🌐(frontend) add localization to editor

We rename the feature summary to table of content
to better reflect the feature purpose.

.github/workflows/docker-hub.yml

@@ -104,7 +104,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-  build-and-push-y-webrtc-signaling:
+  build-and-push-y-provider:
     runs-on: ubuntu-latest
     steps:
       -
@@ -132,7 +132,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: lasuite/impress-y-webrtc-signaling
+          images: lasuite/impress-y-provider
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
@@ -143,7 +143,7 @@ jobs:
         with:
           context: .
           file: ./src/frontend/Dockerfile
-          target: y-webrtc-signaling
+          target: y-provider
           build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/impress-frontend.yml

@@ -139,7 +139,7 @@ jobs:
         with:
           targets: |
             app-dev
-            y-webrtc-signaling
+            y-provider
           load: true
           set: |
             *.cache-from=type=gha,scope=cached-stage
@@ -149,6 +149,10 @@ jobs:
         run: |
           make run
 
+      - name: Start Nginx for the frontend
+        run: |
+          docker compose up --force-recreate -d nginx-front
+
       - name: Apply DRF migrations
         run: |
           make migrate
@@ -213,7 +217,7 @@ jobs:
         with:
           targets: |
             app-dev
-            y-webrtc-signaling
+            y-provider
           load: true
           set: |
             *.cache-from=type=gha,scope=cached-stage
@@ -223,6 +227,10 @@ jobs:
         run: |
           make run
 
+      - name: Start Nginx for the frontend
+        run: |
+          docker compose up --force-recreate -d nginx-front
+
       - name: Apply DRF migrations
         run: |
           make migrate

CHANGELOG.md

@@ -6,9 +6,63 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+
 ## [Unreleased]
 
-## [1.2.0] - 2024-08-06
+## Added
+
+- ✨Add link public/authenticated/restricted access with read/editor roles #234
+- ✨(frontend) add copy link button #235
+- 🛂(frontend) access public docs without being logged #235
+- 🌐(frontend) add localization to editor #268
+
+## Changed
+
+- ♻️ Allow null titles on documents for easier creation #234
+- 🛂(backend) stop to list public doc to everyone #234
+- 🚚(frontend) change visibility in share modal #235
+- ⚡️(frontend) Improve summary #244
+
+## Fixed
+
+- 🐛 Fix forcing ID when creating a document via API endpoint #234
+- 🐛 Rebuild frontend dev container from makefile #248
+
+
+## [1.3.0] - 2024-09-05
+
+## Added
+
+- ✨Add image attachments with access control
+- ✨(frontend) Upload image to a document #211
+- ✨(frontend) Summary #223
+- ✨(frontend) update meta title for docs page #231
+
+## Changed
+
+- 💄(frontend) code background darkened on editor #214
+- 🔥(frontend) hide markdown button if not text #213
+
+## Fixed
+
+- 🐛 Fix emoticon in pdf export #225
+- 🐛 Fix collaboration on document #226
+- 🐛 (docker) Fix compatibility with mac #230
+
+## Removed
+
+- 🔥(frontend) remove saving modal #213
+
+
+## [1.2.1] - 2024-08-23
+
+## Changed
+
+- ♻️ Change ordering docs datagrid #195
+- 🔥(helm) use scaleway email #194
+
+
+## [1.2.0] - 2024-08-22
 
 ## Added
 
@@ -97,8 +151,10 @@ and this project adheres to
 - 🚀 Impress, project to manage your documents easily and collaboratively.
 
 
-[unreleased]: https://github.com/numerique-gouv/impress/compare/v1.2.0...main
+[unreleased]: https://github.com/numerique-gouv/impress/compare/v1.3.0...main
+[1.3.0]: https://github.com/numerique-gouv/impress/releases/v1.3.0
+[1.2.1]: https://github.com/numerique-gouv/impress/releases/v1.2.1
 [1.2.0]: https://github.com/numerique-gouv/impress/releases/v1.2.0
 [1.1.0]: https://github.com/numerique-gouv/impress/releases/v1.1.0
 [1.0.0]: https://github.com/numerique-gouv/impress/releases/v1.0.0
-[0.1.0]: https://github.com/numerique-gouv/impress/releases/v0.1.0
+[0.1.0]: https://github.com/numerique-gouv/impress/releases/v0.1.0

Dockerfile

@@ -76,6 +76,7 @@ RUN apt-get update && \
       libpango-1.0-0 \
       libpangocairo-1.0-0 \
       pandoc \
+      fonts-noto-color-emoji \
       shared-mime-info && \
   rm -rf /var/lib/apt/lists/*
 

Makefile

@@ -92,6 +92,7 @@ bootstrap: \
 # -- Docker/compose
 build: ## build the app-dev container
 	@$(COMPOSE) build app-dev --no-cache
+	@$(COMPOSE) build frontend-dev --no-cache
 .PHONY: build
 
 down: ## stop and remove containers, networks, images, and volumes
@@ -104,7 +105,7 @@ logs: ## display app-dev logs (follow mode)
 
 run: ## start the wsgi (production) and development server
 	@$(COMPOSE) up --force-recreate -d celery-dev
-	@$(COMPOSE) up --force-recreate -d y-webrtc-signaling
+	@$(COMPOSE) up --force-recreate -d y-provider
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_DB)
 .PHONY: run
@@ -313,3 +314,13 @@ start-tilt: ## start the kubernetes cluster using kind
 	tilt up -f ./bin/Tiltfile
 .PHONY: build-k8s-cluster
 
+VERSION_TYPE ?= minor
+bump-packages-version: ## bump the version of the project - VERSION_TYPE can be "major", "minor", "patch"
+	cd ./src/mail && yarn version --no-git-tag-version --$(VERSION_TYPE)
+	cd ./src/frontend/ && yarn version --no-git-tag-version --$(VERSION_TYPE)
+	cd ./src/frontend/apps/e2e/ && yarn version --no-git-tag-version --$(VERSION_TYPE)
+	cd ./src/frontend/apps/impress/ && yarn version --no-git-tag-version --$(VERSION_TYPE)
+	cd ./src/frontend/servers/y-provider/ && yarn version --no-git-tag-version --$(VERSION_TYPE)
+	cd ./src/frontend/packages/eslint-config-impress/ && yarn version --no-git-tag-version --$(VERSION_TYPE)
+	cd ./src/frontend/packages/i18n/ && yarn version --no-git-tag-version --$(VERSION_TYPE)
+.PHONY: bump-packages-version

bin/Tiltfile

@@ -18,13 +18,13 @@ docker_build(
 )
 
 docker_build(
-    'localhost:5001/impress-y-webrtc-signaling:latest',
+    'localhost:5001/impress-y-provider:latest',
     context='..',
     dockerfile='../src/frontend/Dockerfile',
     only=['./src/frontend/', './docker/', './.dockerignore'],
-    target = 'y-webrtc-signaling',
+    target = 'y-provider',
     live_update=[
-        sync('../src/frontend/apps/y-webrtc-signaling/src', '/home/frontend/apps/y-webrtc-signaling/src'),
+        sync('../src/frontend/servers/y-provider/src', '/home/frontend/servers/y-provider/src'),
     ]
 )
 

bin/start-kind.sh

@@ -16,7 +16,7 @@ reg_name='kind-registry'
 reg_port='5001'
 if [ "$(docker inspect -f '{{.State.Running}}' "${reg_name}" 2>/dev/null || true)" != 'true' ]; then
 	docker run \
-		-d --restart=always -p "127.0.0.1:${reg_port}:5000" --network bridge --name "${reg_name}" \
+		-d --restart=unless-stopped -p "127.0.0.1:${reg_port}:5000" --network bridge --name "${reg_name}" \
 		registry:2
 fi
 

docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   postgresql:
     image: postgres:16
@@ -121,6 +119,14 @@ services:
     depends_on:
       - keycloak
 
+  nginx-front:
+    image: nginx:1.25
+    ports:
+      - "3000:3000"
+    volumes:
+      - ./src/frontend/apps/impress/conf/default.conf:/etc/nginx/conf.d/default.conf
+      - ./src/frontend/apps/impress/out:/usr/share/nginx/html
+
   dockerize:
     image: jwilder/dockerize
 
@@ -141,19 +147,19 @@ services:
     volumes:
       - ".:/app"
 
-  y-webrtc-signaling:
+  y-provider:
     user: ${DOCKER_USER:-1000}
     build: 
       context: .
       dockerfile: ./src/frontend/Dockerfile
-      target: y-webrtc-signaling
+      target: y-provider
     restart: unless-stopped
     ports:
       - "4444:4444"
     volumes:
-      - ./src/frontend/apps/y-webrtc-signaling:/home/frontend/apps/y-webrtc-signaling
-      - /home/frontend/apps/y-webrtc-signaling/node_modules/
-      - /home/frontend/apps/y-webrtc-signaling/dist/
+      - ./src/frontend/servers/y-provider:/home/frontend/servers/y-provider
+      - /home/frontend/servers/y-provider/node_modules/
+      - /home/frontend/servers/y-provider/dist/
 
   frontend-dev:
     user: "${DOCKER_USER:-1000}"
@@ -167,12 +173,11 @@ services:
       - ./src/frontend/apps/impress:/home/frontend/apps/impress
       - /home/frontend/node_modules/
     depends_on:
-      - y-webrtc-signaling
+      - y-provider
       - celery-dev
 
   kc_postgresql:
     image: postgres:14.3
-    platform: linux/amd64
     ports:
       - "5433:5432"
     env_file:

docker/files/etc/nginx/conf.d/default.conf

@@ -4,6 +4,36 @@ server {
     server_name localhost;
     charset utf-8;
 
+    location /media/ {
+        # Auth request configuration
+        auth_request /auth;
+        auth_request_set $authHeader $upstream_http_authorization;
+        auth_request_set $authDate $upstream_http_x_amz_date;
+        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+        # Pass specific headers from the auth response
+        proxy_set_header Authorization $authHeader;
+        proxy_set_header X-Amz-Date $authDate;
+        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+
+        # Get resource from Minio
+        proxy_pass http://minio:9000/impress-media-storage/;
+        proxy_set_header Host minio:9000;
+    }
+
+    location /auth {
+        proxy_pass http://app-dev:8000/api/v1.0/documents/retrieve-auth/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Original-URL $request_uri;
+        
+        # Prevent the body from being passed
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-Method $request_method;
+    }
+
     location / {
         proxy_pass http://keycloak:8080;
         proxy_set_header Host $host;

docs/release.md

@@ -23,9 +23,9 @@ Whenever we are cooking a new release (e.g. `4.18.1`) we should follow a standar
              pullPolicy: Always
              tag: "v4.18.1" 
 
-          webrtc:
+          y-provider:
             image:
-              repository: lasuite/impress-y-webrtc-signaling
+              repository: lasuite/impress-y-provider
               pullPolicy: Always
               tag: "v4.18.1" 
          ```

renovate.json

@@ -13,13 +13,7 @@
       "enabled": false,
       "groupName": "ignored js dependencies",
       "matchManagers": ["npm"],
-      "matchPackageNames": [
-        "fetch-mock",
-        "node",
-        "node-fetch",
-        "i18next-parser",
-        "eslint"
-      ]
+      "matchPackageNames": ["fetch-mock", "node", "node-fetch", "eslint"]
     }
   ]
 }

src/backend/core/admin.py

@@ -92,6 +92,14 @@ class DocumentAdmin(admin.ModelAdmin):
     """Document admin interface declaration."""
 
     inlines = (DocumentAccessInline,)
+    list_display = (
+        "id",
+        "title",
+        "link_reach",
+        "link_role",
+        "created_at",
+        "updated_at",
+    )
 
 
 @admin.register(models.Invitation)

src/backend/core/api/permissions.py

@@ -62,6 +62,9 @@ class IsOwnedOrPublic(IsAuthenticated):
 class AccessPermission(permissions.BasePermission):
     """Permission class for access objects."""
 
+    def has_permission(self, request, view):
+        return request.user.is_authenticated or view.action != "create"
+
     def has_object_permission(self, request, view, obj):
         """Check permission for a given object."""
         abilities = obj.get_abilities(request.user)

src/backend/core/api/serializers.py

@@ -1,5 +1,8 @@
 """Client serializers for the impress core app."""
 
+import mimetypes
+
+from django.conf import settings
 from django.db.models import Q
 from django.utils.translation import gettext_lazy as _
 
@@ -63,9 +66,8 @@ class BaseAccessSerializer(serializers.ModelSerializer):
                     "You must set a resource ID in kwargs to create a new access."
                 ) from exc
 
-            teams = user.get_teams()
             if not self.Meta.model.objects.filter(  # pylint: disable=no-member
-                Q(user=user) | Q(team__in=teams),
+                Q(user=user) | Q(team__in=user.teams),
                 role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
             ).exists():
                 raise exceptions.PermissionDenied(
@@ -75,7 +77,7 @@ class BaseAccessSerializer(serializers.ModelSerializer):
             if (
                 role == models.RoleChoices.OWNER
                 and not self.Meta.model.objects.filter(  # pylint: disable=no-member
-                    Q(user=user) | Q(team__in=teams),
+                    Q(user=user) | Q(team__in=user.teams),
                     role=models.RoleChoices.OWNER,
                     **{self.Meta.resource_field_name: resource_id},  # pylint: disable=no-member
                 ).exists()
@@ -146,11 +148,85 @@ class DocumentSerializer(BaseResourceSerializer):
             "title",
             "accesses",
             "abilities",
-            "is_public",
+            "link_role",
+            "link_reach",
             "created_at",
             "updated_at",
         ]
-        read_only_fields = ["id", "accesses", "abilities", "created_at", "updated_at"]
+        read_only_fields = [
+            "id",
+            "accesses",
+            "abilities",
+            "link_role",
+            "link_reach",
+            "created_at",
+            "updated_at",
+        ]
+
+    def get_fields(self):
+        """Dynamically make `id` read-only on PUT requests but writable on POST requests."""
+        fields = super().get_fields()
+
+        request = self.context.get("request")
+        if request and request.method == "POST":
+            fields["id"].read_only = False
+
+        return fields
+
+    def validate_id(self, value):
+        """Ensure the provided ID does not already exist when creating a new document."""
+        request = self.context.get("request")
+
+        # Only check this on POST (creation)
+        if request and request.method == "POST":
+            if models.Document.objects.filter(id=value).exists():
+                raise serializers.ValidationError(
+                    "A document with this ID already exists. You cannot override it."
+                )
+
+        return value
+
+
+class LinkDocumentSerializer(BaseResourceSerializer):
+    """
+    Serialize link configuration for documents.
+    We expose it separately from document in order to simplify and secure access control.
+    """
+
+    class Meta:
+        model = models.Document
+        fields = [
+            "link_role",
+            "link_reach",
+        ]
+
+
+# Suppress the warning about not implementing `create` and `update` methods
+# since we don't use a model and only rely on the serializer for validation
+# pylint: disable=abstract-method
+class FileUploadSerializer(serializers.Serializer):
+    """Receive file upload requests."""
+
+    file = serializers.FileField()
+
+    def validate_file(self, file):
+        """Add file size and type constraints as defined in settings."""
+        # Validate file size
+        if file.size > settings.DOCUMENT_IMAGE_MAX_SIZE:
+            max_size = settings.DOCUMENT_IMAGE_MAX_SIZE // (1024 * 1024)
+            raise serializers.ValidationError(
+                f"File size exceeds the maximum limit of {max_size:d} MB."
+            )
+
+        # Validate file type
+        mime_type, _ = mimetypes.guess_type(file.name)
+        if mime_type not in settings.DOCUMENT_IMAGE_ALLOWED_MIME_TYPES:
+            mime_types = ", ".join(settings.DOCUMENT_IMAGE_ALLOWED_MIME_TYPES)
+            raise serializers.ValidationError(
+                f"File type '{mime_type:s}' is not allowed. Allowed types are: {mime_types:s}"
+            )
+
+        return file
 
 
 class TemplateSerializer(BaseResourceSerializer):
@@ -241,9 +317,8 @@ class InvitationSerializer(serializers.ModelSerializer):
                 "Anonymous users are not allowed to create invitations."
             )
 
-        teams = user.get_teams()
         if not models.DocumentAccess.objects.filter(
-            Q(user=user) | Q(team__in=teams),
+            Q(user=user) | Q(team__in=user.teams),
             document=document_id,
             role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
         ).exists():
@@ -254,7 +329,7 @@ class InvitationSerializer(serializers.ModelSerializer):
         if (
             role == models.RoleChoices.OWNER
             and not models.DocumentAccess.objects.filter(
-                Q(user=user) | Q(team__in=teams),
+                Q(user=user) | Q(team__in=user.teams),
                 document=document_id,
                 role=models.RoleChoices.OWNER,
             ).exists()

src/backend/core/api/utils.py

@@ -0,0 +1,33 @@
+"""Util to generate S3 authorization headers for object storage access control"""
+
+from django.core.files.storage import default_storage
+
+import botocore
+
+
+def generate_s3_authorization_headers(key):
+    """
+    Generate authorization headers for an s3 object.
+    These headers can be used as an alternative to signed urls with many benefits:
+    - the urls of our files never expire and can be stored in our documents' content
+    - we don't leak authorized urls that could be shared (file access can only be done
+      with cookies)
+    - access control is truly realtime
+    - the object storage service does not need to be exposed on internet
+    """
+    url = default_storage.unsigned_connection.meta.client.generate_presigned_url(
+        "get_object",
+        ExpiresIn=0,
+        Params={"Bucket": default_storage.bucket_name, "Key": key},
+    )
+    request = botocore.awsrequest.AWSRequest(method="get", url=url)
+
+    s3_client = default_storage.connection.meta.client
+    # pylint: disable=protected-access
+    credentials = s3_client._request_signer._credentials  # noqa: SLF001
+    frozen_credentials = credentials.get_frozen_credentials()
+    region = s3_client.meta.region_name
+    auth = botocore.auth.S3SigV4Auth(frozen_credentials, "s3", region)
+    auth.add_auth(request)
+
+    return request

src/backend/core/api/viewsets.py

@@ -1,6 +1,14 @@
 """API endpoints"""
 
+import os
+import re
+import uuid
+from urllib.parse import urlparse
+
+from django.conf import settings
 from django.contrib.postgres.aggregates import ArrayAgg
+from django.core.exceptions import ValidationError
+from django.core.files.storage import default_storage
 from django.db.models import (
     OuterRef,
     Q,
@@ -25,10 +33,22 @@ from rest_framework import (
 from core import models
 from core.utils import email_invitation
 
-from . import permissions, serializers
+from . import permissions, serializers, utils
+
+ATTACHMENTS_FOLDER = "attachments"
+UUID_REGEX = (
+    r"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
+)
+FILE_EXT_REGEX = r"\.[a-zA-Z]{3,4}"
+MEDIA_URL_PATTERN = re.compile(
+    f"{settings.MEDIA_URL:s}({UUID_REGEX:s})/"
+    f"({ATTACHMENTS_FOLDER:s}/{UUID_REGEX:s}{FILE_EXT_REGEX:s})$"
+)
 
 # pylint: disable=too-many-ancestors
 
+ATTACHMENTS_FOLDER = "attachments"
+
 
 class NestedGenericViewSet(viewsets.GenericViewSet):
     """
@@ -166,28 +186,21 @@ class ResourceViewsetMixin:
     def get_queryset(self):
         """Custom queryset to get user related resources."""
         queryset = super().get_queryset()
-        if not self.request.user.is_authenticated:
-            return queryset.filter(is_public=True)
-
         user = self.request.user
-        teams = user.get_teams()
+
+        if not user.is_authenticated:
+            return queryset
 
         user_roles_query = (
             self.access_model_class.objects.filter(
-                Q(user=user) | Q(team__in=teams),
+                Q(user=user) | Q(team__in=user.teams),
                 **{self.resource_field_name: OuterRef("pk")},
             )
             .values(self.resource_field_name)
             .annotate(roles_array=ArrayAgg("role"))
             .values("roles_array")
         )
-        return (
-            queryset.filter(
-                Q(accesses__user=user) | Q(accesses__team__in=teams) | Q(is_public=True)
-            )
-            .annotate(user_roles=Subquery(user_roles_query))
-            .distinct()
-        )
+        return queryset.annotate(user_roles=Subquery(user_roles_query)).distinct()
 
     def perform_create(self, serializer):
         """Set the current user as owner of the newly created object."""
@@ -226,8 +239,7 @@ class ResourceAccessViewsetMixin:
 
         if self.action == "list":
             user = self.request.user
-            teams = user.get_teams()
-
+            teams = user.teams
             user_roles_query = (
                 queryset.filter(
                     Q(user=user) | Q(team__in=teams),
@@ -265,7 +277,7 @@ class ResourceAccessViewsetMixin:
         ):
             return drf_response.Response(
                 {"detail": "Cannot delete the last owner access for the resource."},
-                status=403,
+                status=status.HTTP_403_FORBIDDEN,
             )
 
         return super().destroy(request, *args, **kwargs)
@@ -295,34 +307,66 @@ class DocumentViewSet(
     ResourceViewsetMixin,
     mixins.CreateModelMixin,
     mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
     mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
 ):
     """Document ViewSet"""
 
     permission_classes = [
-        permissions.IsAuthenticatedOrSafe,
         permissions.AccessPermission,
     ]
     serializer_class = serializers.DocumentSerializer
     access_model_class = models.DocumentAccess
     resource_field_name = "document"
     queryset = models.Document.objects.all()
+    ordering = ["-updated_at"]
 
-    def perform_create(self, serializer):
-        """
-        Override perform_create to use the provided ID in the payload if it exists
-        """
-        document_id = self.request.data.get("id")
-        document = serializer.save(id=document_id) if document_id else serializer.save()
+    def list(self, request, *args, **kwargs):
+        """Restrict resources returned by the list endpoint"""
+        queryset = self.filter_queryset(self.get_queryset())
+        user = self.request.user
+        if user.is_authenticated:
+            queryset = queryset.filter(
+                Q(accesses__user=user)
+                | Q(accesses__team__in=user.teams)
+                | (
+                    Q(link_traces__user=user)
+                    & ~Q(link_reach=models.LinkReachChoices.RESTRICTED)
+                )
+            )
+        else:
+            queryset = queryset.none()
 
-        self.access_model_class.objects.create(
-            user=self.request.user,
-            role=models.RoleChoices.OWNER,
-            **{self.resource_field_name: document},
-        )
+        page = self.paginate_queryset(queryset)
+        if page is not None:
+            serializer = self.get_serializer(page, many=True)
+            return self.get_paginated_response(serializer.data)
+
+        serializer = self.get_serializer(queryset, many=True)
+        return drf_response.Response(serializer.data)
+
+    def retrieve(self, request, *args, **kwargs):
+        """
+        Add a trace that the document was accessed by a user. This is used to list documents
+        on a user's list view even though the user has no specific role in the document (link
+        access when the link reach configuration of the document allows it).
+        """
+        instance = self.get_object()
+        serializer = self.get_serializer(instance)
+
+        if self.request.user.is_authenticated:
+            try:
+                # Add a trace that the user visited the document (this is needed to include
+                # the document in the user's list view)
+                models.LinkTrace.objects.create(
+                    document=instance,
+                    user=self.request.user,
+                )
+            except ValidationError:
+                # The trace already exists, so we just pass without doing anything
+                pass
+
+        return drf_response.Response(serializer.data)
 
     @decorators.action(detail=True, methods=["get"], url_path="versions")
     def versions_list(self, request, *args, **kwargs):
@@ -330,11 +374,15 @@ class DocumentViewSet(
         Return the document's versions but only those created after the user got access
         to the document
         """
+        if not request.user.is_authenticated:
+            raise exceptions.PermissionDenied("Authentication required.")
+
         document = self.get_object()
+        user = request.user
         from_datetime = min(
             access.created_at
             for access in document.accesses.filter(
-                Q(user=request.user) | Q(team__in=request.user.get_teams()),
+                Q(user=user) | Q(team__in=user.teams),
             )
         )
 
@@ -366,10 +414,11 @@ class DocumentViewSet(
 
         # Don't let users access versions that were created before they were given access
         # to the document
+        user = request.user
         from_datetime = min(
             access.created_at
             for access in document.accesses.filter(
-                Q(user=request.user) | Q(team__in=request.user.get_teams()),
+                Q(user=user) | Q(team__in=user.teams),
             )
         )
         if response["LastModified"] < from_datetime:
@@ -389,6 +438,91 @@ class DocumentViewSet(
             }
         )
 
