✨ POC: integrate Docs documents in the Drive tree

docker/auth/realm.json

@@ -752,6 +752,60 @@
           "microprofile-jwt"
         ]
       },
+      {
+        "id": "97a9c274-3f21-4c3e-8f6a-bcadd0e51a02",
+        "clientId": "impress",
+        "name": "",
+        "description": "",
+        "rootUrl": "",
+        "adminUrl": "",
+        "baseUrl": "",
+        "surrogateAuthRequired": false,
+        "enabled": true,
+        "alwaysDisplayInConsole": false,
+        "clientAuthenticatorType": "client-secret",
+        "secret": "ThisIsAnExampleKeyForDevPurposeOnly",
+        "redirectUris": [
+          "http://localhost:8072/*",
+          "http://localhost:3001/*"
+        ],
+        "webOrigins": [
+          "http://localhost:3001"
+        ],
+        "notBefore": 0,
+        "bearerOnly": false,
+        "consentRequired": false,
+        "standardFlowEnabled": true,
+        "implicitFlowEnabled": false,
+        "directAccessGrantsEnabled": false,
+        "serviceAccountsEnabled": false,
+        "publicClient": false,
+        "frontchannelLogout": true,
+        "protocol": "openid-connect",
+        "attributes": {
+          "access.token.lifespan": "-1",
+          "user.info.response.signature.alg": "RS256",
+          "post.logout.redirect.uris": "http://localhost:3001/*",
+          "use.refresh.tokens": "true",
+          "acr.loa.map": "{}"
+        },
+        "authenticationFlowBindingOverrides": {},
+        "fullScopeAllowed": true,
+        "nodeReRegistrationTimeout": -1,
+        "defaultClientScopes": [
+          "web-origins",
+          "acr",
+          "roles",
+          "profile",
+          "email"
+        ],
+        "optionalClientScopes": [
+          "address",
+          "phone",
+          "offline_access",
+          "microprofile-jwt"
+        ]
+      },
       {
         "id": "869481d0-5774-4e64-bc30-fedc7c58958g",
         "clientId": "deploycenter",

env.d/development/common

@@ -111,3 +111,9 @@ MALWARE_DETECTION_DUMMY_SLEEP=10
 # Must be a valid Fernet key (32 url-safe base64-encoded bytes)
 # To create one, use the bin/fernetkey command.
 # OIDC_STORE_REFRESH_TOKEN_KEY="your-32-byte-encryption-key=="
+
+# Docs <-> Drive POC integration
+SERVER_TO_SERVER_API_TOKENS=docs-drive-poc-secret
+FRONTEND_DOCS_URL=http://localhost:3001
+DOCS_API_BASE_URL=http://docs-app-dev-1:8000/api/v1.0
+DOCS_SERVER_TO_SERVER_TOKEN=docs-drive-poc-secret

src/backend/core/api/filters.py

@@ -22,6 +22,9 @@ class ItemFilter(django_filters.FilterSet):
     title = django_filters.CharFilter(
         field_name="title", lookup_expr="unaccent__icontains", label=_("Title")
     )
+    external_app = django_filters.CharFilter(
+        field_name="metadata__external_app", label=_("External app")
+    )
     category = django_filters.ChoiceFilter(
         method="filter_category", label=_("File type"), choices=enums.FILE_CATEGORY_CHOICES
     )

src/backend/core/api/permissions.py

@@ -11,6 +11,7 @@
 ACTION_FOR_METHOD_TO_PERMISSION = {
     "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"},
     "children": {"GET": "children_list", "POST": "children_create"},
+    "tree_descendants": {"GET": "tree"},
 }
 
 

src/backend/core/api/serializers.py

@@ -268,6 +268,7 @@
             "deleted_at",
             "hard_delete_at",
             "is_wopi_supported",
+            "metadata",
         ]
         read_only_fields = [
             "id",
@@ -298,6 +299,7 @@
             "deleted_at",
             "hard_delete_at",
             "is_wopi_supported",
+            "metadata",
         ]
 
     def to_representation(self, instance):
@@ -421,6 +423,7 @@
             "deleted_at",
             "hard_delete_at",
             "is_wopi_supported",
+            "metadata",
         ]
         read_only_fields = [
             "id",
@@ -446,6 +449,7 @@
             "deleted_at",
             "hard_delete_at",
             "is_wopi_supported",
+            "metadata",
         ]
 
 
@@ -498,6 +502,7 @@
             "deleted_at",
             "hard_delete_at",
             "is_wopi_supported",
+            "metadata",
         ]
         read_only_fields = [
             "id",
@@ -528,6 +533,7 @@
             "deleted_at",
             "hard_delete_at",
             "is_wopi_supported",
+            "metadata",
         ]
 
     def create(self, validated_data):
@@ -539,7 +545,7 @@
             if instance.depth > 1:
                 validated_data["title"] = instance.manage_unique_title(validated_data.get("title"))
 
-            if instance.type == models.ItemTypeChoices.FILE:
+            if instance.type == models.ItemTypeChoices.FILE and not instance.is_external:
                 # Just check for validation, the real filename
                 # will be use later in the rename_file task
                 utils.sanitize_filename(validated_data["title"])
@@ -601,6 +607,7 @@
             "description",
             "hard_delete_at",
             "extension",
+            "metadata",
         ]
         read_only_fields = [
             "abilities",
@@ -651,8 +658,16 @@
     def validate(self, attrs):
         """Validate that filename is set for files."""
         extension = attrs.get("extension")
+        is_external = bool((attrs.get("metadata") or {}).get("external_app"))
 
-        if attrs["type"] == models.ItemTypeChoices.FILE:
+        if attrs["type"] == models.ItemTypeChoices.FILE and is_external:
+            # External items point to a resource hosted by another app: they have
+            # no filename and no physical file, only a title.
+            if not attrs.get("title"):
+                raise serializers.ValidationError(
+                    {"title": _("This field is required.")},
+                )
+        elif attrs["type"] == models.ItemTypeChoices.FILE:
             if extension:
                 # Template-based creation: title is required, filename is computed
                 if not attrs.get("title"):