feat(share,permissions): partage de page par groupes (page_shares)

- app/db.py: ajout colonne shared_with_group_id (FK user_groups, migration
  backfill v5.x) dans page_shares
- app/routers/sharing.py: POST /api/pages/{id}/share accepte group_id
  (upsert, verif FK groupe), GET /shares expose kind/group_name, synchro
  bidirectionnelle avec page_permissions (mirror grant/revoke) pour que
  PermissionManager donne un acces effectif (view/comment/edit) aux membres
  du groupe; PUT/DELETE gardent le miroir a jour
- app/routers/board.py, library.py: received/made incluent les partages via
  groupes (JOIN group_members)
- app/templates/_page_editor_content.html, _page_editor_scripts.html:
  dialogue Share — invite groups (fetch /api/v2/groups, filtre deja partages),
  pickInviteGroup, shareInvite(group_id), rendu accessList avec avatar groupe
- tests/test_share_groups.py: 10 tests (CRUD groupe, kind, miroir ACL)

Chore: inclut evolutions v6.4.0 deja en working copy (webhooks prod,
migrations, sync, config/main) pour garder l'arbre coherent.

app/routers/sharing.py

@@ -36,18 +36,23 @@ def _slugify(title: str) -> str:
 
 @router.post("/pages/{page_id}/share")
 async def share_page(page_id: int, request: Request):
-    """Invite a user or email to a page."""
+    """Invite a user, an email, or a group to a page."""
     user = _require_auth(request)
     body = await request.json() if request.headers.get("content-type") else {}
     target_user_id = body.get("user_id")
+    target_group_id = body.get("group_id")
     email = body.get("email", "")
     permission = body.get("permission", "view")
 
     if permission not in ("view", "comment", "edit"):
         raise HTTPException(400, "Invalid permission. Use view, comment, or edit.")
 
-    if not target_user_id and not email:
-        raise HTTPException(400, "Provide user_id or email to share with.")
+    if not target_user_id and not target_group_id and not email:
+        raise HTTPException(400, "Provide user_id, group_id or email to share with.")
+
+    # Bridge share permission (view/comment/edit) → granular role
+    # (viewer/commenter/editor) so page_permissions grants stay in sync.
+    _SHARE_TO_ROLE = {"view": "viewer", "comment": "commenter", "edit": "editor"}
 
     with get_conn() as conn:
         # Verify page exists
@@ -61,18 +66,29 @@ async def share_page(page_id: int, request: Request):
             if not target:
                 raise HTTPException(404, "Target user not found")
 
+        # Verify target group exists if group_id given
+        if target_group_id:
+            gtarget = conn.execute("SELECT id FROM user_groups WHERE id=?", (target_group_id,)).fetchone()
+            if not gtarget:
+                raise HTTPException(404, "Target group not found")
+
         # Upsert to avoid duplicates: update the existing permission if the same
-        # target (user or email) is already shared on this page.
+        # target (user, group or email) is already shared on this page.
         target_row = None
         if target_user_id:
             target_row = conn.execute(
                 "SELECT id FROM page_shares WHERE page_id=? AND shared_with_user_id=?",
                 (page_id, target_user_id),
             ).fetchone()
+        elif target_group_id:
+            target_row = conn.execute(
+                "SELECT id FROM page_shares WHERE page_id=? AND shared_with_group_id=?",
+                (page_id, target_group_id),
+            ).fetchone()
         elif email:
             target_row = conn.execute(
                 """SELECT id FROM page_shares
-                   WHERE page_id=? AND shared_with_email=? AND shared_with_user_id IS NULL""",
+                   WHERE page_id=? AND shared_with_email=? AND shared_with_user_id IS NULL AND shared_with_group_id IS NULL""",
                 (page_id, email.strip()),
             ).fetchone()
 