+    @decorators.action(detail=True, methods=["put"], url_path="link-configuration")
+    def link_configuration(self, request, *args, **kwargs):
+        """Update link configuration with specific rights (cf get_abilities)."""
+        # Check permissions first
+        document = self.get_object()
+
+        # Deserialize and validate the data
+        serializer = serializers.LinkDocumentSerializer(
+            document, data=request.data, partial=True
+        )
+        if not serializer.is_valid():
+            return drf_response.Response(
+                serializer.errors, status=status.HTTP_400_BAD_REQUEST
+            )
+
+        serializer.save()
+        return drf_response.Response(serializer.data, status=status.HTTP_200_OK)
+
+    @decorators.action(detail=True, methods=["post"], url_path="attachment-upload")
+    def attachment_upload(self, request, *args, **kwargs):
+        """Upload a file related to a given document"""
+        # Check permissions first
+        document = self.get_object()
+
+        # Validate metadata in payload
+        serializer = serializers.FileUploadSerializer(data=request.data)
+        if not serializer.is_valid():
+            return drf_response.Response(
+                serializer.errors, status=status.HTTP_400_BAD_REQUEST
+            )
+        # Extract the file extension from the original filename
+        file = serializer.validated_data["file"]
+        extension = os.path.splitext(file.name)[1]
+
+        # Generate a generic yet unique filename to store the image in object storage
+        file_id = uuid.uuid4()
+        key = f"{document.key_base}/{ATTACHMENTS_FOLDER:s}/{file_id!s}{extension:s}"
+
+        default_storage.save(key, file)
+        return drf_response.Response(
+            {"file": f"{settings.MEDIA_URL:s}{key:s}"}, status=status.HTTP_201_CREATED
+        )
+
+    @decorators.action(detail=False, methods=["get"], url_path="retrieve-auth")
+    def retrieve_auth(self, request, *args, **kwargs):
+        """
+        This view is used by an Nginx subrequest to control access to a document's
+        attachment file.
+
+        The original url is passed by nginx in the "HTTP_X_ORIGINAL_URL" header.
+        See corresponding ingress configuration in Helm chart and read about the
+        nginx.ingress.kubernetes.io/auth-url annotation to understand how the Nginx ingress
+        is configured to do this.
+
+        Based on the original url and the logged in user, we must decide if we authorize Nginx
+        to let this request go through (by returning a 200 code) or if we block it (by returning
+        a 403 error). Note that we return 403 errors without any further details for security
+        reasons.
+
+        When we let the request go through, we compute authorization headers that will be added to
+        the request going through thanks to the nginx.ingress.kubernetes.io/auth-response-headers
+        annotation. The request will then be proxied to the object storage backend who will
+        respond with the file after checking the signature included in headers.
+        """
+        original_url = urlparse(request.META.get("HTTP_X_ORIGINAL_URL"))
+        match = MEDIA_URL_PATTERN.search(original_url.path)
+
+        try:
+            pk, attachment_key = match.groups()
+        except AttributeError as excpt:
+            raise exceptions.PermissionDenied() from excpt
+
+        # Check permission
+        try:
+            document = models.Document.objects.get(pk=pk)
+        except models.Document.DoesNotExist as excpt:
+            raise exceptions.PermissionDenied() from excpt
+
+        if not document.get_abilities(request.user).get("retrieve", False):
+            raise exceptions.PermissionDenied()
+
+        # Generate authorization headers and return an authorization to proceed with the request
+        request = utils.generate_s3_authorization_headers(f"{pk:s}/{attachment_key:s}")
+        return drf_response.Response("authorized", headers=request.headers, status=200)
+
 
 class DocumentAccessViewSet(
     ResourceAccessViewsetMixin,
@@ -442,7 +576,6 @@ class TemplateViewSet(
     ResourceViewsetMixin,
     mixins.CreateModelMixin,
     mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
     mixins.RetrieveModelMixin,
     mixins.UpdateModelMixin,
     viewsets.GenericViewSet,
@@ -458,6 +591,27 @@ class TemplateViewSet(
     resource_field_name = "template"
     queryset = models.Template.objects.all()
 
+    def list(self, request, *args, **kwargs):
+        """Restrict templates returned by the list endpoint"""
+        queryset = self.filter_queryset(self.get_queryset())
+        user = self.request.user
+        if user.is_authenticated:
+            queryset = queryset.filter(
+                Q(accesses__user=user)
+                | Q(accesses__team__in=user.teams)
+                | Q(is_public=True)
+            )
+        else:
+            queryset = queryset.filter(is_public=True)
+
+        page = self.paginate_queryset(queryset)
+        if page is not None:
+            serializer = self.get_serializer(page, many=True)
+            return self.get_paginated_response(serializer.data)
+
+        serializer = self.get_serializer(queryset, many=True)
+        return drf_response.Response(serializer.data)
+
     @decorators.action(
         detail=True,
         methods=["post"],
@@ -584,7 +738,7 @@ class InvitationViewset(
 
         if self.action == "list":
             user = self.request.user
-            teams = user.get_teams()
+            teams = user.teams
 
             # Determine which role the logged-in user has in the document
             user_roles_query = (

src/backend/core/factories.py

@@ -35,8 +35,13 @@ class DocumentFactory(factory.django.DjangoModelFactory):
         skip_postgeneration_save = True
 
     title = factory.Sequence(lambda n: f"document{n}")
-    is_public = factory.Faker("boolean")
     content = factory.Sequence(lambda n: f"content{n}")
+    link_reach = factory.fuzzy.FuzzyChoice(
+        [a[0] for a in models.LinkReachChoices.choices]
+    )
+    link_role = factory.fuzzy.FuzzyChoice(
+        [r[0] for r in models.LinkRoleChoices.choices]
+    )
 
     @factory.post_generation
     def users(self, create, extracted, **kwargs):
@@ -48,6 +53,13 @@ class DocumentFactory(factory.django.DjangoModelFactory):
                 else:
                     UserDocumentAccessFactory(document=self, user=item[0], role=item[1])
 
+    @factory.post_generation
+    def link_traces(self, create, extracted, **kwargs):
+        """Add link traces to document from a given list of users."""
+        if create and extracted:
+            for item in extracted:
+                models.LinkTrace.objects.create(document=self, user=item)
+
 
 class UserDocumentAccessFactory(factory.django.DjangoModelFactory):
     """Create fake document user accesses for testing."""

src/backend/core/migrations/0003_document_link_reach_document_link_role_and_more.py

@@ -0,0 +1,52 @@
+# Generated by Django 5.1 on 2024-09-08 16:55
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0002_create_pg_trgm_extension'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='document',
+            name='link_reach',
+            field=models.CharField(choices=[('restricted', 'Restricted'), ('authenticated', 'Authenticated'), ('public', 'Public')], default='authenticated', max_length=20),
+        ),
+        migrations.AddField(
+            model_name='document',
+            name='link_role',
+            field=models.CharField(choices=[('reader', 'Reader'), ('editor', 'Editor')], default='reader', max_length=20),
+        ),
+        migrations.AlterField(
+            model_name='document',
+            name='is_public',
+            field=models.BooleanField(null=True),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='language',
+            field=models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language'),
+        ),
+        migrations.CreateModel(
+            name='LinkTrace',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created on')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated on')),
+                ('document', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='link_traces', to='core.document')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='link_traces', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'verbose_name': 'Document/user link trace',
+                'verbose_name_plural': 'Document/user link traces',
+                'db_table': 'impress_link_trace',
+                'constraints': [models.UniqueConstraint(fields=('user', 'document'), name='unique_link_trace_document_user', violation_error_message='A link trace already exists for this document/user.')],
+            },
+        ),
+    ]

src/backend/core/migrations/0004_migrate_is_public_to_link_reach.py

@@ -0,0 +1,35 @@
+# Generated by Django 5.1 on 2024-09-08 17:04
+from django.db import migrations
+
+def migrate_is_public_to_link_reach(apps, schema_editor):
+    """
+    Forward migration: Migrate 'is_public' to 'link_reach'.
+    If is_public == True, set link_reach to 'public'
+    """
+    Document = apps.get_model('core', 'Document')
+    Document.objects.filter(is_public=True).update(link_reach='public')
+
+
+def reverse_migrate_link_reach_to_is_public(apps, schema_editor):
+    """
+    Reverse migration: Migrate 'link_reach' back to 'is_public'.
+    - If link_reach == 'public', set is_public to True
+    - Else set is_public to False
+    """
+    Document = apps.get_model('core', 'Document')
+    Document.objects.filter(link_reach='public').update(is_public=True)
+    Document.objects.filter(link_reach__in=['restricted', "authenticated"]).update(is_public=False)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0003_document_link_reach_document_link_role_and_more'),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            migrate_is_public_to_link_reach, 
+            reverse_migrate_link_reach_to_is_public
+        ),
+    ]

src/backend/core/migrations/0005_remove_document_is_public_alter_document_link_reach_and_more.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.1 on 2024-09-09 17:49
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0004_migrate_is_public_to_link_reach'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='document',
+            name='title',
+            field=models.CharField(blank=True, max_length=255, null=True, verbose_name='title'),
+        ),
+    ]

src/backend/core/models.py

@@ -21,7 +21,7 @@ from django.http import FileResponse
 from django.template.base import Template as DjangoTemplate
 from django.template.context import Context
 from django.utils import html, timezone
-from django.utils.functional import lazy
+from django.utils.functional import cached_property, lazy
 from django.utils.translation import gettext_lazy as _
 
 import frontmatter
@@ -36,23 +36,30 @@ logger = getLogger(__name__)
 
 def get_resource_roles(resource, user):
     """Compute the roles a user has on a resource."""
-    roles = []
-    if user.is_authenticated:
+    if not user.is_authenticated:
+        return []
+
+    try:
+        roles = resource.user_roles or []
+    except AttributeError:
         try:
-            roles = resource.user_roles or []
-        except AttributeError:
-            teams = user.get_teams()
-            try:
-                roles = resource.accesses.filter(
-                    models.Q(user=user) | models.Q(team__in=teams),
-                ).values_list("role", flat=True)
-            except (models.ObjectDoesNotExist, IndexError):
-                roles = []
+            roles = resource.accesses.filter(
+                models.Q(user=user) | models.Q(team__in=user.teams),
+            ).values_list("role", flat=True)
+        except (models.ObjectDoesNotExist, IndexError):
+            roles = []
     return roles
 
 
+class LinkRoleChoices(models.TextChoices):
+    """Defines the possible roles a link can offer on a document."""
+
+    READER = "reader", _("Reader")  # Can read
+    EDITOR = "editor", _("Editor")  # Can read and edit
+
+
 class RoleChoices(models.TextChoices):
-    """Defines the possible roles a user can have in a template."""
+    """Defines the possible roles a user can have in a resource."""
 
     READER = "reader", _("Reader")  # Can read
     EDITOR = "editor", _("Editor")  # Can read and edit
@@ -60,6 +67,20 @@ class RoleChoices(models.TextChoices):
     OWNER = "owner", _("Owner")
 
 
+class LinkReachChoices(models.TextChoices):
+    """Defines types of access for links"""
+
+    RESTRICTED = (
+        "restricted",
+        _("Restricted"),
+    )  # Only users with a specific access can read/edit the document
+    AUTHENTICATED = (
+        "authenticated",
+        _("Authenticated"),
+    )  # Any authenticated user can access the document
+    PUBLIC = "public", _("Public")  # Even anonymous users can access the document
+
+
 class BaseModel(models.Model):
     """
     Serves as an abstract base model for other models, ensuring that records are validated
@@ -214,7 +235,8 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
             raise ValueError("User has no email address.")
         mail.send_mail(subject, message, from_email, [self.email], **kwargs)
 
-    def get_teams(self):
+    @cached_property
+    def teams(self):
         """
         Get list of teams in which the user is, as a list of strings.
         Must be cached if retrieved remotely.
@@ -246,7 +268,7 @@ class BaseAccess(BaseModel):
         """
         roles = []
         if user.is_authenticated:
-            teams = user.get_teams()
+            teams = user.teams
             try:
                 roles = self.user_roles or []
             except AttributeError:
@@ -298,11 +320,14 @@ class BaseAccess(BaseModel):
 class Document(BaseModel):
     """Pad document carrying the content."""
 
-    title = models.CharField(_("title"), max_length=255)
-    is_public = models.BooleanField(
-        _("public"),
-        default=False,
-        help_text=_("Whether this document is public for anyone to use."),
+    title = models.CharField(_("title"), max_length=255, null=True, blank=True)
+    link_reach = models.CharField(
+        max_length=20,
+        choices=LinkReachChoices.choices,
+        default=LinkReachChoices.AUTHENTICATED,
+    )
+    link_role = models.CharField(
+        max_length=20, choices=LinkRoleChoices.choices, default=LinkRoleChoices.READER
     )
 
     _content = None
@@ -314,7 +339,7 @@ class Document(BaseModel):
         verbose_name_plural = _("Documents")
 
     def __str__(self):
-        return self.title
+        return str(self.title) if self.title else str(_("Untitled Document"))
 
     def save(self, *args, **kwargs):
         """Write content to object storage only if _content has changed."""
@@ -324,16 +349,23 @@ class Document(BaseModel):
             file_key = self.file_key
             bytes_content = self._content.encode("utf-8")
 
-            if default_storage.exists(file_key):
+            # Attempt to directly check if the object exists using the storage client.
+            try:
                 response = default_storage.connection.meta.client.head_object(
                     Bucket=default_storage.bucket_name, Key=file_key
                 )
+            except ClientError as excpt:
+                # If the error is a 404, the object doesn't exist, so we should create it.
+                if excpt.response["Error"]["Code"] == "404":
+                    has_changed = True
+                else:
+                    raise
+            else:
+                # Compare the existing ETag with the MD5 hash of the new content.
                 has_changed = (
                     response["ETag"].strip('"')
-                    != hashlib.md5(bytes_content).hexdigest()  # noqa
+                    != hashlib.md5(bytes_content).hexdigest()  # noqa: S324
                 )
-            else:
-                has_changed = True
 
             if has_changed:
                 content_file = ContentFile(bytes_content)
@@ -396,7 +428,7 @@ class Document(BaseModel):
             response = default_storage.connection.meta.client.list_object_versions(
                 Bucket=default_storage.bucket_name,
                 Prefix=self.file_key,
-                MaxKeys=settings.S3_VERSIONS_PAGE_SIZE,
+                MaxKeys=settings.DOCUMENT_VERSIONS_PAGE_SIZE,
                 **token,
             )
 
@@ -414,7 +446,7 @@ class Document(BaseModel):
                     if response["NextVersionIdMarker"]:
                         return self.get_versions_slice(
                             from_version_id=response["NextVersionIdMarker"],
-                            page_size=settings.S3_VERSIONS_PAGE_SIZE,
+                            page_size=settings.DOCUMENT_VERSIONS_PAGE_SIZE,
                             from_datetime=from_datetime,
                         )
                     return {
@@ -426,9 +458,9 @@ class Document(BaseModel):
         response = default_storage.connection.meta.client.list_object_versions(
             Bucket=default_storage.bucket_name,
             Prefix=self.file_key,
-            MaxKeys=min(page_size, settings.S3_VERSIONS_PAGE_SIZE)
+            MaxKeys=min(page_size, settings.DOCUMENT_VERSIONS_PAGE_SIZE)
             if page_size
-            else settings.S3_VERSIONS_PAGE_SIZE,
+            else settings.DOCUMENT_VERSIONS_PAGE_SIZE,
             **token,
         )
         return {
@@ -458,26 +490,71 @@ class Document(BaseModel):
         """
         Compute and return abilities for a given user on the document.
         """
-        roles = get_resource_roles(self, user)
-        is_owner_or_admin = bool(
-            set(roles).intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
-        )
-        is_editor = bool(RoleChoices.EDITOR in roles)
-        can_get = self.is_public or bool(roles)
+        roles = set(get_resource_roles(self, user))
+
+        # Compute version roles before adding link roles because we don't
+        # want anonymous users to access versions (we wouldn't know from
+        # which date to allow them anyway)
         can_get_versions = bool(roles)
 
+        # Add role provided by the document link
+        if self.link_reach == LinkReachChoices.PUBLIC or (
+            self.link_reach == LinkReachChoices.AUTHENTICATED and user.is_authenticated
+        ):
+            roles.add(self.link_role)
+
+        is_owner_or_admin = bool(
+            roles.intersection({RoleChoices.OWNER, RoleChoices.ADMIN})
+        )
+        is_editor = bool(RoleChoices.EDITOR in roles)
+        can_get = bool(roles)
+
         return {
+            "attachment_upload": is_owner_or_admin or is_editor,
             "destroy": RoleChoices.OWNER in roles,
+            "link_configuration": is_owner_or_admin,
+            "manage_accesses": is_owner_or_admin,
+            "partial_update": is_owner_or_admin or is_editor,
+            "retrieve": can_get,
+            "update": is_owner_or_admin or is_editor,
             "versions_destroy": is_owner_or_admin,
             "versions_list": can_get_versions,
             "versions_retrieve": can_get_versions,
-            "manage_accesses": is_owner_or_admin,
-            "update": is_owner_or_admin or is_editor,
-            "partial_update": is_owner_or_admin or is_editor,
-            "retrieve": can_get,
         }
 
 
+class LinkTrace(BaseModel):
+    """
+    Relation model to trace accesses to a document via a link by a logged-in user.
+    This is necessary to show the document in the user's list of documents even
+    though the user does not have a role on the document.
+    """
+
+    document = models.ForeignKey(
+        Document,
+        on_delete=models.CASCADE,
+        related_name="link_traces",
+    )
+    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name="link_traces")
+
+    class Meta:
+        db_table = "impress_link_trace"
+        verbose_name = _("Document/user link trace")
+        verbose_name_plural = _("Document/user link traces")
+        constraints = [
+            models.UniqueConstraint(
+                fields=["user", "document"],
+                name="unique_link_trace_document_user",
+                violation_error_message=_(
+                    "A link trace already exists for this document/user."
+                ),
+            ),
+        ]
+
+    def __str__(self):
+        return f"{self.user!s} trace on document {self.document!s}"
+
+
 class DocumentAccess(BaseAccess):
     """Relation model to give access to a document for a user or a team with a role."""
 
@@ -769,7 +846,7 @@ class Invitation(BaseModel):
         roles = []
 
         if user.is_authenticated:
-            teams = user.get_teams()
+            teams = user.teams
             try:
                 roles = self.user_roles or []
             except AttributeError:

src/backend/core/tests/conftest.py

@@ -10,7 +10,9 @@ VIA = [USER, TEAM]
 
 
 @pytest.fixture
-def mock_user_get_teams():
-    """Mock for the "get_teams" method on the User model."""
-    with mock.patch("core.models.User.get_teams") as mock_get_teams:
-        yield mock_get_teams
+def mock_user_teams():
+    """Mock for the "teams" property on the User model."""
+    with mock.patch(
+        "core.models.User.teams", new_callable=mock.PropertyMock
+    ) as mock_teams:
+        yield mock_teams

src/backend/core/tests/documents/test_api_document_accesses.py

@@ -57,7 +57,7 @@ def test_api_document_accesses_list_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_list_authenticated_related(via, mock_user_get_teams):
+def test_api_document_accesses_list_authenticated_related(via, mock_user_teams):
     """
     Authenticated users should be able to list document accesses for a document
     to which they are directly related, whatever their role in the document.
@@ -76,7 +76,7 @@ def test_api_document_accesses_list_authenticated_related(via, mock_user_get_tea
             role=random.choice(models.RoleChoices.choices)[0],
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         user_access = models.DocumentAccess.objects.create(
             document=document,
             team="lasuite",
@@ -181,7 +181,7 @@ def test_api_document_accesses_retrieve_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_get_teams):
+def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_teams):
     """
     A user who is related to a document should be allowed to retrieve the
     associated document user accesses.
@@ -195,7 +195,7 @@ def test_api_document_accesses_retrieve_authenticated_related(via, mock_user_get
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
     access = factories.UserDocumentAccessFactory(document=document)
@@ -276,7 +276,7 @@ def test_api_document_accesses_update_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_accesses_update_authenticated_reader_or_editor(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Readers or editors of a document should not be allowed to update its accesses."""
     user = factories.UserFactory()
@@ -288,7 +288,7 @@ def test_api_document_accesses_update_authenticated_reader_or_editor(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -316,9 +316,7 @@ def test_api_document_accesses_update_authenticated_reader_or_editor(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_administrator_except_owner(
-    via, mock_user_get_teams
-):
+def test_api_document_accesses_update_administrator_except_owner(via, mock_user_teams):
     """
     A user who is a direct administrator in a document should be allowed to update a user
     access for this document, as long as they don't try to set the role to owner.
@@ -334,7 +332,7 @@ def test_api_document_accesses_update_administrator_except_owner(
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -375,9 +373,7 @@ def test_api_document_accesses_update_administrator_except_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_administrator_from_owner(
-    via, mock_user_get_teams
-):
+def test_api_document_accesses_update_administrator_from_owner(via, mock_user_teams):
     """
     A user who is an administrator in a document, should not be allowed to update
     the user access of an "owner" for this document.
@@ -393,7 +389,7 @@ def test_api_document_accesses_update_administrator_from_owner(
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -424,7 +420,7 @@ def test_api_document_accesses_update_administrator_from_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_administrator_to_owner(via, mock_user_get_teams):
+def test_api_document_accesses_update_administrator_to_owner(via, mock_user_teams):
     """
     A user who is an administrator in a document, should not be allowed to update
     the user access of another user to grant document ownership.
@@ -440,7 +436,7 @@ def test_api_document_accesses_update_administrator_to_owner(via, mock_user_get_
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -478,7 +474,7 @@ def test_api_document_accesses_update_administrator_to_owner(via, mock_user_get_
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_owner(via, mock_user_get_teams):
+def test_api_document_accesses_update_owner(via, mock_user_teams):
     """
     A user who is an owner in a document should be allowed to update
     a user access for this document whatever the role.
@@ -492,7 +488,7 @@ def test_api_document_accesses_update_owner(via, mock_user_get_teams):
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )
@@ -534,7 +530,7 @@ def test_api_document_accesses_update_owner(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_update_owner_self(via, mock_user_get_teams):
+def test_api_document_accesses_update_owner_self(via, mock_user_teams):
     """
     A user who is owner of a document should be allowed to update
     their own user access provided there are other owners in the document.
@@ -551,7 +547,7 @@ def test_api_document_accesses_update_owner_self(via, mock_user_get_teams):
             document=document, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )
@@ -626,7 +622,7 @@ def test_api_document_accesses_delete_authenticated():
 
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_get_teams):
+def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_teams):
     """
     Authenticated users should not be allowed to delete a document access for a
     document in which they are a simple reader or editor.
@@ -640,7 +636,7 @@ def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_get_
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -660,7 +656,7 @@ def test_api_document_accesses_delete_reader_or_editor(via, role, mock_user_get_
 
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_accesses_delete_administrators_except_owners(
-    via, mock_user_get_teams
+    via, mock_user_teams
 ):
     """
     Users who are administrators in a document should be allowed to delete an access
@@ -677,7 +673,7 @@ def test_api_document_accesses_delete_administrators_except_owners(
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -698,7 +694,7 @@ def test_api_document_accesses_delete_administrators_except_owners(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_get_teams):
+def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_teams):
     """
     Users who are administrators in a document should not be allowed to delete an ownership
     access from the document.
@@ -714,7 +710,7 @@ def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_get
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -733,7 +729,7 @@ def test_api_document_accesses_delete_administrator_on_owners(via, mock_user_get
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_owners(via, mock_user_get_teams):
+def test_api_document_accesses_delete_owners(via, mock_user_teams):
     """
     Users should be able to delete the document access of another user
     for a document of which they are owner.
@@ -747,7 +743,7 @@ def test_api_document_accesses_delete_owners(via, mock_user_get_teams):
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )
@@ -766,7 +762,7 @@ def test_api_document_accesses_delete_owners(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_delete_owners_last_owner(via, mock_user_get_teams):
+def test_api_document_accesses_delete_owners_last_owner(via, mock_user_teams):
     """
     It should not be possible to delete the last owner access from a document
     """
@@ -782,7 +778,7 @@ def test_api_document_accesses_delete_owners_last_owner(via, mock_user_get_teams
             document=document, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )

src/backend/core/tests/documents/test_api_document_accesses_create.py

@@ -66,7 +66,7 @@ def test_api_document_accesses_create_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_accesses_create_authenticated_reader_or_editor(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Readers or editors of a document should not be allowed to create document accesses."""
     user = factories.UserFactory()
@@ -78,7 +78,7 @@ def test_api_document_accesses_create_authenticated_reader_or_editor(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -101,9 +101,7 @@ def test_api_document_accesses_create_authenticated_reader_or_editor(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_create_authenticated_administrator(
-    via, mock_user_get_teams
-):
+def test_api_document_accesses_create_authenticated_administrator(via, mock_user_teams):
     """
     Administrators of a document should be able to create document accesses
     except for the "owner" role.
@@ -120,7 +118,7 @@ def test_api_document_accesses_create_authenticated_administrator(
             document=document, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="administrator"
         )
@@ -178,7 +176,7 @@ def test_api_document_accesses_create_authenticated_administrator(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_accesses_create_authenticated_owner(via, mock_user_get_teams):
+def test_api_document_accesses_create_authenticated_owner(via, mock_user_teams):
     """
     Owners of a document should be able to create document accesses whatever the role.
     An email should be sent to the accesses to notify them of the adding.
@@ -192,7 +190,7 @@ def test_api_document_accesses_create_authenticated_owner(via, mock_user_get_tea
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )

src/backend/core/tests/documents/test_api_document_invitations.py

@@ -80,7 +80,7 @@ def test_api_document_invitations__create__authenticated_outsider():
 )
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_invitations__create__privileged_members(
-    via, inviting, invited, is_allowed, mock_user_get_teams
+    via, inviting, invited, is_allowed, mock_user_teams
 ):
     """
     Only owners and administrators should be able to invite new users.
@@ -91,7 +91,7 @@ def test_api_document_invitations__create__privileged_members(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=inviting)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=inviting
         )
@@ -291,7 +291,7 @@ def test_api_document_invitations__list__anonymous_user():
 
