POC: delegate tree and sharing to Drive

compose-e2e.yml

@@ -6,12 +6,12 @@ services:
       dockerfile: ./src/frontend/Dockerfile
       target: frontend-production
       args:
-        API_ORIGIN: "http://localhost:8071"
+        API_ORIGIN: "http://localhost:8072"
         PUBLISH_AS_MIT: "false"
         SW_DEACTIVATED: "true"
     image: impress:frontend-production
     ports:
-      - "3000:3000"
+      - "3001:3000"
 
   y-provider:
     user: ${DOCKER_USER:-1000}
@@ -25,7 +25,7 @@ services:
       - env.d/development/common
       - env.d/development/common.local
     ports:
-      - "4444:4444"
+      - "4445:4444"
 
   y-provider-converter:
     user: ${DOCKER_USER:-1000}

compose.yml

@@ -22,7 +22,7 @@ services:
   mailcatcher:
     image: sj26/mailcatcher:latest
     ports:
-      - "1081:1080"
+      - "1082:1080"
 
   minio:
     user: ${DOCKER_USER:-1000}
@@ -31,8 +31,8 @@ services:
       - MINIO_ROOT_USER=impress
       - MINIO_ROOT_PASSWORD=password
     ports:
-      - "9000:9000"
-      - "9001:9001"
+      - "9002:9000"
+      - "9003:9001"
     healthcheck:
       test: ["CMD", "mc", "ready", "local"]
       interval: 1s
@@ -73,7 +73,7 @@ services:
       - env.d/development/postgresql
       - env.d/development/postgresql.local
     ports:
-      - "8071:8000"
+      - "8072:8000"
     networks:
       default: {}
       lasuite:
@@ -118,7 +118,7 @@ services:
   nginx:
     image: nginx:1.25
     ports:
-      - "8083:8083"
+      - "8084:8083"
     networks:
       default: {}
       lasuite:
@@ -129,21 +129,14 @@ services:
     depends_on:
       app-dev:
         condition: service_started
-      keycloak:
-        condition: service_healthy
-        restart: true
 
   nginx-frontend:
     image: nginx:1.25
     ports:
-      - "3000:3000"
+      - "3001:3000"
     volumes:
       - ./src/frontend/apps/impress/conf/default.conf:/etc/nginx/conf.d/impress.conf
       - ./src/frontend/apps/impress/out:/app
-    depends_on:
-      keycloak:
-        condition: service_healthy
-        restart: true
 
   frontend-development:
     user: "${DOCKER_USER:-1000}"
@@ -152,16 +145,18 @@ services:
       dockerfile: ./src/frontend/Dockerfile
       target: impress-dev
       args:
-        API_ORIGIN: "http://localhost:8071"
+        API_ORIGIN: "http://localhost:8072"
         PUBLISH_AS_MIT: "false"
         SW_DEACTIVATED: "true"
     image: impress:frontend-development
+    environment:
+      - NEXT_PUBLIC_API_ORIGIN=http://localhost:8072
     volumes:
       - ./src/frontend:/home/frontend
       - /home/frontend/node_modules
       - /home/frontend/apps/impress/node_modules
     ports:
-      - "3000:3000"
+      - "3001:3000"
 
   crowdin:
     image: crowdin/cli:3.16.0
@@ -193,7 +188,7 @@ services:
       - env.d/development/common
       - env.d/development/common.local
     ports:
-      - "4444:4444"
+      - "4445:4444"
     volumes:
       - ./src/frontend/:/home/frontend
       - /home/frontend/node_modules
@@ -252,7 +247,7 @@ services:
       timeout: 2s
       retries: 300
     ports:
-      - "8080:8080"
+      - "8082:8080"
     depends_on:
       kc_postgresql:
         condition: service_healthy

docker/files/etc/nginx/conf.d/default.conf

@@ -37,16 +37,7 @@ server {
         proxy_set_header X-Original-Method $request_method;
     }
 