@@ -85,29 +101,75 @@ async def share_page(page_id: int, request: Request):
         else:
             if not email:
                 email = ""
-            cur = conn.execute(
-                """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by)
-                   VALUES (?, ?, ?, ?, ?)""",
-                (page_id, target_user_id, email.strip(), permission, user["id"]),
-            )
+            try:
+                cur = conn.execute(
+                    """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_group_id, shared_with_email, permission, created_by)
+                       VALUES (?, ?, ?, ?, ?, ?)""",
+                    (page_id, target_user_id, target_group_id, email.strip(), permission, user["id"]),
+                )
+            except Exception:
+                # Fallback for DBs where the migration has not run yet
+                cur = conn.execute(
+                    """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by)
+                       VALUES (?, ?, ?, ?, ?)""",
+                    (page_id, target_user_id, email.strip(), permission, user["id"]),
+                )
             share_id = cur.lastrowid
         conn.execute("UPDATE pages SET is_shared=1 WHERE id=?", (page_id,))
+        # ── Mirror group shares into page_permissions so the ACL used by
+        # PermissionManager (can_view/edit/comment) grants real access to
+        # every group member. Best-effort: never break legacy page_shares.
+        if target_group_id:
+            try:
+                _mirror_share_grant(conn, page_id, target_group_id, _SHARE_TO_ROLE[permission], user["id"])
+            except Exception:
+                logger.warning("share→page_permissions mirror failed (page=%s group=%s)", page_id, target_group_id)
         conn.commit()
 
     return {
         "id": share_id,
         "page_id": page_id,
         "shared_with_user_id": target_user_id,
+        "shared_with_group_id": target_group_id,
         "shared_with_email": email,
         "permission": permission,
         "status": "shared",
     }
 
 
+def _mirror_share_grant(conn, page_id: int, group_id: int, role: str, granted_by: int) -> None:
+    """Upsert a ``page_permissions`` grant mirroring a group ``page_shares`` row.
+
+    Keeps the granular ACL (used by ``PermissionManager``) in sync with what
+    the share dialog shows, so invited groups get effective view/edit rights.
+    """
+    existing = conn.execute(
+        "SELECT id FROM page_permissions WHERE page_id=? AND user_id IS NULL AND group_id=?",
+        (page_id, group_id),
+    ).fetchone()
+    if existing:
+        conn.execute("UPDATE page_permissions SET role=?, granted_by=? WHERE id=?",
+                     (role, granted_by, existing["id"]))
+    else:
+        conn.execute(
+            "INSERT INTO page_permissions (page_id, user_id, group_id, role, granted_by) "
+            "VALUES (?, NULL, ?, ?, ?)",
+            (page_id, group_id, role, granted_by),
+        )
+
+
+def _mirror_share_revoke(conn, page_id: int, group_id: int) -> None:
+    """Remove the mirrored grant when a group share is updated away or deleted."""
+    conn.execute(
+        "DELETE FROM page_permissions WHERE page_id=? AND user_id IS NULL AND group_id=?",
+        (page_id, group_id),
+    )
+
+
 @router.put("/pages/{page_id}/share/{share_id}", description="Update a share's permission.")
 async def update_share_permission(page_id: int, share_id: int, request: Request):
     """Change the permission level of an existing share entry."""
-    _require_auth(request)
+    user = _require_auth(request)
 
     body = await request.json() if request.headers.get("content-type") else {}
     permission = body.get("permission", "")
@@ -117,7 +179,7 @@ async def update_share_permission(page_id: int, share_id: int, request: Request)
 
