✨(backend) create a dedicated endpoint to update document content

We want a dedicated endpoint to update a document content. Previously,
updating the content was made on the update action shared with all other
document's properties. When the title is updated, the response contains
the content, so a call to the s3 storage is made and we don't want this.
Isolating the content update will allow us in the next commit to remove
the content from the Document serializer.

src/backend/core/api/permissions.py

@@ -12,6 +12,7 @@ from core.models import DocumentAccess, RoleChoices, get_trashbin_cutoff
 ACTION_FOR_METHOD_TO_PERMISSION = {
     "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"},
     "children": {"GET": "children_list", "POST": "children_create"},
+    "content": {"PATCH": "content_patch"},
 }
 
 

src/backend/core/api/serializers.py

@@ -358,6 +358,34 @@ class DocumentSerializer(ListDocumentSerializer):
         return super().save(**kwargs)
 
 
+class DocumentContentSerializer(serializers.Serializer):
+    """Serializer for updating only the raw content of a document stored in S3."""
+
+    content = serializers.CharField(required=True)
+    websocket = serializers.BooleanField(required=False)
+
+    def validate_content(self, value):
+        """Validate the content field."""
+        try:
+            b64decode(value, validate=True)
+        except binascii.Error as err:
+            raise serializers.ValidationError("Invalid base64 content.") from err
+
+        return value
+
+    def update(self, instance, validated_data):
+        """
+        This serializer does not support updates.
+        """
+        raise NotImplementedError("Update is not supported for this serializer.")
+
+    def create(self, validated_data):
+        """
+        This serializer does not support create.
+        """
+        raise NotImplementedError("Create is not supported for this serializer.")
+
+
 class DocumentAccessSerializer(serializers.ModelSerializer):
     """Serialize document accesses."""
 

src/backend/core/api/viewsets.py

@@ -776,17 +776,15 @@ class DocumentViewSet(
     def perform_update(self, serializer):
         """Check rules about collaboration."""
         if (
-            serializer.validated_data.get("websocket", False)
-            or not settings.COLLABORATION_WS_NOT_CONNECTED_READY_ONLY
+            not serializer.validated_data.get("websocket", False)
+            and settings.COLLABORATION_WS_NOT_CONNECTED_READY_ONLY
+            and not self._can_user_edit_document(serializer.instance.id, set_cache=True)
         ):
-            return super().perform_update(serializer)
+            raise drf.exceptions.PermissionDenied(
+                "You are not allowed to edit this document."
+            )
 
-        if self._can_user_edit_document(serializer.instance.id, set_cache=True):
-            return super().perform_update(serializer)
-
-        raise drf.exceptions.PermissionDenied(
-            "You are not allowed to edit this document."
-        )
+        return super().perform_update(serializer)
 
     @drf.decorators.action(
         detail=True,
@@ -1851,6 +1849,68 @@ class DocumentViewSet(
 
         return drf.response.Response("authorized", headers=request.headers, status=200)
 
+    @drf.decorators.action(detail=True, methods=["patch"], url_path="content")
+    def content(self, request, *args, **kwargs):
+        """Update the raw Yjs content of a document stored in S3."""
+        document = self.get_object()
+        serializer = serializers.DocumentContentSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        if (
+            not serializer.validated_data.get("websocket", False)
+            and settings.COLLABORATION_WS_NOT_CONNECTED_READY_ONLY
+            and not self._can_user_edit_document(document.id, set_cache=True)
+        ):
+            raise drf.exceptions.PermissionDenied(
+                "You are not allowed to edit this document."
+            )
+
+        content = serializer.validated_data["content"]
+        try:
+            extracted_attachments = set(extract_attachments(content))
+        except ValueError:
+            return drf_response.Response(
+                "invalid yjs document", status=status.HTTP_400_BAD_REQUEST
+            )
+
+        existing_attachments = set(document.attachments or [])
+        new_attachments = extracted_attachments - existing_attachments
+        if new_attachments:
+            attachments_documents = (
+                models.Document.objects.filter(
+                    attachments__overlap=list(new_attachments)
+                )
+                .only("path", "attachments")
+                .order_by("path")
+            )
+
+            user = self.request.user
+            readable_per_se_paths = (
+                models.Document.objects.readable_per_se(user)
+                .order_by("path")
+                .values_list("path", flat=True)
+            )
+            readable_attachments_paths = filter_descendants(
+                [doc.path for doc in attachments_documents],
+                readable_per_se_paths,
+                skip_sorting=True,
+            )
+
+            readable_attachments = set()
+            for attachments_document in attachments_documents:
+                if attachments_document.path not in readable_attachments_paths:
+                    continue
+                readable_attachments.update(
+                    set(attachments_document.attachments) & new_attachments
+                )
+
+            # Update attachments with readable keys
+            document.attachments = list(existing_attachments | readable_attachments)
+        document.content = content
+        document.save()
+
+        return drf_response.Response(status=status.HTTP_204_NO_CONTENT)
+
     @drf.decorators.action(detail=True, methods=["get"], url_path="media-check")
     def media_check(self, request, *args, **kwargs):
         """