", "action": "prompt"})
-
-    assert response.status_code == 400
-    assert response.json() == {"text": ["This field may not be blank."]}
-
-
-def test_api_documents_ai_transform_invalid_action():
-    """The action should valid when requesting AI transform."""
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = client.post(url, {"text": "Hello", "action": "invalid"})
-
-    assert response.status_code == 400
-    assert response.json() == {"action": ['"invalid" is not a valid choice.']}
-
-
-@override_settings(AI_DOCUMENT_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_throttling_document(mock_create):
-    """
-    Throttling per document should be triggered on the AI transform endpoint.
-    For full throttle class test see: `test_api_utils_ai_document_rate_throttles`
-    """
-    client = APIClient()
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    for _ in range(3):
-        user = factories.UserFactory()
-        client.force_login(user)
-        response = client.post(url, {"text": "Hello", "action": "summarize"})
-        assert response.status_code == 200
-        assert response.json() == {"answer": "Salut"}
-
-    user = factories.UserFactory()
-    client.force_login(user)
-    response = client.post(url, {"text": "Hello", "action": "summarize"})
-
-    assert response.status_code == 429
-    assert response.json() == {
-        "detail": "Request was throttled. Expected available in 60 seconds."
-    }
-
-
-@override_settings(AI_USER_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_transform_throttling_user(mock_create):
-    """
-    Throttling per user should be triggered on the AI transform endpoint.
-    For full throttle class test see: `test_api_utils_ai_user_rate_throttles`
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    for _ in range(3):
-        document = factories.DocumentFactory(link_reach="public", link_role="editor")
-        url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-        response = client.post(url, {"text": "Hello", "action": "summarize"})
-        assert response.status_code == 200
-        assert response.json() == {"answer": "Salut"}
-
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-    url = f"/api/v1.0/documents/{document.id!s}/ai-transform/"
-    response = client.post(url, {"text": "Hello", "action": "summarize"})
-
-    assert response.status_code == 429
-    assert response.json() == {
-        "detail": "Request was throttled. Expected available in 60 seconds."
-    }

src/backend/core/tests/documents/test_api_documents_ai_translate.py

@@ -1,370 +0,0 @@
-"""
-Test AI translate API endpoint for users in impress's core app.
-"""
-
-from unittest.mock import MagicMock, patch
-
-from django.core.cache import cache
-from django.test import override_settings
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories
-from core.tests.conftest import TEAM, USER, VIA
-
-pytestmark = pytest.mark.django_db
-
-
-@pytest.fixture(autouse=True)
-def clear_cache():
-    """Fixture to clear the cache before each test."""
-    cache.clear()
-
-
-@pytest.fixture
-def ai_settings():
-    """Fixture to set AI settings."""
-    with override_settings(
-        AI_BASE_URL="http://example.com", AI_API_KEY="test-key", AI_MODEL="llama"
-    ):
-        yield
-
-
-def test_api_documents_ai_translate_viewset_options_metadata():
-    """The documents endpoint should give us the list of available languages."""
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    response = APIClient().options("/api/v1.0/documents/")
-
-    assert response.status_code == 200
-    metadata = response.json()
-    assert metadata["name"] == "Document List"
-    assert metadata["actions"]["POST"]["language"]["choices"][0] == {
-        "value": "af",
-        "display_name": "Afrikaans",
-    }
-
-
-@pytest.mark.parametrize(
-    "reach, role",
-    [
-        ("restricted", "reader"),
-        ("restricted", "editor"),
-        ("authenticated", "reader"),
-        ("authenticated", "editor"),
-        ("public", "reader"),
-    ],
-)
-def test_api_documents_ai_translate_anonymous_forbidden(reach, role):
-    """
-    Anonymous users should not be able to request AI translate if the link reach
-    and role don't allow it.
-    """
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = APIClient().post(url, {"text": "hello", "language": "es"})
-
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_anonymous_success(mock_create):
-    """
-    Anonymous users should be able to request AI translate to a document
-    if the link reach and role permit it.
-    """
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = APIClient().post(url, {"text": "Hello", "language": "es"})
-
-    assert response.status_code == 200
-    assert response.json() == {"answer": "Salut"}
-    mock_create.assert_called_once_with(
-        model="llama",
-        response_format={"type": "json_object"},
-        messages=[
-            {
-                "role": "system",
-                "content": (
-                    "Translate the markdown text to Spanish, preserving markdown formatting. "
-                    'Return JSON: {"answer": "your translated markdown text in Spanish"}. '
-                    "Do not provide any other information."
-                ),
-            },
-            {"role": "user", "content": '{"markdown_input": "Hello"}'},
-        ],
-    )
-
-
-@pytest.mark.parametrize(
-    "reach, role",
-    [
-        ("restricted", "reader"),
-        ("restricted", "editor"),
-        ("authenticated", "reader"),
-        ("public", "reader"),
-    ],
-)
-def test_api_documents_ai_translate_authenticated_forbidden(reach, role):
-    """
-    Users who are not related to a document can't request AI translate if the
-    link reach and role don't allow it.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = client.post(url, {"text": "Hello", "language": "es"})
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
-
-
-@pytest.mark.parametrize(
-    "reach, role",
-    [
-        ("authenticated", "editor"),
-        ("public", "editor"),
-    ],
-)
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_authenticated_success(mock_create, reach, role):
-    """
-    Autenticated who are not related to a document should be able to request AI translate
-    if the link reach and role permit it.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_reach=reach, link_role=role)
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = client.post(url, {"text": "Hello", "language": "es-co"})
-
-    assert response.status_code == 200
-    assert response.json() == {"answer": "Salut"}
-    mock_create.assert_called_once_with(
-        model="llama",
-        response_format={"type": "json_object"},
-        messages=[
-            {
-                "role": "system",
-                "content": (
-                    "Translate the markdown text to Colombian Spanish, "
-                    "preserving markdown formatting. Return JSON: "
-                    '{"answer": "your translated markdown text in Colombian Spanish"}. '
-                    "Do not provide any other information."
-                ),
-            },
-            {"role": "user", "content": '{"markdown_input": "Hello"}'},
-        ],
-    )
-
-
-@pytest.mark.parametrize("via", VIA)
-def test_api_documents_ai_translate_reader(via, mock_user_teams):
-    """
-    Users who are simple readers on a document should not be allowed to request AI translate.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_role="reader")
-    if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role="reader"
-        )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = client.post(url, {"text": "Hello", "language": "es"})
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
-
-
-@pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
-@pytest.mark.parametrize("via", VIA)
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_success(mock_create, via, role, mock_user_teams):
-    """
-    Editors, administrators and owners of a document should be able to request AI translate.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory()
-    if via == USER:
-        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamDocumentAccessFactory(
-            document=document, team="lasuite", role=role
-        )
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = client.post(url, {"text": "Hello", "language": "es-co"})
-
-    assert response.status_code == 200
-    assert response.json() == {"answer": "Salut"}
-    mock_create.assert_called_once_with(
-        model="llama",
-        response_format={"type": "json_object"},
-        messages=[
-            {
-                "role": "system",
-                "content": (
-                    "Translate the markdown text to Colombian Spanish, "
-                    "preserving markdown formatting. Return JSON: "
-                    '{"answer": "your translated markdown text in Colombian Spanish"}. '
-                    "Do not provide any other information."
-                ),
-            },
-            {"role": "user", "content": '{"markdown_input": "Hello"}'},
-        ],
-    )
-
-
-def test_api_documents_ai_translate_empty_text():
-    """The text should not be empty when requesting AI translate."""
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = client.post(url, {"text": " ", "language": "es"})
-
-    assert response.status_code == 400
-    assert response.json() == {"text": ["This field may not be blank."]}
-
-
-def test_api_documents_ai_translate_invalid_action():
-    """The action should valid when requesting AI translate."""
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = client.post(url, {"text": "Hello", "language": "invalid"})
-
-    assert response.status_code == 400
-    assert response.json() == {"language": ['"invalid" is not a valid choice.']}
-
-
-@override_settings(AI_DOCUMENT_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_throttling_document(mock_create):
-    """
-    Throttling per document should be triggered on the AI translate endpoint.
-    For full throttle class test see: `test_api_utils_ai_document_rate_throttles`
-    """
-    client = APIClient()
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    for _ in range(3):
-        user = factories.UserFactory()
-        client.force_login(user)
-        response = client.post(url, {"text": "Hello", "language": "es"})
-        assert response.status_code == 200
-        assert response.json() == {"answer": "Salut"}
-
-    user = factories.UserFactory()
-    client.force_login(user)
-    response = client.post(url, {"text": "Hello", "language": "es"})
-
-    assert response.status_code == 429
-    assert response.json() == {
-        "detail": "Request was throttled. Expected available in 60 seconds."
-    }
-
-
-@override_settings(AI_USER_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@pytest.mark.usefixtures("ai_settings")
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_documents_ai_translate_throttling_user(mock_create):
-    """
-    Throttling per user should be triggered on the AI translate endpoint.
-    For full throttle class test see: `test_api_utils_ai_user_rate_throttles`
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    for _ in range(3):
-        document = factories.DocumentFactory(link_reach="public", link_role="editor")
-        url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-        response = client.post(url, {"text": "Hello", "language": "es"})
-        assert response.status_code == 200
-        assert response.json() == {"answer": "Salut"}
-
-    document = factories.DocumentFactory(link_reach="public", link_role="editor")
-    url = f"/api/v1.0/documents/{document.id!s}/ai-translate/"
-    response = client.post(url, {"text": "Hello", "language": "es"})
-
-    assert response.status_code == 429
-    assert response.json() == {
-        "detail": "Request was throttled. Expected available in 60 seconds."
-    }

src/backend/core/tests/documents/test_api_documents_attachment_upload.py

@@ -5,7 +5,7 @@ Test file uploads API endpoint for users in impress's core app.
 import re
 import uuid
 
-from django.core.files.storage import default_storage
+from django.core.files.base import ContentFile
 from django.core.files.uploadedfile import SimpleUploadedFile
 
 import pytest
@@ -16,12 +16,6 @@ from core.tests.conftest import TEAM, USER, VIA
 
 pytestmark = pytest.mark.django_db
 
-PIXEL = (
-    b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00"
-    b"\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\nIDATx\x9cc\xf8\xff\xff?\x00\x05\xfe\x02\xfe"
-    b"\xa7V\xbd\xfa\x00\x00\x00\x00IEND\xaeB`\x82"
-)
-
 
 @pytest.mark.parametrize(
     "reach, role",
@@ -39,7 +33,7 @@ def test_api_documents_attachment_upload_anonymous_forbidden(reach, role):
     and role don't allow it.
     """
     document = factories.DocumentFactory(link_reach=reach, link_role=role)
-    file = SimpleUploadedFile(name="test.png", content=PIXEL, content_type="image/png")
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
     response = APIClient().post(url, {"file": file}, format="multipart")
@@ -56,14 +50,14 @@ def test_api_documents_attachment_upload_anonymous_success():
     if the link reach and role permit it.
     """
     document = factories.DocumentFactory(link_reach="public", link_role="editor")
-    file = SimpleUploadedFile(name="test.png", content=PIXEL, content_type="image/png")
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
     response = APIClient().post(url, {"file": file}, format="multipart")
 
     assert response.status_code == 201
 
-    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.png")
+    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.jpg")
     match = pattern.search(response.json()["file"])
     file_id = match.group(1)
 
@@ -85,13 +79,13 @@ def test_api_documents_attachment_upload_authenticated_forbidden(reach, role):
     Users who are not related to a document can't upload attachments if the
     link reach and role don't allow it.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
     document = factories.DocumentFactory(link_reach=reach, link_role=role)
-    file = SimpleUploadedFile(name="test.png", content=PIXEL, content_type="image/png")
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
     response = client.post(url, {"file": file}, format="multipart")
@@ -120,14 +114,14 @@ def test_api_documents_attachment_upload_authenticated_success(reach, role):
     client.force_login(user)
 
     document = factories.DocumentFactory(link_reach=reach, link_role=role)
-    file = SimpleUploadedFile(name="test.png", content=PIXEL, content_type="image/png")
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
     response = client.post(url, {"file": file}, format="multipart")
 
     assert response.status_code == 201
 
-    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.png")
+    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.jpg")
     match = pattern.search(response.json()["file"])
     file_id = match.group(1)
 
@@ -140,7 +134,7 @@ def test_api_documents_attachment_upload_reader(via, mock_user_teams):
     """
     Users who are simple readers on a document should not be allowed to upload an attachment.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -154,7 +148,7 @@ def test_api_documents_attachment_upload_reader(via, mock_user_teams):
             document=document, team="lasuite", role="reader"
         )
 
-    file = SimpleUploadedFile(name="test.png", content=PIXEL, content_type="image/png")
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
     response = client.post(url, {"file": file}, format="multipart")
@@ -185,28 +179,20 @@ def test_api_documents_attachment_upload_success(via, role, mock_user_teams):
             document=document, team="lasuite", role=role
         )
 
-    file = SimpleUploadedFile(name="test.png", content=PIXEL, content_type="image/png")
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
 
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
     response = client.post(url, {"file": file}, format="multipart")
 
     assert response.status_code == 201
 
-    file_path = response.json()["file"]
-    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.png")
-    match = pattern.search(file_path)
+    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.jpg")
+    match = pattern.search(response.json()["file"])
     file_id = match.group(1)
 
     # Validate that file_id is a valid UUID
     uuid.UUID(file_id)
 
-    # Now, check the metadata of the uploaded file
-    key = file_path.replace("/media", "")
-    file_head = default_storage.connection.meta.client.head_object(
-        Bucket=default_storage.bucket_name, Key=key
-    )
-    assert file_head["Metadata"] == {"owner": str(user.id)}
-
 
 def test_api_documents_attachment_upload_invalid(client):
     """Attempt to upload without a file should return an explicit error."""
@@ -236,9 +222,8 @@ def test_api_documents_attachment_upload_size_limit_exceeded(settings):
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
 
     # Create a temporary file larger than the allowed size
-    file = SimpleUploadedFile(
-        name="test.txt", content=b"a" * (1048576 + 1), content_type="text/plain"
-    )
+    content = b"a" * (1048576 + 1)
+    file = ContentFile(content, name="test.jpg")
 
     response = client.post(url, {"file": file}, format="multipart")
 
@@ -246,21 +231,10 @@ def test_api_documents_attachment_upload_size_limit_exceeded(settings):
     assert response.json() == {"file": ["File size exceeds the maximum limit of 1 MB."]}
 
 
-@pytest.mark.parametrize(
-    "name,content,extension",
-    [
-        ("test.exe", b"text", "exe"),
-        ("test", b"text", "txt"),
-        ("test.aaaaaa", b"test", "txt"),
-        ("test.txt", PIXEL, "txt"),
-        ("test.py", b"#!/usr/bin/python", "py"),
-    ],
-)
-def test_api_documents_attachment_upload_fix_extension(name, content, extension):
-    """
-    A file with no extension or a wrong extension is accepted and the extension
-    is corrected in storage.
-    """
+def test_api_documents_attachment_upload_type_not_allowed(settings):
+    """The uploaded file should be of a whitelisted type."""
+    settings.DOCUMENT_IMAGE_ALLOWED_MIME_TYPES = ["image/jpeg", "image/png"]
+
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
@@ -268,70 +242,14 @@ def test_api_documents_attachment_upload_fix_extension(name, content, extension)
     document = factories.DocumentFactory(users=[(user, "owner")])
     url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
 
-    file = SimpleUploadedFile(name=name, content=content)
-    response = client.post(url, {"file": file}, format="multipart")
+    # Create a temporary file with a not allowed type (e.g., text file)
+    file = ContentFile(b"a" * 1048576, name="test.txt")
 
-    assert response.status_code == 201
-
-    file_path = response.json()["file"]
-    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.{extension:s}")
-    match = pattern.search(file_path)
-    file_id = match.group(1)
-
-    # Validate that file_id is a valid UUID
-    uuid.UUID(file_id)
-
-    # Now, check the metadata of the uploaded file
-    key = file_path.replace("/media", "")
-    file_head = default_storage.connection.meta.client.head_object(
-        Bucket=default_storage.bucket_name, Key=key
-    )
-    assert file_head["Metadata"] == {"owner": str(user.id), "is_unsafe": "true"}
-
-
-def test_api_documents_attachment_upload_empty_file():
-    """An empty file should be rejected."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(users=[(user, "owner")])
-    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
-
-    file = SimpleUploadedFile(name="test.png", content=b"")
     response = client.post(url, {"file": file}, format="multipart")
 
     assert response.status_code == 400
-    assert response.json() == {"file": ["The submitted file is empty."]}
-
-
-def test_api_documents_attachment_upload_unsafe():
-    """A file with an unsafe mime type should be tagged as such."""
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(users=[(user, "owner")])
-    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
-
-    file = SimpleUploadedFile(
-        name="script.exe", content=b"\x4d\x5a\x90\x00\x03\x00\x00\x00"
-    )
-    response = client.post(url, {"file": file}, format="multipart")
-
-    assert response.status_code == 201
-
-    file_path = response.json()["file"]
-    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.exe")
-    match = pattern.search(file_path)
-    file_id = match.group(1)
-
-    # Validate that file_id is a valid UUID
-    uuid.UUID(file_id)
-
-    # Now, check the metadata of the uploaded file
-    key = file_path.replace("/media", "")
-    file_head = default_storage.connection.meta.client.head_object(
-        Bucket=default_storage.bucket_name, Key=key
-    )
-    assert file_head["Metadata"] == {"owner": str(user.id), "is_unsafe": "true"}
+    assert response.json() == {
+        "file": [
+            "File type 'text/plain' is not allowed. Allowed types are: image/jpeg, image/png"
+        ]
+    }

src/backend/core/tests/documents/test_api_documents_delete.py

@@ -30,7 +30,7 @@ def test_api_documents_delete_authenticated_unrelated(reach, role):
     Authenticated users should not be allowed to delete a document to which
     they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -42,7 +42,7 @@ def test_api_documents_delete_authenticated_unrelated(reach, role):
     )
 
     assert response.status_code == 403
-    assert models.Document.objects.count() == 2
+    assert models.Document.objects.count() == 1
 
 
 @pytest.mark.parametrize("role", ["reader", "editor", "administrator"])
@@ -52,7 +52,7 @@ def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_teams
     Authenticated users should not be allowed to delete a document for which they are
     only a reader, editor or administrator.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -74,7 +74,7 @@ def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_teams
     assert response.json() == {
         "detail": "You do not have permission to perform this action."
     }
-    assert models.Document.objects.count() == 2
+    assert models.Document.objects.count() == 1
 
 
 @pytest.mark.parametrize("via", VIA)

src/backend/core/tests/documents/test_api_documents_link_configuration.py

@@ -42,7 +42,7 @@ def test_api_documents_link_configuration_update_authenticated_unrelated(reach,
     Authenticated users should not be allowed to update the link configuration for
     a document to which they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -78,7 +78,7 @@ def test_api_documents_link_configuration_update_authenticated_related_forbidden
     Users who are readers or editors of a document should not be allowed to update
     the link configuration.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)

src/backend/core/tests/documents/test_api_documents_retrieve.py

@@ -21,11 +21,8 @@ def test_api_documents_retrieve_anonymous_public():
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
-            "ai_transform": document.link_role == "editor",
-            "ai_translate": document.link_role == "editor",
             "attachment_upload": document.link_role == "editor",
             "destroy": False,
-            "invite_owner": False,
             "link_configuration": False,
             "manage_accesses": False,
             "partial_update": document.link_role == "editor",
@@ -78,12 +75,9 @@ def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
-            "ai_transform": document.link_role == "editor",
-            "ai_translate": document.link_role == "editor",
             "attachment_upload": document.link_role == "editor",
             "link_configuration": False,
             "destroy": False,
-            "invite_owner": False,
             "manage_accesses": False,
             "partial_update": document.link_role == "editor",
             "retrieve": True,
@@ -139,7 +133,7 @@ def test_api_documents_retrieve_authenticated_unrelated_restricted():
     Authenticated users should not be allowed to retrieve a document that is restricted and
     to which they are not related.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -214,7 +208,7 @@ def test_api_documents_retrieve_authenticated_related_team_none(mock_user_teams)
     """
     mock_user_teams.return_value = []
 
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)

src/backend/core/tests/documents/test_api_documents_retrieve_auth.py

@@ -142,7 +142,7 @@ def test_api_documents_retrieve_auth_authenticated_restricted():
     """
     document = factories.DocumentFactory(link_reach="restricted")
 
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 

src/backend/core/tests/documents/test_api_documents_update.py

@@ -66,14 +66,14 @@ def test_api_documents_update_authenticated_unrelated_forbidden(reach, role):
     Authenticated users should not be allowed to update a document to which
     they are not related if the link configuration does not allow it.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
     document = factories.DocumentFactory(link_reach=reach, link_role=role)
-
     old_document_values = serializers.DocumentSerializer(instance=document).data
+
     new_document_values = serializers.DocumentSerializer(
         instance=factories.DocumentFactory()
     ).data
@@ -111,14 +111,14 @@ def test_api_documents_update_anonymous_or_authenticated_unrelated(
     client = APIClient()
 
     if is_authenticated:
-        user = factories.UserFactory(with_owned_document=True)
+        user = factories.UserFactory()
         client.force_login(user)
     else:
         user = AnonymousUser()
 
     document = factories.DocumentFactory(link_reach=reach, link_role=role)
-
     old_document_values = serializers.DocumentSerializer(instance=document).data
+
     new_document_values = serializers.DocumentSerializer(
         instance=factories.DocumentFactory()
     ).data
@@ -146,7 +146,7 @@ def test_api_documents_update_authenticated_reader(via, mock_user_teams):
     Users who are reader of a document but not administrators should
     not be allowed to update it.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -187,7 +187,7 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
     via, role, mock_user_teams
 ):
     """A user who is editor, administrator or owner of a document should be allowed to update it."""
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -227,7 +227,7 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
 @pytest.mark.parametrize("via", VIA)
 def test_api_documents_update_authenticated_owners(via, mock_user_teams):
     """Administrators of a document should be allowed to update it."""
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -269,7 +269,7 @@ def test_api_documents_update_administrator_or_owner_of_another(via, mock_user_t
     Being administrator or owner of a document should not grant authorization to update
     another document.
     """
-    user = factories.UserFactory(with_owned_document=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)

src/backend/core/tests/templates/test_api_template_accesses_create.py

@@ -1,206 +0,0 @@
-"""
-Test template accesses create API endpoint for users in impress's core app.
-"""
-
-import random
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories, models
-from core.tests.conftest import TEAM, USER, VIA
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_template_accesses_create_anonymous():
-    """Anonymous users should not be allowed to create template accesses."""
-    template = factories.TemplateFactory()
-
-    other_user = factories.UserFactory()
-    response = APIClient().post(
-        f"/api/v1.0/templates/{template.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "template": str(template.id),
-            "role": random.choice(models.RoleChoices.choices)[0],
-        },
-        format="json",
-    )
-
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-    assert models.TemplateAccess.objects.exists() is False
-
-
-def test_api_template_accesses_create_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to create template accesses for a template to
-    which they are not related.
-    """
-    user = factories.UserFactory(with_owned_template=True)
-
-    client = APIClient()
-    client.force_login(user)
-
-    other_user = factories.UserFactory()
-    template = factories.TemplateFactory()
-
-    response = client.post(
-        f"/api/v1.0/templates/{template.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-        },
-        format="json",
-    )
-
-    assert response.status_code == 403
-    assert not models.TemplateAccess.objects.filter(user=other_user).exists()
-
-
-@pytest.mark.parametrize("role", ["reader", "editor"])
-@pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_create_authenticated_editor_or_reader(
-    via, role, mock_user_teams
-):
-    """Editors or readers of a template should not be allowed to create template accesses."""
-    user = factories.UserFactory(with_owned_template=True)
-
-    client = APIClient()
-    client.force_login(user)
-
-    template = factories.TemplateFactory()
-    if via == USER:
-        factories.UserTemplateAccessFactory(template=template, user=user, role=role)
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamTemplateAccessFactory(
-            template=template, team="lasuite", role=role
-        )
-
-    other_user = factories.UserFactory()
-
-    for new_role in [role[0] for role in models.RoleChoices.choices]:
-        response = client.post(
-            f"/api/v1.0/templates/{template.id!s}/accesses/",
-            {
-                "user": str(other_user.id),
-                "role": new_role,
-            },
-            format="json",
-        )
-
-        assert response.status_code == 403
-
-    assert not models.TemplateAccess.objects.filter(user=other_user).exists()
-
-
-@pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_create_authenticated_administrator(via, mock_user_teams):
-    """
-    Administrators of a template should be able to create template accesses
-    except for the "owner" role.
-    """
-    user = factories.UserFactory(with_owned_template=True)
-
-    client = APIClient()
-    client.force_login(user)
-
-    template = factories.TemplateFactory()
-    if via == USER:
-        factories.UserTemplateAccessFactory(
-            template=template, user=user, role="administrator"
-        )
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamTemplateAccessFactory(
-            template=template, team="lasuite", role="administrator"
-        )
-
-    other_user = factories.UserFactory()
-
-    # It should not be allowed to create an owner access
-    response = client.post(
-        f"/api/v1.0/templates/{template.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": "owner",
-        },
-        format="json",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "Only owners of a resource can assign other users as owners."
-    }
-
-    # It should be allowed to create a lower access
-    role = random.choice(
-        [role[0] for role in models.RoleChoices.choices if role[0] != "owner"]
-    )
-
-    response = client.post(
-        f"/api/v1.0/templates/{template.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": role,
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201
-    assert models.TemplateAccess.objects.filter(user=other_user).count() == 1
-    new_template_access = models.TemplateAccess.objects.filter(user=other_user).get()
-    assert response.json() == {
-        "abilities": new_template_access.get_abilities(user),
-        "id": str(new_template_access.id),
-        "team": "",
-        "role": role,
-        "user": str(other_user.id),
-    }
-
-
-@pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_create_authenticated_owner(via, mock_user_teams):
-    """
-    Owners of a template should be able to create template accesses whatever the role.
-    """
-    user = factories.UserFactory(with_owned_template=True)
-
-    client = APIClient()
-    client.force_login(user)
-
-    template = factories.TemplateFactory()
-    if via == USER:
-        factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
-    elif via == TEAM:
-        mock_user_teams.return_value = ["lasuite", "unknown"]
-        factories.TeamTemplateAccessFactory(
-            template=template, team="lasuite", role="owner"
-        )
-
-    other_user = factories.UserFactory()
-
-    role = random.choice([role[0] for role in models.RoleChoices.choices])
-
-    response = client.post(
-        f"/api/v1.0/templates/{template.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": role,
-        },
-        format="json",
-    )
-
-    assert response.status_code == 201
-    assert models.TemplateAccess.objects.filter(user=other_user).count() == 1
-    new_template_access = models.TemplateAccess.objects.filter(user=other_user).get()
-    assert response.json() == {
-        "id": str(new_template_access.id),
-        "user": str(other_user.id),
-        "team": "",
-        "role": role,
-        "abilities": new_template_access.get_abilities(user),
-    }

src/backend/core/tests/test_api_template_accesses.py

@@ -32,7 +32,7 @@ def test_api_template_accesses_list_authenticated_unrelated():
     Authenticated users should not be allowed to list template accesses for a template
     to which they are not related.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -62,7 +62,7 @@ def test_api_template_accesses_list_authenticated_related(via, mock_user_teams):
     Authenticated users should be able to list template accesses for a template
     to which they are directly related, whatever their role in the template.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -146,7 +146,7 @@ def test_api_template_accesses_retrieve_authenticated_unrelated():
     Authenticated users should not be allowed to retrieve a template access for
     a template to which they are not related.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -183,7 +183,7 @@ def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_tea
     A user who is related to a template should be allowed to retrieve the
     associated template user accesses.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -211,6 +211,199 @@ def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_tea
     }
 