-    location / {
-        proxy_pass http://keycloak:8080;
-        proxy_set_header Host $http_host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        # Increase proxy buffer size to allow keycloak to send large
-        # header responses when a user is created.
-        proxy_buffer_size 128k;
-        proxy_buffers 4 256k;
-        proxy_busy_buffers_size 256k;
-    }
+    # Authentication is delegated to Drive's Keycloak (single shared
+    # instance, reachable on http://localhost:8083), so this server only
+    # handles media.
 }

env.d/development/common

@@ -18,42 +18,43 @@ PYTHONPATH=/app
 # Mail
 DJANGO_EMAIL_BRAND_NAME="La Suite Numérique"
 DJANGO_EMAIL_HOST="mailcatcher"
-DJANGO_EMAIL_LOGO_IMG="http://localhost:3000/assets/logo-suite-numerique.png"
+DJANGO_EMAIL_LOGO_IMG="http://localhost:3001/assets/logo-suite-numerique.png"
 DJANGO_EMAIL_PORT=1025
-DJANGO_EMAIL_URL_APP="http://localhost:3000"
+DJANGO_EMAIL_URL_APP="http://localhost:3001"
 
 # Backend url
 IMPRESS_BASE_URL="http://localhost:8072"
+DJANGO_CSRF_TRUSTED_ORIGINS=http://localhost:8072,http://localhost:3001
 
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
 AWS_S3_ENDPOINT_URL=http://minio:9000
 AWS_S3_ACCESS_KEY_ID=impress
 AWS_S3_SECRET_ACCESS_KEY=password
-MEDIA_BASE_URL=http://localhost:8083
+MEDIA_BASE_URL=http://localhost:8084
 
 # OIDC
-OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/certs
-OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/impress/protocol/openid-connect/auth
-OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/token
-OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/userinfo
-OIDC_OP_INTROSPECTION_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/token/introspect
+OIDC_OP_JWKS_ENDPOINT=http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/certs
+OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/drive/protocol/openid-connect/auth
+OIDC_OP_TOKEN_ENDPOINT=http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/token
+OIDC_OP_USER_ENDPOINT=http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/userinfo
+OIDC_OP_INTROSPECTION_ENDPOINT=http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/token/introspect
 
 OIDC_RP_CLIENT_ID=impress
 OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
 OIDC_RP_SIGN_ALGO=RS256
 OIDC_RP_SCOPES="openid email"
 
-LOGIN_REDIRECT_URL=http://localhost:3000
-LOGIN_REDIRECT_URL_FAILURE=http://localhost:3000
-LOGOUT_REDIRECT_URL=http://localhost:3000
+LOGIN_REDIRECT_URL=http://localhost:3001
+LOGIN_REDIRECT_URL_FAILURE=http://localhost:3001
+LOGOUT_REDIRECT_URL=http://localhost:3001
 
-OIDC_REDIRECT_ALLOWED_HOSTS="localhost:8083,localhost:3000"
+OIDC_REDIRECT_ALLOWED_HOSTS="localhost:8083,localhost:3001"
 OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
 
 # Resource Server Backend
-OIDC_OP_URL=http://localhost:8083/realms/docs
-OIDC_OP_INTROSPECTION_ENDPOINT = http://nginx:8083/realms/docs/protocol/openid-connect/token/introspect
+OIDC_OP_URL=http://localhost:8083/realms/drive
+OIDC_OP_INTROSPECTION_ENDPOINT = http://drive-keycloak-1:8080/realms/drive/protocol/openid-connect/token/introspect
 OIDC_RESOURCE_SERVER_ENABLED=False
 OIDC_RS_CLIENT_ID=docs
 OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
@@ -69,18 +70,18 @@ OIDC_RS_ALLOWED_AUDIENCES=""
 # OIDC_STORE_REFRESH_TOKEN_KEY="your-32-byte-encryption-key=="
 
 # User reconciliation
-USER_RECONCILIATION_FORM_URL=http://localhost:3000
+USER_RECONCILIATION_FORM_URL=http://localhost:3001
 
