feat(collaboration): 完善在线文档协作与通知闭环

- 新增协作文件夹、文件、不可变修订、成员、会话、回调回执、编辑申请与分享链接数据模型。

- 补齐新建、导入、复制、下载、回收站、恢复、成员授权、所有权转让及文件级权限接口。

- 接入 ONLYOFFICE 共同编辑、历史版本预览与恢复、修订另存副本、导出下载审计和幂等回调保存。

- 增加编辑权限申请、审批通知、项目提醒聚合、通知 Feed、已读处理及历史待办数据回填。

- 支持公开分享的查看或编辑模式、有效期、密码哈希、失败锁定、短时访问凭证与固定分享地址。

- 增加协作者导出、申请编辑、工作表结构保护和所有权管理策略，并纳入项目接口权限矩阵。

- 新增协作文件库、编辑工作区、公开分享页、下载与另存为对话框，以及导航、路由和权限入口。

- 统一网页端与桌面端通知布局，增加沉浸式工作区和浏览器、Tauri 双端全屏能力。

- 扩展运行时文件下载适配、Tauri 环境识别和原生全屏命令，继续保持业务代码运行时边界。

- 加固 ONLYOFFICE 消息桥的同源下载、签名地址隔离和保存为能力校验，并更新桌面发布检查。

- 增加连续数据库迁移、50MB 上传限制、OnlyOffice 中文文案与开发启动路由校验。

- 补充协作、通知、权限、路由、运行时、布局和 OnlyOffice 相关测试及模块说明文档。

backend/app/api/v1/collaboration.py

@@ -0,0 +1,629 @@
+from __future__ import annotations
+
+import uuid
+
+from fastapi import APIRouter, Depends, File, Form, Header, Request, Response, UploadFile, status
+from fastapi.responses import FileResponse
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_current_user, get_db_session, require_api_permission
+from app.schemas.collaboration import (
+    CollaborationCallbackPayload,
+    CollaborationCandidateRead,
+    CollaborationEditorConfigRead,
+    CollaborationEditRequestRead,
+    CollaborationEditRequestResolve,
+    CollaborationExportRecord,
+    CollaborationFileCreate,
+    CollaborationFileRead,
+    CollaborationFileUpdate,
+    CollaborationFolderCreate,
+    CollaborationFolderRead,
+    CollaborationFolderUpdate,
+    CollaborationMemberRead,
+    CollaborationMemberUpsert,
+    CollaborationOwnershipTransferRequest,
+    CollaborationPublicEditorConfigRequest,
+    CollaborationPublicShareMetadata,
+    CollaborationRestoreRequest,
+    CollaborationRevisionCopyRequest,
+    CollaborationRevisionRead,
+    CollaborationRevisionUpdate,
+    CollaborationShareAccessGrant,
+    CollaborationShareLinkRead,
+    CollaborationShareLinkUpdate,
+    CollaborationSharePasswordRequest,
+)
+from app.schemas.onlyoffice import OnlyOfficePreviewConfigRead
+from app.services import collaboration_service, collaboration_share_service, onlyoffice_collaboration_service, onlyoffice_service
+
+router = APIRouter()
+public_router = APIRouter()
+internal_router = APIRouter(include_in_schema=False)
+
+
+@router.get(
+    "/folders",
+    response_model=list[CollaborationFolderRead],
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def list_folders(study_id: uuid.UUID, db: AsyncSession = Depends(get_db_session)):
+    return await collaboration_service.list_folders(db, study_id)
+
+
+@router.post(
+    "/folders",
+    response_model=CollaborationFolderRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_api_permission("collaboration:manage"))],
+)
+async def create_folder(
+    study_id: uuid.UUID,
+    payload: CollaborationFolderCreate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    return await collaboration_service.create_folder(db, study_id, payload, current_user)
+
+
+@router.patch(
+    "/folders/{folder_id}",
+    response_model=CollaborationFolderRead,
+    dependencies=[Depends(require_api_permission("collaboration:manage"))],
+)
+async def update_folder(
+    study_id: uuid.UUID,
+    folder_id: uuid.UUID,
+    payload: CollaborationFolderUpdate,
+    db: AsyncSession = Depends(get_db_session),
+):
+    return await collaboration_service.update_folder(db, study_id, folder_id, payload)
+
+
+@router.delete(
+    "/folders/{folder_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_api_permission("collaboration:manage"))],
+)
+async def delete_folder(study_id: uuid.UUID, folder_id: uuid.UUID, db: AsyncSession = Depends(get_db_session)):
+    await collaboration_service.delete_folder(db, study_id, folder_id)
+
+
+@router.get(
+    "/files",
+    response_model=list[CollaborationFileRead],
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def list_files(
+    study_id: uuid.UUID,
+    folder_id: uuid.UUID | None = None,
+    keyword: str | None = None,
+    deleted: bool = False,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    return await collaboration_service.list_files(
+        db, study_id, current_user, folder_id=folder_id, keyword=keyword, deleted=deleted
+    )
+
+
+@router.post(
+    "/files",
+    response_model=CollaborationFileRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_api_permission("collaboration:create"))],
+)
+async def create_file(
+    study_id: uuid.UUID,
+    payload: CollaborationFileCreate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.create_blank_file(db, study_id, payload, current_user)
+    return await collaboration_service.file_read(db, item, current_user)
+
+
+@router.post(
+    "/files/import",
+    response_model=CollaborationFileRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_api_permission("collaboration:create"))],
+)
+async def import_file(
+    study_id: uuid.UUID,
+    file: UploadFile = File(...),
+    folder_id: uuid.UUID | None = Form(None),
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.import_file(db, study_id, folder_id, file, current_user)
+    return await collaboration_service.file_read(db, item, current_user)
+
+
+@router.post(
+    "/files/{file_id}/copy",
+    response_model=CollaborationFileRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_api_permission("collaboration:create"))],
+)
+async def copy_file(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    source = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    item = await collaboration_service.copy_file(db, source, current_user)
+    return await collaboration_service.file_read(db, item, current_user)
+
+
+@router.get(
+    "/files/{file_id}",
+    response_model=CollaborationFileRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def get_file(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.file_read(db, item, current_user)
+
+
+@router.get(
+    "/files/{file_id}/download",
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def download_file(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    revision = await collaboration_service.prepare_download(db, item, current_user)
+    return FileResponse(
+        path=revision.file_uri,
+        media_type=revision.mime_type,
+        filename=item.title,
+        content_disposition_type="attachment",