 @pytest.mark.parametrize("via", VIA)
 def test_api_document_invitations__list__authenticated(
-    via, mock_user_get_teams, django_assert_num_queries
+    via, mock_user_teams, django_assert_num_queries
 ):
     """
     Authenticated users should be able to list invitations for documents to which they are
@@ -304,7 +304,7 @@ def test_api_document_invitations__list__authenticated(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -432,7 +432,7 @@ def test_api_document_invitations__retrieve__unrelated_user():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_invitations__retrieve__document_member(via, mock_user_get_teams):
+def test_api_document_invitations__retrieve__document_member(via, mock_user_teams):
     """
     Authenticated users related to the document should be able to retrieve invitations
     whatever their role in the document.
@@ -445,7 +445,7 @@ def test_api_document_invitations__retrieve__document_member(via, mock_user_get_
             document=invitation.document, user=user, role=role
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=invitation.document, team="lasuite", role=role
         )
@@ -475,7 +475,7 @@ def test_api_document_invitations__retrieve__document_member(via, mock_user_get_
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_invitations__put_authenticated(via, mock_user_get_teams):
+def test_api_document_invitations__put_authenticated(via, mock_user_teams):
     """
     Authenticated user can put invitations.
     """
@@ -486,7 +486,7 @@ def test_api_document_invitations__put_authenticated(via, mock_user_get_teams):
             document=invitation.document, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=invitation.document, team="lasuite", role="owner"
         )
@@ -503,7 +503,7 @@ def test_api_document_invitations__put_authenticated(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_invitations__patch_authenticated(via, mock_user_get_teams):
+def test_api_document_invitations__patch_authenticated(via, mock_user_teams):
     """
     Authenticated user can patch invitations.
     """
@@ -514,7 +514,7 @@ def test_api_document_invitations__patch_authenticated(via, mock_user_get_teams)
             document=invitation.document, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=invitation.document, team="lasuite", role="owner"
         )
@@ -546,7 +546,7 @@ def test_api_document_invitations__patch_authenticated(via, mock_user_get_teams)
     ["editor", "reader"],
 )
 def test_api_document_invitations__update__forbidden__not_authenticated(
-    method, via, role, mock_user_get_teams
+    method, via, role, mock_user_teams
 ):
     """
     Update of invitations is currently forbidden.
@@ -558,7 +558,7 @@ def test_api_document_invitations__update__forbidden__not_authenticated(
             document=invitation.document, user=user, role=role
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=invitation.document, team="lasuite", role=role
         )
@@ -607,7 +607,7 @@ def test_api_document_invitations__delete__authenticated_outsider():
 @pytest.mark.parametrize("via", VIA)
 @pytest.mark.parametrize("role", ["owner", "administrator"])
 def test_api_document_invitations__delete__privileged_members(
-    role, via, mock_user_get_teams
+    role, via, mock_user_teams
 ):
     """Privileged member should be able to cancel invitation."""
     user = factories.UserFactory()
@@ -615,7 +615,7 @@ def test_api_document_invitations__delete__privileged_members(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -632,16 +632,14 @@ def test_api_document_invitations__delete__privileged_members(
 
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_invitations_delete_readers_or_editors(
-    via, role, mock_user_get_teams
-):
+def test_api_document_invitations_delete_readers_or_editors(via, role, mock_user_teams):
     """Readers or editors should not be able to cancel invitation."""
     user = factories.UserFactory()
     document = factories.DocumentFactory()
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )

src/backend/core/tests/documents/test_api_document_versions.py

@@ -14,37 +14,29 @@ from core.tests.conftest import TEAM, USER, VIA
 pytestmark = pytest.mark.django_db
 
 
-def test_api_document_versions_list_anonymous_public():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+def test_api_document_versions_list_anonymous(role, reach):
     """
-    Anonymous users should not be allowed to list document versions for a public document.
+    Anonymous users should not be allowed to list document versions for a document
+    whatever the reach and role.
     """
-    document = factories.DocumentFactory(is_public=True)
-    factories.UserDocumentAccessFactory.create_batch(2, document=document)
+    document = factories.DocumentFactory(link_role=role, link_reach=reach)
+
+    # Accesses and traces for other users should not interfere
+    factories.UserDocumentAccessFactory(document=document)
+    models.LinkTrace.objects.create(document=document, user=factories.UserFactory())
 
     response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/versions/")
 
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
+    assert response.status_code == 403
+    assert response.json() == {"detail": "Authentication required."}
 
 
-def test_api_document_versions_list_anonymous_private():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_list_authenticated_unrelated(reach):
     """
-    Anonymous users should not be allowed to find document versions for a private document.
-    """
-    document = factories.DocumentFactory(is_public=False)
-    factories.UserDocumentAccessFactory.create_batch(2, document=document)
-
-    response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/versions/")
-
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
-def test_api_document_versions_list_authenticated_unrelated_public():
-    """
-    Authenticated users should not be allowed to list document versions for a public document
+    Authenticated users should not be allowed to list document versions for a document
     to which they are not related.
     """
     user = factories.UserFactory()
@@ -52,7 +44,7 @@ def test_api_document_versions_list_authenticated_unrelated_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
     factories.UserDocumentAccessFactory.create_batch(3, document=document)
 
     # The versions of another document to which the user is related should not be listed either
@@ -67,31 +59,8 @@ def test_api_document_versions_list_authenticated_unrelated_public():
     }
 
 
-def test_api_document_versions_list_authenticated_unrelated_private():
-    """
-    Authenticated users should not be allowed to find document versions for a private document
-    to which they are not related.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(is_public=False)
-    factories.UserDocumentAccessFactory.create_batch(3, document=document)
-
-    # The versions of another document to which the user is related should not be listed either
-    factories.UserDocumentAccessFactory(user=user)
-
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/versions/",
-    )
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_list_authenticated_related(via, mock_user_get_teams):
+def test_api_document_versions_list_authenticated_related(via, mock_user_teams):
     """
     Authenticated users should be able to list document versions for a document
     to which they are directly related, whatever their role in the document.
@@ -109,7 +78,7 @@ def test_api_document_versions_list_authenticated_related(via, mock_user_get_tea
             role=random.choice(models.RoleChoices.choices)[0],
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         models.DocumentAccess.objects.create(
             document=document,
             team="lasuite",
@@ -143,11 +112,13 @@ def test_api_document_versions_list_authenticated_related(via, mock_user_get_tea
     assert content["count"] == 1
 
 
-def test_api_document_versions_retrieve_anonymous_public():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_retrieve_anonymous(reach):
     """
-    Anonymous users should not be allowed to retrieve specific versions for a public document.
+    Anonymous users should not be allowed to find specific versions for a document with
+    restricted or authenticated link reach.
     """
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
     version_id = document.get_versions_slice()["versions"][0]["version_id"]
 
     url = f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/"
@@ -159,23 +130,10 @@ def test_api_document_versions_retrieve_anonymous_public():
     }
 
 
-def test_api_document_versions_retrieve_anonymous_private():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_retrieve_authenticated_unrelated(reach):
     """
-    Anonymous users should not be allowed to find specific versions for a private document.
-    """
-    document = factories.DocumentFactory(is_public=False)
-    version_id = document.get_versions_slice()["versions"][0]["version_id"]
-
-    url = f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/"
-    response = APIClient().get(url)
-
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
-def test_api_document_versions_retrieve_authenticated_unrelated_public():
-    """
-    Authenticated users should not be allowed to retrieve specific versions for a public
+    Authenticated users should not be allowed to retrieve specific versions for a
     document to which they are not related.
     """
     user = factories.UserFactory()
@@ -183,7 +141,7 @@ def test_api_document_versions_retrieve_authenticated_unrelated_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
     version_id = document.get_versions_slice()["versions"][0]["version_id"]
 
     response = client.get(
@@ -195,28 +153,8 @@ def test_api_document_versions_retrieve_authenticated_unrelated_public():
     }
 
 
-def test_api_document_versions_retrieve_authenticated_unrelated_private():
-    """
-    Authenticated users should not be allowed to find specific versions for a private document
-    to which they are not related.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(is_public=False)
-    version_id = document.get_versions_slice()["versions"][0]["version_id"]
-
-    response = client.get(
-        f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
-    )
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_retrieve_authenticated_related(via, mock_user_get_teams):
+def test_api_document_versions_retrieve_authenticated_related(via, mock_user_teams):
     """
     A user who is related to a document should be allowed to retrieve the
     associated document user accesses.
@@ -232,10 +170,10 @@ def test_api_document_versions_retrieve_authenticated_related(via, mock_user_get
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
-    # Versions created before the document was shared should not be available to the user
+    # Versions created before the document was shared should not be seen by the user
     response = client.get(
         f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
     )
@@ -267,10 +205,8 @@ def test_api_document_versions_create_anonymous():
         format="json",
     )
 
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
+    assert response.status_code == 405
+    assert response.json() == {"detail": 'Method "POST" not allowed.'}
 
 
 def test_api_document_versions_create_authenticated_unrelated():
@@ -295,7 +231,7 @@ def test_api_document_versions_create_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_create_authenticated_related(via, mock_user_get_teams):
+def test_api_document_versions_create_authenticated_related(via, mock_user_teams):
     """
     Authenticated users related to a document should not be allowed to create document versions
     whatever their role.
@@ -309,7 +245,7 @@ def test_api_document_versions_create_authenticated_related(via, mock_user_get_t
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
     response = client.post(
@@ -331,7 +267,7 @@ def test_api_document_versions_update_anonymous():
         {"foo": "bar"},
         format="json",
     )
-    assert response.status_code == 401
+    assert response.status_code == 405
 
 
 def test_api_document_versions_update_authenticated_unrelated():
@@ -356,7 +292,7 @@ def test_api_document_versions_update_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_update_authenticated_related(via, mock_user_get_teams):
+def test_api_document_versions_update_authenticated_related(via, mock_user_teams):
     """
     Authenticated users with access to a document should not be able to update its versions
     whatever their role.
@@ -372,7 +308,7 @@ def test_api_document_versions_update_authenticated_related(via, mock_user_get_t
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(document=document, team="lasuite")
 
     response = client.put(
@@ -397,7 +333,8 @@ def test_api_document_versions_delete_anonymous():
     assert response.status_code == 401
 
 
-def test_api_document_versions_delete_authenticated_public():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_document_versions_delete_authenticated(reach):
     """
     Authenticated users should not be allowed to delete a document version for a
     public document to which they are not related.
@@ -407,7 +344,7 @@ def test_api_document_versions_delete_authenticated_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
     version_id = document.get_versions_slice()["versions"][0]["version_id"]
 
     response = client.delete(
@@ -417,30 +354,9 @@ def test_api_document_versions_delete_authenticated_public():
     assert response.status_code == 403
 
 
-def test_api_document_versions_delete_authenticated_private():
-    """
-    Authenticated users should not be allowed to find a document version to delete it
-    for a private document to which they are not related.
-    """
-    user = factories.UserFactory()
-
-    client = APIClient()
-    client.force_login(user)
-
-    document = factories.DocumentFactory(is_public=False)
-    version_id = document.get_versions_slice()["versions"][0]["version_id"]
-
-    response = client.delete(
-        f"/api/v1.0/documents/{document.id!s}/versions/{version_id:s}/",
-    )
-
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
-
-
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_get_teams):
+def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_teams):
     """
     Authenticated users should not be allowed to delete a document version for a
     document in which they are a simple reader or editor.
@@ -454,7 +370,7 @@ def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_get_
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -484,7 +400,7 @@ def test_api_document_versions_delete_reader_or_editor(via, role, mock_user_get_
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_document_versions_delete_administrator_or_owner(via, mock_user_get_teams):
+def test_api_document_versions_delete_administrator_or_owner(via, mock_user_teams):
     """
     Users who are administrator or owner of a document should be allowed to delete a version.
     """
@@ -498,7 +414,7 @@ def test_api_document_versions_delete_administrator_or_owner(via, mock_user_get_
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )

src/backend/core/tests/documents/test_api_documents_attachment_upload.py

@@ -0,0 +1,255 @@
+"""
+Test file uploads API endpoint for users in impress's core app.
+"""
+
+import re
+import uuid
+
+from django.core.files.base import ContentFile
+from django.core.files.uploadedfile import SimpleUploadedFile
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+from core.tests.conftest import TEAM, USER, VIA
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize(
+    "reach, role",
+    [
+        ("restricted", "reader"),
+        ("restricted", "editor"),
+        ("authenticated", "reader"),
+        ("authenticated", "editor"),
+        ("public", "reader"),
+    ],
+)
+def test_api_documents_attachment_upload_anonymous_forbidden(reach, role):
+    """
+    Anonymous users should not be able to upload attachments if the link reach
+    and role don't allow it.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
+
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+    response = APIClient().post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_documents_attachment_upload_anonymous_success():
+    """
+    Anonymous users should be able to upload attachments to a document
+    if the link reach and role permit it.
+    """
+    document = factories.DocumentFactory(link_reach="public", link_role="editor")
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
+
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+    response = APIClient().post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 201
+
+    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.jpg")
+    match = pattern.search(response.json()["file"])
+    file_id = match.group(1)
+
+    # Validate that file_id is a valid UUID
+    uuid.UUID(file_id)
+
+
+@pytest.mark.parametrize(
+    "reach, role",
+    [
+        ("restricted", "reader"),
+        ("restricted", "editor"),
+        ("authenticated", "reader"),
+        ("public", "reader"),
+    ],
+)
+def test_api_documents_attachment_upload_authenticated_forbidden(reach, role):
+    """
+    Users who are not related to a document can't upload attachments if the
+    link reach and role don't allow it.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
+
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+    response = client.post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+
+@pytest.mark.parametrize(
+    "reach, role",
+    [
+        ("authenticated", "editor"),
+        ("public", "editor"),
+    ],
+)
+def test_api_documents_attachment_upload_authenticated_success(reach, role):
+    """
+    Autenticated who are not related to a document should be able to upload a file
+    if the link reach and role permit it.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
+
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+    response = client.post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 201
+
+    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.jpg")
+    match = pattern.search(response.json()["file"])
+    file_id = match.group(1)
+
+    # Validate that file_id is a valid UUID
+    uuid.UUID(file_id)
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_attachment_upload_reader(via, mock_user_teams):
+    """
+    Users who are simple readers on a document should not be allowed to upload an attachment.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_role="reader")
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role="reader"
+        )
+
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
+
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+    response = client.post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+
+@pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_attachment_upload_success(via, role, mock_user_teams):
+    """
+    Editors, administrators and owners of a document should be able to upload an attachment.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role=role
+        )
+
+    file = SimpleUploadedFile("test_file.jpg", b"Dummy content")
+
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+    response = client.post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 201
+
+    pattern = re.compile(rf"^/media/{document.id!s}/attachments/(.*)\.jpg")
+    match = pattern.search(response.json()["file"])
+    file_id = match.group(1)
+
+    # Validate that file_id is a valid UUID
+    uuid.UUID(file_id)
+
+
+def test_api_documents_attachment_upload_invalid(client):
+    """Attempt to upload without a file should return an explicit error."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(users=[(user, "owner")])
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+
+    response = client.post(url, {}, format="multipart")
+
+    assert response.status_code == 400
+    assert response.json() == {"file": ["No file was submitted."]}
+
+
+def test_api_documents_attachment_upload_size_limit_exceeded(settings):
+    """The uploaded file should not exceeed the maximum size in settings."""
+    settings.DOCUMENT_IMAGE_MAX_SIZE = 1048576  # 1 MB for test
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(users=[(user, "owner")])
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+
+    # Create a temporary file larger than the allowed size
+    content = b"a" * (1048576 + 1)
+    file = ContentFile(content, name="test.jpg")
+
+    response = client.post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 400
+    assert response.json() == {"file": ["File size exceeds the maximum limit of 1 MB."]}
+
+
+def test_api_documents_attachment_upload_type_not_allowed(settings):
+    """The uploaded file should be of a whitelisted type."""
+    settings.DOCUMENT_IMAGE_ALLOWED_MIME_TYPES = ["image/jpeg", "image/png"]
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(users=[(user, "owner")])
+    url = f"/api/v1.0/documents/{document.id!s}/attachment-upload/"
+
+    # Create a temporary file with a not allowed type (e.g., text file)
+    file = ContentFile(b"a" * 1048576, name="test.txt")
+
+    response = client.post(url, {"file": file}, format="multipart")
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "file": [
+            "File type 'text/plain' is not allowed. Allowed types are: image/jpeg, image/png"
+        ]
+    }

src/backend/core/tests/documents/test_api_documents_create.py

@@ -2,7 +2,7 @@
 Tests for Documents API endpoint in impress's core app: create
 """
 
-import uuid
+from uuid import uuid4
 
 import pytest
 from rest_framework.test import APIClient
@@ -26,7 +26,7 @@ def test_api_documents_create_anonymous():
     assert not Document.objects.exists()
 
 
-def test_api_documents_create_authenticated():
+def test_api_documents_create_authenticated_success():
     """
     Authenticated users should be able to create documents and should automatically be declared
     as the owner of the newly created document.
@@ -50,24 +50,64 @@ def test_api_documents_create_authenticated():
     assert document.accesses.filter(role="owner", user=user).exists()
 
 
-def test_api_documents_create_with_id_from_payload():
-    """
-    We should be able to create a document with an ID from the payload.
-    """
+def test_api_documents_create_authenticated_title_null():
+    """It should be possible to create several documents with a null title."""
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    doc_id = uuid.uuid4()
+    factories.DocumentFactory(title=None)
+
+    response = client.post("/api/v1.0/documents/", {}, format="json")
+
+    assert response.status_code == 201
+    assert Document.objects.filter(title__isnull=True).count() == 2
+
+
+def test_api_documents_create_force_id_success():
+    """It should be possible to force the document ID when creating a document."""
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    forced_id = uuid4()
+
     response = client.post(
         "/api/v1.0/documents/",
-        {"title": "my document", "id": str(doc_id)},
+        {
+            "id": str(forced_id),
+            "title": "my document",
+        },
         format="json",
     )
 
     assert response.status_code == 201
-    document = Document.objects.get()
-    assert document.title == "my document"
-    assert document.id == doc_id
-    assert document.accesses.filter(role="owner", user=user).exists()
+    documents = Document.objects.all()
+    assert len(documents) == 1
+    assert documents[0].id == forced_id
+
+
+def test_api_documents_create_force_id_existing():
+    """
+    It should not be possible to use the ID of an existing document when forcing ID on creation.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+
+    response = client.post(
+        "/api/v1.0/documents/",
+        {
+            "id": str(document.id),
+            "title": "my document",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert response.json() == {
+        "id": ["A document with this ID already exists. You cannot override it."]
+    }

src/backend/core/tests/documents/test_api_documents_delete.py

@@ -2,8 +2,6 @@
 Tests for Documents API endpoint in impress's core app: delete
 """
 
-import random
-
 import pytest
 from rest_framework.test import APIClient
 
@@ -25,30 +23,31 @@ def test_api_documents_delete_anonymous():
     assert models.Document.objects.count() == 1
 
 
-def test_api_documents_delete_authenticated_unrelated():
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+def test_api_documents_delete_authenticated_unrelated(reach, role):
     """
-    Authenticated users should not be allowed to delete a document to which they are not
-    related.
+    Authenticated users should not be allowed to delete a document to which
+    they are not related.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    is_public = random.choice([True, False])
-    document = factories.DocumentFactory(is_public=is_public)
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
 
     response = client.delete(
         f"/api/v1.0/documents/{document.id!s}/",
     )
 
-    assert response.status_code == 403 if is_public else 404
+    assert response.status_code == 403
     assert models.Document.objects.count() == 1
 
 
 @pytest.mark.parametrize("role", ["reader", "editor", "administrator"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_get_teams):
+def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_teams):
     """
     Authenticated users should not be allowed to delete a document for which they are
     only a reader, editor or administrator.
@@ -62,7 +61,7 @@ def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_get_t
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -79,7 +78,7 @@ def test_api_documents_delete_authenticated_not_owner(via, role, mock_user_get_t
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_delete_authenticated_owner(via, mock_user_get_teams):
+def test_api_documents_delete_authenticated_owner(via, mock_user_teams):
     """
     Authenticated users should be able to delete a document they own.
     """
@@ -92,7 +91,7 @@ def test_api_documents_delete_authenticated_owner(via, mock_user_get_teams):
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )

src/backend/core/tests/documents/test_api_documents_link_configuration.py

@@ -0,0 +1,152 @@
+"""Tests for link configuration of documents on API endpoint"""
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.api import serializers
+from core.tests.conftest import TEAM, USER, VIA
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_link_configuration_update_anonymous(reach, role):
+    """Anonymous users should not be allowed to update a link configuration."""
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    old_document_values = serializers.LinkDocumentSerializer(instance=document).data
+
+    new_document_values = serializers.LinkDocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = APIClient().put(
+        f"/api/v1.0/documents/{document.id!s}/link-configuration/",
+        new_document_values,
+        format="json",
+    )
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+    document.refresh_from_db()
+    document_values = serializers.LinkDocumentSerializer(instance=document).data
+    assert document_values == old_document_values
+
+
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_link_configuration_update_authenticated_unrelated(reach, role):
+    """
+    Authenticated users should not be allowed to update the link configuration for
+    a document to which they are not related.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    old_document_values = serializers.LinkDocumentSerializer(instance=document).data
+
+    new_document_values = serializers.LinkDocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/link-configuration/",
+        new_document_values,
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    document.refresh_from_db()
+    document_values = serializers.LinkDocumentSerializer(instance=document).data
+    assert document_values == old_document_values
+
+
+@pytest.mark.parametrize("role", ["editor", "reader"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_link_configuration_update_authenticated_related_forbidden(
+    via, role, mock_user_teams
+):
+    """
+    Users who are readers or editors of a document should not be allowed to update
+    the link configuration.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role=role
+        )
+
+    old_document_values = serializers.LinkDocumentSerializer(instance=document).data
+
+    new_document_values = serializers.LinkDocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/link-configuration/",
+        new_document_values,
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
+
+    document.refresh_from_db()
+    document_values = serializers.LinkDocumentSerializer(instance=document).data
+    assert document_values == old_document_values
+
+
+@pytest.mark.parametrize("role", ["administrator", "owner"])
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_link_configuration_update_authenticated_related_success(
+    via, role, mock_user_teams
+):
+    """
+    A user who is administrator or owner of a document should be allowed to update
+    the link configuration.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=document, user=user, role=role)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(
+            document=document, team="lasuite", role=role
+        )
+
+    new_document_values = serializers.LinkDocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/link-configuration/",
+        new_document_values,
+        format="json",
+    )
+    assert response.status_code == 200
+
+    document = models.Document.objects.get(pk=document.pk)
+    document_values = serializers.LinkDocumentSerializer(instance=document).data
+    for key, value in document_values.items():
+        assert value == new_document_values[key]

src/backend/core/tests/documents/test_api_documents_list.py

@@ -2,68 +2,71 @@
 Tests for Documents API endpoint in impress's core app: list
 """
 
+import operator
 from unittest import mock
 
 import pytest
 from faker import Faker
 from rest_framework.pagination import PageNumberPagination
-from rest_framework.status import HTTP_200_OK
 from rest_framework.test import APIClient
 
-from core import factories
+from core import factories, models
 
 fake = Faker()
 pytestmark = pytest.mark.django_db
 
 
-def test_api_documents_list_anonymous():
-    """Anonymous users should only be able to list public documents."""
-    factories.DocumentFactory.create_batch(2, is_public=False)
-    documents = factories.DocumentFactory.create_batch(2, is_public=True)
-    expected_ids = {str(document.id) for document in documents}
+@pytest.mark.parametrize("role", models.LinkRoleChoices.values)
+@pytest.mark.parametrize("reach", models.LinkReachChoices.values)
+def test_api_documents_list_anonymous(reach, role):
+    """
+    Anonymous users should not be allowed to list documents whatever the
+    link reach and the role
+    """
+    factories.DocumentFactory(link_reach=reach, link_role=role)
 
     response = APIClient().get("/api/v1.0/documents/")
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
-    assert len(results) == 2
-    results_id = {result["id"] for result in results}
-    assert expected_ids == results_id
+    assert len(results) == 0
 
 
 def test_api_documents_list_authenticated_direct():
     """
     Authenticated users should be able to list documents they are a direct
-    owner/administrator/member of.
+    owner/administrator/member of or documents that have a link reach other
+    than restricted.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    related_documents = [
+    documents = [
         access.document
-        for access in factories.UserDocumentAccessFactory.create_batch(5, user=user)
+        for access in factories.UserDocumentAccessFactory.create_batch(2, user=user)
     ]
-    public_documents = factories.DocumentFactory.create_batch(2, is_public=True)
-    factories.DocumentFactory.create_batch(2, is_public=False)
 
-    expected_ids = {
-        str(document.id) for document in related_documents + public_documents
-    }
+    # Unrelated and untraced documents
+    for reach in models.LinkReachChoices:
+        for role in models.LinkRoleChoices:
+            factories.DocumentFactory(link_reach=reach, link_role=role)
+
+    expected_ids = {str(document.id) for document in documents}
 
     response = client.get(
         "/api/v1.0/documents/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
-    assert len(results) == 7
+    assert len(results) == 2
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
 
 
-def test_api_documents_list_authenticated_via_team(mock_user_get_teams):
+def test_api_documents_list_authenticated_via_team(mock_user_teams):
     """
     Authenticated users should be able to list documents they are a
     owner/administrator/member of via a team.
@@ -73,7 +76,7 @@ def test_api_documents_list_authenticated_via_team(mock_user_get_teams):
     client = APIClient()
     client.force_login(user)
 
-    mock_user_get_teams.return_value = ["team1", "team2", "unknown"]
+    mock_user_teams.return_value = ["team1", "team2", "unknown"]
 
     documents_team1 = [
         access.document
@@ -83,19 +86,71 @@ def test_api_documents_list_authenticated_via_team(mock_user_get_teams):
         access.document
         for access in factories.TeamDocumentAccessFactory.create_batch(3, team="team2")
     ]
-    public_documents = factories.DocumentFactory.create_batch(2, is_public=True)
-    factories.DocumentFactory.create_batch(2, is_public=False)
 
-    expected_ids = {
-        str(document.id)
-        for document in documents_team1 + documents_team2 + public_documents
-    }
+    expected_ids = {str(document.id) for document in documents_team1 + documents_team2}
 
     response = client.get("/api/v1.0/documents/")
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
-    assert len(results) == 7
+    assert len(results) == 5
+    results_id = {result["id"] for result in results}
+    assert expected_ids == results_id
+
+
+def test_api_documents_list_authenticated_link_reach_restricted():
+    """
+    An authenticated user who has link traces to a document that is restricted should not
+    see it on the list view
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_traces=[user], link_reach="restricted")
+
+    # Link traces for other documents or other users should not interfere
+    models.LinkTrace.objects.create(document=document, user=factories.UserFactory())
+    other_document = factories.DocumentFactory(link_reach="public")
+    models.LinkTrace.objects.create(document=other_document, user=user)
+
+    response = client.get(
+        "/api/v1.0/documents/",
+    )
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    # Only the other document is returned but not the restricted document even though the user
+    # visited it earlier (probably b/c it previously had public or authenticated reach...)
+    assert len(results) == 1
+    assert results[0]["id"] == str(other_document.id)
+
+
+def test_api_documents_list_authenticated_link_reach_public_or_authenticated():
+    """
+    An authenticated user who has link traces to a document with public or authenticated
+    link reach should see it on the list view.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    documents = [
+        factories.DocumentFactory(link_traces=[user], link_reach=reach)
+        for reach in models.LinkReachChoices
+        if reach != "restricted"
+    ]
+    expected_ids = {str(document.id) for document in documents}
+
+    response = client.get(
+        "/api/v1.0/documents/",
+    )
+
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 2
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
 