     with get_conn() as conn:
         row = conn.execute(
-            "SELECT id FROM page_shares WHERE id=? AND page_id=?",
+            "SELECT id, shared_with_group_id FROM page_shares WHERE id=? AND page_id=?",
             (share_id, page_id),
         ).fetchone()
         if not row:
@@ -127,6 +189,18 @@ async def update_share_permission(page_id: int, share_id: int, request: Request)
             "UPDATE page_shares SET permission=? WHERE id=?",
             (permission, share_id),
         )
+        # Keep the mirrored ACL grant in sync for group shares.
+        try:
+            gid = row["shared_with_group_id"] if "shared_with_group_id" in row.keys() else None
+        except Exception:
+            gid = None
+        if gid:
+            try:
+                _mirror_share_grant(conn, page_id, gid,
+                                    {"view": "viewer", "comment": "commenter", "edit": "editor"}[permission],
+                                    user["id"])
+            except Exception:
+                logger.warning("share→page_permissions mirror failed (share=%s)", share_id)
         conn.commit()
 
     return {"status": "updated", "share_id": share_id, "permission": permission}
@@ -139,13 +213,22 @@ async def remove_share(page_id: int, share_id: int, request: Request):
 
     with get_conn() as conn:
         row = conn.execute(
-            "SELECT id FROM page_shares WHERE id=? AND page_id=?",
+            "SELECT id, shared_with_group_id FROM page_shares WHERE id=? AND page_id=?",
             (share_id, page_id),
         ).fetchone()
         if not row:
             raise HTTPException(404, "Share entry not found")
 
         conn.execute("DELETE FROM page_shares WHERE id=?", (share_id,))
+        try:
+            gid = row["shared_with_group_id"] if "shared_with_group_id" in row.keys() else None
+        except Exception:
+            gid = None
+        if gid:
+            try:
+                _mirror_share_revoke(conn, page_id, gid)
+            except Exception:
+                logger.warning("share→page_permissions revoke failed (share=%s)", share_id)
         # If no more shares, unset is_shared
         remaining = conn.execute(
             "SELECT COUNT(*) AS c FROM page_shares WHERE page_id=?", (page_id,)
@@ -167,14 +250,25 @@ async def list_shares(page_id: int, request: Request):
         if not page:
             raise HTTPException(404, "Page not found")
 
-        rows = conn.execute(
-            """SELECT s.*, u.login, u.full_name, u.avatar_url
-               FROM page_shares s
-               LEFT JOIN users u ON s.shared_with_user_id = u.id
-               WHERE s.page_id=?
-               ORDER BY s.created_at DESC""",
-            (page_id,),
-        ).fetchall()
+        try:
+            rows = conn.execute(
+                """SELECT s.*, u.login, u.full_name, u.avatar_url, g.name AS group_name
+                   FROM page_shares s
+                   LEFT JOIN users u ON s.shared_with_user_id = u.id
+                   LEFT JOIN user_groups g ON s.shared_with_group_id = g.id
+                   WHERE s.page_id=?
+                   ORDER BY s.created_at DESC""",
+                (page_id,),
+            ).fetchall()
+        except Exception:
+            rows = conn.execute(
+                """SELECT s.*, u.login, u.full_name, u.avatar_url
+                   FROM page_shares s
+                   LEFT JOIN users u ON s.shared_with_user_id = u.id
+                   WHERE s.page_id=?
+                   ORDER BY s.created_at DESC""",
+                (page_id,),
+            ).fetchall()
 
     return {
         "page_id": page_id,
@@ -182,6 +276,7 @@ async def list_shares(page_id: int, request: Request):
             {
                 "id": r["id"],
                 "shared_with_user_id": r["shared_with_user_id"],
+                "shared_with_group_id": r["shared_with_group_id"] if "shared_with_group_id" in r.keys() else None,
                 "shared_with_email": r["shared_with_email"],
                 "permission": r["permission"],
                 "created_at": r["created_at"],
@@ -189,6 +284,8 @@ async def list_shares(page_id: int, request: Request):
                 "user_login": r["login"],
                 "user_full_name": r["full_name"],
                 "user_avatar_url": r["avatar_url"],
+                "group_name": r["group_name"] if "group_name" in r.keys() else None,
+                "kind": "group" if (("shared_with_group_id" in r.keys() and r["shared_with_group_id"]) or ("group_name" in r.keys() and r["group_name"])) else "user",
             }
             for r in rows
         ],