 
+def test_api_template_accesses_create_anonymous():
+    """Anonymous users should not be allowed to create template accesses."""
+    user = factories.UserFactory()
+    template = factories.TemplateFactory()
+
+    response = APIClient().post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(user.id),
+            "template": str(template.id),
+            "role": random.choice(models.RoleChoices.choices)[0],
+        },
+        format="json",
+    )
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+    assert models.TemplateAccess.objects.exists() is False
+
+
+def test_api_template_accesses_create_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to create template accesses for a template to
+    which they are not related.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+    template = factories.TemplateFactory()
+
+    response = client.post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert not models.TemplateAccess.objects.filter(user=other_user).exists()
+
+
+@pytest.mark.parametrize("role", ["reader", "editor"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_create_authenticated_editor_or_reader(
+    via, role, mock_user_teams
+):
+    """Editors or readers of a template should not be allowed to create template accesses."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role=role
+        )
+
+    other_user = factories.UserFactory()
+
+    for new_role in [role[0] for role in models.RoleChoices.choices]:
+        response = client.post(
+            f"/api/v1.0/templates/{template.id!s}/accesses/",
+            {
+                "user": str(other_user.id),
+                "role": new_role,
+            },
+            format="json",
+        )
+
+        assert response.status_code == 403
+
+    assert not models.TemplateAccess.objects.filter(user=other_user).exists()
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_create_authenticated_administrator(via, mock_user_teams):
+    """
+    Administrators of a template should be able to create template accesses
+    except for the "owner" role.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(
+            template=template, user=user, role="administrator"
+        )
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="administrator"
+        )
+
+    other_user = factories.UserFactory()
+
+    # It should not be allowed to create an owner access
+    response = client.post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": "owner",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Only owners of a resource can assign other users as owners."
+    }
+
+    # It should be allowed to create a lower access
+    role = random.choice(
+        [role[0] for role in models.RoleChoices.choices if role[0] != "owner"]
+    )
+
+    response = client.post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.TemplateAccess.objects.filter(user=other_user).count() == 1
+    new_template_access = models.TemplateAccess.objects.filter(user=other_user).get()
+    assert response.json() == {
+        "abilities": new_template_access.get_abilities(user),
+        "id": str(new_template_access.id),
+        "team": "",
+        "role": role,
+        "user": str(other_user.id),
+    }
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_template_accesses_create_authenticated_owner(via, mock_user_teams):
+    """
+    Owners of a template should be able to create template accesses whatever the role.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    template = factories.TemplateFactory()
+    if via == USER:
+        factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamTemplateAccessFactory(
+            template=template, team="lasuite", role="owner"
+        )
+
+    other_user = factories.UserFactory()
+
+    role = random.choice([role[0] for role in models.RoleChoices.choices])
+
+    response = client.post(
+        f"/api/v1.0/templates/{template.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.TemplateAccess.objects.filter(user=other_user).count() == 1
+    new_template_access = models.TemplateAccess.objects.filter(user=other_user).get()
+    assert response.json() == {
+        "id": str(new_template_access.id),
+        "user": str(other_user.id),
+        "team": "",
+        "role": role,
+        "abilities": new_template_access.get_abilities(user),
+    }
+
+
 def test_api_template_accesses_update_anonymous():
     """Anonymous users should not be allowed to update a template access."""
     access = factories.UserTemplateAccessFactory()
@@ -241,14 +434,14 @@ def test_api_template_accesses_update_authenticated_unrelated():
     Authenticated users should not be allowed to update a template access for a template to which
     they are not related.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
     access = factories.UserTemplateAccessFactory()
-
     old_values = serializers.TemplateAccessSerializer(instance=access).data
+
     new_values = {
         "id": uuid4(),
         "user": factories.UserFactory().id,
@@ -274,7 +467,7 @@ def test_api_template_accesses_update_authenticated_editor_or_reader(
     via, role, mock_user_teams
 ):
     """Editors or readers of a template should not be allowed to update its accesses."""
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -316,7 +509,7 @@ def test_api_template_accesses_update_administrator_except_owner(via, mock_user_
     A user who is a direct administrator in a template should be allowed to update a user
     access for this template, as long as they don't try to set the role to owner.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -336,8 +529,8 @@ def test_api_template_accesses_update_administrator_except_owner(via, mock_user_
         template=template,
         role=random.choice(["administrator", "editor", "reader"]),
     )
-
     old_values = serializers.TemplateAccessSerializer(instance=access).data
+
     new_values = {
         "id": uuid4(),
         "user_id": factories.UserFactory().id,
@@ -373,7 +566,7 @@ def test_api_template_accesses_update_administrator_from_owner(via, mock_user_te
     A user who is an administrator in a template, should not be allowed to update
     the user access of an "owner" for this template.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -393,8 +586,8 @@ def test_api_template_accesses_update_administrator_from_owner(via, mock_user_te
     access = factories.UserTemplateAccessFactory(
         template=template, user=other_user, role="owner"
     )
-
     old_values = serializers.TemplateAccessSerializer(instance=access).data
+
     new_values = {
         "id": uuid4(),
         "user_id": factories.UserFactory().id,
@@ -420,7 +613,7 @@ def test_api_template_accesses_update_administrator_to_owner(via, mock_user_team
     A user who is an administrator in a template, should not be allowed to update
     the user access of another user to grant template ownership.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -442,8 +635,8 @@ def test_api_template_accesses_update_administrator_to_owner(via, mock_user_team
         user=other_user,
         role=random.choice(["administrator", "editor", "reader"]),
     )
-
     old_values = serializers.TemplateAccessSerializer(instance=access).data
+
     new_values = {
         "id": uuid4(),
         "user_id": factories.UserFactory().id,
@@ -474,7 +667,7 @@ def test_api_template_accesses_update_owner(via, mock_user_teams):
     A user who is an owner in a template should be allowed to update
     a user access for this template whatever the role.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -492,8 +685,8 @@ def test_api_template_accesses_update_owner(via, mock_user_teams):
     access = factories.UserTemplateAccessFactory(
         template=template,
     )
-
     old_values = serializers.TemplateAccessSerializer(instance=access).data
+
     new_values = {
         "id": uuid4(),
         "user_id": factories.UserFactory().id,
@@ -530,21 +723,22 @@ def test_api_template_accesses_update_owner_self(via, mock_user_teams):
     A user who is owner of a template should be allowed to update
     their own user access provided there are other owners in the template.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
     template = factories.TemplateFactory()
-    if via == TEAM:
+    access = None
+    if via == USER:
+        access = factories.UserTemplateAccessFactory(
+            template=template, user=user, role="owner"
+        )
+    elif via == TEAM:
         mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
-    else:
-        access = factories.UserTemplateAccessFactory(
-            template=template, user=user, role="owner"
-        )
 
     old_values = serializers.TemplateAccessSerializer(instance=access).data
     new_role = random.choice(["administrator", "editor", "reader"])
@@ -593,7 +787,7 @@ def test_api_template_accesses_delete_authenticated():
     Authenticated users should not be allowed to delete a template access for a
     template to which they are not related.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -605,7 +799,7 @@ def test_api_template_accesses_delete_authenticated():
     )
 
     assert response.status_code == 403
-    assert models.TemplateAccess.objects.count() == 2
+    assert models.TemplateAccess.objects.count() == 1
 
 
 @pytest.mark.parametrize("role", ["reader", "editor"])
@@ -615,7 +809,7 @@ def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_team
     Authenticated users should not be allowed to delete a template access for a
     template in which they are a simple editor or reader.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -631,7 +825,7 @@ def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_team
 
     access = factories.UserTemplateAccessFactory(template=template)
 
-    assert models.TemplateAccess.objects.count() == 3
+    assert models.TemplateAccess.objects.count() == 2
     assert models.TemplateAccess.objects.filter(user=access.user).exists()
 
     response = client.delete(
@@ -639,7 +833,7 @@ def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_team
     )
 
     assert response.status_code == 403
-    assert models.TemplateAccess.objects.count() == 3
+    assert models.TemplateAccess.objects.count() == 2
 
 
 @pytest.mark.parametrize("via", VIA)
@@ -687,7 +881,7 @@ def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_tea
     Users who are administrators in a template should not be allowed to delete an ownership
     access from the template.
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -705,7 +899,7 @@ def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_tea
 
     access = factories.UserTemplateAccessFactory(template=template, role="owner")
 
-    assert models.TemplateAccess.objects.count() == 3
+    assert models.TemplateAccess.objects.count() == 2
     assert models.TemplateAccess.objects.filter(user=access.user).exists()
 
     response = client.delete(
@@ -713,7 +907,7 @@ def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_tea
     )
 
     assert response.status_code == 403
-    assert models.TemplateAccess.objects.count() == 3
+    assert models.TemplateAccess.objects.count() == 2
 
 
 @pytest.mark.parametrize("via", VIA)
@@ -754,7 +948,7 @@ def test_api_template_accesses_delete_owners_last_owner(via, mock_user_teams):
     """
     It should not be possible to delete the last owner access from a template
     """
-    user = factories.UserFactory(with_owned_template=True)
+    user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
@@ -771,10 +965,10 @@ def test_api_template_accesses_delete_owners_last_owner(via, mock_user_teams):
             template=template, team="lasuite", role="owner"
         )
 
-    assert models.TemplateAccess.objects.count() == 2
+    assert models.TemplateAccess.objects.count() == 1
     response = client.delete(
         f"/api/v1.0/templates/{template.id!s}/accesses/{access.id!s}/",
     )
 
     assert response.status_code == 403
-    assert models.TemplateAccess.objects.count() == 2
+    assert models.TemplateAccess.objects.count() == 1

src/backend/core/tests/test_api_utils_ai_document_rate_throttles.py

@@ -1,127 +0,0 @@
-"""
-Test throttling on documents for the AI endpoint.
-"""
-
-from unittest.mock import patch
-
-from django.core.cache import cache
-from django.test import override_settings
-
-import pytest
-from rest_framework.response import Response
-from rest_framework.test import APIRequestFactory
-from rest_framework.views import APIView
-
-from core.api.utils import AIDocumentRateThrottle
-
-
-class DocumentAPIView(APIView):
-    """A simple view to test the throttle"""
-
-    throttle_classes = [AIDocumentRateThrottle]
-
-    def get(self, request, *args, **kwargs):
-        """Minimal get method for testing purposes."""
-        return Response({"message": "Success"})
-
-
-@pytest.fixture(autouse=True)
-def clear_cache():
-    """Fixture to clear the cache before each test."""
-    cache.clear()
-
-
-@override_settings(AI_DOCUMENT_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@patch("time.time")
-def test_api_utils_ai_document_rate_throttle_minute_limit(mock_time):
-    """Test that minute limit is enforced."""
-    api_rf = APIRequestFactory()
-    mock_time.return_value = 1000000
-
-    # Simulate requests to the document API
-    for _i in range(3):  # 3 first requests should be allowed
-        request = api_rf.get("/documents/1/")
-        response = DocumentAPIView.as_view()(request, pk=1)
-        assert response.status_code == 200
-
-    # Simulate passage of time
-    mock_time.return_value += 59
-
-    # 4th request should be throttled
-    request = api_rf.get("/documents/1/")
-    response = DocumentAPIView.as_view()(request, pk=1)
-    assert response.status_code == 429
-
-    # After the 60s backoff wait time has passed, we can make a request again
-    mock_time.return_value += 1
-
-    request = api_rf.get("/documents/1/")
-    response = DocumentAPIView.as_view()(request, pk=1)
-    assert response.status_code == 200
-
-
-@override_settings(
-    AI_DOCUMENT_RATE_THROTTLE_RATES={"minute": 100000, "hour": 6, "day": 10}
-)
-@patch("time.time")
-def test_ai_document_rate_throttle_hour_limit(mock_time):
-    """Test that the hour limit is enforced without hitting the minute limit."""
-    api_rf = APIRequestFactory()
-    mock_time.return_value = 1000000
-
-    # Make requests to the document API, one per 21 seconds to avoid hitting the minute limit
-    for _i in range(6):
-        request = api_rf.get("/documents/1/")
-        response = DocumentAPIView.as_view()(request, pk=1)
-        assert response.status_code == 200
-
-        # Simulate passage of time
-        mock_time.return_value += 21
-
-    # Simulate passage of time
-    mock_time.return_value += 3600 - 6 * 21 - 1
-
-    # 7th request should be throttled
-    request = api_rf.get("/documents/1/")
-    response = DocumentAPIView.as_view()(request, pk=1)
-    assert response.status_code == 429
-
-    # After the 1h backoff wait time has passed, we can make a request again
-    mock_time.return_value += 1
-
-    request = api_rf.get("/documents/1/")
-    response = DocumentAPIView.as_view()(request, pk=1)
-    assert response.status_code == 200
-
-
-@override_settings(AI_DOCUMENT_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@patch("time.time")
-def test_api_utils_ai_document_rate_throttle_day_limit(mock_time):
-    """Test that day limit is enforced."""
-    api_rf = APIRequestFactory()
-    mock_time.return_value = 1000000
-
-    # Make requests to the document API, one per 10 minutes to avoid hitting
-    # the minute and hour limits
-    for _i in range(10):  # 10 requests should be allowed
-        request = api_rf.get("/documents/1/")
-        response = DocumentAPIView.as_view()(request, pk=1)
-        assert response.status_code == 200
-
-        # Simulate passage of time
-        mock_time.return_value += 60 * 10
-
-    # Simulate passage of time
-    mock_time.return_value += 24 * 3600 - 10 * 60 * 10 - 1
-
-    # 11th request should be throttled
-    request = api_rf.get("/documents/1/")
-    response = DocumentAPIView.as_view()(request, pk=1)
-    assert response.status_code == 429
-
-    # After the 24h backoff wait time has passed we can make a request again
-    mock_time.return_value += 1
-
-    request = api_rf.get("/documents/1/")
-    response = DocumentAPIView.as_view()(request, pk=1)
-    assert response.status_code == 200

src/backend/core/tests/test_api_utils_ai_user_rate_throttles.py

@@ -1,146 +0,0 @@
-"""
-Test throttling on users for the AI endpoint.
-"""
-
-from unittest.mock import patch
-from uuid import uuid4
-
-from django.core.cache import cache
-from django.test import override_settings
-
-import pytest
-from rest_framework.response import Response
-from rest_framework.test import APIRequestFactory
-from rest_framework.views import APIView
-
-from core.api.utils import AIUserRateThrottle
-from core.factories import UserFactory
-
-pytestmark = pytest.mark.django_db
-
-
-class DocumentAPIView(APIView):
-    """A simple view to test the throttle"""
-
-    throttle_classes = [AIUserRateThrottle]
-
-    def get(self, request, *args, **kwargs):
-        """Minimal get method for testing purposes."""
-        return Response({"message": "Success"})
-
-
-@pytest.fixture(autouse=True)
-def clear_cache():
-    """Fixture to clear the cache before each test."""
-    cache.clear()
-
-
-@override_settings(AI_USER_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@patch("time.time")
-def test_api_utils_ai_user_rate_throttle_minute_limit(mock_time):
-    """Test that minute limit is enforced."""
-    user = UserFactory()
-    api_rf = APIRequestFactory()
-    mock_time.return_value = 1000000
-
-    # Simulate requests to the document API
-    for _i in range(3):  # 3 first requests should be allowed
-        document_id = str(uuid4())
-        request = api_rf.get(f"/documents/{document_id:s}/")
-        request.user = user
-        response = DocumentAPIView.as_view()(request, pk=document_id)
-        assert response.status_code == 200
-
-    # Simulate passage of time
-    mock_time.return_value += 59
-
-    # 4th request should be throttled
-    document_id = str(uuid4())
-    request = api_rf.get(f"/documents/{document_id:s}/")
-    request.user = user
-    response = DocumentAPIView.as_view()(request, pk=document_id)
-    assert response.status_code == 429
-
-    # After the 60s backoff wait time has passed, we can make a request again
-    mock_time.return_value += 1
-
-    document_id = str(uuid4())
-    request = api_rf.get(f"/documents/{document_id:s}/")
-    request.user = user
-    response = DocumentAPIView.as_view()(request, pk=document_id)
-    assert response.status_code == 200
-
-
-@override_settings(AI_USER_RATE_THROTTLE_RATES={"minute": 100000, "hour": 6, "day": 10})
-@patch("time.time")
-def test_ai_user_rate_throttle_hour_limit(mock_time):
-    """Test that the hour limit is enforced without hitting the minute limit."""
-    user = UserFactory()
-    api_rf = APIRequestFactory()
-    mock_time.return_value = 1000000
-
-    # Make requests to the document API, one per 21 seconds to avoid hitting the minute limit
-    for _i in range(6):
-        document_id = str(uuid4())
-        request = api_rf.get(f"/documents/{document_id:s}/")
-        request.user = user
-        response = DocumentAPIView.as_view()(request, pk=document_id)
-        assert response.status_code == 200
-
-        # Simulate passage of time
-        mock_time.return_value += 21
-
-    # Simulate passage of time
-    mock_time.return_value += 3600 - 6 * 21 - 1
-
-    # 7th request should be throttled
-    request = api_rf.get(f"/documents/{document_id:s}/")
-    request.user = user
-    response = DocumentAPIView.as_view()(request, pk=document_id)
-    assert response.status_code == 429
-
-    # After the 1h backoff wait time has passed, we can make a request again
-    mock_time.return_value += 1
-
-    request = api_rf.get(f"/documents/{document_id:s}/")
-    request.user = user
-    response = DocumentAPIView.as_view()(request, pk=document_id)
-    assert response.status_code == 200
-
-
-@override_settings(AI_USER_RATE_THROTTLE_RATES={"minute": 3, "hour": 6, "day": 10})
-@patch("time.time")
-def test_api_utils_ai_user_rate_throttle_day_limit(mock_time):
-    """Test that day limit is enforced."""
-    user = UserFactory()
-    api_rf = APIRequestFactory()
-    mock_time.return_value = 1000000
-
-    # Make requests to the document API, one per 10 minutes to avoid hitting
-    # the minute and hour limits
-    for _i in range(10):  # 10 requests should be allowed
-        document_id = str(uuid4())
-        request = api_rf.get(f"/documents/{document_id:s}/")
-        request.user = user
-        response = DocumentAPIView.as_view()(request, pk=document_id)
-        assert response.status_code == 200
-
-        # Simulate passage of time
-        mock_time.return_value += 60 * 10
-
-    # Simulate passage of time
-    mock_time.return_value += 24 * 3600 - 10 * 60 * 10 - 1
-
-    # 11th request should be throttled
-    request = api_rf.get(f"/documents/{document_id:s}/")
-    request.user = user
-    response = DocumentAPIView.as_view()(request, pk=document_id)
-    assert response.status_code == 429
-
-    # After the 24h backoff wait time has passed we can make a request again
-    mock_time.return_value += 1
-
-    request = api_rf.get(f"/documents/{document_id:s}/")
-    request.user = user
-    response = DocumentAPIView.as_view()(request, pk=document_id)
-    assert response.status_code == 200

src/backend/core/tests/test_models_documents.py

@@ -83,12 +83,9 @@ def test_models_documents_get_abilities_forbidden(is_authenticated, reach, role)
     user = factories.UserFactory() if is_authenticated else AnonymousUser()
     abilities = document.get_abilities(user)
     assert abilities == {
-        "ai_transform": False,
-        "ai_translate": False,
         "attachment_upload": False,
         "link_configuration": False,
         "destroy": False,
-        "invite_owner": False,
         "manage_accesses": False,
         "partial_update": False,
         "retrieve": False,
@@ -116,12 +113,9 @@ def test_models_documents_get_abilities_reader(is_authenticated, reach):
     user = factories.UserFactory() if is_authenticated else AnonymousUser()
     abilities = document.get_abilities(user)
     assert abilities == {
-        "ai_transform": False,
-        "ai_translate": False,
         "attachment_upload": False,
         "destroy": False,
         "link_configuration": False,
-        "invite_owner": False,
         "manage_accesses": False,
         "partial_update": False,
         "retrieve": True,
@@ -149,12 +143,9 @@ def test_models_documents_get_abilities_editor(is_authenticated, reach):
     user = factories.UserFactory() if is_authenticated else AnonymousUser()
     abilities = document.get_abilities(user)
     assert abilities == {
-        "ai_transform": True,
-        "ai_translate": True,
         "attachment_upload": True,
         "destroy": False,
         "link_configuration": False,
-        "invite_owner": False,
         "manage_accesses": False,
         "partial_update": True,
         "retrieve": True,
@@ -171,12 +162,9 @@ def test_models_documents_get_abilities_owner():
     access = factories.UserDocumentAccessFactory(role="owner", user=user)
     abilities = access.document.get_abilities(access.user)
     assert abilities == {
-        "ai_transform": True,
-        "ai_translate": True,
         "attachment_upload": True,
         "destroy": True,
         "link_configuration": True,
-        "invite_owner": True,
         "manage_accesses": True,
         "partial_update": True,
         "retrieve": True,
@@ -192,12 +180,9 @@ def test_models_documents_get_abilities_administrator():
     access = factories.UserDocumentAccessFactory(role="administrator")
     abilities = access.document.get_abilities(access.user)
     assert abilities == {
-        "ai_transform": True,
-        "ai_translate": True,
         "attachment_upload": True,
         "destroy": False,
         "link_configuration": True,
-        "invite_owner": False,
         "manage_accesses": True,
         "partial_update": True,
         "retrieve": True,
@@ -216,12 +201,9 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
-        "ai_transform": True,
-        "ai_translate": True,
         "attachment_upload": True,
         "destroy": False,
         "link_configuration": False,
-        "invite_owner": False,
         "manage_accesses": False,
         "partial_update": True,
         "retrieve": True,
@@ -242,12 +224,9 @@ def test_models_documents_get_abilities_reader_user(django_assert_num_queries):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
-        "ai_transform": False,
-        "ai_translate": False,
         "attachment_upload": False,
         "destroy": False,
         "link_configuration": False,
-        "invite_owner": False,
         "manage_accesses": False,
         "partial_update": False,
         "retrieve": True,
@@ -269,12 +248,9 @@ def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
-        "ai_transform": False,
-        "ai_translate": False,
         "attachment_upload": False,
         "destroy": False,
         "link_configuration": False,
-        "invite_owner": False,
         "manage_accesses": False,
         "partial_update": False,
         "retrieve": True,
@@ -387,9 +363,8 @@ def test_models_documents__email_invitation__success():
     # pylint: disable-next=no-member
     assert len(mail.outbox) == 0
 
-    sender = factories.UserFactory(full_name="Test Sender", email="sender@example.com")
     document.email_invitation(
-        "en", "guest@example.com", models.RoleChoices.EDITOR, sender
+        "en", "guest@example.com", models.RoleChoices.EDITOR, "sender@example.com"
     )
 
     # pylint: disable-next=no-member
@@ -402,8 +377,8 @@ def test_models_documents__email_invitation__success():
     email_content = " ".join(email.body.split())
 
     assert (
-        f'Test Sender (sender@example.com) invited you with the role "editor" '
-        f"on the following document : {document.title}" in email_content
+        f"sender@example.com invited you as an editor on the following document : {document.title}"
+        in email_content
     )
     assert f"docs/{document.id}/" in email_content
 