@@ -120,7 +175,7 @@ def test_api_documents_list_pagination(
         "/api/v1.0/documents/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
 
     assert content["count"] == 3
@@ -136,7 +191,7 @@ def test_api_documents_list_pagination(
         "/api/v1.0/documents/?page=2",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
 
     assert content["count"] == 3
@@ -157,204 +212,63 @@ def test_api_documents_list_authenticated_distinct():
 
     other_user = factories.UserFactory()
 
-    document = factories.DocumentFactory(users=[user, other_user], is_public=True)
+    document = factories.DocumentFactory(users=[user, other_user])
 
     response = client.get(
         "/api/v1.0/documents/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
     assert len(content["results"]) == 1
     assert content["results"][0]["id"] == str(document.id)
 
 
-def test_api_documents_order_created_at_desc():
-    """
-    Test that the endpoint GET documents is sorted in 'created_at' descending order by default.
-    """
+def test_api_documents_list_ordering_default():
+    """Documents should be ordered by descending "updated_at" by default"""
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
-    documents_created = [
-        document.created_at.isoformat().replace("+00:00", "Z")
-        for document in factories.DocumentFactory.create_batch(5, is_public=True)
-    ]
+    factories.DocumentFactory.create_batch(5, users=[user])
 
-    documents_created.sort(reverse=True)
-
-    response = client.get(
-        "/api/v1.0/documents/",
-    )
+    response = client.get("/api/v1.0/documents/")
 
     assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 5
 
-    response_data = response.json()
-    response_document_created = [
-        document["created_at"] for document in response_data["results"]
-    ]
-
-    assert (
-        response_document_created == documents_created
-    ), "created_at values are not sorted from newest to oldest"
+    # Check that results are sorted by descending "updated_at" as expected
+    for i in range(4):
+        assert operator.ge(results[i]["updated_at"], results[i + 1]["updated_at"])
 
 
-def test_api_documents_order_created_at_asc():
-    """
-    Test that the 'created_at' field is sorted in ascending order
-    when the 'ordering' query parameter is set.
-    """
+def test_api_documents_list_ordering_by_fields():
+    """It should be possible to order by several fields"""
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
-    documents_created = [
-        document.created_at.isoformat().replace("+00:00", "Z")
-        for document in factories.DocumentFactory.create_batch(5, is_public=True)
-    ]
+    factories.DocumentFactory.create_batch(5, users=[user])
 
-    documents_created.sort()
+    for parameter in [
+        "created_at",
+        "-created_at",
+        "updated_at",
+        "-updated_at",
+        "title",
+        "-title",
+    ]:
+        is_descending = parameter.startswith("-")
+        field = parameter.lstrip("-")
+        querystring = f"?ordering={parameter}"
 
-    response = client.get(
-        "/api/v1.0/documents/?ordering=created_at",
-    )
+        response = client.get(f"/api/v1.0/documents/{querystring:s}")
+        assert response.status_code == 200
+        results = response.json()["results"]
+        assert len(results) == 5
 
-    assert response.status_code == 200
-
-    response_data = response.json()
-    response_document_created = [
-        document["created_at"] for document in response_data["results"]
-    ]
-
-    assert (
-        response_document_created == documents_created
-    ), "created_at values are not sorted from oldest to newest"
-
-
-def test_api_documents_order_updated_at_desc():
-    """
-    Test that the 'updated_at' field is sorted in descending order
-    when the 'ordering' query parameter is set.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    documents_updated = [
-        document.updated_at.isoformat().replace("+00:00", "Z")
-        for document in factories.DocumentFactory.create_batch(5, is_public=True)
-    ]
-
-    documents_updated.sort(reverse=True)
-
-    response = APIClient().get(
-        "/api/v1.0/documents/?ordering=-updated_at",
-    )
-    assert response.status_code == 200
-
-    response_data = response.json()
-
-    response_document_updated = [
-        document["updated_at"] for document in response_data["results"]
-    ]
-
-    assert (
-        response_document_updated == documents_updated
-    ), "updated_at values are not sorted from newest to oldest"
-
-
-def test_api_documents_order_updated_at_asc():
-    """
-    Test that the 'updated_at' field is sorted in ascending order
-    when the 'ordering' query parameter is set.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    documents_updated = [
-        document.updated_at.isoformat().replace("+00:00", "Z")
-        for document in factories.DocumentFactory.create_batch(5, is_public=True)
-    ]
-
-    documents_updated.sort()
-
-    response = APIClient().get(
-        "/api/v1.0/documents/?ordering=updated_at",
-    )
-    assert response.status_code == 200
-
-    response_data = response.json()
-
-    response_document_updated = [
-        document["updated_at"] for document in response_data["results"]
-    ]
-
-    assert (
-        response_document_updated == documents_updated
-    ), "updated_at values are not sorted from oldest to newest"
-
-
-def test_api_documents_order_title_desc():
-    """
-    Test that the 'title' field is sorted in descending order
-    when the 'ordering' query parameter is set.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    documents_title = [
-        factories.DocumentFactory(is_public=True, title=fake.sentence(nb_words=4)).title
-        for _ in range(5)
-    ]
-
-    documents_title.sort(reverse=True)
-
-    response = APIClient().get(
-        "/api/v1.0/documents/?ordering=-title",
-    )
-    assert response.status_code == 200
-
-    response_data = response.json()
-
-    response_documents_title = [
-        document["title"] for document in response_data["results"]
-    ]
-
-    assert (
-        response_documents_title == documents_title
-    ), "title values are not sorted descending"
-
-
-def test_api_documents_order_title_asc():
-    """
-    Test that the 'title' field is sorted in ascending order
-    when the 'ordering' query parameter is set.
-    """
-    user = factories.UserFactory()
-    client = APIClient()
-    client.force_login(user)
-
-    documents_title = [
-        factories.DocumentFactory(is_public=True, title=fake.sentence(nb_words=4)).title
-        for _ in range(5)
-    ]
-
-    documents_title.sort()
-
-    response = APIClient().get(
-        "/api/v1.0/documents/?ordering=title",
-    )
-    assert response.status_code == 200
-
-    response_data = response.json()
-
-    response_documents_title = [
-        document["title"] for document in response_data["results"]
-    ]
-
-    assert (
-        response_documents_title == documents_title
-    ), "title values are not sorted ascending"
+        # Check that results are sorted by the field in querystring as expected
+        compare = operator.ge if is_descending else operator.le
+        for i in range(4):
+            assert compare(results[i][field], results[i + 1][field])

src/backend/core/tests/documents/test_api_documents_retrieve.py

@@ -5,7 +5,7 @@ Tests for Documents API endpoint in impress's core app: retrieve
 import pytest
 from rest_framework.test import APIClient
 
-from core import factories
+from core import factories, models
 from core.api import serializers
 
 pytestmark = pytest.mark.django_db
@@ -13,7 +13,7 @@ pytestmark = pytest.mark.django_db
 
 def test_api_documents_retrieve_anonymous_public():
     """Anonymous users should be allowed to retrieve public documents."""
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach="public")
 
     response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/")
 
@@ -21,35 +21,42 @@ def test_api_documents_retrieve_anonymous_public():
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
+            "attachment_upload": document.link_role == "editor",
             "destroy": False,
+            "link_configuration": False,
             "manage_accesses": False,
-            "partial_update": False,
+            "partial_update": document.link_role == "editor",
             "retrieve": True,
-            "update": False,
+            "update": document.link_role == "editor",
             "versions_destroy": False,
             "versions_list": False,
             "versions_retrieve": False,
         },
         "accesses": [],
+        "link_reach": "public",
+        "link_role": document.link_role,
         "title": document.title,
-        "is_public": True,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
 
 
-def test_api_documents_retrieve_anonymous_not_public():
+@pytest.mark.parametrize("reach", ["restricted", "authenticated"])
+def test_api_documents_retrieve_anonymous_restricted_or_authenticated(reach):
     """Anonymous users should not be able to retrieve a document that is not public."""
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach=reach)
 
     response = APIClient().get(f"/api/v1.0/documents/{document.id!s}/")
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
 
 
-def test_api_documents_retrieve_authenticated_unrelated_public():
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_retrieve_authenticated_unrelated_public_or_authenticated(reach):
     """
     Authenticated users should be able to retrieve a public document to which they are
     not related.
@@ -59,7 +66,7 @@ def test_api_documents_retrieve_authenticated_unrelated_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=True)
+    document = factories.DocumentFactory(link_reach=reach)
 
     response = client.get(
         f"/api/v1.0/documents/{document.id!s}/",
@@ -68,27 +75,62 @@ def test_api_documents_retrieve_authenticated_unrelated_public():
     assert response.json() == {
         "id": str(document.id),
         "abilities": {
+            "attachment_upload": document.link_role == "editor",
+            "link_configuration": False,
             "destroy": False,
             "manage_accesses": False,
-            "partial_update": False,
+            "partial_update": document.link_role == "editor",
             "retrieve": True,
-            "update": False,
+            "update": document.link_role == "editor",
             "versions_destroy": False,
             "versions_list": False,
             "versions_retrieve": False,
         },
         "accesses": [],
+        "link_reach": reach,
+        "link_role": document.link_role,
         "title": document.title,
-        "is_public": True,
         "content": document.content,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
+    assert (
+        models.LinkTrace.objects.filter(document=document, user=user).exists() is True
+    )
 
 
-def test_api_documents_retrieve_authenticated_unrelated_not_public():
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_retrieve_authenticated_trace_twice(reach):
     """
-    Authenticated users should not be allowed to retrieve a document that is not public and
+    Accessing a document several times should not raise any error even though the
+    trace already exists for this document and user.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory(link_reach=reach)
+    assert (
+        models.LinkTrace.objects.filter(document=document, user=user).exists() is False
+    )
+
+    client.get(
+        f"/api/v1.0/documents/{document.id!s}/",
+    )
+    assert (
+        models.LinkTrace.objects.filter(document=document, user=user).exists() is True
+    )
+
+    # A second visit should not raise any error
+    response = client.get(f"/api/v1.0/documents/{document.id!s}/")
+
+    assert response.status_code == 200
+
+
+def test_api_documents_retrieve_authenticated_unrelated_restricted():
+    """
+    Authenticated users should not be allowed to retrieve a document that is restricted and
     to which they are not related.
     """
     user = factories.UserFactory()
@@ -96,13 +138,15 @@ def test_api_documents_retrieve_authenticated_unrelated_not_public():
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     response = client.get(
         f"/api/v1.0/documents/{document.id!s}/",
     )
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 def test_api_documents_retrieve_authenticated_related_direct():
@@ -150,25 +194,26 @@ def test_api_documents_retrieve_authenticated_related_direct():
         "title": document.title,
         "content": document.content,
         "abilities": document.get_abilities(user),
-        "is_public": document.is_public,
+        "link_reach": document.link_reach,
+        "link_role": document.link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
 
 
-def test_api_documents_retrieve_authenticated_related_team_none(mock_user_get_teams):
+def test_api_documents_retrieve_authenticated_related_team_none(mock_user_teams):
     """
-    Authenticated users should not be able to retrieve a document related to teams in
-    which the user is not.
+    Authenticated users should not be able to retrieve a restricted document related to
+    teams in which the user is not.
     """
-    mock_user_get_teams.return_value = []
+    mock_user_teams.return_value = []
 
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     factories.TeamDocumentAccessFactory(
         document=document, team="readers", role="reader"
@@ -184,8 +229,10 @@ def test_api_documents_retrieve_authenticated_related_team_none(mock_user_get_te
     factories.TeamDocumentAccessFactory()
 
     response = client.get(f"/api/v1.0/documents/{document.id!s}/")
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 @pytest.mark.parametrize(
@@ -198,20 +245,20 @@ def test_api_documents_retrieve_authenticated_related_team_none(mock_user_get_te
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_members(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a document to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     access_reader = factories.TeamDocumentAccessFactory(
         document=document, team="readers", role="reader"
@@ -285,7 +332,8 @@ def test_api_documents_retrieve_authenticated_related_team_members(
         "title": document.title,
         "content": document.content,
         "abilities": document.get_abilities(user),
-        "is_public": False,
+        "link_reach": "restricted",
+        "link_role": document.link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
@@ -300,20 +348,20 @@ def test_api_documents_retrieve_authenticated_related_team_members(
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_administrators(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a document to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     access_reader = factories.TeamDocumentAccessFactory(
         document=document, team="readers", role="reader"
@@ -404,7 +452,8 @@ def test_api_documents_retrieve_authenticated_related_team_administrators(
         "title": document.title,
         "content": document.content,
         "abilities": document.get_abilities(user),
-        "is_public": False,
+        "link_reach": "restricted",
+        "link_role": document.link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }
@@ -420,20 +469,20 @@ def test_api_documents_retrieve_authenticated_related_team_administrators(
     ],
 )
 def test_api_documents_retrieve_authenticated_related_team_owners(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
-    Authenticated users should be allowed to retrieve a document to which they
-    are related via a team whatever the role and see all its accesses.
+    Authenticated users should be allowed to retrieve a restricted document to which
+    they are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach="restricted")
 
     access_reader = factories.TeamDocumentAccessFactory(
         document=document, team="readers", role="reader"
@@ -527,7 +576,8 @@ def test_api_documents_retrieve_authenticated_related_team_owners(
         "title": document.title,
         "content": document.content,
         "abilities": document.get_abilities(user),
-        "is_public": False,
+        "link_reach": "restricted",
+        "link_role": document.link_role,
         "created_at": document.created_at.isoformat().replace("+00:00", "Z"),
         "updated_at": document.updated_at.isoformat().replace("+00:00", "Z"),
     }

src/backend/core/tests/documents/test_api_documents_retrieve_auth.py

@@ -0,0 +1,214 @@
+"""
+Test file uploads API endpoint for users in impress's core app.
+"""
+
+import uuid
+from io import BytesIO
+from urllib.parse import urlparse
+
+from django.conf import settings
+from django.core.files.storage import default_storage
+from django.utils import timezone
+
+import pytest
+import requests
+from rest_framework.test import APIClient
+
+from core import factories
+from core.tests.conftest import TEAM, USER, VIA
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_documents_retrieve_auth_anonymous_public():
+    """Anonymous users should be able to retrieve attachments linked to a public document"""
+    document = factories.DocumentFactory(link_reach="public")
+
+    filename = f"{uuid.uuid4()!s}.jpg"
+    key = f"{document.pk!s}/attachments/{filename:s}"
+
+    default_storage.connection.meta.client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=key,
+        Body=BytesIO(b"my prose"),
+        ContentType="text/plain",
+    )
+
+    original_url = f"http://localhost/media/{key:s}"
+    response = APIClient().get(
+        "/api/v1.0/documents/retrieve-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
+    response = requests.get(
+        file_url,
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content.decode("utf-8") == "my prose"
+
+
+@pytest.mark.parametrize("reach", ["authenticated", "restricted"])
+def test_api_documents_retrieve_auth_anonymous_authenticated_or_restricted(reach):
+    """
+    Anonymous users should not be allowed to retrieve attachments linked to a document
+    with link reach set to authenticated or restricted.
+    """
+    document = factories.DocumentFactory(link_reach=reach)
+
+    filename = f"{uuid.uuid4()!s}.jpg"
+    media_url = f"http://localhost/media/{document.pk!s}/attachments/{filename:s}"
+
+    response = APIClient().get(
+        "/api/v1.0/documents/retrieve-auth/", HTTP_X_ORIGINAL_URL=media_url
+    )
+
+    assert response.status_code == 403
+    assert "Authorization" not in response
+
+
+@pytest.mark.parametrize("reach", ["public", "authenticated"])
+def test_api_documents_retrieve_auth_authenticated_public_or_authenticated(reach):
+    """
+    Authenticated users who are not related to a document should be able to retrieve
+    attachments related to a document with public or authenticated link reach.
+    """
+    document = factories.DocumentFactory(link_reach=reach)
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    filename = f"{uuid.uuid4()!s}.jpg"
+    key = f"{document.pk!s}/attachments/{filename:s}"
+
+    default_storage.connection.meta.client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=key,
+        Body=BytesIO(b"my prose"),
+        ContentType="text/plain",
+    )
+
+    original_url = f"http://localhost/media/{key:s}"
+    response = client.get(
+        "/api/v1.0/documents/retrieve-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
+    response = requests.get(
+        file_url,
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content.decode("utf-8") == "my prose"
+
+
+def test_api_documents_retrieve_auth_authenticated_restricted():
+    """
+    Authenticated users who are not related to a document should not be allowed to
+    retrieve attachments linked to a document that is restricted.
+    """
+    document = factories.DocumentFactory(link_reach="restricted")
+
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    filename = f"{uuid.uuid4()!s}.jpg"
+    media_url = f"http://localhost/media/{document.pk!s}/attachments/{filename:s}"
+
+    response = client.get(
+        "/api/v1.0/documents/retrieve-auth/", HTTP_X_ORIGINAL_URL=media_url
+    )
+
+    assert response.status_code == 403
+    assert "Authorization" not in response
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_retrieve_auth_related(via, mock_user_teams):
+    """
+    Users who have a specific access to a document, whatever the role, should be able to
+    retrieve related attachments.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    document = factories.DocumentFactory()
+    if via == USER:
+        factories.UserDocumentAccessFactory(document=document, user=user)
+    elif via == TEAM:
+        mock_user_teams.return_value = ["lasuite", "unknown"]
+        factories.TeamDocumentAccessFactory(document=document, team="lasuite")
+
+    filename = f"{uuid.uuid4()!s}.jpg"
+    key = f"{document.pk!s}/attachments/{filename:s}"
+
+    default_storage.connection.meta.client.put_object(
+        Bucket=default_storage.bucket_name,
+        Key=key,
+        Body=BytesIO(b"my prose"),
+        ContentType="text/plain",
+    )
+
+    original_url = f"http://localhost/media/{key:s}"
+    response = client.get(
+        "/api/v1.0/documents/retrieve-auth/", HTTP_X_ORIGINAL_URL=original_url
+    )
+
+    assert response.status_code == 200
+
+    authorization = response["Authorization"]
+    assert "AWS4-HMAC-SHA256 Credential=" in authorization
+    assert (
+        "SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature="
+        in authorization
+    )
+    assert response["X-Amz-Date"] == timezone.now().strftime("%Y%m%dT%H%M%SZ")
+
+    s3_url = urlparse(settings.AWS_S3_ENDPOINT_URL)
+    file_url = f"{settings.AWS_S3_ENDPOINT_URL:s}/impress-media-storage/{key:s}"
+    response = requests.get(
+        file_url,
+        headers={
+            "authorization": authorization,
+            "x-amz-date": response["x-amz-date"],
+            "x-amz-content-sha256": response["x-amz-content-sha256"],
+            "Host": f"{s3_url.hostname:s}:{s3_url.port:d}",
+        },
+        timeout=1,
+    )
+    assert response.content.decode("utf-8") == "my prose"

src/backend/core/tests/documents/test_api_documents_update.py

@@ -4,6 +4,8 @@ Tests for Documents API endpoint in impress's core app: update
 
 import random
 
+from django.contrib.auth.models import AnonymousUser
+
 import pytest
 from rest_framework.test import APIClient
 
@@ -14,9 +16,22 @@ from core.tests.conftest import TEAM, USER, VIA
 pytestmark = pytest.mark.django_db
 
 
-def test_api_documents_update_anonymous():
-    """Anonymous users should not be allowed to update a document."""
-    document = factories.DocumentFactory()
+@pytest.mark.parametrize(
+    "reach, role",
+    [
+        ("restricted", "reader"),
+        ("restricted", "editor"),
+        ("authenticated", "reader"),
+        ("authenticated", "editor"),
+        ("public", "reader"),
+    ],
+)
+def test_api_documents_update_anonymous_forbidden(reach, role):
+    """
+    Anonymous users should not be allowed to update a document when link
+    configuration does not allow it.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
     old_document_values = serializers.DocumentSerializer(instance=document).data
 
     new_document_values = serializers.DocumentSerializer(
@@ -37,16 +52,26 @@ def test_api_documents_update_anonymous():
     assert document_values == old_document_values
 
 
-def test_api_documents_update_authenticated_unrelated():
+@pytest.mark.parametrize(
+    "reach,role",
+    [
+        ("public", "reader"),
+        ("authenticated", "reader"),
+        ("restricted", "reader"),
+        ("restricted", "editor"),
+    ],
+)
+def test_api_documents_update_authenticated_unrelated_forbidden(reach, role):
     """
-    Authenticated users should not be allowed to update a document to which they are not related.
+    Authenticated users should not be allowed to update a document to which
+    they are not related if the link configuration does not allow it.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory(is_public=False)
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
     old_document_values = serializers.DocumentSerializer(instance=document).data
 
     new_document_values = serializers.DocumentSerializer(
@@ -58,18 +83,67 @@ def test_api_documents_update_authenticated_unrelated():
         format="json",
     )
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Document matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
     document.refresh_from_db()
     document_values = serializers.DocumentSerializer(instance=document).data
     assert document_values == old_document_values
 
 
-@pytest.mark.parametrize("via", VIA)
-def test_api_documents_update_authenticated_reader(via, mock_user_get_teams):
+@pytest.mark.parametrize(
+    "is_authenticated,reach,role",
+    [
+        (False, "public", "editor"),
+        (True, "public", "editor"),
+        (True, "authenticated", "editor"),
+    ],
+)
+def test_api_documents_update_anonymous_or_authenticated_unrelated(
+    is_authenticated, reach, role
+):
     """
-    Users who are editors or reader of a document but not administrators should
+    Authenticated users should be able to update a document to which
+    they are not related if the link configuration allows it.
+    """
+    client = APIClient()
+
+    if is_authenticated:
+        user = factories.UserFactory()
+        client.force_login(user)
+    else:
+        user = AnonymousUser()
+
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    old_document_values = serializers.DocumentSerializer(instance=document).data
+
+    new_document_values = serializers.DocumentSerializer(
+        instance=factories.DocumentFactory()
+    ).data
+    response = client.put(
+        f"/api/v1.0/documents/{document.id!s}/",
+        new_document_values,
+        format="json",
+    )
+    assert response.status_code == 200
+
+    document = models.Document.objects.get(pk=document.pk)
+    document_values = serializers.DocumentSerializer(instance=document).data
+    for key, value in document_values.items():
+        if key in ["id", "accesses", "created_at", "link_reach", "link_role"]:
+            assert value == old_document_values[key]
+        elif key == "updated_at":
+            assert value > old_document_values[key]
+        else:
+            assert value == new_document_values[key]
+
+
+@pytest.mark.parametrize("via", VIA)
+def test_api_documents_update_authenticated_reader(via, mock_user_teams):
+    """
+    Users who are reader of a document but not administrators should
     not be allowed to update it.
     """
     user = factories.UserFactory()
@@ -77,11 +151,11 @@ def test_api_documents_update_authenticated_reader(via, mock_user_get_teams):
     client = APIClient()
     client.force_login(user)
 
-    document = factories.DocumentFactory()
+    document = factories.DocumentFactory(link_role="reader")
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="reader"
         )
@@ -110,7 +184,7 @@ def test_api_documents_update_authenticated_reader(via, mock_user_get_teams):
 @pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_documents_update_authenticated_editor_administrator_or_owner(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """A user who is editor, administrator or owner of a document should be allowed to update it."""
     user = factories.UserFactory()
@@ -122,7 +196,7 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -142,7 +216,7 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
     document = models.Document.objects.get(pk=document.pk)
     document_values = serializers.DocumentSerializer(instance=document).data
     for key, value in document_values.items():
-        if key in ["id", "accesses", "created_at"]:
+        if key in ["id", "accesses", "created_at", "link_reach", "link_role"]:
             assert value == old_document_values[key]
         elif key == "updated_at":
             assert value > old_document_values[key]
@@ -151,7 +225,7 @@ def test_api_documents_update_authenticated_editor_administrator_or_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_update_authenticated_owners(via, mock_user_get_teams):
+def test_api_documents_update_authenticated_owners(via, mock_user_teams):
     """Administrators of a document should be allowed to update it."""
     user = factories.UserFactory()
 
@@ -162,7 +236,7 @@ def test_api_documents_update_authenticated_owners(via, mock_user_get_teams):
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="owner"
         )
@@ -181,7 +255,7 @@ def test_api_documents_update_authenticated_owners(via, mock_user_get_teams):
     document = models.Document.objects.get(pk=document.pk)
     document_values = serializers.DocumentSerializer(instance=document).data
     for key, value in document_values.items():
-        if key in ["id", "accesses", "created_at"]:
+        if key in ["id", "accesses", "created_at", "link_reach", "link_role"]:
             assert value == old_document_values[key]
         elif key == "updated_at":
             assert value > old_document_values[key]
@@ -190,9 +264,7 @@ def test_api_documents_update_authenticated_owners(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_documents_update_administrator_or_owner_of_another(
-    via, mock_user_get_teams
-):
+def test_api_documents_update_administrator_or_owner_of_another(via, mock_user_teams):
     """
     Being administrator or owner of a document should not grant authorization to update
     another document.
@@ -208,28 +280,27 @@ def test_api_documents_update_administrator_or_owner_of_another(
             document=document, user=user, role=random.choice(["administrator", "owner"])
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document,
             team="lasuite",
             role=random.choice(["administrator", "owner"]),
         )
 