+        headers={"Cache-Control": "no-store"},
+    )
+
+
+@router.patch(
+    "/files/{file_id}",
+    response_model=CollaborationFileRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def update_file(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    payload: CollaborationFileUpdate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    item = await collaboration_service.update_file(db, item, payload, current_user)
+    return await collaboration_service.file_read(db, item, current_user)
+
+
+@router.delete(
+    "/files/{file_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def trash_file(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    await collaboration_service.move_to_trash(db, item, current_user)
+
+
+@router.post(
+    "/files/{file_id}/restore",
+    response_model=CollaborationFileRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def restore_file(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id, include_deleted=True)
+    item = await collaboration_service.restore_file(db, item, current_user)
+    return await collaboration_service.file_read(db, item, current_user)
+
+
+@router.get(
+    "/files/{file_id}/members",
+    response_model=list[CollaborationMemberRead],
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def list_members(study_id: uuid.UUID, file_id: uuid.UUID, db: AsyncSession = Depends(get_db_session)):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.list_members(db, item)
+
+
+@router.put(
+    "/files/{file_id}/members",
+    response_model=CollaborationMemberRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def upsert_member(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    payload: CollaborationMemberUpsert,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.upsert_member(db, item, payload, current_user)
+
+
+@router.delete(
+    "/files/{file_id}/members/{user_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def remove_member(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    user_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    await collaboration_service.remove_member(db, item, user_id, current_user)
+
+
+@router.post(
+    "/files/{file_id}/edit-requests",
+    response_model=CollaborationEditRequestRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def create_edit_request(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.create_edit_request(db, item, current_user)
+
+
+@router.get(
+    "/files/{file_id}/edit-requests",
+    response_model=list[CollaborationEditRequestRead],
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def list_edit_requests(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    pending_only: bool = True,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.list_edit_requests(db, item, current_user, pending_only=pending_only)
+
+
+@router.post(
+    "/files/{file_id}/edit-requests/{request_id}/resolve",
+    response_model=CollaborationEditRequestRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def resolve_edit_request(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    request_id: uuid.UUID,
+    payload: CollaborationEditRequestResolve,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.resolve_edit_request(db, item, request_id, payload, current_user)
+
+
+@router.post(
+    "/files/{file_id}/transfer-ownership",
+    response_model=CollaborationFileRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def transfer_ownership(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    payload: CollaborationOwnershipTransferRequest,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    item = await collaboration_service.transfer_ownership(db, item, payload, current_user)
+    return await collaboration_service.file_read(db, item, current_user)
+
+
+@router.get(
+    "/files/{file_id}/share-link",
+    response_model=CollaborationShareLinkRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def get_share_link(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    response: Response,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    result = await collaboration_share_service.get_share_link(db, item, current_user)
+    response.headers["Cache-Control"] = "no-store"
+    return result
+
+
+@router.put(
+    "/files/{file_id}/share-link",
+    response_model=CollaborationShareLinkRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def update_share_link(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    payload: CollaborationShareLinkUpdate,
+    response: Response,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    result = await collaboration_share_service.update_share_link(db, item, payload, current_user)
+    response.headers["Cache-Control"] = "no-store"
+    return result
+
+
+@router.get(
+    "/member-candidates",
+    response_model=list[CollaborationCandidateRead],
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def list_member_candidates(study_id: uuid.UUID, db: AsyncSession = Depends(get_db_session)):
+    return await collaboration_service.list_candidates(db, study_id)
+
+
+@router.get(
+    "/files/{file_id}/revisions",
+    response_model=list[CollaborationRevisionRead],
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def list_revisions(study_id: uuid.UUID, file_id: uuid.UUID, db: AsyncSession = Depends(get_db_session)):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.list_revisions(db, item)
+
+
+@router.patch(
+    "/files/{file_id}/revisions/{revision_id}",
+    response_model=CollaborationRevisionRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def update_revision(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    revision_id: uuid.UUID,
+    payload: CollaborationRevisionUpdate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.update_revision(db, item, revision_id, payload, current_user)
+
+
+@router.delete(
+    "/files/{file_id}/revisions/{revision_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def delete_revision(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    revision_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    await collaboration_service.delete_revision(db, item, revision_id, current_user)
+
+
+@router.post(
+    "/files/{file_id}/revisions/{revision_id}/copy",