@@ -417,14 +392,8 @@ def test_models_documents__email_invitation__success_fr():
     # pylint: disable-next=no-member
     assert len(mail.outbox) == 0
 
-    sender = factories.UserFactory(
-        full_name="Test Sender2", email="sender2@example.com"
-    )
     document.email_invitation(
-        "fr-fr",
-        "guest2@example.com",
-        models.RoleChoices.OWNER,
-        sender,
+        "fr-fr", "guest2@example.com", models.RoleChoices.OWNER, "sender2@example.com"
     )
 
     # pylint: disable-next=no-member
@@ -437,7 +406,7 @@ def test_models_documents__email_invitation__success_fr():
     email_content = " ".join(email.body.split())
 
     assert (
-        f'Test Sender2 (sender2@example.com) vous a invité avec le rôle "propriétaire" '
+        f"sender2@example.com vous a invité en tant que propriétaire "
         f"sur le document suivant : {document.title}" in email_content
     )
     assert f"docs/{document.id}/" in email_content
@@ -455,12 +424,8 @@ def test_models_documents__email_invitation__failed(mock_logger, _mock_send_mail
     # pylint: disable-next=no-member
     assert len(mail.outbox) == 0
 
-    sender = factories.UserFactory()
     document.email_invitation(
-        "en",
-        "guest3@example.com",
-        models.RoleChoices.ADMIN,
-        sender,
+        "en", "guest3@example.com", models.RoleChoices.ADMIN, "sender3@example.com"
     )
 
     # No email has been sent

src/backend/core/tests/test_models_invitations.py

@@ -2,12 +2,10 @@
 Unit tests for the Invitation model
 """
 
-from datetime import timedelta
-from unittest import mock
+import time
 
 from django.contrib.auth.models import AnonymousUser
 from django.core import exceptions
-from django.utils import timezone
 
 import pytest
 from faker import Faker
@@ -62,7 +60,7 @@ def test_models_invitations_role_among_choices():
         factories.InvitationFactory(role="boss")
 
 
-def test_models_invitations_is_expired():
+def test_models_invitations__is_expired(settings):
     """
     The 'is_expired' property should return False until validity duration
     is exceeded and True afterwards.
@@ -70,16 +68,13 @@ def test_models_invitations_is_expired():
     expired_invitation = factories.InvitationFactory()
     assert expired_invitation.is_expired is False
 
-    not_late = timezone.now() + timedelta(seconds=604799)
-    with mock.patch("django.utils.timezone.now", return_value=not_late):
-        assert expired_invitation.is_expired is False
+    settings.INVITATION_VALIDITY_DURATION = 1
+    time.sleep(1)
 
-    too_late = timezone.now() + timedelta(seconds=604800)  # 7 days
-    with mock.patch("django.utils.timezone.now", return_value=too_late):
-        assert expired_invitation.is_expired is True
+    assert expired_invitation.is_expired is True
 
 
-def test_models_invitationd_new_userd_convert_invitations_to_accesses():
+def test_models_invitation__new_user__convert_invitations_to_accesses():
     """
     Upon creating a new user, invitations linked to the email
     should be converted to accesses and then deleted.
@@ -114,7 +109,7 @@ def test_models_invitationd_new_userd_convert_invitations_to_accesses():
     ).exists()  # the other invitation remains
 
 
-def test_models_invitationd_new_user_filter_expired_invitations():
+def test_models_invitation__new_user__filter_expired_invitations():
     """
     Upon creating a new identity, valid invitations should be converted into accesses
     and expired invitations should remain unchanged.
@@ -145,7 +140,7 @@ def test_models_invitationd_new_user_filter_expired_invitations():
 
 
 @pytest.mark.parametrize("num_invitations, num_queries", [(0, 3), (1, 6), (20, 6)])
-def test_models_invitationd_new_userd_user_creation_constant_num_queries(
+def test_models_invitation__new_user__user_creation_constant_num_queries(
     django_assert_num_queries, num_invitations, num_queries
 ):
     """
@@ -240,7 +235,7 @@ def test_models_document_invitations_get_abilities_reader(via, mock_user_teams):
 
     assert abilities == {
         "destroy": False,
-        "retrieve": False,
+        "retrieve": True,
         "partial_update": False,
         "update": False,
     }
@@ -265,7 +260,7 @@ def test_models_document_invitations_get_abilities_editor(via, mock_user_teams):
 
     assert abilities == {
         "destroy": False,
-        "retrieve": False,
+        "retrieve": True,
         "partial_update": False,
         "update": False,
     }

src/backend/core/tests/test_services_ai_services.py

@@ -1,104 +0,0 @@
-"""
-Test ai API endpoints in the impress core app.
-"""
-
-import json
-from unittest.mock import MagicMock, patch
-
-from django.core.exceptions import ImproperlyConfigured
-from django.test.utils import override_settings
-
-import pytest
-from openai import OpenAIError
-
-from core.services.ai_services import AIService
-
-pytestmark = pytest.mark.django_db
-
-
-@pytest.mark.parametrize(
-    "setting_name, setting_value",
-    [
-        ("AI_BASE_URL", None),
-        ("AI_API_KEY", None),
-        ("AI_MODEL", None),
-    ],
-)
-def test_api_ai_setting_missing(setting_name, setting_value):
-    """Setting should be set"""
-
-    with override_settings(**{setting_name: setting_value}):
-        with pytest.raises(
-            ImproperlyConfigured,
-            match="AI configuration not set",
-        ):
-            AIService()
-
-
-@override_settings(
-    AI_BASE_URL="http://example.com", AI_API_KEY="test-key", AI_MODEL="test-model"
-)
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_ai__client_error(mock_create):
-    """Fail when the client raises an error"""
-
-    mock_create.side_effect = OpenAIError("Mocked client error")
-
-    with pytest.raises(
-        OpenAIError,
-        match="Mocked client error",
-    ):
-        AIService().transform("hello", "prompt")
-
-
-@override_settings(
-    AI_BASE_URL="http://example.com", AI_API_KEY="test-key", AI_MODEL="test-model"
-)
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_ai__client_invalid_response(mock_create):
-    """Fail when the client response is invalid"""
-
-    answer = {"no_answer": "This is an invalid response"}
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=json.dumps(answer)))]
-    )
-
-    with pytest.raises(
-        RuntimeError,
-        match="AI response does not contain an answer",
-    ):
-        AIService().transform("hello", "prompt")
-
-
-@override_settings(
-    AI_BASE_URL="http://example.com", AI_API_KEY="test-key", AI_MODEL="test-model"
-)
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_ai__success(mock_create):
-    """The AI request should work as expect when called with valid arguments."""
-
-    answer = '{"answer": "Salut"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    response = AIService().transform("hello", "prompt")
-
-    assert response == {"answer": "Salut"}
-
-
-@override_settings(
-    AI_BASE_URL="http://example.com", AI_API_KEY="test-key", AI_MODEL="test-model"
-)
-@patch("openai.resources.chat.completions.Completions.create")
-def test_api_ai__success_sanitize(mock_create):
-    """The AI response should be sanitized"""
-
-    answer = '{"answer": "Salut\\n \tle \nmonde"}'
-    mock_create.return_value = MagicMock(
-        choices=[MagicMock(message=MagicMock(content=answer))]
-    )
-
-    response = AIService().transform("hello", "prompt")
-
-    assert response == {"answer": "Salut\n \tle \nmonde"}

src/backend/impress/settings.py

@@ -144,75 +144,14 @@ class Base(Configuration):
         environ_name="DOCUMENT_IMAGE_MAX_SIZE",
         environ_prefix=None,
     )
-
-    DOCUMENT_UNSAFE_MIME_TYPES = [
-        # Executable Files
-        "application/x-msdownload",
-        "application/x-bat",
-        "application/x-dosexec",
-        "application/x-sh",
-        "application/x-ms-dos-executable",
-        "application/x-msi",
-        "application/java-archive",
-        "application/octet-stream",
-        # Dynamic Web Pages
-        "application/x-httpd-php",
-        "application/x-asp",
-        "application/x-aspx",
-        "application/jsp",
-        "application/xhtml+xml",
-        "application/x-python-code",
-        "application/x-perl",
-        "text/html",
-        "text/javascript",
-        "text/x-php",
-        # System Files
-        "application/x-msdownload",
-        "application/x-sys",
-        "application/x-drv",
-        "application/cpl",
-        "application/x-apple-diskimage",
-        # Script Files
-        "application/javascript",
-        "application/x-vbscript",
-        "application/x-powershell",
-        "application/x-shellscript",
-        # Compressed/Archive Files
-        "application/zip",
-        "application/x-tar",
-        "application/gzip",
-        "application/x-bzip2",
-        "application/x-7z-compressed",
-        "application/x-rar",
-        "application/x-rar-compressed",
-        "application/x-compress",
-        "application/x-lzma",
-        # Macros in Documents
-        "application/vnd.ms-word",
-        "application/vnd.ms-excel",
-        "application/vnd.ms-powerpoint",
-        "application/vnd.ms-word.document.macroenabled.12",
-        "application/vnd.ms-excel.sheet.macroenabled.12",
-        "application/vnd.ms-powerpoint.presentation.macroenabled.12",
-        # Disk Images & Virtual Disk Files
-        "application/x-iso9660-image",
-        "application/x-vmdk",
-        "application/x-apple-diskimage",
-        "application/x-dmg",
-        # Other Dangerous MIME Types
-        "application/x-ms-application",
-        "application/x-msdownload",
-        "application/x-shockwave-flash",
-        "application/x-silverlight-app",
-        "application/x-java-vm",
-        "application/x-bittorrent",
-        "application/hta",
-        "application/x-csh",
-        "application/x-ksh",
-        "application/x-ms-regedit",
-        "application/x-msdownload",
-        "application/xml",
+    DOCUMENT_IMAGE_ALLOWED_MIME_TYPES = [
+        "image/bmp",
+        "image/gif",
+        "image/jpeg",
+        "image/png",
         "image/svg+xml",
+        "image/tiff",
+        "image/webp",
     ]
 
     # Document versions
@@ -223,7 +162,6 @@ class Base(Configuration):
 
     # Languages
     LANGUAGE_CODE = values.Value("en-us")
-    LANGUAGE_COOKIE_NAME = "docs_language"  # cookie & language is set from frontend
 
     DRF_NESTED_MULTIPART_PARSER = {
         # output of parser is converted to querydict
@@ -455,20 +393,6 @@ class Base(Configuration):
     ALLOW_LOGOUT_GET_METHOD = values.BooleanValue(
         default=True, environ_name="ALLOW_LOGOUT_GET_METHOD", environ_prefix=None
     )
-    AI_API_KEY = values.Value(None, environ_name="AI_API_KEY", environ_prefix=None)
-    AI_BASE_URL = values.Value(None, environ_name="AI_BASE_URL", environ_prefix=None)
-    AI_MODEL = values.Value(None, environ_name="AI_MODEL", environ_prefix=None)
-
-    AI_DOCUMENT_RATE_THROTTLE_RATES = {
-        "minute": 5,
-        "hour": 100,
-        "day": 500,
-    }
-    AI_USER_RATE_THROTTLE_RATES = {
-        "minute": 3,
-        "hour": 50,
-        "day": 200,
-    }
 
     USER_OIDC_FIELDS_TO_FULLNAME = values.ListValue(
         default=["first_name", "last_name"],

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-people\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-10-15 07:19+0000\n"
-"PO-Revision-Date: 2024-10-15 07:23\n"
+"POT-Creation-Date: 2024-09-25 10:15+0000\n"
+"PO-Revision-Date: 2024-09-25 10:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
 "Language: en_US\n"
@@ -17,15 +17,15 @@ msgstr ""
 "X-Crowdin-File: backend-impress.pot\n"
 "X-Crowdin-File-ID: 8\n"
 
-#: core/admin.py:33
+#: core/admin.py:32
 msgid "Personal info"
 msgstr ""
 
-#: core/admin.py:46
+#: core/admin.py:34
 msgid "Permissions"
 msgstr ""
 
-#: core/admin.py:58
+#: core/admin.py:46
 msgid "Important dates"
 msgstr ""
 
@@ -41,7 +41,7 @@ msgstr ""
 msgid "Format"
 msgstr ""
 
-#: core/authentication/backends.py:57
+#: core/authentication/backends.py:56
 msgid "Invalid response format or token verification failed"
 msgstr ""
 
@@ -49,6 +49,10 @@ msgstr ""
 msgid "User info contained no recognizable user identification"
 msgstr ""
 
+#: core/authentication/backends.py:101
+msgid "Claims contained no recognizable user identification"
+msgstr ""
+
 #: core/models.py:62 core/models.py:69
 msgid "Reader"
 msgstr ""
@@ -113,236 +117,223 @@ msgstr ""
 msgid "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
 msgstr ""
 
-#: core/models.py:149
-msgid "full name"
-msgstr ""
-
-#: core/models.py:150
-msgid "short name"
-msgstr ""
-
-#: core/models.py:152
+#: core/models.py:148
 msgid "identity email address"
 msgstr ""
 
-#: core/models.py:157
+#: core/models.py:153
 msgid "admin email address"
 msgstr ""
 
-#: core/models.py:164
+#: core/models.py:160
 msgid "language"
 msgstr ""
 
-#: core/models.py:165
+#: core/models.py:161
 msgid "The language in which the user wants to see the interface."
 msgstr ""
 
-#: core/models.py:171
+#: core/models.py:167
 msgid "The timezone in which the user wants to see times."
 msgstr ""
 
-#: core/models.py:174
+#: core/models.py:170
 msgid "device"
 msgstr ""
 
-#: core/models.py:176
+#: core/models.py:172
 msgid "Whether the user is a device or a real user."
 msgstr ""
 
-#: core/models.py:179
+#: core/models.py:175
 msgid "staff status"
 msgstr ""
 
-#: core/models.py:181
+#: core/models.py:177
 msgid "Whether the user can log into this admin site."
 msgstr ""
 
-#: core/models.py:184
+#: core/models.py:180
 msgid "active"
 msgstr ""
 
-#: core/models.py:187
+#: core/models.py:183
 msgid "Whether this user should be treated as active. Unselect this instead of deleting accounts."
 msgstr ""
 
-#: core/models.py:199
+#: core/models.py:195
 msgid "user"
 msgstr ""
 
-#: core/models.py:200
+#: core/models.py:196
 msgid "users"
 msgstr ""
 
-#: core/models.py:332 core/models.py:638
+#: core/models.py:328 core/models.py:644
 msgid "title"
 msgstr ""
 
-#: core/models.py:347
+#: core/models.py:343
 msgid "Document"
 msgstr ""
 
-#: core/models.py:348
+#: core/models.py:344
 msgid "Documents"
 msgstr ""
 
-#: core/models.py:351
+#: core/models.py:347
 msgid "Untitled Document"
 msgstr ""
 
-#: core/models.py:530
+#: core/models.py:537
 #, python-format
-msgid "%(sender_name)s shared a document with you: %(document)s"
+msgid "%(username)s shared a document with you: %(document)s"
 msgstr ""
 
-#: core/models.py:574
+#: core/models.py:580
 msgid "Document/user link trace"
 msgstr ""
 
-#: core/models.py:575
+#: core/models.py:581
 msgid "Document/user link traces"
 msgstr ""
 
-#: core/models.py:581
+#: core/models.py:587
 msgid "A link trace already exists for this document/user."
 msgstr ""
 
-#: core/models.py:602
+#: core/models.py:608
 msgid "Document/user relation"
 msgstr ""
 
-#: core/models.py:603
+#: core/models.py:609
 msgid "Document/user relations"
 msgstr ""
 
-#: core/models.py:609
+#: core/models.py:615
 msgid "This user is already in this document."
 msgstr ""
 
-#: core/models.py:615
+#: core/models.py:621
 msgid "This team is already in this document."
 msgstr ""
 
-#: core/models.py:621 core/models.py:810
+#: core/models.py:627 core/models.py:816
 msgid "Either user or team must be set, not both."
 msgstr ""
 
-#: core/models.py:639
+#: core/models.py:645
 msgid "description"
 msgstr ""
 
-#: core/models.py:640
+#: core/models.py:646
 msgid "code"
 msgstr ""
 
-#: core/models.py:641
+#: core/models.py:647
 msgid "css"
 msgstr ""
 
-#: core/models.py:643
+#: core/models.py:649
 msgid "public"
 msgstr ""
 
-#: core/models.py:645
+#: core/models.py:651
 msgid "Whether this template is public for anyone to use."
 msgstr ""
 
-#: core/models.py:651
+#: core/models.py:657
 msgid "Template"
 msgstr ""
 
-#: core/models.py:652
+#: core/models.py:658
 msgid "Templates"
 msgstr ""
 
-#: core/models.py:791
+#: core/models.py:797
 msgid "Template/user relation"
 msgstr ""
 
-#: core/models.py:792
+#: core/models.py:798
 msgid "Template/user relations"
 msgstr ""
 
-#: core/models.py:798
+#: core/models.py:804
 msgid "This user is already in this template."
 msgstr ""
 
-#: core/models.py:804
+#: core/models.py:810
 msgid "This team is already in this template."
 msgstr ""
 
-#: core/models.py:827
+#: core/models.py:833
 msgid "email address"
 msgstr ""
 
-#: core/models.py:844
+#: core/models.py:850
 msgid "Document invitation"
 msgstr ""
 
-#: core/models.py:845
+#: core/models.py:851
 msgid "Document invitations"
 msgstr ""
 
-#: core/models.py:862
+#: core/models.py:868
 msgid "This email is already associated to a registered user."
 msgstr ""
 
-#: core/templates/mail/html/hello.html:159 core/templates/mail/text/hello.txt:3
-msgid "Company logo"
-msgstr ""
-
-#: core/templates/mail/html/hello.html:188 core/templates/mail/text/hello.txt:5
-#, python-format
-msgid "Hello %(name)s"
-msgstr ""
-
-#: core/templates/mail/html/hello.html:188 core/templates/mail/text/hello.txt:5
-msgid "Hello"
-msgstr ""
-
-#: core/templates/mail/html/hello.html:189 core/templates/mail/text/hello.txt:6
-msgid "Thank you very much for your visit!"
-msgstr ""
-
-#: core/templates/mail/html/hello.html:221
-#, python-format
-msgid "This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
-msgstr ""
-
-#: core/templates/mail/html/invitation.html:159
+#: core/templates/mail/html/invitation.html:160
+#: core/templates/mail/html/invitation2.html:160
 #: core/templates/mail/text/invitation.txt:3
+#: core/templates/mail/text/invitation2.txt:3
 msgid "La Suite Numérique"
 msgstr ""
 
-#: core/templates/mail/html/invitation.html:189
+#: core/templates/mail/html/invitation.html:190
 #: core/templates/mail/text/invitation.txt:6
 #, python-format
-msgid " %(sender_name)s shared a document with you ! "
+msgid " %(username)s shared a document with you ! "
 msgstr ""
 
-#: core/templates/mail/html/invitation.html:196
+#: core/templates/mail/html/invitation.html:197
 #: core/templates/mail/text/invitation.txt:8
 #, python-format
-msgid " %(sender_name_email)s invited you with the role \"%(role)s\" on the following document : "
+msgid " %(username)s invited you as an %(role)s on the following document : "
 msgstr ""
 
-#: core/templates/mail/html/invitation.html:205
+#: core/templates/mail/html/invitation.html:206
+#: core/templates/mail/html/invitation2.html:211
 #: core/templates/mail/text/invitation.txt:10
+#: core/templates/mail/text/invitation2.txt:11
 msgid "Open"
 msgstr ""
 
-#: core/templates/mail/html/invitation.html:222
+#: core/templates/mail/html/invitation.html:223
 #: core/templates/mail/text/invitation.txt:14
-msgid " Docs, your new essential tool for organizing, sharing and collaborating on your documents as a team. "
+msgid " Docs, your new essential tool for organizing, sharing and collaborate on your documents as a team. "
 msgstr ""
 
-#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/html/invitation2.html:235
 #: core/templates/mail/text/invitation.txt:16
+#: core/templates/mail/text/invitation2.txt:17
 msgid "Brought to you by La Suite Numérique"
 msgstr ""
 
-#: core/templates/mail/text/hello.txt:8
+#: core/templates/mail/html/invitation2.html:190
 #, python-format
-msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
+msgid "%(username)s shared a document with you"
+msgstr ""
+
+#: core/templates/mail/html/invitation2.html:197
+#: core/templates/mail/text/invitation2.txt:8
+#, python-format
+msgid "%(username)s invited you as an %(role)s on the following document :"
+msgstr ""
+
+#: core/templates/mail/html/invitation2.html:228
+#: core/templates/mail/text/invitation2.txt:15
+msgid "Docs, your new essential tool for organizing, sharing and collaborate on your document as a team."
 msgstr ""
 
 #: impress/settings.py:176

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-people\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-10-15 07:19+0000\n"
-"PO-Revision-Date: 2024-10-15 07:23\n"
+"POT-Creation-Date: 2024-09-25 10:15+0000\n"
+"PO-Revision-Date: 2024-09-25 10:21\n"
 "Last-Translator: \n"
 "Language-Team: French\n"
 "Language: fr_FR\n"
@@ -17,15 +17,15 @@ msgstr ""
 "X-Crowdin-File: backend-impress.pot\n"
 "X-Crowdin-File-ID: 8\n"
 
-#: core/admin.py:33
+#: core/admin.py:32
 msgid "Personal info"
 msgstr "Infos Personnelles"
 
-#: core/admin.py:46
+#: core/admin.py:34
 msgid "Permissions"
 msgstr "Permissions"
 
-#: core/admin.py:58
+#: core/admin.py:46
 msgid "Important dates"
 msgstr "Dates importantes"
 
@@ -41,7 +41,7 @@ msgstr ""
 msgid "Format"
 msgstr ""
 
-#: core/authentication/backends.py:57
+#: core/authentication/backends.py:56
 msgid "Invalid response format or token verification failed"
 msgstr ""
 
@@ -49,6 +49,10 @@ msgstr ""
 msgid "User info contained no recognizable user identification"
 msgstr ""
 
+#: core/authentication/backends.py:101
+msgid "Claims contained no recognizable user identification"
+msgstr ""
+
 #: core/models.py:62 core/models.py:69
 msgid "Reader"
 msgstr "Lecteur"
@@ -113,237 +117,224 @@ msgstr ""
 msgid "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
 msgstr ""
 
-#: core/models.py:149
-msgid "full name"
-msgstr ""
-
-#: core/models.py:150
-msgid "short name"
-msgstr ""
-
-#: core/models.py:152
+#: core/models.py:148
 msgid "identity email address"
 msgstr ""
 
-#: core/models.py:157
+#: core/models.py:153
 msgid "admin email address"
 msgstr ""
 
-#: core/models.py:164
+#: core/models.py:160
 msgid "language"
 msgstr ""
 
-#: core/models.py:165
+#: core/models.py:161
 msgid "The language in which the user wants to see the interface."
 msgstr ""
 
-#: core/models.py:171
+#: core/models.py:167
 msgid "The timezone in which the user wants to see times."
 msgstr ""
 
-#: core/models.py:174
+#: core/models.py:170
 msgid "device"
 msgstr ""
 
-#: core/models.py:176
+#: core/models.py:172
 msgid "Whether the user is a device or a real user."
 msgstr ""
 
-#: core/models.py:179
+#: core/models.py:175
 msgid "staff status"
 msgstr ""
 
-#: core/models.py:181
+#: core/models.py:177
 msgid "Whether the user can log into this admin site."
 msgstr ""
 
-#: core/models.py:184
+#: core/models.py:180
 msgid "active"
 msgstr ""
 
-#: core/models.py:187
+#: core/models.py:183
 msgid "Whether this user should be treated as active. Unselect this instead of deleting accounts."
 msgstr ""
 
-#: core/models.py:199
+#: core/models.py:195
 msgid "user"
 msgstr ""
 
-#: core/models.py:200
+#: core/models.py:196
 msgid "users"
 msgstr ""
 
-#: core/models.py:332 core/models.py:638
+#: core/models.py:328 core/models.py:644
 msgid "title"
 msgstr ""
 
-#: core/models.py:347
+#: core/models.py:343
 msgid "Document"
 msgstr ""
 
-#: core/models.py:348
+#: core/models.py:344
 msgid "Documents"
 msgstr ""
 
-#: core/models.py:351
+#: core/models.py:347
 msgid "Untitled Document"
 msgstr ""
 
-#: core/models.py:530
+#: core/models.py:537
 #, python-format
-msgid "%(sender_name)s shared a document with you: %(document)s"
-msgstr "%(sender_name)s a partagé un document avec vous: %(document)s"
+msgid "%(username)s shared a document with you: %(document)s"
+msgstr "%(username)s a partagé un document avec vous: %(document)s"
 
-#: core/models.py:574
+#: core/models.py:580
 msgid "Document/user link trace"
 msgstr ""
 
-#: core/models.py:575
+#: core/models.py:581
 msgid "Document/user link traces"
 msgstr ""
 
-#: core/models.py:581
+#: core/models.py:587
 msgid "A link trace already exists for this document/user."
 msgstr ""
 
-#: core/models.py:602
+#: core/models.py:608
 msgid "Document/user relation"
 msgstr ""
 
-#: core/models.py:603
+#: core/models.py:609
 msgid "Document/user relations"
 msgstr ""
 
-#: core/models.py:609
+#: core/models.py:615
 msgid "This user is already in this document."
 msgstr ""
 