-    is_public = random.choice([True, False])
-    document = factories.DocumentFactory(title="Old title", is_public=is_public)
-    old_document_values = serializers.DocumentSerializer(instance=document).data
+    other_document = factories.DocumentFactory(title="Old title", link_role="reader")
+    old_document_values = serializers.DocumentSerializer(instance=other_document).data
 
     new_document_values = serializers.DocumentSerializer(
         instance=factories.DocumentFactory()
     ).data
     response = client.put(
-        f"/api/v1.0/documents/{document.id!s}/",
+        f"/api/v1.0/documents/{other_document.id!s}/",
         new_document_values,
         format="json",
     )
 
-    assert response.status_code == 403 if is_public else 404
+    assert response.status_code == 403
 
-    document.refresh_from_db()
-    document_values = serializers.DocumentSerializer(instance=document).data
-    assert document_values == old_document_values
+    other_document.refresh_from_db()
+    other_document_values = serializers.DocumentSerializer(instance=other_document).data
+    assert other_document_values == old_document_values

src/backend/core/tests/templates/test_api_templates_delete.py

@@ -49,7 +49,7 @@ def test_api_templates_delete_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor", "administrator"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_templates_delete_authenticated_member_or_administrator(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """
     Authenticated users should not be allowed to delete a template for which they are
@@ -64,7 +64,7 @@ def test_api_templates_delete_authenticated_member_or_administrator(
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -81,7 +81,7 @@ def test_api_templates_delete_authenticated_member_or_administrator(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_delete_authenticated_owner(via, mock_user_get_teams):
+def test_api_templates_delete_authenticated_owner(via, mock_user_teams):
     """
     Authenticated users should be able to delete a template they own.
     """
@@ -94,7 +94,7 @@ def test_api_templates_delete_authenticated_owner(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )

src/backend/core/tests/templates/test_api_templates_generate_document.py

@@ -44,8 +44,10 @@ def test_api_templates_generate_document_anonymous_not_public():
         format="json",
     )
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
 
 
 def test_api_templates_generate_document_authenticated_public():
@@ -87,12 +89,14 @@ def test_api_templates_generate_document_authenticated_not_public():
         format="json",
     )
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_generate_document_related(via, mock_user_get_teams):
+def test_api_templates_generate_document_related(via, mock_user_teams):
     """Users related to a template can generate pdf document."""
     user = factories.UserFactory()
 
@@ -102,7 +106,7 @@ def test_api_templates_generate_document_related(via, mock_user_get_teams):
     if via == USER:
         access = factories.UserTemplateAccessFactory(user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamTemplateAccessFactory(team="lasuite")
 
     data = {"body": "# Test markdown body"}

src/backend/core/tests/templates/test_api_templates_list.py

@@ -6,7 +6,6 @@ from unittest import mock
 
 import pytest
 from rest_framework.pagination import PageNumberPagination
-from rest_framework.status import HTTP_200_OK
 from rest_framework.test import APIClient
 
 from core import factories
@@ -17,12 +16,12 @@ pytestmark = pytest.mark.django_db
 def test_api_templates_list_anonymous():
     """Anonymous users should only be able to list public templates."""
     factories.TemplateFactory.create_batch(2, is_public=False)
-    templates = factories.TemplateFactory.create_batch(2, is_public=True)
-    expected_ids = {str(template.id) for template in templates}
+    public_templates = factories.TemplateFactory.create_batch(2, is_public=True)
+    expected_ids = {str(template.id) for template in public_templates}
 
     response = APIClient().get("/api/v1.0/templates/")
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
     assert len(results) == 2
     results_id = {result["id"] for result in results}
@@ -32,7 +31,7 @@ def test_api_templates_list_anonymous():
 def test_api_templates_list_authenticated_direct():
     """
     Authenticated users should be able to list templates they are a direct
-    owner/administrator/member of.
+    owner/administrator/member of or that are public.
     """
     user = factories.UserFactory()
 
@@ -54,24 +53,24 @@ def test_api_templates_list_authenticated_direct():
         "/api/v1.0/templates/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
     assert len(results) == 7
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
 
 
-def test_api_templates_list_authenticated_via_team(mock_user_get_teams):
+def test_api_templates_list_authenticated_via_team(mock_user_teams):
     """
     Authenticated users should be able to list templates they are a
-    owner/administrator/member of via a team.
+    owner/administrator/member of via a team or that are public.
     """
     user = factories.UserFactory()
 
     client = APIClient()
     client.force_login(user)
 
-    mock_user_get_teams.return_value = ["team1", "team2", "unknown"]
+    mock_user_teams.return_value = ["team1", "team2", "unknown"]
 
     templates_team1 = [
         access.template
@@ -91,7 +90,7 @@ def test_api_templates_list_authenticated_via_team(mock_user_get_teams):
 
     response = client.get("/api/v1.0/templates/")
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     results = response.json()["results"]
     assert len(results) == 7
     results_id = {result["id"] for result in results}
@@ -118,7 +117,7 @@ def test_api_templates_list_pagination(
         "/api/v1.0/templates/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
 
     assert content["count"] == 3
@@ -134,7 +133,7 @@ def test_api_templates_list_pagination(
         "/api/v1.0/templates/?page=2",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
 
     assert content["count"] == 3
@@ -161,26 +160,24 @@ def test_api_templates_list_authenticated_distinct():
         "/api/v1.0/templates/",
     )
 
-    assert response.status_code == HTTP_200_OK
+    assert response.status_code == 200
     content = response.json()
     assert len(content["results"]) == 1
     assert content["results"][0]["id"] == str(template.id)
 
 
-def test_api_templates_order():
-    """
-    Test that the endpoint GET templates is sorted in 'created_at' descending order by default.
-    """
+def test_api_templates_list_order_default():
+    """The templates list should be sorted by 'created_at' in descending order by default."""
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
     template_ids = [
-        str(template.id)
-        for template in factories.TemplateFactory.create_batch(5, is_public=True)
+        str(access.template.id)
+        for access in factories.UserTemplateAccessFactory.create_batch(5, user=user)
     ]
 
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/templates/",
     )
 
@@ -195,21 +192,21 @@ def test_api_templates_order():
     ), "created_at values are not sorted from newest to oldest"
 
 
-def test_api_templates_order_param():
+def test_api_templates_list_order_param():
     """
-    Test that the 'created_at' field is sorted in ascending order
-    when the 'ordering' query parameter is set.
+    The templates list is sorted by 'created_at' in ascending order when setting
+    the "ordering" query parameter.
     """
     user = factories.UserFactory()
     client = APIClient()
     client.force_login(user)
 
     templates_ids = [
-        str(template.id)
-        for template in factories.TemplateFactory.create_batch(5, is_public=True)
+        str(access.template.id)
+        for access in factories.UserTemplateAccessFactory.create_batch(5, user=user)
     ]
 
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/templates/?ordering=created_at",
     )
     assert response.status_code == 200

src/backend/core/tests/templates/test_api_templates_retrieve.py

@@ -41,8 +41,10 @@ def test_api_templates_retrieve_anonymous_not_public():
 
     response = APIClient().get(f"/api/v1.0/templates/{template.id!s}/")
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
 
 
 def test_api_templates_retrieve_authenticated_unrelated_public():
@@ -94,8 +96,10 @@ def test_api_templates_retrieve_authenticated_unrelated_not_public():
     response = client.get(
         f"/api/v1.0/templates/{template.id!s}/",
     )
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 def test_api_templates_retrieve_authenticated_related_direct():
@@ -146,12 +150,12 @@ def test_api_templates_retrieve_authenticated_related_direct():
     }
 
 
-def test_api_templates_retrieve_authenticated_related_team_none(mock_user_get_teams):
+def test_api_templates_retrieve_authenticated_related_team_none(mock_user_teams):
     """
     Authenticated users should not be able to retrieve a template related to teams in
     which the user is not.
     """
-    mock_user_get_teams.return_value = []
+    mock_user_teams.return_value = []
 
     user = factories.UserFactory()
 
@@ -174,8 +178,10 @@ def test_api_templates_retrieve_authenticated_related_team_none(mock_user_get_te
     factories.TeamTemplateAccessFactory()
 
     response = client.get(f"/api/v1.0/templates/{template.id!s}/")
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
 
 @pytest.mark.parametrize(
@@ -188,13 +194,13 @@ def test_api_templates_retrieve_authenticated_related_team_none(mock_user_get_te
     ],
 )
 def test_api_templates_retrieve_authenticated_related_team_readers_or_editors(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a template to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
@@ -287,13 +293,13 @@ def test_api_templates_retrieve_authenticated_related_team_readers_or_editors(
     ],
 )
 def test_api_templates_retrieve_authenticated_related_team_administrators(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a template to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 
@@ -405,13 +411,13 @@ def test_api_templates_retrieve_authenticated_related_team_administrators(
     ],
 )
 def test_api_templates_retrieve_authenticated_related_team_owners(
-    teams, mock_user_get_teams
+    teams, mock_user_teams
 ):
     """
     Authenticated users should be allowed to retrieve a template to which they
     are related via a team whatever the role and see all its accesses.
     """
-    mock_user_get_teams.return_value = teams
+    mock_user_teams.return_value = teams
 
     user = factories.UserFactory()
 

src/backend/core/tests/templates/test_api_templates_update.py

@@ -58,8 +58,10 @@ def test_api_templates_update_authenticated_unrelated():
         format="json",
     )
 
-    assert response.status_code == 404
-    assert response.json() == {"detail": "No Template matches the given query."}
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You do not have permission to perform this action."
+    }
 
     template.refresh_from_db()
     template_values = serializers.TemplateSerializer(instance=template).data
@@ -67,7 +69,7 @@ def test_api_templates_update_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_update_authenticated_readers(via, mock_user_get_teams):
+def test_api_templates_update_authenticated_readers(via, mock_user_teams):
     """
     Users who are readers of a template should not be allowed to update it.
     """
@@ -80,7 +82,7 @@ def test_api_templates_update_authenticated_readers(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="reader")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="reader"
         )
@@ -109,7 +111,7 @@ def test_api_templates_update_authenticated_readers(via, mock_user_get_teams):
 @pytest.mark.parametrize("role", ["editor", "administrator", "owner"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_templates_update_authenticated_editor_or_administrator_or_owner(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Administrator or owner of a template should be allowed to update it."""
     user = factories.UserFactory()
@@ -121,7 +123,7 @@ def test_api_templates_update_authenticated_editor_or_administrator_or_owner(
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -148,7 +150,7 @@ def test_api_templates_update_authenticated_editor_or_administrator_or_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_update_authenticated_owners(via, mock_user_get_teams):
+def test_api_templates_update_authenticated_owners(via, mock_user_teams):
     """Administrators of a template should be allowed to update it."""
     user = factories.UserFactory()
 
@@ -159,7 +161,7 @@ def test_api_templates_update_authenticated_owners(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -185,9 +187,7 @@ def test_api_templates_update_authenticated_owners(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_templates_update_administrator_or_owner_of_another(
-    via, mock_user_get_teams
-):
+def test_api_templates_update_administrator_or_owner_of_another(via, mock_user_teams):
     """
     Being administrator or owner of a template should not grant authorization to update
     another template.
@@ -203,7 +203,7 @@ def test_api_templates_update_administrator_or_owner_of_another(
             template=template, user=user, role=random.choice(["administrator", "owner"])
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template,
             team="lasuite",

src/backend/core/tests/test_api_template_accesses.py

@@ -57,7 +57,7 @@ def test_api_template_accesses_list_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_list_authenticated_related(via, mock_user_get_teams):
+def test_api_template_accesses_list_authenticated_related(via, mock_user_teams):
     """
     Authenticated users should be able to list template accesses for a template
     to which they are directly related, whatever their role in the template.
@@ -76,7 +76,7 @@ def test_api_template_accesses_list_authenticated_related(via, mock_user_get_tea
             role=random.choice(models.RoleChoices.choices)[0],
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         user_access = models.TemplateAccess.objects.create(
             template=template,
             team="lasuite",
@@ -178,7 +178,7 @@ def test_api_template_accesses_retrieve_authenticated_unrelated():
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_get_teams):
+def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_teams):
     """
     A user who is related to a template should be allowed to retrieve the
     associated template user accesses.
@@ -192,7 +192,7 @@ def test_api_template_accesses_retrieve_authenticated_related(via, mock_user_get
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(template=template, team="lasuite")
 
     access = factories.UserTemplateAccessFactory(template=template)
@@ -261,7 +261,7 @@ def test_api_template_accesses_create_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_template_accesses_create_authenticated_editor_or_reader(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Editors or readers of a template should not be allowed to create template accesses."""
     user = factories.UserFactory()
@@ -273,7 +273,7 @@ def test_api_template_accesses_create_authenticated_editor_or_reader(
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -296,9 +296,7 @@ def test_api_template_accesses_create_authenticated_editor_or_reader(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_create_authenticated_administrator(
-    via, mock_user_get_teams
-):
+def test_api_template_accesses_create_authenticated_administrator(via, mock_user_teams):
     """
     Administrators of a template should be able to create template accesses
     except for the "owner" role.
@@ -314,7 +312,7 @@ def test_api_template_accesses_create_authenticated_administrator(
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -363,7 +361,7 @@ def test_api_template_accesses_create_authenticated_administrator(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_create_authenticated_owner(via, mock_user_get_teams):
+def test_api_template_accesses_create_authenticated_owner(via, mock_user_teams):
     """
     Owners of a template should be able to create template accesses whatever the role.
     """
@@ -376,7 +374,7 @@ def test_api_template_accesses_create_authenticated_owner(via, mock_user_get_tea
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -466,7 +464,7 @@ def test_api_template_accesses_update_authenticated_unrelated():
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
 def test_api_template_accesses_update_authenticated_editor_or_reader(
-    via, role, mock_user_get_teams
+    via, role, mock_user_teams
 ):
     """Editors or readers of a template should not be allowed to update its accesses."""
     user = factories.UserFactory()
@@ -478,7 +476,7 @@ def test_api_template_accesses_update_authenticated_editor_or_reader(
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -506,9 +504,7 @@ def test_api_template_accesses_update_authenticated_editor_or_reader(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_administrator_except_owner(
-    via, mock_user_get_teams
-):
+def test_api_template_accesses_update_administrator_except_owner(via, mock_user_teams):
     """
     A user who is a direct administrator in a template should be allowed to update a user
     access for this template, as long as they don't try to set the role to owner.
@@ -524,7 +520,7 @@ def test_api_template_accesses_update_administrator_except_owner(
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -565,9 +561,7 @@ def test_api_template_accesses_update_administrator_except_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_administrator_from_owner(
-    via, mock_user_get_teams
-):
+def test_api_template_accesses_update_administrator_from_owner(via, mock_user_teams):
     """
     A user who is an administrator in a template, should not be allowed to update
     the user access of an "owner" for this template.
@@ -583,7 +577,7 @@ def test_api_template_accesses_update_administrator_from_owner(
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -614,7 +608,7 @@ def test_api_template_accesses_update_administrator_from_owner(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_administrator_to_owner(via, mock_user_get_teams):
+def test_api_template_accesses_update_administrator_to_owner(via, mock_user_teams):
     """
     A user who is an administrator in a template, should not be allowed to update
     the user access of another user to grant template ownership.
@@ -630,7 +624,7 @@ def test_api_template_accesses_update_administrator_to_owner(via, mock_user_get_
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -668,7 +662,7 @@ def test_api_template_accesses_update_administrator_to_owner(via, mock_user_get_
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_owner(via, mock_user_get_teams):
+def test_api_template_accesses_update_owner(via, mock_user_teams):
     """
     A user who is an owner in a template should be allowed to update
     a user access for this template whatever the role.
@@ -682,7 +676,7 @@ def test_api_template_accesses_update_owner(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -724,7 +718,7 @@ def test_api_template_accesses_update_owner(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_update_owner_self(via, mock_user_get_teams):
+def test_api_template_accesses_update_owner_self(via, mock_user_teams):
     """
     A user who is owner of a template should be allowed to update
     their own user access provided there are other owners in the template.
@@ -741,7 +735,7 @@ def test_api_template_accesses_update_owner_self(via, mock_user_get_teams):
             template=template, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -810,7 +804,7 @@ def test_api_template_accesses_delete_authenticated():
 
 @pytest.mark.parametrize("role", ["reader", "editor"])
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_get_teams):
+def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_teams):
     """
     Authenticated users should not be allowed to delete a template access for a
     template in which they are a simple editor or reader.
@@ -824,7 +818,7 @@ def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_get_
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role=role
         )
@@ -844,7 +838,7 @@ def test_api_template_accesses_delete_editor_or_reader(via, role, mock_user_get_
 
 @pytest.mark.parametrize("via", VIA)
 def test_api_template_accesses_delete_administrators_except_owners(
-    via, mock_user_get_teams
+    via, mock_user_teams
 ):
     """
     Users who are administrators in a template should be allowed to delete an access
@@ -861,7 +855,7 @@ def test_api_template_accesses_delete_administrators_except_owners(
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -882,7 +876,7 @@ def test_api_template_accesses_delete_administrators_except_owners(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_get_teams):
+def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_teams):
     """
     Users who are administrators in a template should not be allowed to delete an ownership
     access from the template.
@@ -898,7 +892,7 @@ def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_get
             template=template, user=user, role="administrator"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="administrator"
         )
@@ -917,7 +911,7 @@ def test_api_template_accesses_delete_administrator_on_owners(via, mock_user_get
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_delete_owners(via, mock_user_get_teams):
+def test_api_template_accesses_delete_owners(via, mock_user_teams):
     """
     Users should be able to delete the template access of another user
     for a template of which they are owner.
@@ -931,7 +925,7 @@ def test_api_template_accesses_delete_owners(via, mock_user_get_teams):
     if via == USER:
         factories.UserTemplateAccessFactory(template=template, user=user, role="owner")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )
@@ -950,7 +944,7 @@ def test_api_template_accesses_delete_owners(via, mock_user_get_teams):
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_api_template_accesses_delete_owners_last_owner(via, mock_user_get_teams):
+def test_api_template_accesses_delete_owners_last_owner(via, mock_user_teams):
     """
     It should not be possible to delete the last owner access from a template
     """
@@ -966,7 +960,7 @@ def test_api_template_accesses_delete_owners_last_owner(via, mock_user_get_teams
             template=template, user=user, role="owner"
         )
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         access = factories.TeamTemplateAccessFactory(
             template=template, team="lasuite", role="owner"
         )

src/backend/core/tests/test_models_documents.py

@@ -27,15 +27,15 @@ def test_models_documents_id_unique():
 
 
 def test_models_documents_title_null():
-    """The "title" field should not be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null."):
-        models.Document.objects.create(title=None)
+    """The "title" field can be null."""
+    document = models.Document.objects.create(title=None)
+    assert document.title is None
 
 
 def test_models_documents_title_empty():
-    """The "title" field should not be empty."""
-    with pytest.raises(ValidationError, match="This field cannot be blank."):
-        models.Document.objects.create(title="")
+    """The "title" field can be empty."""
+    document = models.Document.objects.create(title="")
+    assert document.title == ""
 
 
 def test_models_documents_title_max_length():
@@ -57,64 +57,93 @@ def test_models_documents_file_key():
 # get_abilities
 
 
-def test_models_documents_get_abilities_anonymous_public():
-    """Check abilities returned for an anonymous user if the document is public."""
-    document = factories.DocumentFactory(is_public=True)
-    abilities = document.get_abilities(AnonymousUser())
+@pytest.mark.parametrize(
+    "is_authenticated,reach,role",
+    [
+        (True, "restricted", "reader"),
+        (True, "restricted", "editor"),
+        (False, "restricted", "reader"),
+        (False, "restricted", "editor"),
+        (False, "authenticated", "reader"),
+        (False, "authenticated", "editor"),
+    ],
+)
+def test_models_documents_get_abilities_forbidden(is_authenticated, reach, role):
+    """
+    Check abilities returned for a document giving insufficient roles to link holders
+    i.e anonymous users or authenticated users who have no specific role on the document.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role=role)
+    user = factories.UserFactory() if is_authenticated else AnonymousUser()
+    abilities = document.get_abilities(user)
     assert abilities == {
+        "attachment_upload": False,
+        "link_configuration": False,
         "destroy": False,
-        "retrieve": True,
-        "update": False,
         "manage_accesses": False,
         "partial_update": False,
-        "versions_destroy": False,
-        "versions_list": False,
-        "versions_retrieve": False,
-    }
-
-
-def test_models_documents_get_abilities_anonymous_not_public():
-    """Check abilities returned for an anonymous user if the document is private."""
-    document = factories.DocumentFactory(is_public=False)
-    abilities = document.get_abilities(AnonymousUser())
-    assert abilities == {
-        "destroy": False,
         "retrieve": False,
         "update": False,
-        "manage_accesses": False,
-        "partial_update": False,
         "versions_destroy": False,
         "versions_list": False,
         "versions_retrieve": False,
     }
 
 
-def test_models_documents_get_abilities_authenticated_unrelated_public():
-    """Check abilities returned for an authenticated user if the user is public."""
-    document = factories.DocumentFactory(is_public=True)
-    abilities = document.get_abilities(factories.UserFactory())
+@pytest.mark.parametrize(
+    "is_authenticated,reach",
+    [
+        (True, "public"),
+        (False, "public"),
+        (True, "authenticated"),
+    ],
+)
+def test_models_documents_get_abilities_reader(is_authenticated, reach):
+    """
+    Check abilities returned for a document giving reader role to link holders
+    i.e anonymous users or authenticated users who have no specific role on the document.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role="reader")
+    user = factories.UserFactory() if is_authenticated else AnonymousUser()
+    abilities = document.get_abilities(user)
     assert abilities == {
+        "attachment_upload": False,
         "destroy": False,
+        "link_configuration": False,
+        "manage_accesses": False,
+        "partial_update": False,
         "retrieve": True,
         "update": False,
-        "manage_accesses": False,
-        "partial_update": False,
         "versions_destroy": False,
         "versions_list": False,
         "versions_retrieve": False,
     }
 
 
-def test_models_documents_get_abilities_authenticated_unrelated_not_public():
-    """Check abilities returned for an authenticated user if the document is private."""
-    document = factories.DocumentFactory(is_public=False)
-    abilities = document.get_abilities(factories.UserFactory())
+@pytest.mark.parametrize(
+    "is_authenticated,reach",
+    [
+        (True, "public"),
+        (False, "public"),
+        (True, "authenticated"),
+    ],
+)
+def test_models_documents_get_abilities_editor(is_authenticated, reach):
+    """
+    Check abilities returned for a document giving editor role to link holders
+    i.e anonymous users or authenticated users who have no specific role on the document.
+    """
+    document = factories.DocumentFactory(link_reach=reach, link_role="editor")
+    user = factories.UserFactory() if is_authenticated else AnonymousUser()
+    abilities = document.get_abilities(user)
     assert abilities == {
+        "attachment_upload": True,
         "destroy": False,
-        "retrieve": False,
-        "update": False,
+        "link_configuration": False,
         "manage_accesses": False,
-        "partial_update": False,
+        "partial_update": True,
+        "retrieve": True,
+        "update": True,
         "versions_destroy": False,
         "versions_list": False,
         "versions_retrieve": False,
@@ -127,11 +156,13 @@ def test_models_documents_get_abilities_owner():
     access = factories.UserDocumentAccessFactory(role="owner", user=user)
     abilities = access.document.get_abilities(access.user)
     assert abilities == {
+        "attachment_upload": True,
         "destroy": True,
-        "retrieve": True,
-        "update": True,
+        "link_configuration": True,
         "manage_accesses": True,
         "partial_update": True,
+        "retrieve": True,
+        "update": True,
         "versions_destroy": True,
         "versions_list": True,
         "versions_retrieve": True,
@@ -143,11 +174,13 @@ def test_models_documents_get_abilities_administrator():
     access = factories.UserDocumentAccessFactory(role="administrator")
     abilities = access.document.get_abilities(access.user)
     assert abilities == {
+        "attachment_upload": True,
         "destroy": False,
-        "retrieve": True,
-        "update": True,
+        "link_configuration": True,
         "manage_accesses": True,
         "partial_update": True,
+        "retrieve": True,
+        "update": True,
         "versions_destroy": True,
         "versions_list": True,
         "versions_retrieve": True,
@@ -162,11 +195,13 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
+        "attachment_upload": True,
         "destroy": False,
-        "retrieve": True,
-        "update": True,
+        "link_configuration": False,
         "manage_accesses": False,
         "partial_update": True,
+        "retrieve": True,
+        "update": True,
         "versions_destroy": False,
         "versions_list": True,
         "versions_retrieve": True,
@@ -175,17 +210,21 @@ def test_models_documents_get_abilities_editor_user(django_assert_num_queries):
 
 def test_models_documents_get_abilities_reader_user(django_assert_num_queries):
     """Check abilities returned for the reader of a document."""
-    access = factories.UserDocumentAccessFactory(role="reader")
+    access = factories.UserDocumentAccessFactory(
+        role="reader", document__link_role="reader"
+    )
 
     with django_assert_num_queries(1):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
+        "attachment_upload": False,
         "destroy": False,
-        "retrieve": True,
-        "update": False,
+        "link_configuration": False,
         "manage_accesses": False,
         "partial_update": False,
+        "retrieve": True,
+        "update": False,
         "versions_destroy": False,
         "versions_list": True,
         "versions_retrieve": True,
@@ -194,18 +233,22 @@ def test_models_documents_get_abilities_reader_user(django_assert_num_queries):
 
 def test_models_documents_get_abilities_preset_role(django_assert_num_queries):
     """No query is done if the role is preset e.g. with query annotation."""
-    access = factories.UserDocumentAccessFactory(role="reader")
+    access = factories.UserDocumentAccessFactory(
+        role="reader", document__link_role="reader"
+    )
     access.document.user_roles = ["reader"]
 
     with django_assert_num_queries(0):
         abilities = access.document.get_abilities(access.user)
 
     assert abilities == {
+        "attachment_upload": False,
         "destroy": False,
-        "retrieve": True,
-        "update": False,
+        "link_configuration": False,
         "manage_accesses": False,
         "partial_update": False,
+        "retrieve": True,
+        "update": False,
         "versions_destroy": False,
         "versions_list": True,
         "versions_retrieve": True,
@@ -217,7 +260,7 @@ def test_models_documents_get_versions_slice(settings):
     The "get_versions_slice" method should allow navigating all versions of
     the document with pagination.
     """
-    settings.S3_VERSIONS_PAGE_SIZE = 4
+    settings.DOCUMENT_VERSIONS_PAGE_SIZE = 4
 
     # Create a document with 7 versions
     document = factories.DocumentFactory()

src/backend/core/tests/test_models_invitations.py

@@ -189,7 +189,7 @@ def test_models_document_invitations_get_abilities_authenticated():
 @pytest.mark.parametrize("via", VIA)
 @pytest.mark.parametrize("role", ["administrator", "owner"])
 def test_models_document_invitations_get_abilities_privileged_member(
-    role, via, mock_user_get_teams
+    role, via, mock_user_teams
 ):
     """Check abilities for a document member with a privileged role."""
 