+    response_model=CollaborationFileRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[
+        Depends(require_api_permission("collaboration:create")),
+        Depends(require_api_permission("collaboration:read")),
+    ],
+)
+async def copy_revision(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    revision_id: uuid.UUID,
+    payload: CollaborationRevisionCopyRequest,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    copied = await collaboration_service.copy_revision(db, item, revision_id, payload, current_user)
+    return await collaboration_service.file_read(db, copied, current_user)
+
+
+@router.get(
+    "/files/{file_id}/revisions/{revision_id}/preview-config",
+    response_model=OnlyOfficePreviewConfigRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def get_revision_preview_config(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    revision_id: uuid.UUID,
+    response: Response,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    revision = await collaboration_service.prepare_revision_preview(db, item, revision_id, current_user)
+    await onlyoffice_service.ensure_onlyoffice_available()
+    result = onlyoffice_service.build_preview_config(
+        resource_type="collaboration_revision",
+        resource_id=revision.id,
+        file_name=item.title,
+        file_hash=revision.file_hash,
+        user_id=current_user.id,
+        user_name=current_user.full_name,
+    )
+    response.headers["Cache-Control"] = "no-store"
+    return result
+
+
+@router.post(
+    "/files/{file_id}/revisions/{revision_id}/restore",
+    response_model=CollaborationRevisionRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def restore_revision(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    revision_id: uuid.UUID,
+    payload: CollaborationRestoreRequest,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    return await collaboration_service.restore_revision(
+        db, item, revision_id, current_user, payload.change_summary
+    )
+
+
+@router.get(
+    "/files/{file_id}/editor-config",
+    response_model=CollaborationEditorConfigRead,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def get_editor_config(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    response: Response,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    result = await onlyoffice_collaboration_service.build_editor_config(db, item, current_user)
+    response.headers["Cache-Control"] = "no-store"
+    return result
+
+
+@router.post(
+    "/files/{file_id}/exports",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def record_export(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    payload: CollaborationExportRecord,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    await collaboration_service.record_export(db, item, current_user, payload.file_type)
+
+
+@router.post(
+    "/files/{file_id}/downloads",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_api_permission("collaboration:read"))],
+)
+async def record_download(
+    study_id: uuid.UUID,
+    file_id: uuid.UUID,
+    payload: CollaborationExportRecord,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+):
+    item = await collaboration_service.get_file_or_404(db, study_id, file_id)
+    await collaboration_service.record_download(db, item, current_user, payload.file_type)
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
+@public_router.get("/metadata", response_model=CollaborationPublicShareMetadata)
+async def get_public_share_metadata(
+    response: Response,
+    x_ctms_share_token: str | None = Header(default=None, alias="X-CTMS-Share-Token"),
+    db: AsyncSession = Depends(get_db_session),
+):
+    result = await collaboration_share_service.public_metadata(db, x_ctms_share_token)
+    response.headers["Cache-Control"] = "no-store"
+    return result
+
+
+@public_router.post("/access", response_model=CollaborationShareAccessGrant)
+async def verify_public_share_password(
+    payload: CollaborationSharePasswordRequest,
+    response: Response,
+    x_ctms_share_token: str | None = Header(default=None, alias="X-CTMS-Share-Token"),
+    db: AsyncSession = Depends(get_db_session),
+):
+    result = await collaboration_share_service.verify_share_password(
+        db, x_ctms_share_token, payload.password
+    )
+    response.headers["Cache-Control"] = "no-store"
+    return result
+
+
+@public_router.post("/editor-config", response_model=CollaborationEditorConfigRead)
+async def get_public_share_editor_config(
+    payload: CollaborationPublicEditorConfigRequest,
+    response: Response,
+    x_ctms_share_token: str | None = Header(default=None, alias="X-CTMS-Share-Token"),
+    db: AsyncSession = Depends(get_db_session),
+):
+    link, item = await collaboration_share_service.resolve_active_share(db, x_ctms_share_token)
+    collaboration_share_service.validate_access_grant(link, payload.access_token)
+    result = await onlyoffice_collaboration_service.build_shared_editor_config(
+        db,
+        item,
+        link,
+        client_id=payload.client_id,
+        display_name=payload.display_name,
+    )
+    response.headers["Cache-Control"] = "no-store"
+    return result
+
+
+@internal_router.get("/internal/onlyoffice/collaboration/sessions/{session_id}/content")
+async def get_session_content(session_id: uuid.UUID, request: Request, db: AsyncSession = Depends(get_db_session)):
+    revision, item = await onlyoffice_collaboration_service.get_session_content(
+        db, session_id, request.headers.get("AuthorizationJwt")
+    )
+    return FileResponse(
+        path=revision.file_uri,
+        media_type=revision.mime_type,
+        filename=item.title,
+        content_disposition_type="inline",
+    )
+
+
+@internal_router.post("/internal/onlyoffice/collaboration/sessions/{session_id}/callback")
+async def collaboration_callback(
+    session_id: uuid.UUID,
+    payload: CollaborationCallbackPayload,
+    request: Request,
+    db: AsyncSession = Depends(get_db_session),
+):
+    onlyoffice_collaboration_service.validate_callback_token(
+        request.headers.get("AuthorizationJwt"), payload
+    )
+    return await onlyoffice_collaboration_service.process_callback(db, session_id, payload)