-#: core/models.py:615
+#: core/models.py:621
 msgid "This team is already in this document."
 msgstr ""
 
-#: core/models.py:621 core/models.py:810
+#: core/models.py:627 core/models.py:816
 msgid "Either user or team must be set, not both."
 msgstr ""
 
-#: core/models.py:639
+#: core/models.py:645
 msgid "description"
 msgstr ""
 
-#: core/models.py:640
+#: core/models.py:646
 msgid "code"
 msgstr ""
 
-#: core/models.py:641
+#: core/models.py:647
 msgid "css"
 msgstr ""
 
-#: core/models.py:643
+#: core/models.py:649
 msgid "public"
 msgstr ""
 
-#: core/models.py:645
+#: core/models.py:651
 msgid "Whether this template is public for anyone to use."
 msgstr ""
 
-#: core/models.py:651
+#: core/models.py:657
 msgid "Template"
 msgstr ""
 
-#: core/models.py:652
+#: core/models.py:658
 msgid "Templates"
 msgstr ""
 
-#: core/models.py:791
+#: core/models.py:797
 msgid "Template/user relation"
 msgstr ""
 
-#: core/models.py:792
+#: core/models.py:798
 msgid "Template/user relations"
 msgstr ""
 
-#: core/models.py:798
+#: core/models.py:804
 msgid "This user is already in this template."
 msgstr ""
 
-#: core/models.py:804
+#: core/models.py:810
 msgid "This team is already in this template."
 msgstr ""
 
-#: core/models.py:827
+#: core/models.py:833
 msgid "email address"
 msgstr ""
 
-#: core/models.py:844
+#: core/models.py:850
 msgid "Document invitation"
 msgstr ""
 
-#: core/models.py:845
+#: core/models.py:851
 msgid "Document invitations"
 msgstr ""
 
-#: core/models.py:862
+#: core/models.py:868
 msgid "This email is already associated to a registered user."
 msgstr ""
 
-#: core/templates/mail/html/hello.html:159 core/templates/mail/text/hello.txt:3
-msgid "Company logo"
-msgstr ""
-
-#: core/templates/mail/html/hello.html:188 core/templates/mail/text/hello.txt:5
-#, python-format
-msgid "Hello %(name)s"
-msgstr ""
-
-#: core/templates/mail/html/hello.html:188 core/templates/mail/text/hello.txt:5
-msgid "Hello"
-msgstr ""
-
-#: core/templates/mail/html/hello.html:189 core/templates/mail/text/hello.txt:6
-msgid "Thank you very much for your visit!"
-msgstr ""
-
-#: core/templates/mail/html/hello.html:221
-#, python-format
-msgid "This mail has been sent to %(email)s by <a href=\"%(href)s\">%(name)s</a>"
-msgstr ""
-
-#: core/templates/mail/html/invitation.html:159
+#: core/templates/mail/html/invitation.html:160
+#: core/templates/mail/html/invitation2.html:160
 #: core/templates/mail/text/invitation.txt:3
+#: core/templates/mail/text/invitation2.txt:3
 msgid "La Suite Numérique"
 msgstr ""
 
-#: core/templates/mail/html/invitation.html:189
+#: core/templates/mail/html/invitation.html:190
 #: core/templates/mail/text/invitation.txt:6
 #, python-format
-msgid " %(sender_name)s shared a document with you ! "
-msgstr " %(sender_name)s a partagé un document avec vous ! "
+msgid " %(username)s shared a document with you ! "
+msgstr " %(username)s a partagé un document avec vous ! "
 
-#: core/templates/mail/html/invitation.html:196
+#: core/templates/mail/html/invitation.html:197
 #: core/templates/mail/text/invitation.txt:8
 #, python-format
-msgid " %(sender_name_email)s invited you with the role \"%(role)s\" on the following document : "
-msgstr " %(sender_name_email)s vous a invité avec le rôle \"%(role)s\" sur le document suivant : "
+msgid " %(username)s invited you as an %(role)s on the following document : "
+msgstr " %(username)s vous a invité en tant que %(role)s sur le document suivant : "
 
-#: core/templates/mail/html/invitation.html:205
+#: core/templates/mail/html/invitation.html:206
+#: core/templates/mail/html/invitation2.html:211
 #: core/templates/mail/text/invitation.txt:10
+#: core/templates/mail/text/invitation2.txt:11
 msgid "Open"
 msgstr "Ouvrir"
 
-#: core/templates/mail/html/invitation.html:222
+#: core/templates/mail/html/invitation.html:223
 #: core/templates/mail/text/invitation.txt:14
-msgid " Docs, your new essential tool for organizing, sharing and collaborating on your documents as a team. "
+msgid " Docs, your new essential tool for organizing, sharing and collaborate on your documents as a team. "
 msgstr " Docs, votre nouvel outil incontournable pour organiser, partager et collaborer sur vos documents en équipe. "
 
-#: core/templates/mail/html/invitation.html:229
+#: core/templates/mail/html/invitation.html:230
+#: core/templates/mail/html/invitation2.html:235
 #: core/templates/mail/text/invitation.txt:16
+#: core/templates/mail/text/invitation2.txt:17
 msgid "Brought to you by La Suite Numérique"
 msgstr "Proposé par La Suite Numérique"
 
-#: core/templates/mail/text/hello.txt:8
+#: core/templates/mail/html/invitation2.html:190
 #, python-format
-msgid "This mail has been sent to %(email)s by %(name)s [%(href)s]"
-msgstr ""
+msgid "%(username)s shared a document with you"
+msgstr "%(username)s a partagé un document avec vous"
+
+#: core/templates/mail/html/invitation2.html:197
+#: core/templates/mail/text/invitation2.txt:8
+#, python-format
+msgid "%(username)s invited you as an %(role)s on the following document :"
+msgstr "%(username)s vous a invité en tant que %(role)s sur le document suivant :"
+
+#: core/templates/mail/html/invitation2.html:228
+#: core/templates/mail/text/invitation2.txt:15
+msgid "Docs, your new essential tool for organizing, sharing and collaborate on your document as a team."
+msgstr "Docs, votre nouvel outil essentiel pour organiser, partager et collaborer sur votre document en équipe."
 
 #: impress/settings.py:176
 msgid "English"

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "impress"
-version = "1.7.0"
+version = "1.5.1"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -25,39 +25,39 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "boto3==1.35.44",
+    "boto3==1.35.34",
     "Brotli==1.1.0",
     "celery[redis]==5.4.0",
     "django-configurations==2.5.1",
-    "django-cors-headers==4.5.0",
+    "django-cors-headers==4.4.0",
     "django-countries==7.6.1",
     "django-parler==2.3",
     "redis==5.1.1",
     "django-redis==5.4.0",
     "django-storages[s3]==1.14.4",
     "django-timezone-field>=5.1",
-    "django==5.1.2",
+    "django==5.1.1",
     "djangorestframework==3.15.2",
     "drf_spectacular==0.27.2",
     "dockerflow==2024.4.2",
     "easy_thumbnails==2.10",
     "factory_boy==3.3.1",
+    "freezegun==1.5.1",
     "gunicorn==23.0.0",
     "jsonschema==4.23.0",
     "markdown==3.7",
     "nested-multipart-parser==1.5.0",
-    "openai==1.52.0",
     "psycopg[binary]==3.2.3",
     "PyJWT==2.9.0",
-    "pypandoc==1.14",
+    "pypandoc==1.13",
     "python-frontmatter==1.1.0",
-    "python-magic==0.4.27",
     "requests==2.32.3",
-    "sentry-sdk==2.17.0",
+    "sentry-sdk==2.15.0",
     "url-normalize==1.4.3",
     "WeasyPrint>=60.2",
     "whitenoise==6.7.0",
     "mozilla-django-oidc==4.0.1",
+    "y-py==0.6.2"
 ]
 
 [project.urls]
@@ -70,11 +70,10 @@ dependencies = [
 dev = [
     "django-extensions==3.2.3",
     "drf-spectacular-sidecar==2024.7.1",
-    "freezegun==1.5.1",
     "ipdb==0.13.13",
     "ipython==8.28.0",
-    "pyfakefs==5.7.1",
-    "pylint-django==2.6.1",
+    "pyfakefs==5.6.0",
+    "pylint-django==2.5.5",
     "pylint==3.3.1",
     "pytest-cov==5.0.0",
     "pytest-django==4.9.0",
@@ -82,8 +81,8 @@ dev = [
     "pytest-icdiff==0.9",
     "pytest-xdist==3.6.1",
     "responses==0.25.3",
-    "ruff==0.7.0",
-    "types-requests==2.32.0.20241016",
+    "ruff==0.6.9",
+    "types-requests==2.32.0.20240914",
 ]
 
 [tool.setuptools]

src/frontend/apps/e2e/__tests__/app-impress/common.ts

@@ -4,17 +4,17 @@ export const keyCloakSignIn = async (page: Page, browserName: string) => {
   const login = `user-e2e-${browserName}`;
   const password = `password-e2e-${browserName}`;
 
-  await expect(
-    page.locator('.login-pf-page-header').getByText('impress'),
-  ).toBeVisible();
-
   if (await page.getByLabel('Restart login').isVisible()) {
-    await page.getByLabel('Restart login').click();
-  }
+    await page.getByRole('textbox', { name: 'password' }).fill(password);
 
-  await page.getByRole('textbox', { name: 'username' }).fill(login);
-  await page.getByRole('textbox', { name: 'password' }).fill(password);
-  await page.click('input[type="submit"]', { force: true });
+    await page.click('input[type="submit"]', { force: true });
+  } else {
+    await page.getByRole('textbox', { name: 'username' }).fill(login);
+
+    await page.getByRole('textbox', { name: 'password' }).fill(password);
+
+    await page.click('input[type="submit"]', { force: true });
+  }
 };
 
 export const randomName = (name: string, browserName: string, length: number) =>
@@ -27,6 +27,7 @@ export const createDoc = async (
   docName: string,
   browserName: string,
   length: number,
+  isPublic: boolean = false,
 ) => {
   const randomDocs = randomName(docName, browserName, length);
 
@@ -43,6 +44,21 @@ export const createDoc = async (
     await page.getByRole('heading', { name: 'Untitled document' }).click();
     await page.keyboard.type(randomDocs[i]);
     await page.getByText('Created at ').click();
+
+    if (isPublic) {
+      await page.getByRole('button', { name: 'Share' }).click();
+      await page.getByText('Doc private').click();
+
+      await page.locator('.c__modal__backdrop').click({
+        position: { x: 0, y: 0 },
+      });
+
+      await expect(
+        page
+          .getByLabel('It is the card information about the document.')
+          .getByText('Public'),
+      ).toBeVisible();
+    }
   }
 
   return randomDocs;

src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts

@@ -9,78 +9,6 @@ test.beforeEach(async ({ page }) => {
 });
 
 test.describe('Doc Editor', () => {
-  test('it check translations of the slash menu when changing language', async ({
-    page,
-    browserName,
-  }) => {
-    await createDoc(page, 'doc-toolbar', browserName, 1);
-
-    const header = page.locator('header').first();
-    const editor = page.locator('.ProseMirror');
-    // Trigger slash menu to show english menu
-    await editor.click();
-    await editor.fill('/');
-    await expect(page.getByText('Headings', { exact: true })).toBeVisible();
-    await header.click();
-    await expect(page.getByText('Headings', { exact: true })).toBeHidden();
-
-    // Reset menu
-    await editor.click();
-    await editor.fill('');
-
-    // Change language to French
-    await header.click();
-    await header.getByRole('combobox').getByText('English').click();
-    await header.getByRole('option', { name: 'Français' }).click();
-    await expect(
-      header.getByRole('combobox').getByText('Français'),
-    ).toBeVisible();
-
-    // Trigger slash menu to show french menu
-    await editor.click();
-    await editor.fill('/');
-    await expect(page.getByText('Titres', { exact: true })).toBeVisible();
-    await header.click();
-    await expect(page.getByText('Titres', { exact: true })).toBeHidden();
-  });
-
-  test('it checks default toolbar buttons are displayed', async ({
-    page,
-    browserName,
-  }) => {
-    await createDoc(page, 'doc-toolbar', browserName, 1);
-
-    const editor = page.locator('.ProseMirror');
-    await editor.click();
-    await editor.fill('test content');
-
-    await editor.getByText('test content').dblclick();
-
-    const toolbar = page.locator('.bn-formatting-toolbar');
-    await expect(toolbar.locator('button[data-test="bold"]')).toBeVisible();
-    await expect(toolbar.locator('button[data-test="italic"]')).toBeVisible();
-    await expect(
-      toolbar.locator('button[data-test="underline"]'),
-    ).toBeVisible();
-    await expect(toolbar.locator('button[data-test="strike"]')).toBeVisible();
-    await expect(
-      toolbar.locator('button[data-test="alignTextLeft"]'),
-    ).toBeVisible();
-    await expect(
-      toolbar.locator('button[data-test="alignTextCenter"]'),
-    ).toBeVisible();
-    await expect(
-      toolbar.locator('button[data-test="alignTextRight"]'),
-    ).toBeVisible();
-    await expect(toolbar.locator('button[data-test="colors"]')).toBeVisible();
-    await expect(
-      toolbar.locator('button[data-test="unnestBlock"]'),
-    ).toBeVisible();
-    await expect(
-      toolbar.locator('button[data-test="createLink"]'),
-    ).toBeVisible();
-  });
-
   test('checks the Doc is connected to the provider server', async ({
     page,
     browserName,
@@ -131,10 +59,9 @@ test.describe('Doc Editor', () => {
 
   test('it renders correctly when we switch from one doc to another', async ({
     page,
-    browserName,
   }) => {
     // Check the first doc
-    const [firstDoc] = await createDoc(page, 'doc-switch-1', browserName, 1);
+    const firstDoc = await goToGridDoc(page);
     await expect(page.locator('h2').getByText(firstDoc)).toBeVisible();
 
     const editor = page.locator('.ProseMirror');
@@ -143,7 +70,9 @@ test.describe('Doc Editor', () => {
     await expect(editor.getByText('Hello World Doc 1')).toBeVisible();
 
     // Check the second doc
-    const [secondDoc] = await createDoc(page, 'doc-switch-2', browserName, 1);
+    const secondDoc = await goToGridDoc(page, {
+      nthRow: 2,
+    });
     await expect(page.locator('h2').getByText(secondDoc)).toBeVisible();
     await expect(editor.getByText('Hello World Doc 1')).toBeHidden();
     await editor.click();
@@ -159,12 +88,9 @@ test.describe('Doc Editor', () => {
     await expect(editor.getByText('Hello World Doc 1')).toBeVisible();
   });
 
-  test('it saves the doc when we change pages', async ({
-    page,
-    browserName,
-  }) => {
+  test('it saves the doc when we change pages', async ({ page }) => {
     // Check the first doc
-    const [doc] = await createDoc(page, 'doc-saves-change', browserName, 1);
+    const doc = await goToGridDoc(page);
     await expect(page.locator('h2').getByText(doc)).toBeVisible();
 
     const editor = page.locator('.ProseMirror');
@@ -255,57 +181,4 @@ test.describe('Doc Editor', () => {
       /http:\/\/localhost:8083\/media\/.*\/attachments\/.*.png/,
     );
   });
-
-  test('it checks the AI buttons', async ({ page, browserName }) => {
-    await page.route(/.*\/ai-translate\//, async (route) => {
-      const request = route.request();
-      if (request.method().includes('POST')) {
-        await route.fulfill({
-          json: {
-            answer: 'Bonjour le monde',
-          },
-        });
-      } else {
-        await route.continue();
-      }
-    });
-
-    await createDoc(page, 'doc-ai', browserName, 1);
-
-    await page.locator('.bn-block-outer').last().fill('Hello World');
-
-    const editor = page.locator('.ProseMirror');
-    await editor.getByText('Hello').dblclick();
-
-    await page.getByRole('button', { name: 'AI' }).click();
-
-    await expect(
-      page.getByRole('menuitem', { name: 'Use as prompt' }),
-    ).toBeVisible();
-    await expect(
-      page.getByRole('menuitem', { name: 'Rephrase' }),
-    ).toBeVisible();
-    await expect(
-      page.getByRole('menuitem', { name: 'Summarize' }),
-    ).toBeVisible();
-    await expect(page.getByRole('menuitem', { name: 'Correct' })).toBeVisible();
-    await expect(
-      page.getByRole('menuitem', { name: 'Language' }),
-    ).toBeVisible();
-
-    await page.getByRole('menuitem', { name: 'Language' }).hover();
-    await expect(
-      page.getByRole('menuitem', { name: 'English', exact: true }),
-    ).toBeVisible();
-    await expect(
-      page.getByRole('menuitem', { name: 'French', exact: true }),
-    ).toBeVisible();
-    await expect(
-      page.getByRole('menuitem', { name: 'German', exact: true }),
-    ).toBeVisible();
-
-    await page.getByRole('menuitem', { name: 'English', exact: true }).click();
-
-    await expect(editor.getByText('Bonjour le monde')).toBeVisible();
-  });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-grid.spec.ts

@@ -52,7 +52,6 @@ test.describe('Documents Grid', () => {
       orderDefault: '',
       orderDesc: '&ordering=-title',
       orderAsc: '&ordering=title',
-      defaultColumn: false,
     },
     {
       nameColumn: 'Created at',
@@ -61,7 +60,6 @@ test.describe('Documents Grid', () => {
       orderDefault: '',
       orderDesc: '&ordering=-created_at',
       orderAsc: '&ordering=created_at',
-      defaultColumn: false,
     },
     {
       nameColumn: 'Updated at',
@@ -70,7 +68,6 @@ test.describe('Documents Grid', () => {
       orderDefault: '&ordering=-updated_at',
       orderDesc: '&ordering=updated_at',
       orderAsc: '',
-      defaultColumn: true,
     },
   ].forEach(
     ({
@@ -80,7 +77,6 @@ test.describe('Documents Grid', () => {
       orderDefault,
       orderDesc,
       orderAsc,
-      defaultColumn,
     }) => {
       test(`checks datagrid ordering ${ordering}`, async ({ page }) => {
         const responsePromise = page.waitForResponse(
@@ -102,19 +98,20 @@ test.describe('Documents Grid', () => {
         );
 
         // Checks the initial state
-        const datagrid = page.getByLabel('Datagrid of the documents page 1');
-        const datagridTable = datagrid.getByRole('table');
-        const thead = datagridTable.locator('thead');
+        const datagrid = page
+          .getByLabel('Datagrid of the documents page 1')
+          .getByRole('table');
+        const thead = datagrid.locator('thead');
 
         const response = await responsePromise;
         expect(response.ok()).toBeTruthy();
 
-        const docNameRow1 = datagridTable
+        const docNameRow1 = datagrid
           .getByRole('row')
           .nth(1)
           .getByRole('cell')
           .nth(cellNumber);
-        const docNameRow2 = datagridTable
+        const docNameRow2 = datagrid
           .getByRole('row')
           .nth(2)
           .getByRole('cell')
@@ -147,21 +144,13 @@ test.describe('Documents Grid', () => {
         await expect(docNameRow2).toHaveText(/.*/);
         const textDocNameRow1Asc = await docNameRow1.textContent();
         const textDocNameRow2Asc = await docNameRow2.textContent();
-
-        const compare = (comp1: string, comp2: string) => {
-          const comparisonResult = comp1.localeCompare(comp2, 'en', {
-            caseFirst: 'false',
-            ignorePunctuation: true,
-          });
-
-          // eslint-disable-next-line playwright/no-conditional-in-test
-          return defaultColumn ? comparisonResult >= 0 : comparisonResult <= 0;
-        };
-
         expect(
           textDocNameRow1Asc &&
             textDocNameRow2Asc &&
-            compare(textDocNameRow1Asc, textDocNameRow2Asc),
+            textDocNameRow1Asc.localeCompare(textDocNameRow2Asc, 'en', {
+              caseFirst: 'false',
+              ignorePunctuation: true,
+            }) <= 0,
         ).toBeTruthy();
 
         // Ordering Desc
@@ -182,7 +171,10 @@ test.describe('Documents Grid', () => {
         expect(
           textDocNameRow1Desc &&
             textDocNameRow2Desc &&
-            compare(textDocNameRow2Desc, textDocNameRow1Desc),
+            textDocNameRow1Desc.localeCompare(textDocNameRow2Desc, 'en', {
+              caseFirst: 'false',
+              ignorePunctuation: true,
+            }) >= 0,
         ).toBeTruthy();
       });
     },

src/frontend/apps/e2e/__tests__/app-impress/doc-header.spec.ts

@@ -21,7 +21,6 @@ test.describe('Doc Header', () => {
           role: 'owner',
           user: {
             email: 'super@owner.com',
-            full_name: 'Super Owner',
           },
         },
         {
@@ -66,7 +65,7 @@ test.describe('Doc Header', () => {
       card.getByText('Created at 09/01/2021, 11:00 AM'),
     ).toBeVisible();
     await expect(
-      card.getByText('Owners: Super Owner / super2@owner.com'),
+      card.getByText('Owners: super@owner.com / super2@owner.com'),
     ).toBeVisible();
     await expect(card.getByText('Your role: Owner')).toBeVisible();
     await expect(page.getByRole('button', { name: 'Share' })).toBeVisible();
@@ -212,11 +211,7 @@ test.describe('Doc Header', () => {
 
     const shareModal = page.getByLabel('Share modal');
 
-    await expect(
-      shareModal.getByRole('combobox', {
-        name: 'Visibility',
-      }),
-    ).not.toHaveAttribute('disabled');
+    await expect(shareModal.getByLabel('Doc private')).toBeEnabled();
     await expect(shareModal.getByText('Search by email')).toBeVisible();
 
     const invitationCard = shareModal.getByLabel('List invitation card');
@@ -289,11 +284,7 @@ test.describe('Doc Header', () => {
 
     const shareModal = page.getByLabel('Share modal');
 
-    await expect(
-      shareModal.getByRole('combobox', {
-        name: 'Visibility',
-      }),
-    ).toHaveAttribute('disabled');
+    await expect(shareModal.getByLabel('Doc private')).toBeDisabled();
     await expect(shareModal.getByText('Search by email')).toBeHidden();
 
     const invitationCard = shareModal.getByLabel('List invitation card');
@@ -366,11 +357,7 @@ test.describe('Doc Header', () => {
 
     const shareModal = page.getByLabel('Share modal');
 
-    await expect(
-      shareModal.getByRole('combobox', {
-        name: 'Visibility',
-      }),
-    ).toHaveAttribute('disabled');
+    await expect(shareModal.getByLabel('Doc private')).toBeDisabled();
     await expect(shareModal.getByText('Search by email')).toBeHidden();
 
     const invitationCard = shareModal.getByLabel('List invitation card');
@@ -397,81 +384,6 @@ test.describe('Doc Header', () => {
       }),
     ).toBeHidden();
   });
-
-  test('It checks the copy as Markdown button', async ({
-    page,
-    browserName,
-  }) => {
-    // eslint-disable-next-line playwright/no-skipped-test
-    test.skip(
-      browserName === 'webkit',
-      'navigator.clipboard is not working with webkit and playwright',
-    );
-
-    // create page and navigate to it
-    await page
-      .getByRole('button', {
-        name: 'Create a new document',
-      })
-      .click();
-
-    // Add dummy content to the doc
-    const editor = page.locator('.ProseMirror');
-    const docFirstBlock = editor.locator('.bn-block-content').first();
-    await docFirstBlock.click();
-    await page.keyboard.type('# Hello World', { delay: 100 });
-    const docFirstBlockContent = docFirstBlock.locator('h1');
-    await expect(docFirstBlockContent).toHaveText('Hello World');
-
-    // Copy content to clipboard
-    await page.getByLabel('Open the document options').click();
-    await page.getByRole('button', { name: 'Copy as Markdown' }).click();
-    await expect(page.getByText('Copied to clipboard')).toBeVisible();
-
-    // Test that clipboard is in Markdown format
-    const handle = await page.evaluateHandle(() =>
-      navigator.clipboard.readText(),
-    );
-    const clipboardContent = await handle.jsonValue();
-    expect(clipboardContent.trim()).toBe('# Hello World');
-  });
-
-  test('It checks the copy as HTML button', async ({ page, browserName }) => {
-    // eslint-disable-next-line playwright/no-skipped-test
-    test.skip(
-      browserName === 'webkit',
-      'navigator.clipboard is not working with webkit and playwright',
-    );
-
-    // create page and navigate to it
-    await page
-      .getByRole('button', {
-        name: 'Create a new document',
-      })
-      .click();
-
-    // Add dummy content to the doc
-    const editor = page.locator('.ProseMirror');
-    const docFirstBlock = editor.locator('.bn-block-content').first();
-    await docFirstBlock.click();
-    await page.keyboard.type('# Hello World', { delay: 100 });
-    const docFirstBlockContent = docFirstBlock.locator('h1');
-    await expect(docFirstBlockContent).toHaveText('Hello World');
-
-    // Copy content to clipboard
-    await page.getByLabel('Open the document options').click();
-    await page.getByRole('button', { name: 'Copy as HTML' }).click();
-    await expect(page.getByText('Copied to clipboard')).toBeVisible();
-
-    // Test that clipboard is in HTML format
-    const handle = await page.evaluateHandle(() =>
-      navigator.clipboard.readText(),
-    );
-    const clipboardContent = await handle.jsonValue();
-    expect(clipboardContent.trim()).toBe(
-      `<h1 data-level="1">Hello World</h1><p></p>`,
-    );
-  });
 });
 
 test.describe('Documents Header mobile', () => {

src/frontend/apps/e2e/__tests__/app-impress/doc-member-list.spec.ts

@@ -25,7 +25,6 @@ test.describe('Document list members', () => {
             user: {
               id: `fc092149-cafa-4ffa-a29d-e4b18af751-${pageId}-${i}`,
               email: `impress@impress.world-page-${pageId}-${i}`,
-              full_name: `Impress World Page ${pageId}-${i}`,
             },
             team: '',
             role: 'editor',
@@ -59,11 +58,9 @@ test.describe('Document list members', () => {
     await waitForElementCount(list.locator('li'), 21, 10000);
 
     expect(await list.locator('li').count()).toBeGreaterThan(20);
-    await expect(list.getByText(`Impress World Page 1-16`)).toBeVisible();
     await expect(
       list.getByText(`impress@impress.world-page-1-16`),
     ).toBeVisible();
-    await expect(list.getByText(`Impress World Page 2-15`)).toBeVisible();
     await expect(
       list.getByText(`impress@impress.world-page-2-15`),
     ).toBeVisible();
@@ -167,22 +164,14 @@ test.describe('Document list members', () => {
     const shareModal = page.getByLabel('Share modal');
 
