🐛(backend) fix computed_link_role computation

By default a document is restricted, but with
inheritance it can be authenticated.
We updated the way max_role is computed
by taking in consideration that a document
can still be in a restricted type.

Author: AntoLC

CHANGELOG.md

@@ -22,6 +22,7 @@ and this project adheres to
 
 - 🐛(makefile) Windows compatibility fix for Docker volume mounting #1264
 - 🐛(minio) fix user permission error with Minio and Windows #1264
+- 🐛link role update #1287
 
 
 ## [3.5.0] - 2025-07-31

src/backend/core/choices.py

@@ -88,7 +88,7 @@ def get_equivalent_link_definition(ancestors_links):
     """
     Return the (reach, role) pair with:
     1. Highest reach
-    2. Highest role among links having that reach
+    2. Highest role among links having that reach, or from restricted links when max_reach is higher
     """
     if not ancestors_links:
         return {"link_reach": None, "link_role": None}
@@ -99,17 +99,17 @@ def get_equivalent_link_definition(ancestors_links):
         key=lambda link: LinkReachChoices.get_priority(link["link_reach"]),
     )["link_reach"]
 
-    # 2) Among those, find the highest role (ignore role if RESTRICTED)
+    # 2) Among those, find the highest role
     if max_reach == LinkReachChoices.RESTRICTED:
         max_role = None
     else:
-        max_role = max(
-            (
-                link["link_role"]
-                for link in ancestors_links
-                if link["link_reach"] == max_reach
-            ),
-            key=LinkRoleChoices.get_priority,
-        )
+        eligible_roles = [
+            link["link_role"]
+            for link in ancestors_links
+            if (link["link_reach"] == max_reach or 
+                link["link_reach"] == LinkReachChoices.RESTRICTED)
+        ]
+        
+        max_role = max(eligible_roles, key=LinkRoleChoices.get_priority) if eligible_roles else None
 
     return {"link_reach": max_reach, "link_role": max_role}

src/backend/core/tests/documents/test_api_documents_link_configuration.py

@@ -158,3 +158,39 @@ def test_api_documents_link_configuration_update_authenticated_related_success(
         document_values = serializers.LinkDocumentSerializer(instance=document).data
         for key, value in document_values.items():
             assert value == new_document_values[key]
+
+def test_api_documents_link_configuration_update_role_is_computed():
+    """
+    Test that the computed link_role is updated correctly when the link_role changes.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    parent_document = factories.DocumentFactory(
+        link_reach=models.LinkReachChoices.AUTHENTICATED,
+        link_role=models.LinkRoleChoices.READER,
+    )
+
+    factories.UserDocumentAccessFactory(
+        document=parent_document, user=user, role=models.RoleChoices.OWNER
+    )
+
+    child_document = factories.DocumentFactory(
+        parent=parent_document,
+        link_reach=models.Document._meta.get_field('link_reach').default,
+        link_role=models.Document._meta.get_field('link_role').default,
+    )
+
+    new_data = {"link_role": models.LinkRoleChoices.EDITOR}
+
+    response = client.put(
+        f"/api/v1.0/documents/{child_document.id!s}/link-configuration/",
+        new_data,
+        format="json",
+    )
+
+    assert response.status_code == 200
+
+    child_document = models.Document.objects.get(pk=child_document.pk)
+    assert child_document.computed_link_role == models.LinkRoleChoices.EDITOR

src/frontend/apps/e2e/__tests__/app-impress/doc-inherited-share.spec.ts

@@ -52,6 +52,12 @@ test.describe('Inherited share accesses', () => {
     await expect(docVisibilityCard.getByText('Connected')).toBeVisible();
     await expect(docVisibilityCard.getByText('Reading')).toBeVisible();
 
+    await docVisibilityCard.getByText('Reading').click();
+    await page.getByRole('menuitem', { name: 'Editing' }).click();
+
+    await expect(docVisibilityCard.getByText('Reading')).toBeHidden();
+    await expect(docVisibilityCard.getByText('Editing')).toBeVisible();
+
     // Verify inherited link
     await docVisibilityCard.getByText('Connected').click();
     await expect(
@@ -61,17 +67,13 @@ test.describe('Inherited share accesses', () => {
     // Update child link
     await page.getByRole('menuitem', { name: 'Public' }).click();
 
-    await docVisibilityCard.getByText('Reading').click();
-    await page.getByRole('menuitem', { name: 'Editing' }).click();
-
     await expect(docVisibilityCard.getByText('Connected')).toBeHidden();
-    await expect(docVisibilityCard.getByText('Reading')).toBeHidden();
     await expect(
       docVisibilityCard.getByText('Public', {
         exact: true,
       }),
     ).toBeVisible();
-    await expect(docVisibilityCard.getByText('Editing')).toBeVisible();
+
     await expect(
       docVisibilityCard.getByText(
         'The link sharing rules differ from the parent document',