backend/app/api/v1/notifications.py

@@ -1,13 +1,15 @@
+import logging
 import uuid
 
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Response, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.deps import get_db_session, get_current_user, require_study_member
-from app.schemas.notification import NotificationItem
-from app.services import document_service
+from app.schemas.notification import GeneralNotificationFeed, GeneralNotificationRead, NotificationItem
+from app.services import document_service, notification_service, project_reminder_service
 
 router = APIRouter()
+logger = logging.getLogger(__name__)
 
 
 @router.get(
@@ -29,3 +31,60 @@ async def list_notifications(
         skip=skip,
         limit=limit,
     )
+
+
+@router.get(
+    "/notifications/feed",
+    response_model=GeneralNotificationFeed,
+    dependencies=[Depends(require_study_member())],
+)
+async def list_general_notifications(
+    study_id: uuid.UUID,
+    limit: int = 10,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> GeneralNotificationFeed:
+    try:
+        await project_reminder_service.sync_project_reminders(db, study_id, current_user)
+    except Exception:
+        await db.rollback()
+        logger.warning("Failed to synchronize legacy project reminders", exc_info=True)
+    return await notification_service.list_feed(
+        db,
+        study_id=study_id,
+        recipient_id=current_user.id,
+        limit=limit,
+    )
+
+
+@router.post(
+    "/notifications/{notification_id}/read",
+    response_model=GeneralNotificationRead,
+    dependencies=[Depends(require_study_member())],
+)
+async def mark_general_notification_read(
+    study_id: uuid.UUID,
+    notification_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> GeneralNotificationRead:
+    return await notification_service.mark_read(
+        db,
+        study_id=study_id,
+        recipient_id=current_user.id,
+        notification_id=notification_id,
+    )
+
+
+@router.post(
+    "/notifications/read-all",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_study_member())],
+)
+async def mark_all_general_notifications_read(
+    study_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> Response:
+    await notification_service.mark_all_read(db, study_id=study_id, recipient_id=current_user.id)
+    return Response(status_code=status.HTTP_204_NO_CONTENT)