     // Admin still have the right to share
-    await expect(
-      shareModal.getByRole('combobox', {
-        name: 'Visibility',
-      }),
-    ).not.toHaveAttribute('disabled');
+    await expect(shareModal.getByLabel('Doc private')).toBeEnabled();
 
     await SelectRoleCurrentUser.click();
     await page.getByRole('option', { name: 'Reader' }).click();
     await expect(page.getByText('The role has been updated')).toBeVisible();
 
     // Reader does not have the right to share
-    await expect(
-      shareModal.getByRole('combobox', {
-        name: 'Visibility',
-      }),
-    ).toHaveAttribute('disabled');
+    await expect(shareModal.getByLabel('Doc private')).toBeDisabled();
   });
 
   test('it checks the delete members', async ({ page, browserName }) => {

src/frontend/apps/e2e/__tests__/app-impress/doc-routing.spec.ts

@@ -7,22 +7,6 @@ test.describe('Doc Routing', () => {
     await page.goto('/');
   });
 
-  test('Check the presence of the meta tag noindex', async ({ page }) => {
-    const buttonCreateHomepage = page.getByRole('button', {
-      name: 'Create a new document',
-    });
-
-    await expect(buttonCreateHomepage).toBeVisible();
-    await buttonCreateHomepage.click();
-    await expect(
-      page.getByRole('button', {
-        name: 'Share',
-      }),
-    ).toBeVisible();
-    const metaDescription = page.locator('meta[name="robots"]');
-    await expect(metaDescription).toHaveAttribute('content', 'noindex');
-  });
-
   test('checks alias docs url with homepage', async ({ page }) => {
     await expect(page).toHaveURL('/');
 

src/frontend/apps/e2e/__tests__/app-impress/doc-visibility.spec.ts

@@ -2,13 +2,40 @@ import { expect, test } from '@playwright/test';
 
 import { createDoc, keyCloakSignIn } from './common';
 
-const browsersName = ['chromium', 'webkit', 'firefox'];
-
 test.describe('Doc Visibility', () => {
   test.beforeEach(async ({ page }) => {
     await page.goto('/');
   });
 
+  test('Make a public doc', async ({ page, browserName }) => {
+    const [docTitle] = await createDoc(
+      page,
+      'My new doc',
+      browserName,
+      1,
+      true,
+    );
+
+    const header = page.locator('header').first();
+    await header.locator('h2').getByText('Docs').click();
+
+    const datagrid = page
+      .getByLabel('Datagrid of the documents page 1')
+      .getByRole('table');
+
+    await expect(datagrid.getByLabel('Loading data')).toBeHidden({
+      timeout: 10000,
+    });
+
+    await expect(datagrid.getByText(docTitle)).toBeVisible();
+
+    const row = datagrid.getByRole('row').filter({
+      hasText: docTitle,
+    });
+
+    await expect(row.getByRole('cell').nth(0)).toHaveText('Public');
+  });
+
   test('It checks the copy link button', async ({ page, browserName }) => {
     // eslint-disable-next-line playwright/no-skipped-test
     test.skip(
@@ -30,48 +57,12 @@ test.describe('Doc Visibility', () => {
 
     expect(clipboardContent).toMatch(page.url());
   });
-
-  test('It checks the link role options', async ({ page, browserName }) => {
-    await createDoc(page, 'Doc role options', browserName, 1);
-
-    await page.getByRole('button', { name: 'Share' }).click();
-
-    const selectVisibility = page.getByRole('combobox', {
-      name: 'Visibility',
-    });
-
-    await expect(selectVisibility.getByText('Authenticated')).toBeVisible();
-
-    await expect(page.getByLabel('Read only')).toBeVisible();
-    await expect(page.getByLabel('Can read and edit')).toBeVisible();
-
-    await selectVisibility.click();
-    await page
-      .getByRole('option', {
-        name: 'Restricted',
-      })
-      .click();
-
-    await expect(page.getByLabel('Read only')).toBeHidden();
-    await expect(page.getByLabel('Can read and edit')).toBeHidden();
-
-    await selectVisibility.click();
-
-    await page
-      .getByRole('option', {
-        name: 'Public',
-      })
-      .click();
-
-    await expect(page.getByLabel('Read only')).toBeVisible();
-    await expect(page.getByLabel('Can read and edit')).toBeVisible();
-  });
 });
 
-test.describe('Doc Visibility: Restricted', () => {
+test.describe('Doc Visibility: Not loggued', () => {
   test.use({ storageState: { cookies: [], origins: [] } });
 
-  test('A doc is not accessible when not authentified.', async ({
+  test('A public doc is accessible even when not authentified.', async ({
     page,
     browserName,
   }) => {
@@ -80,33 +71,16 @@ test.describe('Doc Visibility: Restricted', () => {
 
     const [docTitle] = await createDoc(
       page,
-      'Restricted no auth',
+      'My new doc',
       browserName,
       1,
+      true,
     );
 
-    await expect(page.getByRole('heading', { name: docTitle })).toBeVisible();
-
-    await page.getByRole('button', { name: 'Share' }).click();
-    await page
-      .getByRole('combobox', {
-        name: 'Visibility',
-      })
-      .click();
-    await page
-      .getByRole('option', {
-        name: 'Restricted',
-      })
-      .click();
-
     await expect(
-      page.getByText('The document visibility has been updated.'),
+      page.getByText('The document visiblitity has been updated.'),
     ).toBeVisible();
 
-    await page.locator('.c__modal__backdrop').click({
-      position: { x: 0, y: 0 },
-    });
-
     const urlDoc = page.url();
 
     await page
@@ -119,173 +93,21 @@ test.describe('Doc Visibility: Restricted', () => {
 
     await page.goto(urlDoc);
 
-    await expect(page.getByRole('textbox', { name: 'password' })).toBeVisible();
+    await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Share' })).toBeHidden();
   });
 
-  test('A doc is not accessible when authentified but not member.', async ({
+  test('A private doc redirect to the OIDC when not authentified.', async ({
     page,
     browserName,
   }) => {
-    await page.goto('/');
-    await keyCloakSignIn(page, browserName);
-
-    const [docTitle] = await createDoc(page, 'Restricted auth', browserName, 1);
-
-    await expect(page.getByRole('heading', { name: docTitle })).toBeVisible();
-
-    await page.getByRole('button', { name: 'Share' }).click();
-    await page
-      .getByRole('combobox', {
-        name: 'Visibility',
-      })
-      .click();
-    await page
-      .getByRole('option', {
-        name: 'Restricted',
-      })
-      .click();
-
-    await expect(
-      page.getByText('The document visibility has been updated.'),
-    ).toBeVisible();
-
-    await page.locator('.c__modal__backdrop').click({
-      position: { x: 0, y: 0 },
-    });
-
-    const urlDoc = page.url();
-
-    await page
-      .getByRole('button', {
-        name: 'Logout',
-      })
-      .click();
-
-    const otherBrowser = browsersName.find((b) => b !== browserName);
-
-    await keyCloakSignIn(page, otherBrowser!);
-
-    await page.goto(urlDoc);
-
-    await expect(
-      page.getByText('You do not have permission to perform this action.'),
-    ).toBeVisible();
-  });
-
-  test('A doc is accessible when member.', async ({ page, browserName }) => {
     test.slow();
     await page.goto('/');
     await keyCloakSignIn(page, browserName);
 
-    const [docTitle] = await createDoc(page, 'Restricted auth', browserName, 1);
-
-    await expect(page.getByRole('heading', { name: docTitle })).toBeVisible();
-
-    await page.getByRole('button', { name: 'Share' }).click();
-    await page
-      .getByRole('combobox', {
-        name: 'Visibility',
-      })
-      .click();
-    await page
-      .getByRole('option', {
-        name: 'Restricted',
-      })
-      .click();
-
-    await expect(
-      page.getByText('The document visibility has been updated.'),
-    ).toBeVisible();
-
-    const inputSearch = page.getByLabel(/Find a member to add to the document/);
-
-    const otherBrowser = browsersName.find((b) => b !== browserName);
-    const username = `user@${otherBrowser}.e2e`;
-    await inputSearch.fill(username);
-    await page.getByRole('option', { name: username }).click();
-
-    // Choose a role
-    await page.getByRole('combobox', { name: /Choose a role/ }).click();
-    await page.getByRole('option', { name: 'Administrator' }).click();
-
-    await page.getByRole('button', { name: 'Validate' }).click();
-
-    await expect(
-      page.getByText(`User ${username} added to the document.`),
-    ).toBeVisible();
-
-    await page.locator('.c__modal__backdrop').click({
-      position: { x: 0, y: 0 },
-    });
-
-    const urlDoc = page.url();
-
-    await page
-      .getByRole('button', {
-        name: 'Logout',
-      })
-      .click();
-
-    await keyCloakSignIn(page, otherBrowser!);
-
-    await page.goto(urlDoc);
+    const [docTitle] = await createDoc(page, 'My private doc', browserName, 1);
 
     await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
-    await expect(page.getByRole('button', { name: 'Share' })).toBeVisible();
-  });
-});
-
-test.describe('Doc Visibility: Public', () => {
-  test.use({ storageState: { cookies: [], origins: [] } });
-
-  test('It checks a public doc in read only mode', async ({
-    page,
-    browserName,
-  }) => {
-    await page.goto('/');
-    await keyCloakSignIn(page, browserName);
-
-    const [docTitle] = await createDoc(
-      page,
-      'Public read only',
-      browserName,
-      1,
-    );
-
-    await expect(page.getByRole('heading', { name: docTitle })).toBeVisible();
-
-    await page.getByRole('button', { name: 'Share' }).click();
-    await page
-      .getByRole('combobox', {
-        name: 'Visibility',
-      })
-      .click();
-
-    await page
-      .getByRole('option', {
-        name: 'Public',
-      })
-      .click();
-
-    await expect(
-      page.getByText('The document visibility has been updated.'),
-    ).toBeVisible();
-
-    await page.getByLabel('Read only').click();
-
-    await expect(
-      page.getByText('The document visibility has been updated.').first(),
-    ).toBeVisible();
-
-    await page.locator('.c__modal__backdrop').click({
-      position: { x: 0, y: 0 },
-    });
-
-    await expect(
-      page
-        .getByLabel('It is the card information about the document.')
-        .getByText('Public', { exact: true }),
-    ).toBeVisible();
 
     const urlDoc = page.url();
 
@@ -295,197 +117,10 @@ test.describe('Doc Visibility: Public', () => {
       })
       .click();
 
-    await expect(page.getByRole('button', { name: 'Sign in' })).toBeVisible();
+    await expect(page.getByRole('textbox', { name: 'password' })).toBeVisible();
 
     await page.goto(urlDoc);
 
-    await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
-    await expect(page.getByRole('button', { name: 'Share' })).toBeHidden();
-    await expect(
-      page.getByText('Read only, you cannot edit this document'),
-    ).toBeVisible();
-  });
-
-  test('It checks a public doc in editable mode', async ({
-    page,
-    browserName,
-  }) => {
-    await page.goto('/');
-    await keyCloakSignIn(page, browserName);
-
-    const [docTitle] = await createDoc(page, 'Public editable', browserName, 1);
-
-    await expect(page.getByRole('heading', { name: docTitle })).toBeVisible();
-
-    await page.getByRole('button', { name: 'Share' }).click();
-    await page
-      .getByRole('combobox', {
-        name: 'Visibility',
-      })
-      .click();
-
-    await page
-      .getByRole('option', {
-        name: 'Public',
-      })
-      .click();
-
-    await expect(
-      page.getByText('The document visibility has been updated.'),
-    ).toBeVisible();
-
-    await page.getByLabel('Can read and edit').click();
-
-    await expect(
-      page.getByText('The document visibility has been updated.').first(),
-    ).toBeVisible();
-
-    await page.locator('.c__modal__backdrop').click({
-      position: { x: 0, y: 0 },
-    });
-
-    await expect(
-      page
-        .getByLabel('It is the card information about the document.')
-        .getByText('Public', { exact: true }),
-    ).toBeVisible();
-
-    const urlDoc = page.url();
-
-    await page
-      .getByRole('button', {
-        name: 'Logout',
-      })
-      .click();
-
-    await expect(page.getByRole('button', { name: 'Sign in' })).toBeVisible();
-
-    await page.goto(urlDoc);
-
-    await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
-    await expect(page.getByRole('button', { name: 'Share' })).toBeHidden();
-    await expect(
-      page.getByText('Read only, you cannot edit this document'),
-    ).toBeHidden();
-  });
-});
-
-test.describe('Doc Visibility: Authenticated', () => {
-  test.use({ storageState: { cookies: [], origins: [] } });
-
-  test('A doc is not accessible when unauthentified.', async ({
-    page,
-    browserName,
-  }) => {
-    await page.goto('/');
-    await keyCloakSignIn(page, browserName);
-
-    const [docTitle] = await createDoc(
-      page,
-      'Authenticated unauthentified',
-      browserName,
-      1,
-    );
-
-    await expect(page.getByRole('heading', { name: docTitle })).toBeVisible();
-
-    const urlDoc = page.url();
-
-    await page
-      .getByRole('button', {
-        name: 'Logout',
-      })
-      .click();
-
-    await expect(page.getByRole('button', { name: 'Sign in' })).toBeVisible();
-
-    await page.goto(urlDoc);
-
-    await expect(page.locator('h2').getByText(docTitle)).toBeHidden();
     await expect(page.getByRole('textbox', { name: 'password' })).toBeVisible();
   });
-
-  test('It checks a authenticated doc in read only mode', async ({
-    page,
-    browserName,
-  }) => {
-    await page.goto('/');
-    await keyCloakSignIn(page, browserName);
-
-    const [docTitle] = await createDoc(
-      page,
-      'Authenticated read only',
-      browserName,
-      1,
-    );
-
-    await expect(page.getByRole('heading', { name: docTitle })).toBeVisible();
-
-    const urlDoc = page.url();
-
-    await page
-      .getByRole('button', {
-        name: 'Logout',
-      })
-      .click();
-
-    const otherBrowser = browsersName.find((b) => b !== browserName);
-    await keyCloakSignIn(page, otherBrowser!);
-
-    await page.goto(urlDoc);
-
-    await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
-    await expect(page.getByRole('button', { name: 'Share' })).toBeVisible();
-    await expect(
-      page.getByText('Read only, you cannot edit this document'),
-    ).toBeVisible();
-  });
-
-  test('It checks a authenticated doc in editable mode', async ({
-    page,
-    browserName,
-  }) => {
-    await page.goto('/');
-    await keyCloakSignIn(page, browserName);
-
-    const [docTitle] = await createDoc(
-      page,
-      'Authenticated editable',
-      browserName,
-      1,
-    );
-
-    await expect(page.getByRole('heading', { name: docTitle })).toBeVisible();
-
-    const urlDoc = page.url();
-
-    await page.getByRole('button', { name: 'Share' }).click();
-
-    await page.getByLabel('Can read and edit').click();
-
-    await expect(
-      page.getByText('The document visibility has been updated.').first(),
-    ).toBeVisible();
-
-    await page.locator('.c__modal__backdrop').click({
-      position: { x: 0, y: 0 },
-    });
-
-    await page
-      .getByRole('button', {
-        name: 'Logout',
-      })
-      .click();
-
-    const otherBrowser = browsersName.find((b) => b !== browserName);
-    await keyCloakSignIn(page, otherBrowser!);
-
-    await page.goto(urlDoc);
-
-    await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
-    await expect(page.getByRole('button', { name: 'Share' })).toBeVisible();
-    await expect(
-      page.getByText('Read only, you cannot edit this document'),
-    ).toBeHidden();
-  });
 });

src/frontend/apps/e2e/__tests__/app-impress/language.spec.ts

@@ -25,38 +25,4 @@ test.describe('Language', () => {
       }),
     ).toBeVisible();
   });
-
-  test('checks that backend uses the same language as the frontend', async ({
-    page,
-  }) => {
-    // Helper function to intercept and assert 404 response
-    const check404Response = async (expectedDetail: string) => {
-      const expectedBackendResponse = page.waitForResponse(
-        (response) =>
-          response.url().includes('/api') &&
-          response.url().includes('non-existent-doc-uuid') &&
-          response.status() === 404,
-      );
-
-      // Trigger the specific 404 XHR response by navigating to a non-existent document
-      await page.goto('/docs/non-existent-doc-uuid');
-
-      // Assert that the intercepted error message is in the expected language
-      const interceptedBackendResponse = await expectedBackendResponse;
-      expect(await interceptedBackendResponse.json()).toStrictEqual({
-        detail: expectedDetail,
-      });
-    };
-
-    // Check for English 404 response
-    await check404Response('Not found.');
-
-    // Switch language to French
-    const header = page.locator('header').first();
-    await header.getByRole('combobox').getByText('English').click();
-    await header.getByRole('option', { name: 'Français' }).click();
-
-    // Check for French 404 response
-    await check404Response('Pas trouvé.');
-  });
 });

src/frontend/apps/e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-e2e",
-  "version": "1.7.0",
+  "version": "1.5.1",
   "private": true,
   "scripts": {
     "lint": "eslint . --ext .ts",
@@ -12,7 +12,7 @@
     "test:ui::chromium": "yarn test:ui --project=chromium"
   },
   "devDependencies": {
-    "@playwright/test": "1.48.1",
+    "@playwright/test": "1.47.2",
     "@types/node": "*",
     "@types/pdf-parse": "1.1.4",
     "eslint-config-impress": "*",

src/frontend/apps/impress/cunningham.ts

@@ -358,8 +358,6 @@ const config = {
         },
         'forms-field': {
           color: 'var(--c--theme--colors--primary-text)',
-          'footer-font-size': 'var(--c--theme--font--sizes--t)',
-          'footer-color': 'var(--c--theme--colors--greyscale-text)',
         },
         'forms-input': {
           'border-radius': '4px',
@@ -374,9 +372,6 @@ const config = {
             big: 'var(--c--theme--colors--primary-text)',
           },
         },
-        'forms-radio': {
-          'accent-color': 'var(--c--theme--colors--primary-600)',
-        },
         'forms-select': {
           'item-font-size': '14px',
           'border-radius': '4px',

src/frontend/apps/impress/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-impress",
-  "version": "1.7.0",
+  "version": "1.5.1",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -19,37 +19,36 @@
     "@blocknote/mantine": "*",
     "@blocknote/react": "*",
     "@gouvfr-lasuite/integration": "1.0.2",
-    "@hocuspocus/provider": "2.13.7",
+    "@hocuspocus/provider": "2.13.6",
     "@openfun/cunningham-react": "2.9.4",
-    "@tanstack/react-query": "5.59.15",
-    "i18next": "23.16.2",
-    "i18next-browser-languagedetector": "8.0.0",
+    "@tanstack/react-query": "5.56.2",
+    "i18next": "23.15.1",
     "idb": "8.0.0",
     "lodash": "4.17.21",
     "luxon": "3.5.0",
-    "next": "14.2.15",
+    "next": "14.2.13",
     "react": "*",
-    "react-aria-components": "1.4.1",
+    "react-aria-components": "1.3.3",
     "react-dom": "*",
-    "react-i18next": "15.0.3",
+    "react-i18next": "15.0.2",
     "react-select": "5.8.1",
     "styled-components": "6.1.13",
     "y-protocols": "1.0.6",
     "yjs": "*",
-    "zustand": "5.0.0"
+    "zustand": "4.5.5"
   },
   "devDependencies": {
     "@svgr/webpack": "8.1.0",
-    "@tanstack/react-query-devtools": "5.59.15",
+    "@tanstack/react-query-devtools": "5.58.0",
     "@testing-library/dom": "10.4.0",
-    "@testing-library/jest-dom": "6.6.2",
+    "@testing-library/jest-dom": "6.5.0",
     "@testing-library/react": "16.0.1",
     "@testing-library/user-event": "14.5.2",
     "@types/jest": "29.5.13",
-    "@types/lodash": "4.17.12",
+    "@types/lodash": "4.17.9",
     "@types/luxon": "3.4.2",
     "@types/node": "*",
-    "@types/react": "18.3.11",
+    "@types/react": "18.3.10",
     "@types/react-dom": "*",
     "cross-env": "*",
     "dotenv": "16.4.5",
@@ -59,7 +58,7 @@
     "jest-environment-jsdom": "29.7.0",
     "node-fetch": "2.7.0",
     "prettier": "3.3.3",
-    "stylelint": "16.10.0",
+    "stylelint": "16.9.0",
     "stylelint-config-standard": "36.0.1",
     "stylelint-prettier": "5.0.2",
     "typescript": "*",

src/frontend/apps/impress/src/api/APIError.ts

@@ -18,7 +18,3 @@ export class APIError<T = unknown> extends Error implements IAPIError<T> {
     this.data = data;
   }
 }
-
-export const isAPIError = (error: unknown): error is APIError => {
-  return error instanceof APIError;
-};

src/frontend/apps/impress/src/components/Box.tsx

@@ -19,7 +19,7 @@ export interface BoxProps {
   $direction?: CSSProperties['flexDirection'];
   $display?: CSSProperties['display'];
   $effect?: 'show' | 'hide';
-  $flex?: CSSProperties['flex'];
+  $flex?: boolean;
   $gap?: CSSProperties['gap'];
   $hasTransition?: boolean | 'slow';
   $height?: CSSProperties['height'];
@@ -50,7 +50,7 @@ export const Box = styled('div')<BoxProps>`
   ${({ $color }) => $color && `color: ${$color};`}
   ${({ $direction }) => $direction && `flex-direction: ${$direction};`}
   ${({ $display }) => $display && `display: ${$display};`}
-  ${({ $flex }) => $flex && `flex: ${$flex};`}
+  ${({ $flex }) => $flex === false && `display: block;`}
   ${({ $gap }) => $gap && `gap: ${$gap};`}
   ${({ $height }) => $height && `height: ${$height};`}
   ${({ $hasTransition }) =>

src/frontend/apps/impress/src/components/Text.tsx

@@ -1,9 +1,4 @@
-import {
-  CSSProperties,
-  ComponentPropsWithRef,
-  ReactHTML,
-  forwardRef,
-} from 'react';
+import { CSSProperties, ComponentPropsWithRef, ReactHTML } from 'react';
 import styled from 'styled-components';
 
 import { tokens } from '@/cunningham';
@@ -60,21 +55,18 @@ export const TextStyled = styled(Box)<TextProps>`
     `white-space: nowrap; overflow: hidden; text-overflow: ellipsis;`}
 `;
 
-const Text = forwardRef<HTMLElement, ComponentPropsWithRef<typeof TextStyled>>(
-  ({ className, $isMaterialIcon, ...props }, ref) => {
-    return (
-      <TextStyled
-        ref={ref}
-        as="span"
-        $theme="greyscale"
-        $variation="text"
-        className={`${className || ''}${$isMaterialIcon ? ' material-icons' : ''}`}
-        {...props}
-      />
-    );
-  },
-);
-
-Text.displayName = 'Text';
-
-export { Text };
+export const Text = ({
+  className,
+  $isMaterialIcon,
+  ...props
+}: ComponentPropsWithRef<typeof TextStyled>) => {
+  return (
+    <TextStyled
+      as="span"
+      $theme="greyscale"
+      $variation="text"
+      className={`${className || ''}${$isMaterialIcon ? ' material-icons' : ''}`}
+      {...props}
+    />
+  );
+};

src/frontend/apps/impress/src/core/auth/api/types.ts

@@ -8,6 +8,4 @@
 export interface User {
   id: string;
   email: string;
-  full_name: string;
-  short_name: string;
 }

src/frontend/apps/impress/src/cunningham/cunningham-style.css

@@ -16,12 +16,6 @@
   line-height: initial;
 }
 
-.c__field .c__field__footer {
-  padding: 2px 0 0;
-  font-size: var(--c--components--forms-field--footer-font-size);
-  color: var(--c--components--forms-field--footer-color);
-}
-
 .labelled-box label {
   color: var(--c--theme--colors--primary-text);
 }
@@ -334,10 +328,6 @@ input:-webkit-autofill:focus {
   cursor: not-allowed;
 }
 
