From 002c5b0a204d8d8a60936e29cfdb4dd0e5f4c72a Mon Sep 17 00:00:00 2001
From: Trenton H <797416+stumpylog@users.noreply.github.com>
Date: Sun, 12 Apr 2026 13:49:48 -0700
Subject: [PATCH] Don't lose our prefetches when invoking guardian and fetch
 the custom field__field, which we actually use

---
 src/documents/filters.py | 12 +++++++++---
 src/documents/views.py   |  2 +-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/documents/filters.py b/src/documents/filters.py
index b2b226ee1..d688d9df2 100644
--- a/src/documents/filters.py
+++ b/src/documents/filters.py
@@ -884,10 +884,16 @@ class ObjectOwnedOrGrantedPermissionsFilter(ObjectPermissionsFilter):
     """
 
     def filter_queryset(self, request, queryset, view):
+        # django-guardian's get_objects_for_user builds its own queryset
+        # internally and loses prefetch_related declarations.  Use its result
+        # as a subquery so we can filter the original queryset (which retains
+        # all prefetch hints) rather than returning guardian's queryset directly.
         objects_with_perms = super().filter_queryset(request, queryset, view)
-        objects_owned = queryset.filter(owner=request.user)
-        objects_unowned = queryset.filter(owner__isnull=True)
-        return objects_with_perms | objects_owned | objects_unowned
+        return queryset.filter(
+            Q(pk__in=objects_with_perms)
+            | Q(owner=request.user)
+            | Q(owner__isnull=True),
+        )
 
 
 class ObjectOwnedPermissionsFilter(ObjectPermissionsFilter):
diff --git a/src/documents/views.py b/src/documents/views.py
index dd9c4b837..54abcff1b 100644
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -919,7 +919,7 @@ class DocumentViewSet(
                     ),
                 ),
                 "tags",
-                "custom_fields",
+                "custom_fields__field",
                 "notes",
             )
         )