@@ -198,7 +198,7 @@ def test_models_document_invitations_get_abilities_privileged_member(
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role=role)
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role=role
         )
@@ -217,7 +217,7 @@ def test_models_document_invitations_get_abilities_privileged_member(
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_models_document_invitations_get_abilities_reader(via, mock_user_get_teams):
+def test_models_document_invitations_get_abilities_reader(via, mock_user_teams):
     """Check abilities for a document reader with 'reader' role."""
 
     user = factories.UserFactory()
@@ -225,7 +225,7 @@ def test_models_document_invitations_get_abilities_reader(via, mock_user_get_tea
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="reader")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="reader"
         )
@@ -242,7 +242,7 @@ def test_models_document_invitations_get_abilities_reader(via, mock_user_get_tea
 
 
 @pytest.mark.parametrize("via", VIA)
-def test_models_document_invitations_get_abilities_editor(via, mock_user_get_teams):
+def test_models_document_invitations_get_abilities_editor(via, mock_user_teams):
     """Check abilities for a document editor with 'editor' role."""
 
     user = factories.UserFactory()
@@ -250,7 +250,7 @@ def test_models_document_invitations_get_abilities_editor(via, mock_user_get_tea
     if via == USER:
         factories.UserDocumentAccessFactory(document=document, user=user, role="editor")
     elif via == TEAM:
-        mock_user_get_teams.return_value = ["lasuite", "unknown"]
+        mock_user_teams.return_value = ["lasuite", "unknown"]
         factories.TeamDocumentAccessFactory(
             document=document, team="lasuite", role="editor"
         )

src/backend/demo/management/commands/create_demo.py

@@ -130,7 +130,9 @@ def create_demo(stdout):
             queue.push(
                 models.Document(
                     title=fake.sentence(nb_words=4),
-                    is_public=random_true_with_probability(0.5),
+                    link_reach=models.LinkReachChoices.AUTHENTICATED
+                    if random_true_with_probability(0.5)
+                    else random.choice(models.LinkReachChoices.values),
                 )
             )
 

src/backend/impress/settings.py

@@ -138,7 +138,24 @@ class Base(Configuration):
         environ_prefix=None,
     )
 
-    S3_VERSIONS_PAGE_SIZE = 50
+    # Document images
+    DOCUMENT_IMAGE_MAX_SIZE = values.Value(
+        10 * (2**20),  # 10MB
+        environ_name="DOCUMENT_IMAGE_MAX_SIZE",
+        environ_prefix=None,
+    )
+    DOCUMENT_IMAGE_ALLOWED_MIME_TYPES = [
+        "image/bmp",
+        "image/gif",
+        "image/jpeg",
+        "image/png",
+        "image/svg+xml",
+        "image/tiff",
+        "image/webp",
+    ]
+
+    # Document versions
+    DOCUMENT_VERSIONS_PAGE_SIZE = 50
 
     # Internationalization
     # https://docs.djangoproject.com/en/3.1/topics/i18n/
@@ -297,6 +314,7 @@ class Base(Configuration):
     # Easy thumbnails
     THUMBNAIL_EXTENSION = "webp"
     THUMBNAIL_TRANSPARENCY_EXTENSION = "webp"
+    THUMBNAIL_DEFAULT_STORAGE_ALIAS = "default"
     THUMBNAIL_ALIASES = {}
 
     # Celery

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "impress"
-version = "1.2.0"
+version = "1.3.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -25,7 +25,7 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "boto3==1.35.0",
+    "boto3==1.35.10",
     "Brotli==1.1.0",
     "celery[redis]==5.4.0",
     "django-configurations==2.5.1",
@@ -34,9 +34,9 @@ dependencies = [
     "django-parler==2.3",
     "redis==5.0.8",
     "django-redis==5.4.0",
-    "django-storages[s3]==1.14.2",
+    "django-storages[s3]==1.14.4",
     "django-timezone-field>=5.1",
-    "django==5.0.8",
+    "django==5.1",
     "djangorestframework==3.15.2",
     "drf_spectacular==0.27.2",
     "dockerflow==2024.4.2",
@@ -70,17 +70,17 @@ dev = [
     "django-extensions==3.2.3",
     "drf-spectacular-sidecar==2024.7.1",
     "ipdb==0.13.13",
-    "ipython==8.26.0",
+    "ipython==8.27.0",
     "pyfakefs==5.6.0",
     "pylint-django==2.5.5",
-    "pylint==3.2.6",
+    "pylint==3.2.7",
     "pytest-cov==5.0.0",
-    "pytest-django==4.8.0",
+    "pytest-django==4.9.0",
     "pytest==8.3.2",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.6.1",
     "responses==0.25.3",
-    "ruff==0.6.1",
+    "ruff==0.6.3",
     "types-requests==2.32.0.20240712",
 ]
 

src/frontend/Dockerfile

@@ -1,10 +1,10 @@
-FROM node:20-alpine as frontend-deps-y-webrtc-signaling
+FROM node:20-alpine as frontend-deps-y-provider
 
 WORKDIR /home/frontend/
 
 COPY ./src/frontend/package.json ./package.json
 COPY ./src/frontend/yarn.lock ./yarn.lock
-COPY ./src/frontend/apps/y-webrtc-signaling/package.json ./apps/y-webrtc-signaling/package.json
+COPY ./src/frontend/servers/y-provider/package.json ./servers/y-provider/package.json
 COPY ./src/frontend/packages/eslint-config-impress/package.json ./packages/eslint-config-impress/package.json
 
 RUN yarn install
@@ -14,10 +14,10 @@ COPY ./src/frontend/ .
 # Copy entrypoint
 COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
 
-# ---- y-webrtc-signaling ----
-FROM frontend-deps-y-webrtc-signaling as y-webrtc-signaling
+# ---- y-provider ----
+FROM frontend-deps-y-provider as y-provider
 
-WORKDIR /home/frontend/apps/y-webrtc-signaling
+WORKDIR /home/frontend/servers/y-provider
 RUN yarn build
 
 # Un-privileged user running the application
@@ -64,8 +64,8 @@ WORKDIR /home/frontend/apps/impress
 ARG FRONTEND_THEME
 ENV NEXT_PUBLIC_THEME=${FRONTEND_THEME}
 
-ARG SIGNALING_URL
-ENV NEXT_PUBLIC_SIGNALING_URL=${SIGNALING_URL}
+ARG Y_PROVIDER_URL
+ENV NEXT_PUBLIC_Y_PROVIDER_URL=${Y_PROVIDER_URL}
 
 ARG API_ORIGIN
 ENV NEXT_PUBLIC_API_ORIGIN=${API_ORIGIN}

src/frontend/apps/e2e/__tests__/app-impress/common.ts

@@ -55,14 +55,25 @@ export const createDoc = async (
       })
       .fill(randomDocs[i]);
 
-    if (isPublic) {
-      await page.getByText('Is it public ?').click();
-    }
-
     await expect(buttonCreate).toBeEnabled();
     await buttonCreate.click();
 
     await expect(page.locator('h2').getByText(randomDocs[i])).toBeVisible();
+
+    if (isPublic) {
+      await page.getByRole('button', { name: 'Share' }).click();
+      await page.getByText('Doc private').click();
+
+      await page.locator('.c__modal__backdrop').click({
+        position: { x: 0, y: 0 },
+      });
+
+      await expect(
+        page
+          .getByLabel('It is the card information about the document.')
+          .getByText('Public'),
+      ).toBeVisible();
+    }
   }
 
   return randomDocs;
@@ -153,6 +164,7 @@ export const mockedDocument = async (page: Page, json: object) => {
           accesses: [],
           abilities: {
             destroy: false, // Means not owner
+            link_configuration: false,
             versions_destroy: false,
             versions_list: true,
             versions_retrieve: true,
@@ -161,7 +173,7 @@ export const mockedDocument = async (page: Page, json: object) => {
             partial_update: false, // Means not editor
             retrieve: true,
           },
-          is_public: false,
+          link_reach: 'restricted',
           created_at: '2021-09-01T09:00:00Z',
           ...json,
         },

src/frontend/apps/e2e/__tests__/app-impress/doc-create.spec.ts

@@ -21,8 +21,6 @@ test.describe('Doc Create', () => {
     ).toBeVisible();
     await expect(card.getByLabel('Document name')).toBeVisible();
 
-    await expect(card.getByText('Is it public ?')).toBeVisible();
-
     await expect(
       card.getByRole('button', {
         name: 'Create the document',
@@ -46,13 +44,11 @@ test.describe('Doc Create', () => {
     await expect(buttonCreateHomepage).toBeVisible();
   });
 
-  test('create a new public doc', async ({ page, browserName }) => {
-    const [docTitle] = await createDoc(
-      page,
-      'My new doc',
-      browserName,
-      1,
-      true,
+  test('it creates a doc', async ({ page, browserName }) => {
+    const [docTitle] = await createDoc(page, 'My new doc', browserName, 1);
+
+    expect(await page.locator('title').textContent()).toMatch(
+      /My new doc - Docs/,
     );
 
     const header = page.locator('header').first();
@@ -65,11 +61,5 @@ test.describe('Doc Create', () => {
     await expect(datagrid.getByLabel('Loading data')).toBeHidden();
 
     await expect(datagrid.getByText(docTitle)).toBeVisible();
-
-    const row = datagrid.getByRole('row').filter({
-      hasText: docTitle,
-    });
-
-    await expect(row.getByRole('cell').nth(0)).toHaveText('Public');
   });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts

@@ -1,3 +1,5 @@
+import path from 'path';
+
 import { expect, test } from '@playwright/test';
 
 import { createDoc, goToGridDoc, mockedDocument } from './common';
@@ -7,7 +9,7 @@ test.beforeEach(async ({ page }) => {
 });
 
 test.describe('Doc Editor', () => {
-  test('checks the Doc is connected to the webrtc server', async ({
+  test('checks the Doc is connected to the provider server', async ({
     page,
     browserName,
   }) => {
@@ -27,12 +29,7 @@ test.describe('Doc Editor', () => {
     await page.locator('.ProseMirror.bn-editor').fill('Hello World');
 
     const framesent = await framesentPromise;
-    const payload = JSON.parse(framesent.payload as string) as {
-      type: string;
-    };
-
-    const typeCases = ['publish', 'subscribe', 'unsubscribe', 'ping'];
-    expect(typeCases.includes(payload.type)).toBeTruthy();
+    expect(framesent.payload).not.toBeNull();
   });
 
   test('markdown button converts from markdown to the editor syntax json', async ({
@@ -104,10 +101,6 @@ test.describe('Doc Editor', () => {
       nthRow: 2,
     });
 
-    await expect(
-      page.getByText(`Your document "${doc}" has been saved.`),
-    ).toBeVisible();
-
     await expect(page.locator('h2').getByText(secondDoc)).toBeVisible();
 
     await goToGridDoc(page, {
@@ -143,6 +136,7 @@ test.describe('Doc Editor', () => {
     await mockedDocument(page, {
       abilities: {
         destroy: false, // Means not owner
+        link_configuration: false,
         versions_destroy: false,
         versions_list: true,
         versions_retrieve: true,
@@ -159,4 +153,31 @@ test.describe('Doc Editor', () => {
       page.getByText('Read only, you cannot edit this document.'),
     ).toBeVisible();
   });
+
+  test('it adds an image to the doc editor', async ({ page }) => {
+    await goToGridDoc(page);
+
+    const fileChooserPromise = page.waitForEvent('filechooser');
+
+    await page.locator('.bn-block-outer').last().fill('Hello World');
+
+    await page.keyboard.press('Enter');
+    await page.locator('.bn-block-outer').last().fill('/');
+    await page.getByText('Resizable image with caption').click();
+    await page.getByText('Upload image').click();
+
+    const fileChooser = await fileChooserPromise;
+    await fileChooser.setFiles(
+      path.join(__dirname, 'assets/logo-suite-numerique.png'),
+    );
+
+    const image = page.getByRole('img', { name: 'logo-suite-numerique.png' });
+
+    await expect(image).toBeVisible();
+
+    // Check src of image
+    expect(await image.getAttribute('src')).toMatch(
+      /http:\/\/localhost:8083\/media\/.*\/attachments\/.*.png/,
+    );
+  });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-export.spec.ts

@@ -175,6 +175,11 @@ test.describe('Doc Export', () => {
         name: 'Image',
       })
       .click();
+    await page
+      .getByRole('tab', {
+        name: 'Embed',
+      })
+      .click();
     await page
       .getByPlaceholder('Enter URL')
       .fill('https://example.com/image.jpg');

src/frontend/apps/e2e/__tests__/app-impress/doc-grid.spec.ts

@@ -49,111 +49,130 @@ test.describe('Documents Grid', () => {
       nameColumn: 'Document name',
       ordering: 'title',
       cellNumber: 1,
+      orderDefault: '',
+      orderDesc: '&ordering=-title',
+      orderAsc: '&ordering=title',
     },
     {
       nameColumn: 'Created at',
       ordering: 'created_at',
       cellNumber: 2,
+      orderDefault: '',
+      orderDesc: '&ordering=-created_at',
+      orderAsc: '&ordering=created_at',
     },
     {
       nameColumn: 'Updated at',
       ordering: 'updated_at',
       cellNumber: 3,
+      orderDefault: '&ordering=-updated_at',
+      orderDesc: '&ordering=updated_at',
+      orderAsc: '',
     },
-  ].forEach(({ nameColumn, ordering, cellNumber }) => {
-    test(`checks datagrid ordering ${ordering}`, async ({ page }) => {
-      const responsePromise = page.waitForResponse(
-        (response) =>
-          response.url().includes(`/documents/?page=1`) &&
-          response.status() === 200,
-      );
+  ].forEach(
+    ({
+      nameColumn,
+      ordering,
+      cellNumber,
+      orderDefault,
+      orderDesc,
+      orderAsc,
+    }) => {
+      test(`checks datagrid ordering ${ordering}`, async ({ page }) => {
+        const responsePromise = page.waitForResponse(
+          (response) =>
+            response.url().includes(`/documents/?page=1${orderDefault}`) &&
+            response.status() === 200,
+        );
 
-      const responsePromiseOrderingDesc = page.waitForResponse(
-        (response) =>
-          response.url().includes(`/documents/?page=1&ordering=-${ordering}`) &&
-          response.status() === 200,
-      );
+        const responsePromiseOrderingDesc = page.waitForResponse(
+          (response) =>
+            response.url().includes(`/documents/?page=1${orderDesc}`) &&
+            response.status() === 200,
+        );
 
-      const responsePromiseOrderingAsc = page.waitForResponse(
-        (response) =>
-          response.url().includes(`/documents/?page=1&ordering=${ordering}`) &&
-          response.status() === 200,
-      );
+        const responsePromiseOrderingAsc = page.waitForResponse(
+          (response) =>
+            response.url().includes(`/documents/?page=1${orderAsc}`) &&
+            response.status() === 200,
+        );
 
-      const datagrid = page
-        .getByLabel('Datagrid of the documents page 1')
-        .getByRole('table');
-      const thead = datagrid.locator('thead');
+        // Checks the initial state
+        const datagrid = page
+          .getByLabel('Datagrid of the documents page 1')
+          .getByRole('table');
+        const thead = datagrid.locator('thead');
 
-      const response = await responsePromise;
-      expect(response.ok()).toBeTruthy();
+        const response = await responsePromise;
+        expect(response.ok()).toBeTruthy();
 
-      const docNameRow1 = datagrid
-        .getByRole('row')
-        .nth(1)
-        .getByRole('cell')
-        .nth(cellNumber);
-      const docNameRow2 = datagrid
-        .getByRole('row')
-        .nth(2)
-        .getByRole('cell')
-        .nth(cellNumber);
+        const docNameRow1 = datagrid
+          .getByRole('row')
+          .nth(1)
+          .getByRole('cell')
+          .nth(cellNumber);
+        const docNameRow2 = datagrid
+          .getByRole('row')
+          .nth(2)
+          .getByRole('cell')
+          .nth(cellNumber);
 
-      await expect(datagrid.getByLabel('Loading data')).toBeHidden();
+        await expect(datagrid.getByLabel('Loading data')).toBeHidden();
 
-      // Initial state
-      await expect(docNameRow1).toHaveText(/.*/);
-      await expect(docNameRow2).toHaveText(/.*/);
-      const initialDocNameRow1 = await docNameRow1.textContent();
-      const initialDocNameRow2 = await docNameRow2.textContent();
+        // Initial state
+        await expect(docNameRow1).toHaveText(/.*/);
+        await expect(docNameRow2).toHaveText(/.*/);
+        const initialDocNameRow1 = await docNameRow1.textContent();
+        const initialDocNameRow2 = await docNameRow2.textContent();
 
-      expect(initialDocNameRow1).toBeDefined();
-      expect(initialDocNameRow2).toBeDefined();
+        expect(initialDocNameRow1).toBeDefined();
+        expect(initialDocNameRow2).toBeDefined();
 
-      // Ordering ASC
-      await thead.getByText(nameColumn).click();
+        // Ordering ASC
+        await thead.getByText(nameColumn).click();
 
-      const responseOrderingAsc = await responsePromiseOrderingAsc;
-      expect(responseOrderingAsc.ok()).toBeTruthy();
+        const responseOrderingAsc = await responsePromiseOrderingAsc;
+        expect(responseOrderingAsc.ok()).toBeTruthy();
 
-      await expect(datagrid.getByLabel('Loading data')).toBeHidden();
+        await expect(datagrid.getByLabel('Loading data')).toBeHidden();
 
-      await expect(docNameRow1).toHaveText(/.*/);
-      await expect(docNameRow2).toHaveText(/.*/);
-      const textDocNameRow1Asc = await docNameRow1.textContent();
-      const textDocNameRow2Asc = await docNameRow2.textContent();
-      expect(
-        textDocNameRow1Asc &&
-          textDocNameRow2Asc &&
-          textDocNameRow1Asc.localeCompare(textDocNameRow2Asc, 'en', {
-            caseFirst: 'false',
-            ignorePunctuation: true,
-          }) <= 0,
-      ).toBeTruthy();
+        await expect(docNameRow1).toHaveText(/.*/);
+        await expect(docNameRow2).toHaveText(/.*/);
+        const textDocNameRow1Asc = await docNameRow1.textContent();
+        const textDocNameRow2Asc = await docNameRow2.textContent();
+        expect(
+          textDocNameRow1Asc &&
+            textDocNameRow2Asc &&
+            textDocNameRow1Asc.localeCompare(textDocNameRow2Asc, 'en', {
+              caseFirst: 'false',
+              ignorePunctuation: true,
+            }) <= 0,
+        ).toBeTruthy();
 
-      // Ordering Desc
-      await thead.getByText(nameColumn).click();
+        // Ordering Desc
+        await thead.getByText(nameColumn).click();
 
-      const responseOrderingDesc = await responsePromiseOrderingDesc;
-      expect(responseOrderingDesc.ok()).toBeTruthy();
+        const responseOrderingDesc = await responsePromiseOrderingDesc;
+        expect(responseOrderingDesc.ok()).toBeTruthy();
 
-      await expect(datagrid.getByLabel('Loading data')).toBeHidden();
+        await expect(datagrid.getByLabel('Loading data')).toBeHidden();
 
-      await expect(docNameRow1).toHaveText(/.*/);
-      await expect(docNameRow2).toHaveText(/.*/);
-      const textDocNameRow1Desc = await docNameRow1.textContent();
-      const textDocNameRow2Desc = await docNameRow2.textContent();
+        await expect(docNameRow1).toHaveText(/.*/);
+        await expect(docNameRow2).toHaveText(/.*/);
+        const textDocNameRow1Desc = await docNameRow1.textContent();
+        const textDocNameRow2Desc = await docNameRow2.textContent();
 
-      expect(
-        textDocNameRow1Desc &&
-          textDocNameRow2Desc &&
-          textDocNameRow1Desc.localeCompare(textDocNameRow2Desc, 'en', {
-            caseFirst: 'false',
-            ignorePunctuation: true,
-          }) >= 0,
-      ).toBeTruthy();
-    });
-  });
+        expect(
+          textDocNameRow1Desc &&
+            textDocNameRow2Desc &&
+            textDocNameRow1Desc.localeCompare(textDocNameRow2Desc, 'en', {
+              caseFirst: 'false',
+              ignorePunctuation: true,
+            }) >= 0,
+        ).toBeTruthy();
+      });
+    },
+  );
 
   test('checks the pagination', async ({ page }) => {
     const responsePromisePage1 = page.waitForResponse(

src/frontend/apps/e2e/__tests__/app-impress/doc-header.spec.ts

@@ -34,6 +34,7 @@ test.describe('Doc Header', () => {
       ],
       abilities: {
         destroy: true, // Means owner
+        link_configuration: true,
         versions_destroy: true,
         versions_list: true,
         versions_retrieve: true,
@@ -42,7 +43,7 @@ test.describe('Doc Header', () => {
         partial_update: true,
         retrieve: true,
       },
-      is_public: true,
+      link_reach: 'public',
       created_at: '2021-09-01T09:00:00Z',
     });
 
@@ -65,13 +66,7 @@ test.describe('Doc Header', () => {
   });
 
   test('it updates the doc', async ({ page, browserName }) => {
-    const [randomDoc] = await createDoc(
-      page,
-      'doc-update',
-      browserName,
-      1,
-      true,
-    );
+    const [randomDoc] = await createDoc(page, 'doc-update', browserName, 1);
     await expect(page.locator('h2').getByText(randomDoc)).toBeVisible();
 
     await page.getByLabel('Open the document options').click();
@@ -85,12 +80,7 @@ test.describe('Doc Header', () => {
       page.locator('h2').getByText(`Update document "${randomDoc}"`),
     ).toBeVisible();
 