-.c__checkbox.c__checkbox--disabled .c__checkbox__label {
-  color: var(--c--theme--colors--greyscale-400);
-}
-
 /**
  * Button
 */
@@ -542,10 +532,3 @@ input:-webkit-autofill:focus {
 .c__toast__container {
   z-index: 10000;
 }
-
-/**
- * Tooltip
-*/
-.c__tooltip {
-  padding: 4px 6px;
-}

src/frontend/apps/impress/src/cunningham/cunningham-tokens.css

@@ -477,12 +477,6 @@
   --c--components--forms-datepicker--border-radius: 0;
   --c--components--forms-fileuploader--border-radius: 0;
   --c--components--forms-field--color: var(--c--theme--colors--primary-text);
-  --c--components--forms-field--footer-font-size: var(
-    --c--theme--font--sizes--t
-  );
-  --c--components--forms-field--footer-color: var(
-    --c--theme--colors--greyscale-text
-  );
   --c--components--forms-input--border-radius: 4px;
   --c--components--forms-input--background-color: #fff;
   --c--components--forms-input--border-color: var(
@@ -498,9 +492,6 @@
   --c--components--forms-labelledbox--label-color--big: var(
     --c--theme--colors--primary-text
   );
-  --c--components--forms-radio--accent-color: var(
-    --c--theme--colors--primary-600
-  );
   --c--components--forms-select--item-font-size: 14px;
   --c--components--forms-select--border-radius: 4px;
   --c--components--forms-select--border-radius-hover: 4px;

src/frontend/apps/impress/src/cunningham/cunningham-tokens.ts

@@ -479,11 +479,7 @@ export const tokens = {
         },
         'forms-datepicker': { 'border-radius': '0' },
         'forms-fileuploader': { 'border-radius': '0' },
-        'forms-field': {
-          color: 'var(--c--theme--colors--primary-text)',
-          'footer-font-size': 'var(--c--theme--font--sizes--t)',
-          'footer-color': 'var(--c--theme--colors--greyscale-text)',
-        },
+        'forms-field': { color: 'var(--c--theme--colors--primary-text)' },
         'forms-input': {
           'border-radius': '4px',
           'background-color': '#ffffff',
@@ -495,9 +491,6 @@ export const tokens = {
         'forms-labelledbox': {
           'label-color': { big: 'var(--c--theme--colors--primary-text)' },
         },
-        'forms-radio': {
-          'accent-color': 'var(--c--theme--colors--primary-600)',
-        },
         'forms-select': {
           'item-font-size': '14px',
           'border-radius': '4px',

src/frontend/apps/impress/src/features/docs/doc-editor/api/index.ts

@@ -1,3 +0,0 @@
-export * from './useCreateDocUpload';
-export * from './useDocAITransform';
-export * from './useDocAITranslate';

src/frontend/apps/impress/src/features/docs/doc-editor/api/useDocAITransform.tsx

@@ -1,46 +0,0 @@
-import { useMutation } from '@tanstack/react-query';
-
-import { APIError, errorCauses, fetchAPI } from '@/api';
-
-export type AITransformActions =
-  | 'correct'
-  | 'prompt'
-  | 'rephrase'
-  | 'summarize';
-
-export type DocAITransform = {
-  docId: string;
-  text: string;
-  action: AITransformActions;
-};
-
-export type DocAITransformResponse = {
-  answer: string;
-};
-
-export const docAITransform = async ({
-  docId,
-  ...params
-}: DocAITransform): Promise<DocAITransformResponse> => {
-  const response = await fetchAPI(`documents/${docId}/ai-transform/`, {
-    method: 'POST',
-    body: JSON.stringify({
-      ...params,
-    }),
-  });
-
-  if (!response.ok) {
-    throw new APIError(
-      'Failed to request ai transform',
-      await errorCauses(response),
-    );
-  }
-
-  return response.json() as Promise<DocAITransformResponse>;
-};
-
-export function useDocAITransform() {
-  return useMutation<DocAITransformResponse, APIError, DocAITransform>({
-    mutationFn: docAITransform,
-  });
-}

src/frontend/apps/impress/src/features/docs/doc-editor/api/useDocAITranslate.tsx

@@ -1,40 +0,0 @@
-import { useMutation } from '@tanstack/react-query';
-
-import { APIError, errorCauses, fetchAPI } from '@/api';
-
-export type DocAITranslate = {
-  docId: string;
-  text: string;
-  language: string;
-};
-
-export type DocAITranslateResponse = {
-  answer: string;
-};
-
-export const docAITranslate = async ({
-  docId,
-  ...params
-}: DocAITranslate): Promise<DocAITranslateResponse> => {
-  const response = await fetchAPI(`documents/${docId}/ai-translate/`, {
-    method: 'POST',
-    body: JSON.stringify({
-      ...params,
-    }),
-  });
-
-  if (!response.ok) {
-    throw new APIError(
-      'Failed to request ai translate',
-      await errorCauses(response),
-    );
-  }
-
-  return response.json() as Promise<DocAITranslateResponse>;
-};
-
-export function useDocAITranslate() {
-  return useMutation<DocAITranslateResponse, APIError, DocAITranslate>({
-    mutationFn: docAITranslate,
-  });
-}

src/frontend/apps/impress/src/features/docs/doc-editor/components/AIButton.tsx

@@ -1,340 +0,0 @@
-import {
-  ComponentProps,
-  useBlockNoteEditor,
-  useComponentsContext,
-  useSelectedBlocks,
-} from '@blocknote/react';
-import {
-  Loader,
-  VariantType,
-  useToastProvider,
-} from '@openfun/cunningham-react';
-import { PropsWithChildren, ReactNode, useMemo } from 'react';
-import { useTranslation } from 'react-i18next';
-
-import { isAPIError } from '@/api';
-import { Box, Text } from '@/components';
-import { useDocOptions } from '@/features/docs/doc-management/';
-
-import {
-  AITransformActions,
-  useDocAITransform,
-  useDocAITranslate,
-} from '../api/';
-import { useDocStore } from '../stores';
-
-type LanguageTranslate = {
-  value: string;
-  display_name: string;
-};
-
-const sortByPopularLanguages = (
-  languages: LanguageTranslate[],
-  popularLanguages: string[],
-) => {
-  languages.sort((a, b) => {
-    const indexA = popularLanguages.indexOf(a.value);
-    const indexB = popularLanguages.indexOf(b.value);
-
-    // If both languages are in the popular list, sort based on their order in popularLanguages
-    if (indexA !== -1 && indexB !== -1) {
-      return indexA - indexB;
-    }
-
-    // If only a is in the popular list, it should come first
-    if (indexA !== -1) {
-      return -1;
-    }
-
-    // If only b is in the popular list, it should come first
-    if (indexB !== -1) {
-      return 1;
-    }
-
-    // If neither a nor b is in the popular list, maintain their relative order
-    return 0;
-  });
-};
-
-export function AIGroupButton() {
-  const editor = useBlockNoteEditor();
-  const Components = useComponentsContext();
-  const selectedBlocks = useSelectedBlocks(editor);
-  const { t } = useTranslation();
-  const { currentDoc } = useDocStore();
-  const { data: docOptions } = useDocOptions();
-
-  const languages = useMemo(() => {
-    const languages = docOptions?.actions.POST.language.choices;
-
-    if (!languages) {
-      return;
-    }
-
-    sortByPopularLanguages(languages, [
-      'fr',
-      'en',
-      'de',
-      'es',
-      'it',
-      'pt',
-      'nl',
-      'pl',
-    ]);
-
-    return languages;
-  }, [docOptions?.actions.POST.language.choices]);
-
-  const show = useMemo(() => {
-    return !!selectedBlocks.find((block) => block.content !== undefined);
-  }, [selectedBlocks]);
-
-  if (!show || !editor.isEditable || !Components || !currentDoc || !languages) {
-    return null;
-  }
-
-  return (
-    <Components.Generic.Menu.Root>
-      <Components.Generic.Menu.Trigger>
-        <Components.FormattingToolbar.Button
-          className="bn-button bn-menu-item"
-          data-test="ai-actions"
-          label="AI"
-          mainTooltip={t('AI Actions')}
-          icon={
-            <Text $isMaterialIcon $size="l">
-              auto_awesome
-            </Text>
-          }
-        />
-      </Components.Generic.Menu.Trigger>
-      <Components.Generic.Menu.Dropdown
-        className="bn-menu-dropdown bn-drag-handle-menu"
-        sub={true}
-      >
-        <AIMenuItemTransform
-          action="prompt"
-          docId={currentDoc.id}
-          icon={
-            <Text $isMaterialIcon $size="s">
-              text_fields
-            </Text>
-          }
-        >
-          {t('Use as prompt')}
-        </AIMenuItemTransform>
-        <AIMenuItemTransform
-          action="rephrase"
-          docId={currentDoc.id}
-          icon={
-            <Text $isMaterialIcon $size="s">
-              refresh
-            </Text>
-          }
-        >
-          {t('Rephrase')}
-        </AIMenuItemTransform>
-        <AIMenuItemTransform
-          action="summarize"
-          docId={currentDoc.id}
-          icon={
-            <Text $isMaterialIcon $size="s">
-              summarize
-            </Text>
-          }
-        >
-          {t('Summarize')}
-        </AIMenuItemTransform>
-        <AIMenuItemTransform
-          action="correct"
-          docId={currentDoc.id}
-          icon={
-            <Text $isMaterialIcon $size="s">
-              check
-            </Text>
-          }
-        >
-          {t('Correct')}
-        </AIMenuItemTransform>
-        <Components.Generic.Menu.Root position="right" sub={true}>
-          <Components.Generic.Menu.Trigger sub={false}>
-            <Components.Generic.Menu.Item
-              className="bn-menu-item"
-              subTrigger={true}
-            >
-              <Box $direction="row" $gap="0.6rem">
-                <Text $isMaterialIcon $size="s">
-                  translate
-                </Text>
-                {t('Language')}
-              </Box>
-            </Components.Generic.Menu.Item>
-          </Components.Generic.Menu.Trigger>
-          <Components.Generic.Menu.Dropdown
-            sub={true}
-            className="bn-menu-dropdown"
-          >
-            {languages.map((language) => (
-              <AIMenuItemTranslate
-                key={language.value}
-                language={language.value}
-                docId={currentDoc.id}
-              >
-                {language.display_name}
-              </AIMenuItemTranslate>
-            ))}
-          </Components.Generic.Menu.Dropdown>
-        </Components.Generic.Menu.Root>
-      </Components.Generic.Menu.Dropdown>
-    </Components.Generic.Menu.Root>
-  );
-}
-
-/**
- * Item is derived from Mantime, some props seem lacking or incorrect.
- */
-type ItemDefault = ComponentProps['Generic']['Menu']['Item'];
-type ItemProps = Omit<ItemDefault, 'onClick'> & {
-  rightSection?: ReactNode;
-  closeMenuOnClick?: boolean;
-  onClick: (e: React.MouseEvent) => void;
-};
-
-interface AIMenuItemTransform {
-  action: AITransformActions;
-  docId: string;
-  icon?: ReactNode;
-}
-
-const AIMenuItemTransform = ({
-  docId,
-  action,
-  children,
-  icon,
-}: PropsWithChildren<AIMenuItemTransform>) => {
-  const { mutateAsync: requestAI, isPending } = useDocAITransform();
-
-  const requestAIAction = async (markdown: string) => {
-    const responseAI = await requestAI({
-      text: markdown,
-      action,
-      docId,
-    });
-    return responseAI.answer;
-  };
-
-  return (
-    <AIMenuItem icon={icon} requestAI={requestAIAction} isPending={isPending}>
-      {children}
-    </AIMenuItem>
-  );
-};
-
-interface AIMenuItemTranslate {
-  language: string;
-  docId: string;
-  icon?: ReactNode;
-}
-
-const AIMenuItemTranslate = ({
-  children,
-  docId,
-  icon,
-  language,
-}: PropsWithChildren<AIMenuItemTranslate>) => {
-  const { mutateAsync: requestAI, isPending } = useDocAITranslate();
-
-  const requestAITranslate = async (markdown: string) => {
-    const responseAI = await requestAI({
-      text: markdown,
-      language,
-      docId,
-    });
-    return responseAI.answer;
-  };
-
-  return (
-    <AIMenuItem
-      icon={icon}
-      requestAI={requestAITranslate}
-      isPending={isPending}
-    >
-      {children}
-    </AIMenuItem>
-  );
-};
-
-interface AIMenuItemProps {
-  requestAI: (markdown: string) => Promise<string>;
-  isPending: boolean;
-  icon?: ReactNode;
-}
-
-const AIMenuItem = ({
-  requestAI,
-  isPending,
-  children,
-  icon,
-}: PropsWithChildren<AIMenuItemProps>) => {
-  const Components = useComponentsContext();
-
-  const editor = useBlockNoteEditor();
-  const handleAIError = useHandleAIError();
-
-  const handleAIAction = async () => {
-    const selectedBlocks = editor.getSelection()?.blocks;
-
-    if (!selectedBlocks || selectedBlocks.length === 0) {
-      return;
-    }
-
-    const markdown = await editor.blocksToMarkdownLossy(selectedBlocks);
-
-    try {
-      const responseAI = await requestAI(markdown);
-
-      if (!responseAI) {
-        return;
-      }
-
-      const blockMarkdown = await editor.tryParseMarkdownToBlocks(responseAI);
-      editor.replaceBlocks(selectedBlocks, blockMarkdown);
-    } catch (error) {
-      handleAIError(error);
-    }
-  };
-
-  if (!Components) {
-    return null;
-  }
-
-  const Item = Components.Generic.Menu.Item as React.FC<ItemProps>;
-
-  return (
-    <Item
-      closeMenuOnClick={false}
-      icon={icon}
-      onClick={(e: React.MouseEvent) => {
-        e.stopPropagation();
-        void handleAIAction();
-      }}
-      rightSection={isPending ? <Loader size="small" /> : undefined}
-    >
-      {children}
-    </Item>
-  );
-};
-
-const useHandleAIError = () => {
-  const { toast } = useToastProvider();
-  const { t } = useTranslation();
-
-  return (error: unknown) => {
-    if (isAPIError(error) && error.status === 429) {
-      toast(t('Too many requests. Please wait 60 seconds.'), VariantType.ERROR);
-      return;
-    }
-
-    toast(t('AI seems busy! Please try again.'), VariantType.ERROR);
-  };
-};

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteEditor.tsx

@@ -1,11 +1,9 @@
-import { locales } from '@blocknote/core';
+import { BlockNoteEditor as BlockNoteEditorCore } from '@blocknote/core';
 import '@blocknote/core/fonts/inter.css';
 import { BlockNoteView } from '@blocknote/mantine';
 import '@blocknote/mantine/style.css';
-import { useCreateBlockNote } from '@blocknote/react';
 import { HocuspocusProvider } from '@hocuspocus/provider';
-import React, { useCallback, useEffect } from 'react';
-import { useTranslation } from 'react-i18next';
+import React, { useCallback, useEffect, useMemo } from 'react';
 
 import { Box, TextErrors } from '@/components';
 import { mediaUrl } from '@/core';
@@ -115,8 +113,6 @@ export const BlockNoteContent = ({
     error: errorAttachment,
   } = useCreateDocAttachment();
   const { setHeadings, resetHeadings } = useHeadingStore();
-  const { i18n } = useTranslation();
-  const lang = i18n.language;
 
   const uploadFile = useCallback(
     async (file: File) => {
@@ -133,8 +129,12 @@ export const BlockNoteContent = ({
     [createDocAttachment, doc.id],
   );
 
-  const editor = useCreateBlockNote(
-    {
+  const editor = useMemo(() => {
+    if (storedEditor) {
+      return storedEditor;
+    }
+
+    return BlockNoteEditorCore.create({
       collaboration: {
         provider,
         fragment: provider.document.getXmlFragment('document-store'),
@@ -143,11 +143,9 @@ export const BlockNoteContent = ({
           color: randomColor(),
         },
       },
-      dictionary: locales[lang as keyof typeof locales],
       uploadFile,
-    },
-    [provider, uploadFile, userData?.email, lang],
-  );
+    });
+  }, [provider, storedEditor, uploadFile, userData?.email]);
 
   useEffect(() => {
     setStore(storeId, { editor });
@@ -178,7 +176,7 @@ export const BlockNoteContent = ({
       )}
 
       <BlockNoteView
-        editor={storedEditor ?? editor}
+        editor={editor}
         formattingToolbar={false}
         editable={!readOnly}
         theme="light"

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteToolbar.tsx

@@ -1,26 +1,55 @@
 import '@blocknote/mantine/style.css';
 import {
+  BasicTextStyleButton,
+  BlockTypeSelect,
+  ColorStyleButton,
+  CreateLinkButton,
   FormattingToolbar,
   FormattingToolbarController,
-  getFormattingToolbarItems,
+  NestBlockButton,
+  TextAlignButton,
+  UnnestBlockButton,
 } from '@blocknote/react';
 import React from 'react';
 
-import { AIGroupButton } from './AIButton';
 import { MarkdownButton } from './MarkdownButton';
 
 export const BlockNoteToolbar = () => {
   return (
     <FormattingToolbarController
-      formattingToolbar={({ blockTypeSelectItems }) => (
+      formattingToolbar={() => (
         <FormattingToolbar>
-          {getFormattingToolbarItems(blockTypeSelectItems)}
-
-          {/* Extra button to do some AI powered actions */}
-          <AIGroupButton key="AIButton" />
+          <BlockTypeSelect key="blockTypeSelect" />
 
           {/* Extra button to convert from markdown to json */}
           <MarkdownButton key="customButton" />
+
+          <BasicTextStyleButton basicTextStyle="bold" key="boldStyleButton" />
+          <BasicTextStyleButton
+            basicTextStyle="italic"
+            key="italicStyleButton"
+          />
+          <BasicTextStyleButton
+            basicTextStyle="underline"
+            key="underlineStyleButton"
+          />
+          <BasicTextStyleButton
+            basicTextStyle="strike"
+            key="strikeStyleButton"
+          />
+          {/* Extra button to toggle code styles */}
+          <BasicTextStyleButton key="codeStyleButton" basicTextStyle="code" />
+
+          <TextAlignButton textAlignment="left" key="textAlignLeftButton" />
+          <TextAlignButton textAlignment="center" key="textAlignCenterButton" />
+          <TextAlignButton textAlignment="right" key="textAlignRightButton" />
+
+          <ColorStyleButton key="colorStyleButton" />
+
+          <NestBlockButton key="nestBlockButton" />
+          <UnnestBlockButton key="unnestBlockButton" />
+
+          <CreateLinkButton key="createLinkButton" />
         </FormattingToolbar>
       )}
     />

src/frontend/apps/impress/src/features/docs/doc-editor/components/MarkdownButton.tsx

@@ -6,7 +6,6 @@ import {
 } from '@blocknote/react';
 import { forEach, isArray } from 'lodash';
 import React, { useMemo } from 'react';
-import { useTranslation } from 'react-i18next';
 
 type Block = {
   type: string;
@@ -43,7 +42,6 @@ export function MarkdownButton() {
   const editor = useBlockNoteEditor();
   const Components = useComponentsContext();
   const selectedBlocks = useSelectedBlocks(editor);
-  const { t } = useTranslation();
 
   const handleConvertMarkdown = () => {
     const blocks = editor.getSelection()?.blocks;
@@ -77,7 +75,7 @@ export function MarkdownButton() {
 
   return (
     <Components.FormattingToolbar.Button
-      mainTooltip={t('Convert Markdown')}
+      mainTooltip="Convert Markdown"
       onClick={handleConvertMarkdown}
     >
       M

src/frontend/apps/impress/src/features/docs/doc-editor/stores/useDocStore.tsx

@@ -4,7 +4,7 @@ import * as Y from 'yjs';
 import { create } from 'zustand';
 
 import { providerUrl } from '@/core';
-import { Base64, Doc } from '@/features/docs/doc-management';
+import { Base64 } from '@/features/docs/doc-management';
 
 import { blocksToYDoc } from '../utils';
 
@@ -14,17 +14,14 @@ interface DocStore {
 }
 
 export interface UseDocStore {
-  currentDoc?: Doc;
   docsStore: {
     [storeId: string]: DocStore;
   };
   createProvider: (storeId: string, initialDoc: Base64) => HocuspocusProvider;
   setStore: (storeId: string, props: Partial<DocStore>) => void;
-  setCurrentDoc: (doc: Doc | undefined) => void;
 }
 
 export const useDocStore = create<UseDocStore>((set, get) => ({
-  currentDoc: undefined,
   docsStore: {},
   createProvider: (storeId: string, initialDoc: Base64) => {
     const doc = new Y.Doc({
@@ -55,9 +52,8 @@ export const useDocStore = create<UseDocStore>((set, get) => ({
     return provider;
   },
   setStore: (storeId, props) => {
-    set(({ docsStore }, ...store) => {
+    set(({ docsStore }) => {
       return {
-        ...store,
         docsStore: {
           ...docsStore,
           [storeId]: {
@@ -68,7 +64,4 @@ export const useDocStore = create<UseDocStore>((set, get) => ({
       };
     });
   },
-  setCurrentDoc: (doc) => {
-    set({ currentDoc: doc });
-  },
 }));

src/frontend/apps/impress/src/features/docs/doc-header/components/DocHeader.tsx

@@ -104,7 +104,7 @@ export const DocHeader = ({ doc, versionId }: DocHeaderProps) => {
                   )
                   .map((access, index, accesses) => (
                     <Fragment key={`access-${index}`}>
-                      {access.user.full_name || access.user.email}{' '}
+                      {access.user.email}{' '}
                       {index < accesses.length - 1 ? ' / ' : ''}
                     </Fragment>
                   ))}

src/frontend/apps/impress/src/features/docs/doc-header/components/DocTitle.tsx

@@ -7,6 +7,7 @@ import {
 } from '@openfun/cunningham-react';
 import React, { useCallback, useEffect, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
+import { createGlobalStyle } from 'styled-components';
 
 import { Box, Text } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
@@ -21,6 +22,12 @@ import {
 import { useResponsiveStore } from '@/stores';
 import { isFirefox } from '@/utils/userAgent';
 
+const DocTitleStyle = createGlobalStyle`
+  .c__tooltip {
+    padding: 4px 6px;
+  }
+`;
+
 interface DocTitleProps {
   doc: Doc;
 }
@@ -119,6 +126,7 @@ const DocTitleInput = ({ doc }: DocTitleProps) => {
 
   return (
     <>
+      <DocTitleStyle />
       <Tooltip content={t('Rename')} placement="top">
         <Box
           as="h2"

src/frontend/apps/impress/src/features/docs/doc-header/components/DocToolBox.tsx

@@ -1,14 +1,10 @@
-import {
-  Button,
-  VariantType,
-  useToastProvider,
-} from '@openfun/cunningham-react';
+import { Button } from '@openfun/cunningham-react';
 import React, { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import { Box, DropButton, IconOptions } from '@/components';
 import { useAuthStore } from '@/core';
-import { useDocStore, usePanelEditorStore } from '@/features/docs/doc-editor/';
+import { usePanelEditorStore } from '@/features/docs/doc-editor/';
 import {
   Doc,
   ModalRemoveDoc,
@@ -35,32 +31,6 @@ export const DocToolBox = ({ doc, versionId }: DocToolBoxProps) => {
   const [isModalVersionOpen, setIsModalVersionOpen] = useState(false);
   const { isSmallMobile } = useResponsiveStore();
   const { authenticated } = useAuthStore();
-  const { docsStore } = useDocStore();
-  const { toast } = useToastProvider();
-
-  const copyCurrentEditorToClipboard = async (
-    asFormat: 'html' | 'markdown',
-  ) => {
-    const editor = docsStore[doc.id]?.editor;
-    if (!editor) {
-      toast(t('Editor unavailable'), VariantType.ERROR, { duration: 3000 });
-      return;
-    }
-
-    try {
-      const editorContentFormatted =
-        asFormat === 'html'
-          ? await editor.blocksToHTMLLossy()
-          : await editor.blocksToMarkdownLossy();
-      await navigator.clipboard.writeText(editorContentFormatted);
-      toast(t('Copied to clipboard'), VariantType.SUCCESS, { duration: 3000 });
-    } catch (error) {
-      console.error(error);
-      toast(t('Failed to copy to clipboard'), VariantType.ERROR, {
-        duration: 3000,
-      });
-    }
-  };
 
   return (
     <Box
@@ -155,28 +125,6 @@ export const DocToolBox = ({ doc, versionId }: DocToolBoxProps) => {
                 {t('Delete document')}
               </Button>
             )}
-            <Button
-              onClick={() => {
-                setIsDropOpen(false);
-                void copyCurrentEditorToClipboard('markdown');
-              }}
-              color="primary-text"
-              icon={<span className="material-icons">content_copy</span>}
-              size="small"
-            >
-              {t('Copy as {{format}}', { format: 'Markdown' })}
-            </Button>
-            <Button
-              onClick={() => {
-                setIsDropOpen(false);
-                void copyCurrentEditorToClipboard('html');
-              }}
-              color="primary-text"
-              icon={<span className="material-icons">content_copy</span>}
-              size="small"
-            >
-              {t('Copy as {{format}}', { format: 'HTML' })}
-            </Button>
           </Box>
         </DropButton>
       </Box>

src/frontend/apps/impress/src/features/docs/doc-management/api/index.ts

@@ -1,6 +1,5 @@
 export * from './useCreateDoc';
 export * from './useDoc';
-export * from './useDocOptions';
 export * from './useDocs';
 export * from './useUpdateDoc';
 export * from './useUpdateDocLink';

src/frontend/apps/impress/src/features/docs/doc-management/api/useDocOptions.tsx

@@ -1,47 +0,0 @@
-import { UseQueryOptions, useQuery } from '@tanstack/react-query';
-
-import { APIError, errorCauses, fetchAPI } from '@/api';
-
-type DocOptionsResponse = {
-  actions: {
-    POST: {
-      language: {
-        choices: {
-          value: string;
-          display_name: string;
-        }[];
-      };
-    };
-  };
-};
-
-export const docOptions = async (): Promise<DocOptionsResponse> => {
-  const response = await fetchAPI(`documents/`, {
-    method: 'OPTIONS',
-  });
-
-  if (!response.ok) {
-    throw new APIError(
-      'Failed to get the doc options',
-      await errorCauses(response),
-    );
-  }
-
-  return response.json() as Promise<DocOptionsResponse>;
-};
-
-export const KEY_DOC_OPTIONS = 'doc-options';
-
-export function useDocOptions(
-  queryConfig?: UseQueryOptions<
-    DocOptionsResponse,
-    APIError,
-    DocOptionsResponse
-  >,
-) {
-  return useQuery<DocOptionsResponse, APIError, DocOptionsResponse>({
-    queryKey: [KEY_DOC_OPTIONS],
-    queryFn: docOptions,
-    ...queryConfig,
-  });
-}

src/frontend/apps/impress/src/features/docs/doc-management/components/DocVisibility.tsx