 # Collaboration
 COLLABORATION_API_URL=http://y-provider-development:4444/collaboration/api/
 COLLABORATION_BACKEND_BASE_URL=http://app-dev:8000
-COLLABORATION_SERVER_ORIGIN=http://localhost:3000
+COLLABORATION_SERVER_ORIGIN=http://localhost:3001
 COLLABORATION_SERVER_SECRET=my-secret
 COLLABORATION_WS_NOT_CONNECTED_READ_ONLY=true
-COLLABORATION_WS_URL=ws://localhost:4444/collaboration/ws/
+COLLABORATION_WS_URL=ws://localhost:4445/collaboration/ws/
 COLLABORATION_WS_INACTIVITY_TIMEOUT=15 # Seconds
 
-DJANGO_SERVER_TO_SERVER_API_TOKENS=server-api-token
+DJANGO_SERVER_TO_SERVER_API_TOKENS=server-api-token,docs-drive-poc-secret
 Y_PROVIDER_API_BASE_URL=http://y-provider-development-converter:4444/api/
 Y_PROVIDER_API_KEY=yprovider-api-key
 
@@ -97,3 +98,7 @@ SEARCH_URL=http://find:8000/api/v1.0/documents/search/
 SEARCH_INDEXER_QUERY_LIMIT=50
 
 CONVERSION_UPLOAD_ENABLED=true
+
+# Docs <-> Drive POC integration
+DRIVE_API_BASE_URL=http://drive-app-dev-1:8000/api/v1.0
+DRIVE_SERVER_TO_SERVER_TOKEN=docs-drive-poc-secret

env.d/development/kc_auth

@@ -1,6 +1,6 @@
 # Keycloak
 
-KC_HOSTNAME=http://localhost:8083
+KC_HOSTNAME=http://localhost:8084
 KEYCLOAK_ADMIN: admin
 KEYCLOAK_ADMIN_PASSWORD: admin
 KC_DB: postgres

src/backend/core/admin.py

@@ -8,7 +8,6 @@
 from django.shortcuts import redirect
 from django.utils.translation import gettext_lazy as _
 
-from treebeard.admin import TreeAdmin
 
 from core import models
 from core.tasks.user_reconciliation import user_reconciliation_csv_import_job
@@ -164,16 +163,8 @@ class UserReconciliationAdmin(admin.ModelAdmin):
     actions = [process_reconciliation]
 
 
-class DocumentAccessInline(admin.TabularInline):
-    """Inline admin class for document accesses."""
-
-    autocomplete_fields = ["user"]
-    model = models.DocumentAccess
-    extra = 0
-
-
 @admin.register(models.Document)
-class DocumentAdmin(TreeAdmin):
+class DocumentAdmin(admin.ModelAdmin):
     """Document admin interface declaration."""
 
     fieldsets = (
@@ -183,76 +174,23 @@ class DocumentAdmin(TreeAdmin):
                 "fields": (
                     "id",
                     "title",
-                )
-            },
-        ),
-        (
-            _("Permissions"),
-            {
-                "fields": (
                     "creator",
-                    "link_reach",
-                    "link_role",
-                )
-            },
-        ),
-        (
-            _("Tree structure"),
-            {
-                "fields": (
-                    "path",
-                    "depth",
-                    "numchild",
-                    "duplicated_from",
                     "attachments",
                 )
             },
         ),
     )
-    inlines = (DocumentAccessInline,)
     list_display = (
         "id",
         "title",
-        "link_reach",
-        "link_role",
         "created_at",
         "updated_at",
     )
     readonly_fields = (
         "attachments",
         "creator",
-        "depth",
-        "duplicated_from",
         "id",
-        "numchild",
-        "path",
     )
     search_fields = ("id", "title")
 
 
-@admin.register(models.Invitation)
-class InvitationAdmin(admin.ModelAdmin):
-    """Admin interface to handle invitations."""
-
-    fields = (
-        "email",
-        "document",
-        "role",
-        "created_at",
-        "issuer",
-    )
-    readonly_fields = (
-        "created_at",
-        "is_expired",
-        "issuer",
-    )
-    list_display = (
-        "email",
-        "document",
-        "created_at",
-        "is_expired",
-    )
-
-    def save_model(self, request, obj, form, change):
-        obj.issuer = request.user
-        obj.save()