-    await expect(
-      page.getByRole('checkbox', { name: 'Is it public ?' }),
-    ).toBeChecked();
-
     await page.getByText('Document name').fill(`${randomDoc}-updated`);
-    await page.getByText('Is it public ?').click();
 
     await page
       .getByRole('button', {
@@ -116,8 +106,8 @@ test.describe('Doc Header', () => {
       .click();
 
     await expect(
-      page.getByRole('checkbox', { name: 'Is it public ?' }),
-    ).not.toBeChecked();
+      page.getByRole('textbox', { name: 'Document name' }),
+    ).toHaveValue(`${randomDoc}-updated`);
   });
 
   test('it deletes the doc', async ({ page, browserName }) => {
@@ -164,6 +154,7 @@ test.describe('Doc Header', () => {
     await mockedDocument(page, {
       abilities: {
         destroy: false, // Means not owner
+        link_configuration: true,
         versions_destroy: true,
         versions_list: true,
         versions_retrieve: true,
@@ -195,6 +186,7 @@ test.describe('Doc Header', () => {
     await mockedDocument(page, {
       abilities: {
         destroy: false, // Means not owner
+        link_configuration: false,
         versions_destroy: true,
         versions_list: true,
         versions_retrieve: true,
@@ -226,6 +218,7 @@ test.describe('Doc Header', () => {
     await mockedDocument(page, {
       abilities: {
         destroy: false, // Means not owner
+        link_configuration: false,
         versions_destroy: false,
         versions_list: true,
         versions_retrieve: true,

src/frontend/apps/e2e/__tests__/app-impress/doc-routing.spec.ts

@@ -47,4 +47,13 @@ test.describe('Doc Routing: Not loggued', () => {
     await keyCloakSignIn(page, browserName);
     await expect(page).toHaveURL(/\/docs\/mocked-document-id\/$/);
   });
+
+  test('The homepage redirects to login.', async ({ page }) => {
+    await page.goto('/');
+    await expect(
+      page.getByRole('button', {
+        name: 'Sign In',
+      }),
+    ).toBeVisible();
+  });
 });

src/frontend/apps/e2e/__tests__/app-impress/doc-table-content.spec.ts

@@ -0,0 +1,93 @@
+import { expect, test } from '@playwright/test';
+
+import { createDoc } from './common';
+
+test.beforeEach(async ({ page }) => {
+  await page.goto('/');
+});
+
+test.describe('Doc Table Content', () => {
+  test('it checks the doc table content', async ({ page, browserName }) => {
+    const [randomDoc] = await createDoc(
+      page,
+      'doc-table-content',
+      browserName,
+      1,
+    );
+
+    await expect(page.locator('h2').getByText(randomDoc)).toBeVisible();
+
+    await page.getByLabel('Open the document options').click();
+    await page
+      .getByRole('button', {
+        name: 'Table of content',
+      })
+      .click();
+
+    const panel = page.getByLabel('Document panel');
+    const editor = page.locator('.ProseMirror');
+
+    await editor.locator('.bn-block-outer').last().fill('/');
+    await page.getByText('Heading 1').click();
+    await page.keyboard.type('Hello World');
+
+    await page.locator('.bn-block-outer').last().click();
+
+    // Create space to fill the viewport
+    for (let i = 0; i < 5; i++) {
+      await page.keyboard.press('Enter');
+    }
+
+    await editor.locator('.bn-block-outer').last().fill('/');
+    await page.getByText('Heading 2').click();
+    await page.keyboard.type('Super World');
+
+    await page.locator('.bn-block-outer').last().click();
+
+    // Create space to fill the viewport
+    for (let i = 0; i < 5; i++) {
+      await page.keyboard.press('Enter');
+    }
+
+    await editor.locator('.bn-block-outer').last().fill('/');
+    await page.getByText('Heading 3').click();
+    await page.keyboard.type('Another World');
+
+    const hello = panel.getByText('Hello World');
+    const superW = panel.getByText('Super World');
+    const another = panel.getByText('Another World');
+
+    await expect(hello).toBeVisible();
+    await expect(hello).toHaveCSS('font-size', '19.2px');
+    await expect(hello).toHaveAttribute('aria-selected', 'true');
+
+    await expect(superW).toBeVisible();
+    await expect(superW).toHaveCSS('font-size', '16px');
+    await expect(superW).toHaveAttribute('aria-selected', 'false');
+
+    await expect(another).toBeVisible();
+    await expect(another).toHaveCSS('font-size', '12.8px');
+    await expect(another).toHaveAttribute('aria-selected', 'false');
+
+    await hello.click();
+
+    await expect(editor.getByText('Hello World')).toBeInViewport();
+    await expect(hello).toHaveAttribute('aria-selected', 'true');
+    await expect(superW).toHaveAttribute('aria-selected', 'false');
+
+    await another.click();
+
+    await expect(editor.getByText('Hello World')).not.toBeInViewport();
+    await expect(hello).toHaveAttribute('aria-selected', 'false');
+    await expect(superW).toHaveAttribute('aria-selected', 'true');
+
+    await panel.getByText('Back to top').click();
+    await expect(editor.getByText('Hello World')).toBeInViewport();
+    await expect(hello).toHaveAttribute('aria-selected', 'true');
+    await expect(superW).toHaveAttribute('aria-selected', 'false');
+
+    await panel.getByText('Go to bottom').click();
+    await expect(editor.getByText('Hello World')).not.toBeInViewport();
+    await expect(superW).toHaveAttribute('aria-selected', 'true');
+  });
+});

src/frontend/apps/e2e/__tests__/app-impress/doc-visibility.spec.ts

@@ -0,0 +1,96 @@
+import { expect, test } from '@playwright/test';
+
+import { createDoc, keyCloakSignIn } from './common';
+
+test.describe('Doc Visibility', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.goto('/');
+  });
+
+  test('Make a public doc', async ({ page, browserName }) => {
+    const [docTitle] = await createDoc(
+      page,
+      'My new doc',
+      browserName,
+      1,
+      true,
+    );
+
+    const header = page.locator('header').first();
+    await header.locator('h2').getByText('Docs').click();
+
+    const datagrid = page
+      .getByLabel('Datagrid of the documents page 1')
+      .getByRole('table');
+
+    await expect(datagrid.getByLabel('Loading data')).toBeHidden();
+
+    await expect(datagrid.getByText(docTitle)).toBeVisible();
+
+    const row = datagrid.getByRole('row').filter({
+      hasText: docTitle,
+    });
+
+    await expect(row.getByRole('cell').nth(0)).toHaveText('Public');
+  });
+
+  test('It checks the copy link button', async ({ page, browserName }) => {
+    // eslint-disable-next-line playwright/no-skipped-test
+    test.skip(
+      browserName === 'webkit',
+      'navigator.clipboard is not working with webkit and playwright',
+    );
+
+    await createDoc(page, 'My button copy doc', browserName, 1);
+
+    await page.getByRole('button', { name: 'Share' }).click();
+    await page.getByRole('button', { name: 'Copy link' }).click();
+
+    await expect(page.getByText('Link Copied !')).toBeVisible();
+
+    const handle = await page.evaluateHandle(() =>
+      navigator.clipboard.readText(),
+    );
+    const clipboardContent = await handle.jsonValue();
+
+    expect(clipboardContent).toMatch(page.url());
+  });
+});
+
+test.describe('Doc Visibility: Not loggued', () => {
+  test.use({ storageState: { cookies: [], origins: [] } });
+
+  test('A public doc is accessible even when not authentified.', async ({
+    page,
+    browserName,
+  }) => {
+    await page.goto('/');
+    await keyCloakSignIn(page, browserName);
+
+    const [docTitle] = await createDoc(
+      page,
+      'My new doc',
+      browserName,
+      1,
+      true,
+    );
+
+    await expect(
+      page.getByText('The document visiblitity has been updated.'),
+    ).toBeVisible();
+
+    const urlDoc = page.url();
+
+    await page
+      .getByRole('button', {
+        name: 'Logout',
+      })
+      .click();
+
+    await expect(page.getByRole('button', { name: 'Sign in' })).toBeVisible();
+
+    await page.goto(urlDoc);
+
+    await expect(page.locator('h2').getByText(docTitle)).toBeVisible();
+  });
+});

src/frontend/apps/e2e/__tests__/app-impress/header.spec.ts

@@ -22,6 +22,12 @@ test.describe('Header', () => {
       /Marianne/i,
     );
 
+    await expect(
+      header.getByRole('button', {
+        name: 'Logout',
+      }),
+    ).toBeVisible();
+
     await expect(header.getByAltText('Language Icon')).toBeVisible();
 
     await expect(
@@ -68,12 +74,6 @@ test.describe('Header: Log out', () => {
     await page.goto('/');
     await keyCloakSignIn(page, browserName);
 
-    await page
-      .getByRole('button', {
-        name: 'My account',
-      })
-      .click();
-
     await page
       .getByRole('button', {
         name: 'Logout',

src/frontend/apps/e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-e2e",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "private": true,
   "scripts": {
     "lint": "eslint . --ext .ts",
@@ -12,7 +12,7 @@
     "test:ui::chromium": "yarn test:ui --project=chromium"
   },
   "devDependencies": {
-    "@playwright/test": "1.46.1",
+    "@playwright/test": "1.47.1",
     "@types/node": "*",
     "@types/pdf-parse": "1.1.4",
     "eslint-config-impress": "*",
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "convert-stream": "1.0.2",
-    "jsdom": "24.1.1",
-    "pdf-parse": "^1.1.1"
+    "jsdom": "25.0.0",
+    "pdf-parse": "1.1.1"
   }
 }

src/frontend/apps/e2e/playwright.config.ts

@@ -32,12 +32,10 @@ export default defineConfig({
   },
 
   webServer: {
-    command: `cd ../.. && yarn app:${
-      process.env.CI ? 'start -p ' : 'dev --port '
-    } ${PORT}`,
+    command: !process.env.CI ? `cd ../.. && yarn app:dev --port ${PORT}` : '',
     url: baseURL,
     timeout: 120 * 1000,
-    reuseExistingServer: !process.env.CI,
+    reuseExistingServer: true,
   },
 
   /* Configure projects for major browsers */
@@ -50,6 +48,9 @@ export default defineConfig({
         locale: 'en-US',
         timezoneId: 'Europe/Paris',
         storageState: 'playwright/.auth/user-chromium.json',
+        contextOptions: {
+          permissions: ['clipboard-read', 'clipboard-write'],
+        },
       },
       dependencies: ['setup'],
     },
@@ -70,6 +71,12 @@ export default defineConfig({
         locale: 'en-US',
         timezoneId: 'Europe/Paris',
         storageState: 'playwright/.auth/user-firefox.json',
+        launchOptions: {
+          firefoxUserPrefs: {
+            'dom.events.asyncClipboard.readText': true,
+            'dom.events.testing.asyncClipboard': true,
+          },
+        },
       },
       dependencies: ['setup'],
     },

src/frontend/apps/impress/.env

@@ -1,3 +1,4 @@
-NEXT_PUBLIC_THEME=dsfr
-NEXT_PUBLIC_SIGNALING_URL=
 NEXT_PUBLIC_API_ORIGIN=
+NEXT_PUBLIC_Y_PROVIDER_URL=
+NEXT_PUBLIC_MEDIA_URL=
+NEXT_PUBLIC_THEME=dsfr

src/frontend/apps/impress/.env.development

@@ -1,3 +1,4 @@
 NEXT_PUBLIC_API_ORIGIN=http://localhost:8071
-NEXT_PUBLIC_SIGNALING_URL=ws://localhost:4444
+NEXT_PUBLIC_Y_PROVIDER_URL=ws://localhost:4444
+NEXT_PUBLIC_MEDIA_URL=http://localhost:8083
 NEXT_PUBLIC_SW_DEACTIVATED=true

src/frontend/apps/impress/conf/default.conf

@@ -1,5 +1,6 @@
 server {
   listen 8080;
+  listen 3000;
   server_name localhost;
 
   root /usr/share/nginx/html;

src/frontend/apps/impress/cunningham.ts

@@ -340,6 +340,10 @@ const config = {
         'forms-checkbox': {
           'border-radius': '0',
           color: 'var(--c--theme--colors--primary-text)',
+          text: {
+            color: 'var(--c--theme--colors--greyscale-text)',
+            size: 'var(--c--theme--font--sizes--t)',
+          },
         },
         'forms-datepicker': {
           'border-radius': '0',

src/frontend/apps/impress/next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/basic-features/typescript for more information.
+// see https://nextjs.org/docs/pages/building-your-application/configuring/typescript for more information.

src/frontend/apps/impress/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-impress",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -19,35 +19,36 @@
     "@blocknote/mantine": "*",
     "@blocknote/react": "*",
     "@gouvfr-lasuite/integration": "1.0.2",
-    "@openfun/cunningham-react": "2.9.3",
-    "@tanstack/react-query": "5.51.24",
-    "i18next": "23.14.0",
+    "@hocuspocus/provider": "2.13.5",
+    "@openfun/cunningham-react": "2.9.4",
+    "@tanstack/react-query": "5.56.2",
+    "i18next": "23.15.1",
     "idb": "8.0.0",
     "lodash": "4.17.21",
     "luxon": "3.5.0",
-    "next": "14.2.5",
+    "next": "14.2.11",
     "react": "*",
-    "react-aria-components": "1.3.1",
+    "react-aria-components": "1.3.3",
     "react-dom": "*",
-    "react-i18next": "15.0.1",
+    "react-i18next": "15.0.2",
     "react-select": "5.8.0",
-    "styled-components": "6.1.12",
-    "y-webrtc": "10.3.0",
+    "styled-components": "6.1.13",
     "yjs": "*",
+    "y-protocols": "1.0.6",
     "zustand": "4.5.5"
   },
   "devDependencies": {
     "@svgr/webpack": "8.1.0",
-    "@tanstack/react-query-devtools": "5.51.24",
+    "@tanstack/react-query-devtools": "5.56.2",
     "@testing-library/dom": "10.4.0",
-    "@testing-library/jest-dom": "6.4.8",
-    "@testing-library/react": "16.0.0",
+    "@testing-library/jest-dom": "6.5.0",
+    "@testing-library/react": "16.0.1",
     "@testing-library/user-event": "14.5.2",
-    "@types/jest": "29.5.12",
+    "@types/jest": "29.5.13",
     "@types/lodash": "4.17.7",
     "@types/luxon": "3.4.2",
     "@types/node": "*",
-    "@types/react": "18.3.3",
+    "@types/react": "18.3.6",
     "@types/react-dom": "*",
     "cross-env": "*",
     "dotenv": "16.4.5",
@@ -57,10 +58,11 @@
     "jest-environment-jsdom": "29.7.0",
     "node-fetch": "2.7.0",
     "prettier": "3.3.3",
-    "stylelint": "16.8.2",
+    "stylelint": "16.9.0",
     "stylelint-config-standard": "36.0.1",
     "stylelint-prettier": "5.0.2",
     "typescript": "*",
+    "webpack": "5.94.0",
     "workbox-webpack-plugin": "7.1.0"
   }
 }

src/frontend/apps/impress/src/api/__tests__/fetchApi.test.tsx

@@ -1,7 +1,6 @@
 import fetchMock from 'fetch-mock';
 
 import { fetchAPI } from '@/api';
-import { useAuthStore } from '@/core/auth';
 
 describe('fetchAPI', () => {
   beforeEach(() => {
@@ -30,19 +29,6 @@ describe('fetchAPI', () => {
     });
   });
 
-  it('logout if 401 response', async () => {
-    const logoutMock = jest.fn();
-    jest
-      .spyOn(useAuthStore.getState(), 'logout')
-      .mockImplementation(logoutMock);
-
-    fetchMock.mock('http://test.jest/api/v1.0/some/url', 401);
-
-    await fetchAPI('some/url');
-
-    expect(logoutMock).toHaveBeenCalled();
-  });
-
   it('check the versionning', () => {
     fetchMock.mock('http://test.jest/api/v2.0/some/url', 200);
 

src/frontend/apps/impress/src/api/fetchApi.ts

@@ -1,40 +1,34 @@
-import { baseApiUrl, useAuthStore } from '@/core';
+import { baseApiUrl } from '@/core';
 
-/**
- * Retrieves the CSRF token from the document's cookies.
- *
- * @returns {string|null} The CSRF token if found in the cookies, or null if not present.
- */
-function getCSRFToken() {
-  return document.cookie
-    .split(';')
-    .filter((cookie) => cookie.trim().startsWith('csrftoken='))
-    .map((cookie) => cookie.split('=')[1])
-    .pop();
+import { getCSRFToken } from './utils';
+
+interface FetchAPIInit extends RequestInit {
+  withoutContentType?: boolean;
 }
 
 export const fetchAPI = async (
   input: string,
-  init?: RequestInit,
+  init?: FetchAPIInit,
   apiVersion = '1.0',
 ) => {
   const apiUrl = `${baseApiUrl(apiVersion)}${input}`;
   const csrfToken = getCSRFToken();
 
+  const headers = {
+    'Content-Type': 'application/json',
+    ...init?.headers,
+    ...(csrfToken && { 'X-CSRFToken': csrfToken }),
+  };
+
+  if (init?.withoutContentType) {
+    delete headers?.['Content-Type' as keyof typeof headers];
+  }
+
   const response = await fetch(apiUrl, {
     ...init,
     credentials: 'include',
-    headers: {
-      ...init?.headers,
-      'Content-Type': 'application/json',
-      ...(csrfToken && { 'X-CSRFToken': csrfToken }),
-    },
+    headers,
   });
 
-  if (response.status === 401) {
-    const { logout } = useAuthStore.getState();
-    logout();
-  }
-
   return response;
 };

src/frontend/apps/impress/src/api/utils.ts

@@ -16,3 +16,14 @@ export const errorCauses = async (response: Response, data?: unknown) => {
     data,
   };
 };
+
+/**
+ * Retrieves the CSRF token from the document's cookies.
+ */
+export function getCSRFToken() {
+  return document.cookie
+    .split(';')
+    .filter((cookie) => cookie.trim().startsWith('csrftoken='))
+    .map((cookie) => cookie.split('=')[1])
+    .pop();
+}

src/frontend/apps/impress/src/components/BoxButton.tsx

@@ -29,6 +29,7 @@ const BoxButton = forwardRef<HTMLDivElement, BoxType>(
           border: none;
           outline: none;
           transition: all 0.2s ease-in-out;
+          font-family: inherit;
           ${$css || ''}
         `}
         {...props}

src/frontend/apps/impress/src/components/Panel.tsx

@@ -0,0 +1,106 @@
+import React, { PropsWithChildren, useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { Box, Card, IconBG, Text } from '@/components';
+import { useCunninghamTheme } from '@/cunningham';
+
+interface PanelProps {
+  title?: string;
+  setIsPanelOpen: (isOpen: boolean) => void;
+}
+
+export const Panel = ({
+  children,
+  title,
+  setIsPanelOpen,
+}: PropsWithChildren<PanelProps>) => {
+  const { t } = useTranslation();
+  const { colorsTokens } = useCunninghamTheme();
+
+  const [isOpen, setIsOpen] = useState(false);
+
+  useEffect(() => {
+    setIsOpen(true);
+  }, []);
+
+  const closedOverridingStyles = !isOpen && {
+    $width: '0',
+    $maxWidth: '0',
+    $minWidth: '0',
+  };
+
+  const transition = 'all 0.5s ease-in-out';
+
+  return (
+    <Card
+      $width="100%"
+      $maxWidth="20rem"
+      $position="sticky"
+      $maxHeight="96vh"
+      $height="100%"
+      $css={`
+        top: 2vh;
+        transition: ${transition};
+        ${
+          !isOpen &&
+          `
+            box-shadow: none;
+            border: none;
+          `
+        }
+      `}
+      aria-label={t('Document panel')}
+      {...closedOverridingStyles}
+    >
+      <Box
+        $overflow="inherit"
+        $position="sticky"
+        $css={`
+          top: 0;
+          opacity: ${isOpen ? '1' : '0'};
+          transition: ${transition};
+        `}
+        $maxHeight="100%"
+      >
+        <Box
+          $padding={{ all: 'small' }}
+          $direction="row"
+          $align="center"
+          $justify="center"
+          $css={`border-top: 2px solid ${colorsTokens()['primary-600']};`}
+        >
+          <IconBG
+            iconName="menu_open"
+            aria-label={isOpen ? t('Close the panel') : t('Open the panel')}
+            $background="transparent"
+            $size="h2"
+            $zIndex={1}
+            $css={`
+              cursor: pointer;
+              left: 0rem;
+              top: 0.1rem;
+              transition: ${transition};
+              transform: rotate(180deg);
+              opacity: ${isOpen ? '1' : '0'};
+              user-select: none;
+            `}
+            $position="absolute"
+            onClick={() => {
+              setIsOpen(false);
+              setTimeout(() => {
+                setIsPanelOpen(false);
+              }, 400);
+            }}
+            $radius="2px"
+          />
+          {title && (
+            <Text $weight="bold" $size="l" $theme="primary">
+              {title}
+            </Text>
+          )}
+        </Box>
+        {children}
+      </Box>
+    </Card>
+  );
+};

src/frontend/apps/impress/src/core/AppProvider.tsx

@@ -4,7 +4,7 @@ import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { useCunninghamTheme } from '@/cunningham';
 import '@/i18n/initI18n';
 
-import { Auth } from './auth/Auth';
+import { Auth } from './auth/';
 
 /**
  * QueryClient:

src/frontend/apps/impress/src/core/auth/AccountDropdown.tsx

@@ -0,0 +1,34 @@
+import { Button } from '@openfun/cunningham-react';
+import React from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { useAuthStore } from '@/core/auth';
+
+export const AccountDropdown = () => {
+  const { t } = useTranslation();
+  const { logout, authenticated, login } = useAuthStore();
+
+  if (!authenticated) {
+    return (
+      <Button
+        onClick={login}
+        color="primary-text"
+        icon={<span className="material-icons">login</span>}
+        aria-label={t('Login')}
+      >
+        {t('Login')}
+      </Button>
+    );
+  }
+
+  return (
+    <Button
+      onClick={logout}
+      color="primary-text"
+      icon={<span className="material-icons">logout</span>}
+      aria-label={t('Logout')}
+    >
+      {t('Logout')}
+    </Button>
+  );
+};

src/frontend/apps/impress/src/core/auth/Auth.tsx

@@ -1,18 +1,47 @@
 import { Loader } from '@openfun/cunningham-react';
-import { PropsWithChildren, useEffect } from 'react';
+import { useRouter } from 'next/router';
+import { PropsWithChildren, useEffect, useState } from 'react';
 
 import { Box } from '@/components';
 
 import { useAuthStore } from './useAuthStore';
 
+/**
+ * TODO: Remove this restriction when we will have a homepage design for non-authenticated users.
+ *
+ * We define the paths that are not allowed without authentication.
+ * Actually, only the home page and the docs page are not allowed without authentication.
+ * When we will have a homepage design for non-authenticated users, we will remove this restriction to have
+ * the full website accessible without authentication.
+ */
+const regexpUrlsAuth = [/\/docs\/$/g, /^\/$/g];
+
 export const Auth = ({ children }: PropsWithChildren) => {
-  const { authenticated, initAuth } = useAuthStore();
+  const { initAuth, initiated, authenticated, login } = useAuthStore();
+  const { asPath } = useRouter();
+
+  const [pathAllowed, setPathAllowed] = useState<boolean>(
+    !regexpUrlsAuth.some((regexp) => !!asPath.match(regexp)),
+  );
 
   useEffect(() => {
     initAuth();
   }, [initAuth]);
 
-  if (!authenticated) {
+  useEffect(() => {
+    setPathAllowed(!regexpUrlsAuth.some((regexp) => !!asPath.match(regexp)));
+  }, [asPath]);
+
+  // We force to login except on allowed paths
+  useEffect(() => {
+    if (!initiated || authenticated || pathAllowed) {
+      return;
+    }
+
+    login();
+  }, [authenticated, pathAllowed, login, initiated]);
+
+  if ((!initiated && pathAllowed) || (!authenticated && !pathAllowed)) {
     return (
       <Box $height="100vh" $width="100vw" $align="center" $justify="center">
         <Loader />

src/frontend/apps/impress/src/core/auth/index.ts

@@ -1,3 +1,4 @@
+export * from './AccountDropdown';
+export * from './api/types';
 export * from './Auth';
 export * from './useAuthStore';
-export * from './api/types';

src/frontend/apps/impress/src/core/auth/useAuthStore.tsx

@@ -6,18 +6,22 @@ import { User, getMe } from './api';
 import { PATH_AUTH_LOCAL_STORAGE } from './conf';
 
 interface AuthStore {
+  initiated: boolean;
   authenticated: boolean;
   initAuth: () => void;
   logout: () => void;
+  login: () => void;
   userData?: User;
 }
 
 const initialState = {
+  initiated: false,
   authenticated: false,
   userData: undefined,
 };
 
 export const useAuthStore = create<AuthStore>((set) => ({
+  initiated: initialState.initiated,
   authenticated: initialState.authenticated,
   userData: initialState.userData,
 
@@ -34,20 +38,21 @@ export const useAuthStore = create<AuthStore>((set) => ({
 
         set({ authenticated: true, userData: data });
       })
-      .catch(() => {
-        // If we try to access a specific page and we are not authenticated
-        // we store the path in the local storage to redirect to it after login
-        if (window.location.pathname !== '/') {
-          localStorage.setItem(
-            PATH_AUTH_LOCAL_STORAGE,
-            window.location.pathname,
-          );
-        }
-
-        window.location.replace(new URL('authenticate/', baseApiUrl()).href);
+      .catch(() => {})
+      .finally(() => {
+        set({ initiated: true });
       });
   },
+  login: () => {
+    // If we try to access a specific page and we are not authenticated
+    // we store the path in the local storage to redirect to it after login
+    if (window.location.pathname !== '/') {
+      localStorage.setItem(PATH_AUTH_LOCAL_STORAGE, window.location.pathname);
+    }
+
+    window.location.replace(`${baseApiUrl()}authenticate/`);
+  },
   logout: () => {
-    window.location.replace(new URL('logout/', baseApiUrl()).href);
+    window.location.replace(`${baseApiUrl()}logout/`);
   },
 }));

src/frontend/apps/impress/src/core/conf.ts

@@ -1,14 +1,17 @@
-export const baseApiUrl = (apiVersion: string = '1.0') => {
-  const origin =
-    process.env.NEXT_PUBLIC_API_ORIGIN ||
-    (typeof window !== 'undefined' ? window.location.origin : '');
+export const mediaUrl = () =>
+  process.env.NEXT_PUBLIC_MEDIA_URL ||
+  (typeof window !== 'undefined' ? window.location.origin : '');
 
-  return `${origin}/api/v${apiVersion}/`;
-};
+export const backendUrl = () =>
+  process.env.NEXT_PUBLIC_API_ORIGIN ||
+  (typeof window !== 'undefined' ? window.location.origin : '');
 
-export const signalingUrl = (docId: string) => {
+export const baseApiUrl = (apiVersion: string = '1.0') =>
+  `${backendUrl()}/api/v${apiVersion}/`;
+
+export const providerUrl = (docId: string) => {
   const base =
-    process.env.NEXT_PUBLIC_SIGNALING_URL ||
+    process.env.NEXT_PUBLIC_Y_PROVIDER_URL ||
     (typeof window !== 'undefined' ? `wss://${window.location.host}/ws` : '');
 
   return `${base}/${docId}`;

src/frontend/apps/impress/src/cunningham/cunningham-style.css

@@ -308,6 +308,11 @@ input:-webkit-autofill:focus {
   transition: all 0.8s ease-in-out;
 }
 
+.c__checkbox .c__field__text {
+  color: var(--c--components--forms-checkbox--text--color);
+  font-size: var(--c--components--forms-checkbox--text--size);
+}
+
 /**
  * Button
 */

src/frontend/apps/impress/src/cunningham/cunningham-tokens.css

@@ -463,6 +463,10 @@
   );
   --c--components--forms-checkbox--border-radius: 0;
   --c--components--forms-checkbox--color: var(--c--theme--colors--primary-text);
+  --c--components--forms-checkbox--text--color: var(
+    --c--theme--colors--greyscale-text
+  );
+  --c--components--forms-checkbox--text--size: var(--c--theme--font--sizes--t);
   --c--components--forms-datepicker--border-radius: 0;
   --c--components--forms-fileuploader--border-radius: 0;
   --c--components--forms-field--color: var(--c--theme--colors--primary-text);

src/frontend/apps/impress/src/cunningham/cunningham-tokens.ts

@@ -469,6 +469,10 @@ export const tokens = {
         'forms-checkbox': {
           'border-radius': '0',
           color: 'var(--c--theme--colors--primary-text)',
+          text: {
+            color: 'var(--c--theme--colors--greyscale-text)',
+            size: 'var(--c--theme--font--sizes--t)',
+          },
         },
         'forms-datepicker': { 'border-radius': '0' },
         'forms-fileuploader': { 'border-radius': '0' },

src/frontend/apps/impress/src/custom-next.d.ts

@@ -20,7 +20,8 @@ declare module '*.svg?url' {
 namespace NodeJS {
   interface ProcessEnv {
     NEXT_PUBLIC_API_ORIGIN?: string;
-    NEXT_PUBLIC_SIGNALING_URL?: string;
+    NEXT_PUBLIC_MEDIA_URL?: string;
+    NEXT_PUBLIC_Y_PROVIDER_URL?: string;
     NEXT_PUBLIC_SW_DEACTIVATED?: string;
     NEXT_PUBLIC_THEME?: string;
   }

src/frontend/apps/impress/src/features/docs/doc-editor/api/useCreateDocUpload.tsx