@@ -1,17 +1,16 @@
 import {
-  Radio,
-  RadioGroup,
-  Select,
+  Button,
+  Switch,
   VariantType,
   useToastProvider,
 } from '@openfun/cunningham-react';
+import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import { Box, Card, IconBG } from '@/components';
-import { useCunninghamTheme } from '@/cunningham';
 
 import { KEY_DOC, KEY_LIST_DOC, useUpdateDocLink } from '../api';
-import { Doc, LinkReach, LinkRole } from '../types';
+import { Doc, LinkReach } from '../types';
 
 interface DocVisibilityProps {
   doc: Doc;
@@ -19,12 +18,14 @@ interface DocVisibilityProps {
 
 export const DocVisibility = ({ doc }: DocVisibilityProps) => {
   const { t } = useTranslation();
+  const [docPublic, setDocPublic] = useState(
+    doc.link_reach === LinkReach.PUBLIC,
+  );
   const { toast } = useToastProvider();
-  const { colorsTokens } = useCunninghamTheme();
   const api = useUpdateDocLink({
     onSuccess: () => {
       toast(
-        t('The document visibility has been updated.'),
+        t('The document visiblitity has been updated.'),
         VariantType.SUCCESS,
         {
           duration: 4000,
@@ -34,34 +35,6 @@ export const DocVisibility = ({ doc }: DocVisibilityProps) => {
     listInvalideQueries: [KEY_LIST_DOC, KEY_DOC],
   });
 
-  const transLinkReach = {
-    [LinkReach.RESTRICTED]: {
-      label: t('Restricted'),
-      description: t('Only for people with access'),
-    },
-    [LinkReach.AUTHENTICATED]: {
-      label: t('Authenticated'),
-      description: t('Only for authenticated users'),
-    },
-    [LinkReach.PUBLIC]: {
-      label: t('Public'),
-      description: t('Anyone on the internet with the link can view'),
-    },
-  };
-
-  const linkRoleList = [
-    {
-      label: t('Read only'),
-      value: LinkRole.READER,
-    },
-    {
-      label: t('Can read and edit'),
-      value: LinkRole.EDITOR,
-    },
-  ];
-
-  const showLinkRoleOptions = doc.link_reach !== LinkReach.RESTRICTED;
-
   return (
     <Card
       $margin="tiny"
@@ -71,73 +44,55 @@ export const DocVisibility = ({ doc }: DocVisibilityProps) => {
       $align="center"
       $justify="space-between"
       $gap="1rem"
-      $wrap="wrap"
     >
-      <IconBG iconName="public" />
+      <IconBG iconName="public" $margin="none" />
       <Box
+        $width="100%"
         $wrap="wrap"
         $gap="1rem"
+        $justify="space-between"
         $direction="row"
-        $align="center"
-        $flex="1"
-        $css={`
-          & .c__field__footer .c__field__text {
-            ${!doc.abilities.link_configuration && `color: ${colorsTokens()['greyscale-400']};`};
-          }
-        `}
       >
-        <Box $shrink="0" $flex="auto" $maxWidth="20rem">
-          <Select
-            label={t('Visibility')}
-            options={Object.values(LinkReach).map((linkReach) => ({
-              label: transLinkReach[linkReach].label,
-              value: linkReach,
-            }))}
-            onChange={(evt) =>
+        <Box $direction="row" $gap="1rem" $align="center">
+          <Switch
+            label={t(docPublic ? 'Doc public' : 'Doc private')}
+            defaultChecked={docPublic}
+            onChange={() => {
               api.mutate({
-                link_reach: evt.target.value as LinkReach,
                 id: doc.id,
-              })
-            }
-            value={doc.link_reach}
-            clearable={false}
-            text={transLinkReach[doc.link_reach].description}
+                link_reach: docPublic ? LinkReach.RESTRICTED : LinkReach.PUBLIC,
+                link_role: 'reader',
+              });
+              setDocPublic(!docPublic);
+            }}
             disabled={!doc.abilities.link_configuration}
+            text={
+              docPublic
+                ? t('Anyone on the internet with the link can view')
+                : t('Only for people with access')
+            }
           />
         </Box>
-        {showLinkRoleOptions && (
-          <Box
-            $css={`
-              & .c__checkbox{
-                padding: 0.15rem 0.25rem;
-              }
-            `}
-          >
-            <RadioGroup
-              compact
-              style={{
-                display: 'flex',
-              }}
-              text={t('How people can interact with the document')}
-            >
-              {linkRoleList.map((radio) => (
-                <Radio
-                  key={radio.value}
-                  label={radio.label}
-                  value={radio.value}
-                  onChange={() =>
-                    api.mutate({
-                      link_role: radio.value,
-                      id: doc.id,
-                    })
-                  }
-                  checked={doc.link_role === radio.value}
-                  disabled={!doc.abilities.link_configuration}
-                />
-              ))}
-            </RadioGroup>
-          </Box>
-        )}
+        <Button
+          onClick={() => {
+            navigator.clipboard
+              .writeText(window.location.href)
+              .then(() => {
+                toast(t('Link Copied !'), VariantType.SUCCESS, {
+                  duration: 3000,
+                });
+              })
+              .catch(() => {
+                toast(t('Failed to copy link'), VariantType.ERROR, {
+                  duration: 3000,
+                });
+              });
+          }}
+          color="primary"
+          icon={<span className="material-icons">copy</span>}
+        >
+          {t('Copy link')}
+        </Button>
       </Box>
     </Card>
   );

src/frontend/apps/impress/src/features/docs/doc-management/components/ModalShare.tsx

@@ -1,8 +1,3 @@
-import {
-  Button,
-  VariantType,
-  useToastProvider,
-} from '@openfun/cunningham-react';
 import { t } from 'i18next';
 import { createGlobalStyle } from 'styled-components';
 
@@ -46,7 +41,6 @@ interface ModalShareProps {
 export const ModalShare = ({ onClose, doc }: ModalShareProps) => {
   const { isMobile, isSmallMobile } = useResponsiveStore();
   const width = isSmallMobile ? '100vw' : isMobile ? '90vw' : '70vw';
-  const { toast } = useToastProvider();
 
   return (
     <>
@@ -74,44 +68,13 @@ export const ModalShare = ({ onClose, doc }: ModalShareProps) => {
                 iconName="share"
                 $margin="none"
               />
-              <Box
-                $justify="space-between"
-                $direction="row"
-                $align="center"
-                $width="100%"
-                $gap="1rem"
-                $wrap="wrap"
-              >
-                <Box $align="flex-start">
-                  <Text as="h3" $size="26px" $margin="none">
-                    {t('Share')}
-                  </Text>
-                  <Text $size="small" $weight="normal" $textAlign="left">
-                    {doc.title}
-                  </Text>
-                </Box>
-                <Box $margin={{ right: '1.5rem' }} $shrink="0">
-                  <Button
-                    onClick={() => {
-                      navigator.clipboard
-                        .writeText(window.location.href)
-                        .then(() => {
-                          toast(t('Link Copied !'), VariantType.SUCCESS, {
-                            duration: 3000,
-                          });
-                        })
-                        .catch(() => {
-                          toast(t('Failed to copy link'), VariantType.ERROR, {
-                            duration: 3000,
-                          });
-                        });
-                    }}
-                    color="primary"
-                    icon={<span className="material-icons">copy</span>}
-                  >
-                    {t('Copy link')}
-                  </Button>
-                </Box>
+              <Box $align="flex-start">
+                <Text as="h3" $size="26px" $margin="none">
+                  {t('Share')}
+                </Text>
+                <Text $size="small" $weight="normal" $textAlign="left">
+                  {doc.title}
+                </Text>
               </Box>
             </Card>
             <DocVisibility doc={doc} />

src/frontend/apps/impress/src/features/docs/doc-management/types.tsx

@@ -27,11 +27,6 @@ export enum LinkReach {
   AUTHENTICATED = 'authenticated',
 }
 
-export enum LinkRole {
-  READER = 'reader',
-  EDITOR = 'editor',
-}
-
 export type Base64 = string;
 
 export interface Doc {
@@ -39,7 +34,7 @@ export interface Doc {
   title: string;
   content: Base64;
   link_reach: LinkReach;
-  link_role: LinkRole;
+  link_role: 'reader' | 'editor';
   accesses: Access[];
   created_at: string;
   updated_at: string;

src/frontend/apps/impress/src/features/docs/members/members-list/components/MemberItem.tsx

@@ -84,10 +84,9 @@ export const MemberItem = ({
           $css={`flex: ${isSmallMobile ? '100%' : '70%'};`}
         >
           <IconBG iconName="account_circle" $size="2rem" />
-          <Box $justify="center" $css="flex:1;">
-            {access.user.full_name && <Text>{access.user.full_name}</Text>}
-            <Text>{access.user.email}</Text>
-          </Box>
+          <Text $justify="center" $css="flex:1;">
+            {access.user.email}
+          </Text>
           <Box
             $direction="row"
             $gap="1rem"

src/frontend/apps/impress/src/features/service-worker/ApiPlugin.ts

@@ -1,11 +1,7 @@
 import { WorkboxPlugin } from 'workbox-core';
 
 import { Doc, DocsResponse } from '@/features/docs/doc-management';
-import {
-  LinkReach,
-  LinkRole,
-  Role,
-} from '@/features/docs/doc-management/types';
+import { LinkReach, Role } from '@/features/docs/doc-management/types';
 
 import { DBRequest, DocsDB } from './DocsDB';
 import { RequestSerializer } from './RequestSerializer';
@@ -213,8 +209,6 @@ export class ApiPlugin implements WorkboxPlugin {
           user: {
             id: 'dummy-id',
             email: 'dummy-email',
-            full_name: 'dummy-full-name',
-            short_name: 'dummy-short-name',
           },
           abilities: {
             destroy: false,
@@ -226,7 +220,7 @@ export class ApiPlugin implements WorkboxPlugin {
         },
       ],
       link_reach: LinkReach.RESTRICTED,
-      link_role: LinkRole.READER,
+      link_role: 'reader',
     };
 
     await DocsDB.cacheResponse(

src/frontend/apps/impress/src/i18n/__tests__/utils.spec.ts

@@ -0,0 +1,55 @@
+import { LANGUAGE_LOCAL_STORAGE } from '../conf';
+import { getLanguage, splitLocaleCode } from '../utils';
+
+describe('i18n utils', () => {
+  afterEach(() => {
+    localStorage.removeItem(LANGUAGE_LOCAL_STORAGE);
+  });
+
+  it('checks language code is correctly splitted', () => {
+    expect(splitLocaleCode('fr_FR')).toEqual({ language: 'fr', region: 'FR' });
+    expect(splitLocaleCode('en_US')).toEqual({ language: 'en', region: 'US' });
+    expect(splitLocaleCode('en')).toEqual({
+      language: 'en',
+      region: undefined,
+    });
+    expect(splitLocaleCode('fr-FR')).toEqual({ language: 'fr', region: 'FR' });
+    expect(splitLocaleCode('en-US')).toEqual({ language: 'en', region: 'US' });
+  });
+
+  it('checks that we get expected language from local storage', () => {
+    localStorage.setItem(LANGUAGE_LOCAL_STORAGE, 'fr_FR');
+    expect(getLanguage()).toEqual('fr');
+    localStorage.removeItem(LANGUAGE_LOCAL_STORAGE);
+
+    localStorage.setItem(LANGUAGE_LOCAL_STORAGE, 'en_FR');
+    expect(getLanguage()).toEqual('en');
+
+    localStorage.setItem(LANGUAGE_LOCAL_STORAGE, 'xx_XX');
+    expect(getLanguage()).toEqual('fr');
+  });
+
+  it('checks that we get expected language from browser', () => {
+    Object.defineProperty(navigator, 'language', {
+      value: 'fr',
+      writable: false,
+      configurable: true,
+    });
+
+    expect(getLanguage()).toEqual('fr');
+
+    Object.defineProperty(navigator, 'language', {
+      value: 'en',
+      writable: false,
+      configurable: true,
+    });
+    expect(getLanguage()).toEqual('en');
+
+    Object.defineProperty(navigator, 'language', {
+      value: 'xx',
+      writable: false,
+      configurable: true,
+    });
+    expect(getLanguage()).toEqual('fr');
+  });
+});

src/frontend/apps/impress/src/i18n/conf.ts

@@ -2,5 +2,5 @@ export const LANGUAGES_ALLOWED: { [key: string]: string } = {
   en: 'English',
   fr: 'Français',
 };
-export const LANGUAGE_COOKIE_NAME = 'docs_language';
-export const BASE_LANGUAGE = 'en';
+export const LANGUAGE_LOCAL_STORAGE = 'impress-language';
+export const BASE_LANGUAGE = 'fr';

src/frontend/apps/impress/src/i18n/initI18n.ts

@@ -1,32 +1,30 @@
 import i18n from 'i18next';
-import LanguageDetector from 'i18next-browser-languagedetector';
 import { initReactI18next } from 'react-i18next';
 
-import { BASE_LANGUAGE, LANGUAGES_ALLOWED, LANGUAGE_COOKIE_NAME } from './conf';
+import { LANGUAGES_ALLOWED, LANGUAGE_LOCAL_STORAGE } from './conf';
 import resources from './translations.json';
+import { getLanguage } from './utils';
 
 i18n
-  .use(LanguageDetector)
   .use(initReactI18next)
   .init({
     resources,
-    fallbackLng: BASE_LANGUAGE,
-    supportedLngs: Object.keys(LANGUAGES_ALLOWED),
-    detection: {
-      order: ['cookie', 'navigator'], // detection order
-      caches: ['cookie'], // Use cookies to store the language preference
-      lookupCookie: LANGUAGE_COOKIE_NAME,
-      cookieMinutes: 525600, // Expires after one year
-    },
+    lng: getLanguage(),
     interpolation: {
       escapeValue: false,
     },
     preload: Object.keys(LANGUAGES_ALLOWED),
-    nsSeparator: false,
-    keySeparator: false,
+    nsSeparator: '||',
   })
   .catch(() => {
     throw new Error('i18n initialization failed');
   });
 
+// Save language in local storage
+i18n.on('languageChanged', (lng) => {
+  if (typeof window !== 'undefined') {
+    localStorage.setItem(LANGUAGE_LOCAL_STORAGE, lng);
+  }
+});
+
 export default i18n;

src/frontend/apps/impress/src/i18n/translations.json

@@ -3,19 +3,14 @@
   "fr": {
     "translation": {
       "\"{{email}}\" is already invited to the document.": "\"{{email}}\" est déjà invité à accéder au document.",
-      "\"{{email}}\" is already member of the document.": "\"{{email}}\" est déjà membre du document.",
-      "AI Actions": "Actions IA",
-      "AI seems busy! Please try again.": "L'IA semble occupée ! Veuillez réessayer.",
       "Accessibility": "Accessibilité",
       "Accessibility statement": "Déclaration d'accessibilité",
       "Address:": "Adresse :",
       "Administrator": "Administrateur",
-      "Anyone on the internet with the link can view": "Les personnes disposant du lien peuvent y accéder",
+      "Anyone on the internet with the link can view": "N'importe qui sur Internet avec le lien peut consulter",
       "Are you sure you want to delete the document \"{{title}}\"?": "Êtes-vous sûr de vouloir supprimer le document \"{{title}}\" ?",
-      "Authenticated": "Authentifié",
       "Back to home page": "Retour à l'accueil",
       "Back to top": "Retour en haut",
-      "Can read and edit": "Peut lire et éditer",
       "Can't load this page, please check your internet connection.": "Impossible de charger cette page, veuillez vérifier votre connexion Internet.",
       "Cancel": "Annuler",
       "Choose a role": "Choisissez un rôle",
@@ -25,13 +20,9 @@
       "Confirm deletion": "Confirmer la suppression",
       "Content modal to delete document": "Contenu modal pour supprimer le document",
       "Content modal to export the document": "Contenu modal pour exporter le document",
-      "Convert Markdown": "Convertir le Markdown",
       "Cookies placed": "Cookies déposés",
-      "Copied to clipboard": "Copié dans le presse-papier",
-      "Copy as {{format}}": "Copier en {{format}}",
       "Copy link": "Copier le lien",
       "Copyright": "Copyright",
-      "Correct": "Corriger",
       "Create a new document": "Créer un nouveau document",
       "Created at": "Créé le",
       "Current version": "Version en cours",
@@ -53,18 +44,15 @@
       "Download": "Télécharger",
       "E-mail:": "E-mail:",
       "Editor": "Éditeur",
-      "Editor unavailable": "Éditeur indisponible",
       "Established on December 20, 2023.": "Établi le 20 décembre 2023.",
       "Export": "Exporter",
       "Export your document, it will be inserted in the selected template.": "Exportez votre document, il sera inséré dans le modèle sélectionné.",
       "Failed to add the member in the document.": "Impossible d'ajouter le membre dans le document.",
       "Failed to copy link": "Échec de la copie du lien",
-      "Failed to copy to clipboard": "Échec de la copie dans le presse-papier",
       "Failed to create the invitation for {{email}}.": "Impossible de créer l'invitation pour {{email}}.",
       "Find a member to add to the document": "Trouver un membre à ajouter au document",
       "French Interministerial Directorate for Digital Affairs (DINUM), 20 avenue de Ségur 75007 Paris.": "Direction interministérielle des affaires numériques (DINUM), 20 avenue de Segur 75007 Paris.",
       "Go to bottom": "Aller en bas",
-      "How people can interact with the document": "Comment les gens peuvent interagir avec le document",
       "If a member is editing, his works can be lost.": "Si un membre est en train d'éditer, ses travaux peuvent être perdus.",
       "If you are unable to access a content or a service, you can contact the person responsible for https://lasuite.numerique.gouv.fr to be directed to an accessible alternative or to obtain the content in another form.": "Si vous ne pouvez pas accéder à un contenu ou à un service, vous pouvez contacter la personne responsable de https://lasuite. umerique.gouv.fr pour être dirigé vers une alternative accessible ou pour obtenir le contenu sous une autre forme.",
       "Illustration:": "Illustration :",
@@ -76,6 +64,7 @@
       "It seems that the page you are looking for does not exist or cannot be displayed correctly.": "Il semble que la page que vous cherchez n'existe pas ou ne puisse pas être affichée correctement.",
       "It's true, you didn't have to click on a block that covers half the page to say you agree to the placement of cookies — even if you don't know what it means!": "C'est vrai, vous n'avez pas à cliquer sur un bloc qui couvre la moitié de la page pour dire que vous acceptez le placement de cookies — même si vous ne savez pas ce que cela signifie !",
       "Language": "Langue",
+      "Language Icon": "Icône de langue",
       "Legal Notice": "Mentions Legales",
       "Legal notice": "Mention légale",
       "Link Copied !": "Lien copié !",
@@ -89,10 +78,8 @@
       "No editor found": "Pas d'éditeur trouvé",
       "Nothing exceptional, no special privileges related to a .gouv.fr.": "Rien d'exceptionnel, pas de privilèges spéciaux liés à un .gouv.fr.",
       "Offline ?!": "Hors-ligne ?!",
-      "Only for authenticated users": "Uniquement pour les utilisateurs authentifiés",
       "Only for people with access": "Seulement pour les personnes avec accès",
       "Open the document options": "Ouvrir les options du document",
-      "Open the header menu": "Ouvrir le menu d'en-tête",
       "Open the panel": "Ouvrir le panneau",
       "Open the version options": "Ouvrir les options de version",
       "Ouch !": "Aïe !",
@@ -103,18 +90,15 @@
       "Public": "Public",
       "Publication Director": "Directeur de la publication",
       "Publisher": "Éditeur",
-      "Read only": "Lecture seule",
       "Read only, you cannot edit document versions.": "En lecture seule, vous ne pouvez pas éditer les versions du document.",
       "Read only, you cannot edit this document.": "En lecture seule, vous ne pouvez pas éditer ce document.",
       "Reader": "Lecteur",
       "Remedies": "Voie de recours",
       "Rename": "Renommer",
-      "Rephrase": "Reformuler",
       "Restore": "Restaurer",
       "Restore the version": "Restaurer la version",
       "Restore this version": "Restaurer cette version",
       "Restore this version?": "Restaurer cette version?",
-      "Restricted": "Restreint",
       "Role": "Rôle",
       "Search by email": "Recherche par email",
       "Send a letter by post (free of charge, no stamp needed):": "Envoyer un courrier par la poste (gratuit, ne pas mettre de timbre):",
@@ -122,12 +106,11 @@
       "Share modal": "Modale de partage",
       "Something bad happens, please retry.": "Une erreur inattendue s'est produite, veuillez réessayer.",
       "Stéphanie Schaer: Interministerial Digital Director (DINUM).": "Stéphanie Schaer: Directrice numérique interministériel (DINUM).",
-      "Summarize": "Résumer",
       "Table of content": "Table des matières",
       "Table of contents": "Table des matières",
       "Template": "Template",
       "The document has been deleted.": "Le document a bien été supprimé.",
-      "The document visibility has been updated.": "La visibilité du document a été mise à jour.",
+      "The document visiblitity has been updated.": "La visibilité du document a été mise à jour.",
       "The invitation has been removed.": "L'invitation a été supprimée.",
       "The member has been removed from the document": "Le membre a été retiré du document",
       "The role has been updated": "Le rôle a été mis à jour",
@@ -139,17 +122,14 @@
       "This site does not display a cookie consent banner, why?": "Ce site n'affiche pas de bannière de consentement des cookies, pourquoi?",
       "This site places a small text file (a \"cookie\") on your computer when you visit it.": "Ce site place un petit fichier texte (un « cookie ») sur votre ordinateur lorsque vous le visitez.",
       "This will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.": "Cela protégera votre vie privée, mais empêchera également le propriétaire d'apprendre de vos actions et de créer une meilleure expérience pour vous et les autres utilisateurs.",
-      "Too many requests. Please wait 60 seconds.": "Trop de demandes. Veuillez patienter 60 secondes.",
       "Unless otherwise stated, all content on this site is under": "Sauf mention contraire, tout le contenu de ce site est sous",
       "Untitled document": "Document sans titre",
       "Updated at": "Mise à jour le",
-      "Use as prompt": "Utiliser comme un prompt",
       "User {{email}} added to the document.": "L'utilisateur {{email}} a été ajouté au document.",
       "Validate": "Valider",
       "Version history": "Historique des versions",
       "Version restored successfully": "Version restaurée avec succès",
       "Versions": "Versions",
-      "Visibility": "Visibilité",
       "We didn't find a mail matching, try to be more accurate": "Nous n'avons pas trouvé de correspondance par mail, essayez d'être plus précis",
       "We simply comply with the law, which states that certain audience measurement tools, properly configured to respect privacy, are exempt from prior authorization.": "Nous nous conformons simplement à la loi, qui stipule que certains outils de mesure d’audience, correctement configurés pour respecter la vie privée, sont exemptés de toute autorisation préalable.",
       "We try to respond within 2 working days.": "Nous essayons de répondre dans les 2 jours ouvrables.",

src/frontend/apps/impress/src/i18n/utils.ts

@@ -0,0 +1,28 @@
+import {
+  BASE_LANGUAGE,
+  LANGUAGES_ALLOWED,
+  LANGUAGE_LOCAL_STORAGE,
+} from './conf';
+
+export const splitLocaleCode = (language: string) => {
+  const locale = language.split(/[-_]/);
+  return {
+    language: locale[0],
+    region: locale.length === 2 ? locale[1] : undefined,
+  };
+};
+
+export const getLanguage = () => {
+  if (typeof window === 'undefined') {
+    return BASE_LANGUAGE;
+  }
+
+  const languageStore =
+    localStorage.getItem(LANGUAGE_LOCAL_STORAGE) || navigator?.language;
+
+  const language = splitLocaleCode(languageStore).language;
+
+  return Object.keys(LANGUAGES_ALLOWED).includes(language)
+    ? language
+    : BASE_LANGUAGE;
+};

src/frontend/apps/impress/src/pages/docs/[id]/index.tsx

@@ -1,5 +1,4 @@
 import { Loader } from '@openfun/cunningham-react';
-import Head from 'next/head';
 import { useRouter as useNavigate } from 'next/navigation';
 import { useRouter } from 'next/router';
 import { useEffect, useState } from 'react';
@@ -7,7 +6,7 @@ import { useEffect, useState } from 'react';
 import { Box, Text } from '@/components';
 import { TextErrors } from '@/components/TextErrors';
 import { useAuthStore } from '@/core/auth';
-import { DocEditor, useDocStore } from '@/features/docs';
+import { DocEditor } from '@/features/docs';
 import { useDoc } from '@/features/docs/doc-management';
 import { MainLayout } from '@/layouts';
 import { NextPageWithLayout } from '@/types/next';
@@ -22,14 +21,9 @@ export function DocLayout() {
   }
 
   return (
-    <>
-      <Head>
-        <meta name="robots" content="noindex" />
-      </Head>
-      <MainLayout withoutFooter>
-        <DocPage id={id} />
-      </MainLayout>
-    </>
+    <MainLayout withoutFooter>
+      <DocPage id={id} />
+    </MainLayout>
   );
 }
 
