Fixhancement: PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT (#13281)

src/paperless/settings/__init__.py

@@ -460,11 +460,22 @@ def _parse_paperless_url():
 
 PAPERLESS_URL = _parse_paperless_url()
 
+
+def _get_allauth_trusted_proxy_count(trusted_proxies: list[str]) -> int:
+    count = get_int_from_env(
+        "PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT",
+        len(trusted_proxies),
+    )
+    if count < 0:
+        raise ImproperlyConfigured(
+            "PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT must be zero or greater",
+        )
+    return count
+
+
 # For use with trusted proxies
 TRUSTED_PROXIES = get_list_from_env("PAPERLESS_TRUSTED_PROXIES")
-# Derive allauth's proxy count from the same list so X-Forwarded-For is trusted
-# correctly when users have configured PAPERLESS_TRUSTED_PROXIES.
-ALLAUTH_TRUSTED_PROXY_COUNT = len(TRUSTED_PROXIES)
+ALLAUTH_TRUSTED_PROXY_COUNT = _get_allauth_trusted_proxy_count(TRUSTED_PROXIES)
 ALLAUTH_TRUSTED_CLIENT_IP_HEADER = os.getenv(
     "PAPERLESS_ALLAUTH_TRUSTED_CLIENT_IP_HEADER",
 )

src/paperless/tests/settings/test_settings.py

@@ -3,7 +3,9 @@ from unittest import TestCase
 from unittest import mock
 
 import pytest
+from django.core.exceptions import ImproperlyConfigured
 
+from paperless.settings import _get_allauth_trusted_proxy_count
 from paperless.settings import _get_search_language_setting
 from paperless.settings import _parse_paperless_url
 from paperless.settings import default_threads_per_worker
@@ -35,6 +37,31 @@ class TestThreadCalculation(TestCase):
                 self.assertLessEqual(default_workers * default_threads, i)
 
 
+def test_allauth_trusted_proxy_count_defaults_to_trusted_proxies(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.delenv("PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT", raising=False)
+
+    assert _get_allauth_trusted_proxy_count(["proxy-v4", "proxy-v6"]) == 2
+
+
+def test_allauth_trusted_proxy_count_can_be_overridden(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT", "1")
+
+    assert _get_allauth_trusted_proxy_count(["proxy-v4", "proxy-v6"]) == 1
+
+
+def test_allauth_trusted_proxy_count_rejects_negative_values(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("PAPERLESS_ALLAUTH_TRUSTED_PROXY_COUNT", "-1")
+
+    with pytest.raises(ImproperlyConfigured, match="must be zero or greater"):
+        _get_allauth_trusted_proxy_count([])
+
+
 @pytest.mark.parametrize(
     ("env_value", "expected"),
     [