@@ -0,0 +1,36 @@
+import { useMutation } from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
+import { DocAttachment } from '../types';
+
+interface CreateDocAttachment {
+  docId: string;
+  body: FormData;
+}
+
+export const createDocAttachment = async ({
+  docId,
+  body,
+}: CreateDocAttachment): Promise<DocAttachment> => {
+  const response = await fetchAPI(`documents/${docId}/attachment-upload/`, {
+    method: 'POST',
+    body,
+    withoutContentType: true,
+  });
+
+  if (!response.ok) {
+    throw new APIError(
+      'Failed to upload on the doc',
+      await errorCauses(response),
+    );
+  }
+
+  return response.json() as Promise<DocAttachment>;
+};
+
+export function useCreateDocAttachment() {
+  return useMutation<DocAttachment, APIError, CreateDocAttachment>({
+    mutationFn: createDocAttachment,
+  });
+}

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteEditor.tsx

@@ -1,21 +1,42 @@
-import { BlockNoteEditor as BlockNoteEditorCore } from '@blocknote/core';
+import {
+  BlockNoteEditor as BlockNoteEditorCore,
+  locales,
+} from '@blocknote/core';
 import '@blocknote/core/fonts/inter.css';
 import { BlockNoteView } from '@blocknote/mantine';
 import '@blocknote/mantine/style.css';
-import React, { useEffect, useMemo } from 'react';
-import { WebrtcProvider } from 'y-webrtc';
+import { HocuspocusProvider } from '@hocuspocus/provider';
+import React, { useCallback, useEffect, useMemo } from 'react';
 
-import { Box } from '@/components';
+import { Box, TextErrors } from '@/components';
+import { mediaUrl } from '@/core';
 import { useAuthStore } from '@/core/auth';
 import { Doc } from '@/features/docs/doc-management';
 import { Version } from '@/features/docs/doc-versioning/';
 
+import { useCreateDocAttachment } from '../api/useCreateDocUpload';
 import useSaveDoc from '../hook/useSaveDoc';
 import { useDocStore } from '../stores';
 import { randomColor } from '../utils';
 
 import { BlockNoteToolbar } from './BlockNoteToolbar';
 
+import { useTranslation } from 'react-i18next';
+
+const cssEditor = `
+  &, & > .bn-container, & .ProseMirror {
+    height:100%
+  };
+  & .collaboration-cursor__caret.ProseMirror-widget{
+    word-wrap: initial;
+  }
+  & .bn-inline-content code {
+    background-color: gainsboro;
+    padding: 2px;
+    border-radius: 4px;
+  }
+`;
+
 interface BlockNoteEditorProps {
   doc: Doc;
   version?: Version;
@@ -28,7 +49,7 @@ export const BlockNoteEditor = ({ doc, version }: BlockNoteEditorProps) => {
   const provider = docsStore?.[storeId]?.provider;
 
   useEffect(() => {
-    if (!provider || provider.doc.guid !== storeId) {
+    if (!provider || provider.document.guid !== storeId) {
       createProvider(storeId, initialContent);
     }
   }, [createProvider, initialContent, provider, storeId]);
@@ -42,7 +63,7 @@ export const BlockNoteEditor = ({ doc, version }: BlockNoteEditorProps) => {
 
 interface BlockNoteContentProps {
   doc: Doc;
-  provider: WebrtcProvider;
+  provider: HocuspocusProvider;
   storeId: string;
 }
 
@@ -55,9 +76,42 @@ export const BlockNoteContent = ({
   const { userData } = useAuthStore();
   const { setStore, docsStore } = useDocStore();
   const canSave = doc.abilities.partial_update && !isVersion;
-  useSaveDoc(doc.id, provider.doc, canSave);
-
+  useSaveDoc(doc.id, provider.document, canSave);
   const storedEditor = docsStore?.[storeId]?.editor;
+  const {
+    mutateAsync: createDocAttachment,
+    isError: isErrorAttachment,
+    error: errorAttachment,
+  } = useCreateDocAttachment();
+
+  const uploadFile = useCallback(
+    async (file: File) => {
+      const body = new FormData();
+      body.append('file', file);
+
+      const ret = await createDocAttachment({
+        docId: doc.id,
+        body,
+      });
+
+      return `${mediaUrl()}${ret.file}`;
+    },
+    [createDocAttachment, doc.id],
+  );
+
+  const { t, i18n } = useTranslation();
+  const lang = i18n.language;
+
+  const resetStore = () => {
+    setStore(storeId, { editor: undefined });
+  };
+
+  // Invalidate the stored editor when the language changes
+  useEffect(() => {
+    resetStore();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [lang]);
+
   const editor = useMemo(() => {
     if (storedEditor) {
       return storedEditor;
@@ -66,30 +120,29 @@ export const BlockNoteContent = ({
     return BlockNoteEditorCore.create({
       collaboration: {
         provider,
-        fragment: provider.doc.getXmlFragment('document-store'),
+        fragment: provider.document.getXmlFragment('document-store'),
         user: {
           name: userData?.email || 'Anonymous',
           color: randomColor(),
         },
       },
+      dictionary: locales[lang as keyof typeof locales],
+      uploadFile,
     });
-  }, [provider, storedEditor, userData?.email]);
+  }, [provider, storedEditor, uploadFile, userData?.email, lang]);
 
   useEffect(() => {
     setStore(storeId, { editor });
   }, [setStore, storeId, editor]);
 
   return (
-    <Box
-      $css={`
-        &, & > .bn-container, & .ProseMirror {
-          height:100%
-        };
-        & .collaboration-cursor__caret.ProseMirror-widget{
-          word-wrap: initial;
-        }
-      `}
-    >
+    <Box $css={cssEditor}>
+      {isErrorAttachment && (
+        <Box $margin={{ bottom: 'big' }}>
+          <TextErrors causes={errorAttachment.cause} />
+        </Box>
+      )}
+
       <BlockNoteView
         editor={editor}
         formattingToolbar={false}

src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteToolbar.tsx

@@ -11,9 +11,11 @@ import {
   UnnestBlockButton,
   useBlockNoteEditor,
   useComponentsContext,
+  useSelectedBlocks,
 } from '@blocknote/react';
 import { forEach, isArray } from 'lodash';
-import React from 'react';
+import React, { useMemo } from 'react';
+import { useTranslation } from 'react-i18next';
 
 export const BlockNoteToolbar = () => {
   return (
@@ -91,6 +93,8 @@ const recursiveContent = (content: Block[], base: string = '') => {
 export function MarkdownButton() {
   const editor = useBlockNoteEditor();
   const Components = useComponentsContext();
+  const selectedBlocks = useSelectedBlocks(editor);
+  const { t } = useTranslation();
 
   const handleConvertMarkdown = () => {
     const blocks = editor.getSelection()?.blocks;
@@ -114,13 +118,17 @@ export function MarkdownButton() {
     });
   };
 
-  if (!Components) {
+  const show = useMemo(() => {
+    return !!selectedBlocks.find((block) => block.content !== undefined);
+  }, [selectedBlocks]);
+
+  if (!show || !editor.isEditable || !Components) {
     return null;
   }
 
   return (
     <Components.FormattingToolbar.Button
-      mainTooltip="Convert Markdown"
+      mainTooltip={t('Convert Markdown')}
       onClick={handleConvertMarkdown}
     >
       M

src/frontend/apps/impress/src/features/docs/doc-editor/components/DocEditor.tsx

@@ -5,10 +5,17 @@ import React from 'react';
 import { useTranslation } from 'react-i18next';
 
 import { Box, Card, Text, TextErrors } from '@/components';
+import { Panel } from '@/components/Panel';
 import { useCunninghamTheme } from '@/cunningham';
 import { DocHeader } from '@/features/docs/doc-header';
 import { Doc } from '@/features/docs/doc-management';
-import { Versions, useDocVersion } from '@/features/docs/doc-versioning/';
+import { TableContent } from '@/features/docs/doc-table-content';
+import {
+  VersionList,
+  Versions,
+  useDocVersion,
+  useDocVersionStore,
+} from '@/features/docs/doc-versioning/';
 
 import { BlockNoteEditor } from './BlockNoteEditor';
 
@@ -20,7 +27,7 @@ export const DocEditor = ({ doc }: DocEditorProps) => {
   const {
     query: { versionId },
   } = useRouter();
-
+  const { isPanelVersionOpen, setIsPanelVersionOpen } = useDocVersionStore();
   const { t } = useTranslation();
 
   const isVersion = versionId && typeof versionId === 'string';
@@ -29,7 +36,7 @@ export const DocEditor = ({ doc }: DocEditorProps) => {
 
   return (
     <>
-      <DocHeader doc={doc} />
+      <DocHeader doc={doc} versionId={versionId as Versions['version_id']} />
       {!doc.abilities.partial_update && (
         <Box $margin={{ all: 'small', top: 'none' }}>
           <Alert type={VariantType.WARNING}>
@@ -58,6 +65,12 @@ export const DocEditor = ({ doc }: DocEditorProps) => {
             <BlockNoteEditor doc={doc} />
           )}
         </Card>
+        {doc.abilities.versions_list && isPanelVersionOpen && (
+          <Panel title={t('VERSIONS')} setIsPanelOpen={setIsPanelVersionOpen}>
+            <VersionList doc={doc} />
+          </Panel>
+        )}
+        <TableContent doc={doc} />
       </Box>
     </>
   );

src/frontend/apps/impress/src/features/docs/doc-editor/hook/useSaveDoc.tsx

@@ -1,32 +1,14 @@
-import { VariantType, useToastProvider } from '@openfun/cunningham-react';
 import { useRouter } from 'next/router';
 import { useCallback, useEffect, useRef, useState } from 'react';
-import { useTranslation } from 'react-i18next';
 import * as Y from 'yjs';
 
 import { useUpdateDoc } from '@/features/docs/doc-management/';
 import { KEY_LIST_DOC_VERSIONS } from '@/features/docs/doc-versioning';
 
-import { useDocStore } from '../stores';
 import { toBase64 } from '../utils';
 
 const useSaveDoc = (docId: string, doc: Y.Doc, canSave: boolean) => {
-  const { toast } = useToastProvider();
-  const { t } = useTranslation();
-  const { forceSave, setForceSave } = useDocStore();
-
   const { mutate: updateDoc } = useUpdateDoc({
-    onSuccess: (data) => {
-      toast(
-        t('Your document "{{docTitle}}" has been saved.', {
-          docTitle: data.title,
-        }),
-        VariantType.SUCCESS,
-        {
-          duration: 1500,
-        },
-      );
-    },
     listInvalideQueries: [KEY_LIST_DOC_VERSIONS],
   });
   const [initialDoc, setInitialDoc] = useState<string>(
@@ -83,18 +65,6 @@ const useSaveDoc = (docId: string, doc: Y.Doc, canSave: boolean) => {
     });
   }, [doc, docId, updateDoc]);
 
-  useEffect(() => {
-    if (forceSave === 'false') {
-      return;
-    }
-
-    setForceSave('false');
-
-    if ((forceSave === 'current' && hasChanged()) || forceSave === 'version') {
-      saveDoc();
-    }
-  }, [forceSave, hasChanged, saveDoc, setForceSave]);
-
   const timeout = useRef<NodeJS.Timeout>();
   const router = useRouter();
 

src/frontend/apps/impress/src/features/docs/doc-editor/index.tsx

@@ -1,2 +1,3 @@
 export * from './components';
 export * from './stores';
+export * from './utils';

src/frontend/apps/impress/src/features/docs/doc-editor/stores/useDocStore.tsx

@@ -1,34 +1,26 @@
 import { BlockNoteEditor } from '@blocknote/core';
-import { WebrtcProvider } from 'y-webrtc';
+import { HocuspocusProvider } from '@hocuspocus/provider';
 import * as Y from 'yjs';
 import { create } from 'zustand';
 
-import { signalingUrl } from '@/core';
+import { providerUrl } from '@/core';
 import { Base64 } from '@/features/docs/doc-management';
 
 interface DocStore {
-  provider: WebrtcProvider;
+  provider: HocuspocusProvider;
   editor?: BlockNoteEditor;
 }
 
-type ForceSaveState = 'false' | 'version' | 'current';
-
 export interface UseDocStore {
   docsStore: {
     [storeId: string]: DocStore;
   };
-  createProvider: (storeId: string, initialDoc: Base64) => WebrtcProvider;
+  createProvider: (storeId: string, initialDoc: Base64) => HocuspocusProvider;
   setStore: (storeId: string, props: Partial<DocStore>) => void;
-  forceSave: ForceSaveState;
-  setForceSave: (forceSave: ForceSaveState) => void;
 }
 
 export const useDocStore = create<UseDocStore>((set, get) => ({
   docsStore: {},
-  forceSave: 'false',
-  setForceSave: (forceSave) => {
-    set(() => ({ forceSave }));
-  },
   createProvider: (storeId: string, initialDoc: Base64) => {
     const doc = new Y.Doc({
       guid: storeId,
@@ -38,9 +30,10 @@ export const useDocStore = create<UseDocStore>((set, get) => ({
       Y.applyUpdate(doc, Buffer.from(initialDoc, 'base64'));
     }
 
-    const provider = new WebrtcProvider(storeId, doc, {
-      signaling: [signalingUrl(storeId)],
-      maxConns: 5,
+    const provider = new HocuspocusProvider({
+      url: providerUrl(storeId),
+      name: storeId,
+      document: doc,
     });
 
     get().setStore(storeId, { provider });

src/frontend/apps/impress/src/features/docs/doc-editor/types.tsx

@@ -0,0 +1,3 @@
+export interface DocAttachment {
+  file: string;
+}

src/frontend/apps/impress/src/features/docs/doc-header/components/DocHeader.tsx

@@ -1,4 +1,5 @@
-import React, { Fragment } from 'react';
+import { Button } from '@openfun/cunningham-react';
+import React, { Fragment, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import { Box, Card, StyledLink, Text } from '@/components';
@@ -9,96 +10,114 @@ import {
   currentDocRole,
   useTransRole,
 } from '@/features/docs/doc-management';
+import { ModalVersion, Versions } from '@/features/docs/doc-versioning';
 import { useDate } from '@/hook';
 
+import { DocTagPublic } from './DocTagPublic';
 import { DocToolBox } from './DocToolBox';
 
 interface DocHeaderProps {
   doc: Doc;
+  versionId?: Versions['version_id'];
 }
 
-export const DocHeader = ({ doc }: DocHeaderProps) => {
+export const DocHeader = ({ doc, versionId }: DocHeaderProps) => {
   const { colorsTokens } = useCunninghamTheme();
   const { t } = useTranslation();
   const { formatDate } = useDate();
   const transRole = useTransRole();
+  const [isModalVersionOpen, setIsModalVersionOpen] = useState(false);
 
   return (
-    <Card
-      $margin="small"
-      aria-label={t('It is the card information about the document.')}
-    >
-      <Box $padding="small" $direction="row" $align="center">
-        <StyledLink href="/">
-          <Text
-            $isMaterialIcon
-            $theme="primary"
-            $size="2rem"
-            $css={`&:hover {background-color: ${colorsTokens()['primary-100']}; };`}
-            $hasTransition
-            $radius="5px"
-            $padding="tiny"
-          >
-            home
-          </Text>
-        </StyledLink>
-        <Box
-          $width="1px"
-          $height="70%"
-          $background={colorsTokens()['greyscale-100']}
-          $margin={{ horizontal: 'small' }}
-        />
-        <Text as="h2" $align="center" $margin={{ all: 'none', left: 'tiny' }}>
-          {doc.title}
-        </Text>
-        <DocToolBox doc={doc} />
-      </Box>
-      <Box
-        $direction="row"
-        $align="center"
-        $css="border-top:1px solid #eee"
-        $padding={{ horizontal: 'big', vertical: 'tiny' }}
-        $gap="0.5rem 2rem"
-        $justify="space-between"
-        $wrap="wrap"
+    <>
+      <Card
+        $margin="small"
+        aria-label={t('It is the card information about the document.')}
       >
-        <Box $direction="row" $align="center" $gap="0.5rem 2rem" $wrap="wrap">
-          {doc.is_public && (
+        <Box $padding="small" $direction="row" $align="center">
+          <StyledLink href="/">
             <Text
-              $weight="bold"
-              $background={colorsTokens()['primary-600']}
-              $color="white"
-              $padding="xtiny"
-              $radius="3px"
-              $size="s"
+              $isMaterialIcon
+              $theme="primary"
+              $size="2rem"
+              $css={`&:hover {background-color: ${colorsTokens()['primary-100']}; };`}
+              $hasTransition
+              $radius="5px"
+              $padding="tiny"
             >
-              {t('Public')}
+              home
             </Text>
-          )}
+          </StyledLink>
+          <Box
+            $width="1px"
+            $height="70%"
+            $background={colorsTokens()['greyscale-100']}
+            $margin={{ horizontal: 'small' }}
+          />
+          <Box $gap="1rem" $direction="row">
+            <Text
+              as="h2"
+              $align="center"
+              $margin={{ all: 'none', left: 'tiny' }}
+            >
+              {doc.title}
+            </Text>
+            {versionId && (
+              <Button
+                onClick={() => {
+                  setIsModalVersionOpen(true);
+                }}
+                size="small"
+              >
+                {t('Restore this version')}
+              </Button>
+            )}
+          </Box>
+          <DocToolBox doc={doc} />
+        </Box>
+        <Box
+          $direction="row"
+          $align="center"
+          $css="border-top:1px solid #eee"
+          $padding={{ horizontal: 'big', vertical: 'tiny' }}
+          $gap="0.5rem 2rem"
+          $justify="space-between"
+          $wrap="wrap"
+        >
+          <Box $direction="row" $align="center" $gap="0.5rem 2rem" $wrap="wrap">
+            <DocTagPublic doc={doc} />
+            <Text $size="s" $display="inline">
+              {t('Created at')} <strong>{formatDate(doc.created_at)}</strong>
+            </Text>
+            <Text $size="s" $display="inline" $elipsis $maxWidth="60vw">
+              {t('Owners:')}{' '}
+              <strong>
+                {doc.accesses
+                  .filter(
+                    (access) => access.role === Role.OWNER && access.user.email,
+                  )
+                  .map((access, index, accesses) => (
+                    <Fragment key={`access-${index}`}>
+                      {access.user.email}{' '}
+                      {index < accesses.length - 1 ? ' / ' : ''}
+                    </Fragment>
+                  ))}
+              </strong>
+            </Text>
+          </Box>
           <Text $size="s" $display="inline">
-            {t('Created at')} <strong>{formatDate(doc.created_at)}</strong>
-          </Text>
-          <Text $size="s" $display="inline" $elipsis $maxWidth="60vw">
-            {t('Owners:')}{' '}
-            <strong>
-              {doc.accesses
-                .filter(
-                  (access) => access.role === Role.OWNER && access.user.email,
-                )
-                .map((access, index, accesses) => (
-                  <Fragment key={`access-${index}`}>
-                    {access.user.email}{' '}
-                    {index < accesses.length - 1 ? ' / ' : ''}
-                  </Fragment>
-                ))}
-            </strong>
+            {t('Your role:')}{' '}
+            <strong>{transRole(currentDocRole(doc.abilities))}</strong>
           </Text>
         </Box>
-        <Text $size="s" $display="inline">
-          {t('Your role:')}{' '}
-          <strong>{transRole(currentDocRole(doc.abilities))}</strong>
-        </Text>
-      </Box>
-    </Card>
+      </Card>
+      {isModalVersionOpen && versionId && (
+        <ModalVersion
+          onClose={() => setIsModalVersionOpen(false)}
+          docId={doc.id}
+          versionId={versionId}
+        />
+      )}
+    </>
   );
 };

src/frontend/apps/impress/src/features/docs/doc-header/components/DocTagPublic.tsx

@@ -0,0 +1,31 @@
+import { useTranslation } from 'react-i18next';
+
+import { Text } from '@/components';
+import { useCunninghamTheme } from '@/cunningham';
+import { Doc, LinkReach } from '@/features/docs/doc-management';
+
+interface DocTagPublicProps {
+  doc: Doc;
+}
+
+export const DocTagPublic = ({ doc }: DocTagPublicProps) => {
+  const { colorsTokens } = useCunninghamTheme();
+  const { t } = useTranslation();
+
+  if (doc?.link_reach !== LinkReach.PUBLIC) {
+    return null;
+  }
+
+  return (
+    <Text
+      $weight="bold"
+      $background={colorsTokens()['primary-600']}
+      $color="white"
+      $padding="xtiny"
+      $radius="3px"
+      $size="s"
+    >
+      {t('Public')}
+    </Text>
+  );
+};

src/frontend/apps/impress/src/features/docs/doc-header/components/DocToolBox.tsx

@@ -9,6 +9,8 @@ import {
   ModalShare,
   ModalUpdateDoc,
 } from '@/features/docs/doc-management';
+import { useDocTableContentStore } from '@/features/docs/doc-table-content';
+import { useDocVersionStore } from '@/features/docs/doc-versioning';
 
 import { ModalPDF } from './ModalExport';
 
@@ -23,6 +25,8 @@ export const DocToolBox = ({ doc }: DocToolBoxProps) => {
   const [isModalRemoveOpen, setIsModalRemoveOpen] = useState(false);
   const [isModalPDFOpen, setIsModalPDFOpen] = useState(false);
   const [isDropOpen, setIsDropOpen] = useState(false);
+  const { setIsPanelVersionOpen } = useDocVersionStore();
+  const { setIsPanelTableContentOpen } = useDocTableContentStore();
 
   return (
     <Box
@@ -77,6 +81,18 @@ export const DocToolBox = ({ doc }: DocToolBoxProps) => {
               <Text $theme="primary">{t('Delete document')}</Text>
             </Button>
           )}
+          <Button
+            onClick={() => {
+              setIsPanelTableContentOpen(true);
+              setIsPanelVersionOpen(false);
+              setIsDropOpen(false);
+            }}
+            color="primary-text"
+            icon={<span className="material-icons">summarize</span>}
+            size="small"
+          >
+            <Text $theme="primary">{t('Table of content')}</Text>
+          </Button>
           <Button
             onClick={() => {
               setIsModalPDFOpen(true);

src/frontend/apps/impress/src/features/docs/doc-management/api/index.ts

@@ -1,3 +1,4 @@
 export * from './useDoc';
 export * from './useDocs';
 export * from './useUpdateDoc';
+export * from './useUpdateDocLink';

src/frontend/apps/impress/src/features/docs/doc-management/api/useCreateDoc.tsx

@@ -6,17 +6,13 @@ import { Doc } from '../types';
 
 import { KEY_LIST_DOC } from './useDocs';
 
-export type CreateDocParam = Pick<Doc, 'title' | 'is_public'>;
+export type CreateDocParam = Pick<Doc, 'title'>;
 
-export const createDoc = async ({
-  title,
-  is_public,
-}: CreateDocParam): Promise<Doc> => {
+export const createDoc = async ({ title }: CreateDocParam): Promise<Doc> => {
   const response = await fetchAPI(`documents/`, {
     method: 'POST',
     body: JSON.stringify({
       title,
-      is_public,
     }),
   });
 

src/frontend/apps/impress/src/features/docs/doc-management/api/useDoc.tsx

@@ -19,6 +19,7 @@ export const getDoc = async ({ id }: DocParams): Promise<Doc> => {
 };
 
 export const KEY_DOC = 'doc';
+export const KEY_DOC_VISIBILITY = 'doc-visibility';
 
 export function useDoc(
   param: DocParams,

src/frontend/apps/impress/src/features/docs/doc-management/api/useUpdateDoc.tsx

@@ -4,7 +4,7 @@ import { APIError, errorCauses, fetchAPI } from '@/api';
 import { Doc } from '@/features/docs';
 
 export type UpdateDocParams = Pick<Doc, 'id'> &
-  Partial<Pick<Doc, 'content' | 'title' | 'is_public'>>;
+  Partial<Pick<Doc, 'content' | 'title'>>;
 
 export const updateDoc = async ({
   id,

src/frontend/apps/impress/src/features/docs/doc-management/api/useUpdateDocLink.tsx

@@ -0,0 +1,51 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+import { Doc } from '@/features/docs';
+
+export type UpdateDocLinkParams = Pick<Doc, 'id'> &
+  Partial<Pick<Doc, 'link_role' | 'link_reach'>>;
+
+export const updateDocLink = async ({
+  id,
+  ...params
+}: UpdateDocLinkParams): Promise<Doc> => {
+  const response = await fetchAPI(`documents/${id}/link-configuration/`, {
+    method: 'PUT',
+    body: JSON.stringify({
+      ...params,
+    }),
+  });
+
+  if (!response.ok) {
+    throw new APIError(
+      'Failed to update the doc link',
+      await errorCauses(response),
+    );
+  }
+
+  return response.json() as Promise<Doc>;
+};
+
+interface UpdateDocLinkProps {
+  onSuccess?: (data: Doc) => void;
+  listInvalideQueries?: string[];
+}
+
+export function useUpdateDocLink({
+  onSuccess,
+  listInvalideQueries,
+}: UpdateDocLinkProps = {}) {
+  const queryClient = useQueryClient();
+  return useMutation<Doc, APIError, UpdateDocLinkParams>({
+    mutationFn: updateDocLink,
+    onSuccess: (data) => {
+      listInvalideQueries?.forEach((queryKey) => {
+        void queryClient.resetQueries({
+          queryKey: [queryKey],
+        });
+      });
+      onSuccess?.(data);
+    },
+  });
+}