✨(backend) sort favorite docs by last updated

Sort favorite_list results by updated_at property descending.

Signed-off-by: Paul Vernin <paul.vernin@gmail.com>

Author: pvrnn

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to
 ### Changed
 
 - ♿(frontend) use aria-haspopup menu on DropButton triggers #2126
+- ✨(backend) Order pinned documents by last updated at
 
 ## [v4.8.4] - 2026-03-25
 

src/backend/core/api/viewsets.py

@@ -829,6 +829,7 @@ def favorite_list(self, request, *args, **kwargs):
         queryset = self.queryset.filter(path_list)
         queryset = queryset.filter(id__in=favorite_documents_ids)
         queryset = queryset.filter(ancestors_deleted_at__isnull=True)
+        queryset = queryset.order_by("-updated_at")
         queryset = queryset.annotate_user_roles(user)
         queryset = queryset.annotate(
             is_favorite=db.Value(True, output_field=db.BooleanField())

src/backend/core/tests/documents/test_api_documents_favorite_list.py

@@ -1,5 +1,9 @@
 """Test for the document favorite_list endpoint."""
 
+from datetime import timedelta
+
+from django.utils import timezone
+
 import pytest
 from rest_framework.test import APIClient
 
@@ -116,6 +120,48 @@ def test_api_document_favorite_list_with_favorite_children():
     assert content[2]["id"] == str(access.document.id)
 
 
+def test_api_document_favorite_list_sorted_by_updated_at():
+    """
+    Authenticated users should receive their favorite documents including children
+    sorted by last updated_at timestamp.
+    """
+    user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
+
+    root = factories.DocumentFactory(creator=user, users=[user])
+    children = factories.DocumentFactory.create_batch(
+        2, parent=root, favorited_by=[user]
+    )
+
+    access = factories.UserDocumentAccessFactory(
+        user=user, role=models.RoleChoices.READER, document__favorited_by=[user]
+    )
+
+    other_root = factories.DocumentFactory(creator=user, users=[user])
+    factories.DocumentFactory.create_batch(2, parent=other_root)
+
+    now = timezone.now()
+
+    models.Document.objects.filter(pk=children[0].pk).update(
+        updated_at=now + timedelta(seconds=2)
+    )
+    models.Document.objects.filter(pk=children[1].pk).update(
+        updated_at=now + timedelta(seconds=3)
+    )
+
+    response = client.get("/api/v1.0/documents/favorite_list/")
+
+    assert response.status_code == 200
+    assert response.json()["count"] == 3
+
+    content = response.json()["results"]
+
+    assert content[0]["id"] == str(children[1].id)
+    assert content[1]["id"] == str(children[0].id)
+    assert content[2]["id"] == str(access.document.id)
+
+
 def test_api_document_favorite_list_with_deleted_child():
     """
     Authenticated users should not see deleted documents in their favorite list.