backend/app/api/v1/onlyoffice.py

@@ -16,6 +16,7 @@ from app.crud import attachment as attachment_crud
 from app.crud import audit as audit_crud
 from app.crud import document as document_crud
 from app.crud import document_version as version_crud
+from app.models.collaboration import CollaborationRevision
 from app.schemas.onlyoffice import OnlyOfficePreviewConfigRead
 from app.services import document_service, onlyoffice_service
 
@@ -210,3 +211,24 @@ async def get_internal_version_content(
         media_type=version.mime_type or "application/octet-stream",
         headers={"Content-Disposition": _content_disposition(file_name)},
     )
+
+
+@internal_router.get("/internal/onlyoffice/collaboration-revisions/{revision_id}/content")
+async def get_internal_collaboration_revision_content(
+    revision_id: uuid.UUID,
+    request: Request,
+    db: AsyncSession = Depends(get_db_session),
+) -> FileResponse:
+    expected_url = onlyoffice_service.onlyoffice_content_url("collaboration_revision", revision_id)
+    _authorize_internal_file_request(request, expected_url)
+    revision = await db.get(CollaborationRevision, revision_id)
+    file_path = Path(revision.file_uri) if revision else None
+    if not revision or getattr(revision, "deleted_at", None) is not None or not file_path or not file_path.exists():
+        raise onlyoffice_service.onlyoffice_error(
+            "COLLABORATION_REVISION_NOT_FOUND", "协作修订不存在", status.HTTP_404_NOT_FOUND
+        )
+    return FileResponse(
+        path=str(file_path),
+        media_type=revision.mime_type or "application/octet-stream",
+        headers={"Content-Disposition": _content_disposition(revision.original_filename)},
+    )

backend/app/api/v1/router.py

@@ -1,6 +1,6 @@
 from fastapi import APIRouter
 
-from app.api.v1 import auth, users, admin_email_settings, studies, sites, members, attachments, audit_logs, dashboard, subjects, visits, aes, finance_dashboard, fees_contracts, drug_shipments, material_equipments, project_milestones, startup, precautions, subject_histories, subject_pds, study_subject_pds, faq_categories, faqs, documents, etmf, overview, notifications, desktop_notifications, monitoring_visit_issues, api_permissions, permission_monitoring, permission_templates, system_permissions, study_active_roles, onlyoffice
+from app.api.v1 import auth, users, admin_email_settings, studies, sites, members, attachments, audit_logs, dashboard, subjects, visits, aes, finance_dashboard, fees_contracts, drug_shipments, material_equipments, project_milestones, startup, precautions, subject_histories, subject_pds, study_subject_pds, faq_categories, faqs, documents, etmf, overview, notifications, desktop_notifications, monitoring_visit_issues, api_permissions, permission_monitoring, permission_templates, system_permissions, study_active_roles, onlyoffice, collaboration
 
 
 api_router = APIRouter()
@@ -30,6 +30,8 @@ api_router.include_router(material_equipments.router, prefix="/studies/{study_id
 api_router.include_router(project_milestones.router, prefix="/studies/{study_id}/project", tags=["project-milestones"])
 api_router.include_router(startup.router, prefix="/studies/{study_id}/startup", tags=["startup"])
 api_router.include_router(precautions.router, prefix="/studies/{study_id}/shared-library", tags=["precautions"])
+api_router.include_router(collaboration.router, prefix="/studies/{study_id}/collaboration", tags=["collaboration"])
+api_router.include_router(collaboration.public_router, prefix="/collaboration/shares", tags=["collaboration-shares"])
 api_router.include_router(monitoring_visit_issues.router, prefix="/studies/{study_id}/monitoring", tags=["monitoring-visit-issues"])
 api_router.include_router(subject_histories.router, prefix="/studies/{study_id}/subjects/{subject_id}", tags=["subject-histories"])
 api_router.include_router(subject_pds.router, prefix="/studies/{study_id}/subjects/{subject_id}", tags=["subject-pds"])