@@ -41,7 +35,6 @@ const DocPage = ({ id }: DocProps) => {
   const { login } = useAuthStore();
   const { data: docQuery, isError, error } = useDoc({ id });
   const [doc, setDoc] = useState(docQuery);
-  const { setCurrentDoc } = useDocStore();
 
   const navigate = useNavigate();
 
@@ -59,12 +52,7 @@ const DocPage = ({ id }: DocProps) => {
     }
 
     setDoc(docQuery);
-    setCurrentDoc(docQuery);
-
-    return () => {
-      setCurrentDoc(undefined);
-    };
-  }, [docQuery, setCurrentDoc]);
+  }, [docQuery]);
 
   if (isError && error) {
     if (error.status === 404) {

src/frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impress",
-  "version": "1.7.0",
+  "version": "1.5.1",
   "private": true,
   "workspaces": {
     "packages": [
@@ -25,18 +25,18 @@
     "i18n:test": "yarn I18N run test"
   },
   "resolutions": {
-    "@blocknote/core": "0.17.1",
-    "@blocknote/mantine": "0.17.1",
-    "@blocknote/react": "0.17.1",
-    "@types/node": "20.16.13",
-    "@types/react-dom": "18.3.1",
-    "@typescript-eslint/eslint-plugin": "8.10.0",
-    "@typescript-eslint/parser": "8.10.0",
+    "@blocknote/core": "0.16.0",
+    "@blocknote/mantine": "0.16.0",
+    "@blocknote/react": "0.16.0",
+    "@types/node": "20.16.10",
+    "@types/react-dom": "18.3.0",
+    "@typescript-eslint/eslint-plugin": "8.7.0",
+    "@typescript-eslint/parser": "8.7.0",
     "cross-env": "7.0.3",
     "eslint": "8.57.0",
     "react": "18.3.1",
     "react-dom": "18.3.1",
-    "typescript": "5.6.3",
-    "yjs": "13.6.20"
+    "typescript": "5.6.2",
+    "yjs": "13.6.19"
   }
 }

src/frontend/packages/eslint-config-impress/package.json

@@ -1,25 +1,25 @@
 {
   "name": "eslint-config-impress",
-  "version": "1.7.0",
+  "version": "1.5.1",
   "license": "MIT",
   "scripts": {
     "lint": "eslint --ext .js ."
   },
   "dependencies": {
-    "@next/eslint-plugin-next": "14.2.15",
-    "@tanstack/eslint-plugin-query": "5.59.7",
+    "@next/eslint-plugin-next": "14.2.13",
+    "@tanstack/eslint-plugin-query": "5.58.1",
     "@typescript-eslint/eslint-plugin": "*",
     "@typescript-eslint/parser": "*",
     "eslint": "*",
-    "eslint-config-next": "14.2.15",
+    "eslint-config-next": "14.2.13",
     "eslint-config-prettier": "9.1.0",
-    "eslint-plugin-import": "2.31.0",
+    "eslint-plugin-import": "2.30.0",
     "eslint-plugin-jest": "28.8.3",
-    "eslint-plugin-jsx-a11y": "6.10.1",
-    "eslint-plugin-playwright": "1.8.0",
+    "eslint-plugin-jsx-a11y": "6.10.0",
+    "eslint-plugin-playwright": "1.6.2",
     "eslint-plugin-prettier": "5.2.1",
-    "eslint-plugin-react": "7.37.1",
-    "eslint-plugin-testing-library": "6.4.0",
+    "eslint-plugin-react": "7.37.0",
+    "eslint-plugin-testing-library": "6.3.0",
     "prettier": "3.3.3"
   }
 }

src/frontend/packages/i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packages-i18n",
-  "version": "1.7.0",
+  "version": "1.5.1",
   "private": true,
   "scripts": {
     "extract-translation": "yarn extract-translation:impress",
@@ -15,7 +15,7 @@
     "@types/jest": "29.5.13",
     "@types/node": "*",
     "eslint-config-impress": "*",
-    "eslint-plugin-import": "2.31.0",
+    "eslint-plugin-import": "2.30.0",
     "i18next-parser": "9.0.2",
     "jest": "29.7.0",
     "ts-jest": "29.2.5",

src/frontend/servers/y-provider/package.json

@@ -1,6 +1,6 @@
 {
   "name": "server-y-provider",
-  "version": "1.7.0",
+  "version": "1.5.1",
   "description": "Y.js provider for docs",
   "repository": "https://github.com/numerique-gouv/impress",
   "license": "MIT",
@@ -15,7 +15,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@hocuspocus/server": "2.13.7",
+    "@hocuspocus/server": "2.13.6",
     "y-protocols": "1.0.6"
   },
   "devDependencies": {

src/helm/env.d/dev/secrets.enc.yaml

@@ -0,0 +1,62 @@
+djangoSuperUserEmail: ENC[AES256_GCM,data:7b1xfYmr1g0RlBmsHBRA39ZPV/6+1DrtHQ==,iv:/GW7oLxPTZYmRWVPvyAQMoZl1owHM4Fo0XAOtyEh2rA=,tag:DaqoW+dglyAOXMm5+mrDfA==,type:str]
+djangoSuperUserPass: ENC[AES256_GCM,data:RQgX,iv:q3CdfmwGfHSTjLXTimDk/1MyoFLviRuwmZa2E7GUzhY=,tag:HCtdtqgSxdJIHFhI8xpegQ==,type:str]
+djangoSecretKey: ENC[AES256_GCM,data:mtJCf6mKfj/fJkg4wmfIvvU1vkUEF77BI8TUFikp/M3nPveDXhKmy3Cw3cXFpOYiFZ0=,iv:qwPRKsPS1Jhylj5asbmknXm1xOX3nfp9iccuorUrcj0=,tag:ENVfAt4i3PttoqD8+Kc4wQ==,type:str]
+oidc:
+    clientId: ENC[AES256_GCM,data:wndPCbysbWDybdHglcG+wkMWk1rrD40hKqFxct9T3TLEGOk/,iv:RH1OdBX1GYIT90sSq0AGz49fFi6dL0m49Pegs6Ko9tQ=,tag:/tKytQwoZkBX1Tf96gAjIA==,type:str]
+    clientSecret: ENC[AES256_GCM,data:MUJ0wsg+LC2QZ1jZ0Twd3FS3dQevmJq9/97qVI3ARHuJIVlQz0Qah4vE7/iR+sn7ME2o1s1AzV4c1Yx/F3nHBg==,iv:LvinICSzF/8EvrHZD4Jp6lt7g3yxSOEgVHPrc3SShjo=,tag:yvkyyBXmhEkmGL7jZevUCA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMMjFCeWhkUmRWTnlIM1JM
+            dVFock1DWmtXQnpQZWZMWW1YdndhSS93MlVFCmxKVDUwOUt0NjJIZiswSm5aRi9U
+            VEllelBZVmFKdVFzcVJPUm50VHo5RTgKLS0tIDlkU3htTEdSREFOSUxlTGVtUm1n
+            RzJZbzhFcDNZKzdxMWFHTWx6Uy9GVFkKTw8LbhzAACp0NUHDfNcXpZyr2pJyNxxw
+            C7j/UB0cAejlSJHaUUiZ6TEcslXRpqnNagwUw4z/uzo7m4temay22A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQQjBNMnVlNURQVWdjSyty
+            RGozcmN5eTUwRHJIWnhhc1E3U1NXQ3AwTWxBCnFjbmJNZnFiRVJ6VHhmQmt1Vk5n
+            OTVXWVh3RzhoMWNrbUl6OHphTjFLQVUKLS0tIGJjUlNhK0dHQ2R3SCtrbTRnaFJT
+            Q1pyRXhSVm8xQWk2NG1MK0srVU1pL2sKkoxGCM00UM2leTNCn5H8499uwJw1NIXs
+            PoRNgplehrHFptrAwGEpSYMXbxu88N7EWa/rtOp+sHWK5zpxscMkjA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1plkp8td6zzfcavjusmsfrlk54t9vn8jjxm8zaz7cmnr7kzl2nfnsd54hwg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzYnpkYnJnYnJjVFRHRzRa
+            N09JOXVnQkVrcVcwdk9kR1k1azNib2lkMVZFCmhvOHlpVnJ0RlRpYWZ1TkVoaklV
+            NmNzY3BEeWN1MUtKWmZFT2RaMUxBRW8KLS0tIG92ZmhsZ29LSkRSREhiaG9kWXhH
+            akREb0ttYVpNWTJHb1pjaWRFbWpxUjgKgZp3cN2rZw4ktbpb5cUnDEtsT/KWszGi
+            pmpJHgsMADigyUc+Pjw+1pwpn0FtXVEXGedbf8bBuJavvbS2PuJBsg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxaHZJeStiVnBzTGNTNzdo
+            UDFVTU51ZWp0WWorUnBlSzVBSU9IU2JnbUNNCkpMZGdNV3FUYkZOcWNLK0JWci81
+            WGNwYi9Jb0QrV0lkUzNJWTcrUjIzUmMKLS0tIHlTKzNsVzNsSGFuYjJ0RFp0Y1Nr
+            a1VOcDBPTTYvNjkxN092N1UrYk1CM2cKNifC3ZLOrFTFKA9iKg8nPpZb+3DxnTwq
+            grsrxQa40b/Vv/aPoiPBMeSENDcH48X/EhMFNKX7dvl+7HEaY+QPlA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hnhuzj96ktkhpyygvmz0x9h8mfvssz7ss6emmukags644mdhf4msajk93r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoZ2ZlcllJeGlKUDNxUk1w
+            ekZ3TSttaXREV1FBRWwzNW54cjlYbHpLdWpRCnhSL2hEVVBEWEJKQWF0YTk1YzhJ
+            RTBGN25sT0hBM3V4QndiTVkveDBwQ2cKLS0tIEdoZGRLRXdCME1wcUJHQXhtSHBQ
+            UVEyNUVIanF6Z3ZSUjU1aTk0NFRBR0EKGuH5vzOV9lP/qRew0maECapKtLILaf/4
+            XoSgPnjh8pIbJG7i9VKnFORlzkNJ6OPhZlX3ax15hd1qQv0PSCMBDA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-07-02T10:03:17Z"
+    mac: ENC[AES256_GCM,data:qx236E1cFtBmbYyUf6B95/Fwu2hoi9ZAhUcYiY/tsG9h1+kwXntfkvbH3ekyI7A5ZrpJXMeQZ7gLc+ohci4m5Ju+/G39MjMt+ww0Y6gBMqe59YlHfeFD2mYsnn9j1pqtbrIJ6+8fLDmhaXtGtXP3qRmFTc9LwL6Rm+5gn8cjcnA=,iv:TC7zBnQ0hRz0JSytrYVnyJiI1eMWRTBqctLajZYUhvU=,tag:wCBeo2xD5UpdRqGjkZxbXA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

src/helm/env.d/dev/values.impress.yaml.gotmpl

@@ -0,0 +1,120 @@
+image:
+  repository: localhost:5001/impress-backend
+  pullPolicy: Always
+  tag: "latest"
+
+backend:
+  replicas: 1
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: https://impress.127.0.0.1.nip.io,http://impress.127.0.0.1.nip.io
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: "*"
+    DJANGO_SECRET_KEY: {{ .Values.djangoSecretKey }}
+    DJANGO_SETTINGS_MODULE: impress.settings
+    DJANGO_SUPERUSER_PASSWORD: admin
+    DJANGO_EMAIL_HOST: "mailcatcher"
+    DJANGO_EMAIL_PORT: 1025
+    DJANGO_EMAIL_USE_SSL: False
+    OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID: {{ .Values.oidc.clientId }}
+    OIDC_RP_CLIENT_SECRET: {{ .Values.oidc.clientSecret }}
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://impress.127.0.0.1.nip.io
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://impress.127.0.0.1.nip.io
+    LOGIN_REDIRECT_URL_FAILURE: https://impress.127.0.0.1.nip.io
+    LOGOUT_REDIRECT_URL: https://impress.127.0.0.1.nip.io
+    DB_HOST: postgres-postgresql
+    DB_NAME: impress
+    DB_USER: dinum
+    DB_PASSWORD: pass
+    DB_PORT: 5432
+    POSTGRES_DB: impress
+    POSTGRES_USER: dinum
+    POSTGRES_PASSWORD: pass
+    REDIS_URL: redis://default:pass@redis-master:6379/1
+    AWS_S3_ENDPOINT_URL: http://minio.impress.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: impress
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_STORAGE_BUCKET_NAME: impress-media-storage
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+
+  migrate:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py migrate --no-input &&
+        python manage.py create_demo --force
+    restartPolicy: Never
+
+  command:
+    - "gunicorn"
+    - "-c"
+    - "/usr/local/etc/gunicorn/impress.py"
+    - "impress.wsgi:application"
+    - "--reload"
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email admin@example.com --password admin
+    restartPolicy: Never
+
+frontend:
+  envVars:
+    PORT: 8080
+    NEXT_PUBLIC_API_ORIGIN: https://impress.127.0.0.1.nip.io
+    NEXT_PUBLIC_Y_PROVIDER_URL: wss://impress.127.0.0.1.nip.io/ws
+    NEXT_PUBLIC_MEDIA_URL: https://impress.127.0.0.1.nip.io
+
+  replicas: 1
+  command:
+    - yarn
+    - dev
+
+  image:
+    repository: localhost:5001/impress-frontend
+    pullPolicy: Always
+    tag: "latest"
+
+yProvider:
+  replicas: 1
+
+  image:
+    repository: localhost:5001/impress-y-provider
+    pullPolicy: Always
+    tag: "latest"
+
+ingress:
+  enabled: true
+  host: impress.127.0.0.1.nip.io
+
+ingressWS:
+  enabled: true
+  host: impress.127.0.0.1.nip.io
+
+ingressAdmin:
+  enabled: true
+  host: impress.127.0.0.1.nip.io
+
+ingressMedia:
+  enabled: true
+  host: impress.127.0.0.1.nip.io
+
+  annotations:
+    nginx.ingress.kubernetes.io/auth-url: https://impress.127.0.0.1.nip.io/api/v1.0/documents/retrieve-auth/
+    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
+    nginx.ingress.kubernetes.io/upstream-vhost: minio.impress.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/rewrite-target: /impress-media-storage/$1
+
+serviceMedia:
+  host: minio.impress.svc.cluster.local
+  port: 9000

src/helm/env.d/preprod/secrets.enc.yaml

@@ -0,0 +1 @@
+../../../../secrets/numerique-gouv/impress/env/preprod/secrets.enc.yaml

src/helm/env.d/preprod/values.impress.yaml.gotmpl

@@ -0,0 +1,174 @@
+image:
+  repository: lasuite/impress-backend
+  pullPolicy: Always
+  tag: "v1.5.1-preprod"
+
+backend:
+  migrateJobAnnotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: http://impress-preprod.beta.numerique.gouv.fr,https://impress-preprod.beta.numerique.gouv.fr
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: "*"
+    DJANGO_SUPERUSER_EMAIL:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_EMAIL
+    DJANGO_SECRET_KEY:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SECRET_KEY
+    DJANGO_SETTINGS_MODULE: impress.settings
+    DJANGO_SUPERUSER_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_PASSWORD
+    DJANGO_EMAIL_HOST: "smtp.tem.scw.cloud"
+    DJANGO_EMAIL_PORT: 587
+    DJANGO_EMAIL_USE_TLS: True
+    DJANGO_EMAIL_FROM: "noreply@docs.beta.numerique.gouv.fr"
+    DJANGO_EMAIL_HOST_USER:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_EMAIL_HOST_USER
+    DJANGO_EMAIL_HOST_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_EMAIL_HOST_PASSWORD
+    DJANGO_SILENCED_SYSTEM_CHECKS: security.W008,security.W004
+    OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_ID
+    OIDC_RP_CLIENT_SECRET:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_SECRET
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://impress-preprod.beta.numerique.gouv.fr
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://impress-preprod.beta.numerique.gouv.fr
+    LOGIN_REDIRECT_URL_FAILURE: https://impress-preprod.beta.numerique.gouv.fr
+    LOGOUT_REDIRECT_URL: https://impress-preprod.beta.numerique.gouv.fr
+    DB_HOST:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: host
+    DB_NAME:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    DB_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    DB_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    DB_PORT:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: port
+    POSTGRES_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    POSTGRES_DB:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    POSTGRES_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    REDIS_URL:
+      secretKeyRef:
+        name: redis.redis.libre.sh
+        key: url
+    AWS_S3_ENDPOINT_URL:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: url
+    AWS_S3_ACCESS_KEY_ID:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: accessKey
+    AWS_S3_SECRET_ACCESS_KEY:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: secretKey
+    AWS_STORAGE_BUCKET_NAME:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: bucket
+    AWS_S3_REGION_NAME: local
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD
+    restartPolicy: Never
+
+frontend:
+  image:
+    repository: lasuite/impress-frontend
+    pullPolicy: Always
+    tag: "v1.5.1-preprod"
+
+yProvider:
+  image:
+    repository: lasuite/impress-y-provider
+    pullPolicy: Always
+    tag: "v1.5.1-preprod"
+
+ingress:
+  enabled: true
+  host: impress-preprod.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+
+ingressWS:
+  enabled: true
+  host: impress-preprod.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+
+ingressAdmin:
+  enabled: true
+  host: impress-preprod.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/auth-signin: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/start
+    nginx.ingress.kubernetes.io/auth-url: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/auth
+
+ingressMedia:
+  enabled: true
+  host: impress-preprod.beta.numerique.gouv.fr
+
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
+    nginx.ingress.kubernetes.io/auth-url: https://impress-preprod.beta.numerique.gouv.fr/api/v1.0/documents/retrieve-auth/
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /impress-preprod-impress-media-storage/$1
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/upstream-vhost: s3.margaret-hamilton.indiehosters.net
+
+serviceMedia:
+  host: s3.margaret-hamilton.indiehosters.net
+  port: 443

src/helm/env.d/production/secrets.enc.yaml

@@ -0,0 +1 @@
+../../../../secrets/numerique-gouv/impress/env/production/secrets.enc.yaml

src/helm/env.d/production/values.impress.yaml.gotmpl

@@ -0,0 +1,174 @@
+image:
+  repository: lasuite/impress-backend
+  pullPolicy: Always
+  tag: "v1.5.1"
+
+backend:
+  migrateJobAnnotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: https://docs.numerique.gouv.fr
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: "*"
+    DJANGO_SECRET_KEY:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SECRET_KEY
+    DJANGO_SETTINGS_MODULE: impress.settings
+    DJANGO_SUPERUSER_EMAIL:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_EMAIL
+    DJANGO_SUPERUSER_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_PASSWORD
+    DJANGO_EMAIL_HOST: "smtp.tem.scw.cloud"
+    DJANGO_EMAIL_PORT: 587
+    DJANGO_EMAIL_USE_TLS: True
+    DJANGO_EMAIL_FROM: "noreply@docs.beta.numerique.gouv.fr"
+    DJANGO_EMAIL_HOST_USER:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_EMAIL_HOST_USER
+    DJANGO_EMAIL_HOST_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_EMAIL_HOST_PASSWORD
+    DJANGO_SILENCED_SYSTEM_CHECKS: security.W008,security.W004
+    OIDC_OP_JWKS_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_ID
+    OIDC_RP_CLIENT_SECRET:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_SECRET
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://docs.numerique.gouv.fr
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://docs.numerique.gouv.fr
+    LOGIN_REDIRECT_URL_FAILURE: https://docs.numerique.gouv.fr
+    LOGOUT_REDIRECT_URL: https://docs.numerique.gouv.fr
+    DB_HOST:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: host
+    DB_NAME:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    DB_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    DB_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    DB_PORT:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: port
+    POSTGRES_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    POSTGRES_DB:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    POSTGRES_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    REDIS_URL:
+      secretKeyRef:
+        name: redis.redis.libre.sh
+        key: url
+    AWS_S3_ENDPOINT_URL:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: url
+    AWS_S3_ACCESS_KEY_ID:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: accessKey
+    AWS_S3_SECRET_ACCESS_KEY:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: secretKey
+    AWS_STORAGE_BUCKET_NAME:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: bucket
+    AWS_S3_REGION_NAME: local
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD
+    restartPolicy: Never
+
+frontend:
+  image:
+    repository: lasuite/impress-frontend
+    pullPolicy: Always
+    tag: "v1.5.1"
+
+yProvider:
+  image:
+    repository: lasuite/impress-y-provider
+    pullPolicy: Always
+    tag: "v1.5.1"
+
+ingress:
+  enabled: true
+  host: docs.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+
+ingressWS:
+  enabled: true
+  host: docs.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+
+ingressAdmin:
+  enabled: true
+  host: docs.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/auth-signin: https://oauth2-proxy.beta.numerique.gouv.fr/oauth2/start
+    nginx.ingress.kubernetes.io/auth-url: https://oauth2-proxy.beta.numerique.gouv.fr/oauth2/auth
+
+ingressMedia:
+  enabled: true
+  host: docs.numerique.gouv.fr
+
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
+    nginx.ingress.kubernetes.io/auth-url: https://docs.numerique.gouv.fr/api/v1.0/documents/retrieve-auth/
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /impress-impress-media-storage/$1
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/upstream-vhost: s3.hedy-lamarr.indiehosters.net
+
+serviceMedia:
+  host: s3.hedy-lamarr.indiehosters.net
+  port: 443

src/helm/env.d/staging/secrets.enc.yaml

@@ -0,0 +1 @@
+../../../../secrets/numerique-gouv/impress/env/staging/secrets.enc.yaml

src/helm/env.d/staging/values.impress.yaml.gotmpl

@@ -0,0 +1,174 @@
+image:
+  repository: lasuite/impress-backend
+  pullPolicy: Always
+  tag: "main"
+
+backend:
+  migrateJobAnnotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: http://impress-staging.beta.numerique.gouv.fr,https://impress-staging.beta.numerique.gouv.fr
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: "*"
+    DJANGO_SECRET_KEY:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SECRET_KEY
+    DJANGO_SETTINGS_MODULE: impress.settings
+    DJANGO_SUPERUSER_EMAIL:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_EMAIL
+    DJANGO_SUPERUSER_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_PASSWORD
+    DJANGO_EMAIL_HOST: "smtp.tem.scw.cloud"
+    DJANGO_EMAIL_PORT: 587
+    DJANGO_EMAIL_USE_TLS: True
+    DJANGO_EMAIL_FROM: "noreply@docs.beta.numerique.gouv.fr"
+    DJANGO_EMAIL_HOST_USER:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_EMAIL_HOST_USER
+    DJANGO_EMAIL_HOST_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_EMAIL_HOST_PASSWORD
+    DJANGO_SILENCED_SYSTEM_CHECKS: security.W008,security.W004
+    OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_ID
+    OIDC_RP_CLIENT_SECRET:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_SECRET
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://impress-staging.beta.numerique.gouv.fr
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://impress-staging.beta.numerique.gouv.fr
+    LOGIN_REDIRECT_URL_FAILURE: https://impress-staging.beta.numerique.gouv.fr
+    LOGOUT_REDIRECT_URL: https://impress-staging.beta.numerique.gouv.fr
+    DB_HOST:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: host
+    DB_NAME:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    DB_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    DB_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    DB_PORT:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: port
+    POSTGRES_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    POSTGRES_DB:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    POSTGRES_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    REDIS_URL:
+      secretKeyRef:
+        name: redis.redis.libre.sh
+        key: url
+    AWS_S3_ENDPOINT_URL:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: url
+    AWS_S3_ACCESS_KEY_ID:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: accessKey
+    AWS_S3_SECRET_ACCESS_KEY:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: secretKey
+    AWS_STORAGE_BUCKET_NAME:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: bucket
+    AWS_S3_REGION_NAME: local
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD
+    restartPolicy: Never
+
+frontend:
+  image:
+    repository: lasuite/impress-frontend
+    pullPolicy: Always
+    tag: "main"
+
+yProvider:
+  image:
+    repository: lasuite/impress-y-provider
+    pullPolicy: Always
+    tag: "main"
+
+ingress:
+  enabled: true
+  host: impress-staging.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+
+ingressWS:
+  enabled: true
+  host: impress-staging.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+
+ingressAdmin:
+  enabled: true
+  host: impress-staging.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/auth-signin: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/start
+    nginx.ingress.kubernetes.io/auth-url: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/auth
+
+ingressMedia:
+  enabled: true
+  host: impress-staging.beta.numerique.gouv.fr
+
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
+    nginx.ingress.kubernetes.io/auth-url: https://impress-staging.beta.numerique.gouv.fr/api/v1.0/documents/retrieve-auth/
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /impress-staging-impress-media-storage/$1
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/upstream-vhost: s3.margaret-hamilton.indiehosters.net
+
+serviceMedia:
+  host: s3.margaret-hamilton.indiehosters.net
+  port: 443