Fix: respect subpath in logout, share link and auto-login redirects (#14476)

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>

src/paperless/auth.py

@@ -16,7 +16,7 @@ logger = logging.getLogger("paperless.auth")
 class AutoLoginMiddleware(MiddlewareMixin):
     def process_request(self, request: HttpRequest) -> None:
         # Dont use auto-login with token request
-        if request.path.startswith("/api/token/") and request.method == "POST":
+        if request.path_info.startswith("/api/token/") and request.method == "POST":
             return None
         try:
             request.user = User.objects.get(

src/paperless/tests/test_auth_middleware.py

@@ -51,3 +51,21 @@ class TestAutoLoginMiddleware(TestCase):
         self._process(request)
 
         self.assertFalse(request.user.is_authenticated)
+
+    @override_settings(FORCE_SCRIPT_NAME="/paperless")
+    def test_token_request_is_not_logged_in_under_subpath(self) -> None:
+        """
+        GIVEN:
+            - Paperless is served under a subpath
+        WHEN:
+            - A token is requested via POST
+        THEN:
+            - The request is left anonymous so the posted credentials are used
+        """
+        UserFactory(username="autologin")
+
+        request = self.factory.post("/api/token/")
+        request.user = AnonymousUser()
+        self._process(request)
+
+        self.assertFalse(request.user.is_authenticated)