From d891c368e8b8d09e532aba1f4bc32b7ae64b1492 Mon Sep 17 00:00:00 2001
From: stumpylog <797416+stumpylog@users.noreply.github.com>
Date: Wed, 14 Oct 2026 12:18:19 -0700
Subject: [PATCH] Fix: copy only direct user grants in
 DocumentMetadataOverrides.from_document

get_users_with_perms includes group members by default, so PDF actions such
as merge and split gave them direct grants on the new documents, which
outlived their group membership.
---
 src/documents/data_models.py         |  2 ++
 src/documents/tests/test_consumer.py | 28 ++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/src/documents/data_models.py b/src/documents/data_models.py
index e8df1a022..35821cf5d 100644
--- a/src/documents/data_models.py
+++ b/src/documents/data_models.py
@@ -130,12 +130,14 @@ class DocumentMetadataOverrides:
             get_users_with_perms(
                 doc,
                 only_with_perms_in=["view_document"],
+                with_group_users=False,
             ).values_list("id", flat=True),
         )
         overrides.change_users = list(
             get_users_with_perms(
                 doc,
                 only_with_perms_in=["change_document"],
+                with_group_users=False,
             ).values_list("id", flat=True),
         )
         overrides.custom_fields = {
diff --git a/src/documents/tests/test_consumer.py b/src/documents/tests/test_consumer.py
index a4e48379f..7d614ca69 100644
--- a/src/documents/tests/test_consumer.py
+++ b/src/documents/tests/test_consumer.py
@@ -34,8 +34,10 @@ from documents.tests.utils import GetConsumerMixin
 from paperless_mail.models import MailRule
 from paperless_testing.assertions import FileSystemAssertsMixin
 from paperless_testing.dirs import DirectoriesMixin
+from paperless_testing.factories import DocumentFactory
 from paperless_testing.factories import UserFactory
 from paperless_testing.fakes.progress import FakeProgressManager
+from paperless_testing.permissions import grant_object
 
 
 class _BaseNewStyleParser:
@@ -1683,6 +1685,32 @@ class TestMetadataOverrides(TestCase):
         self.assertEqual(base.actor_id, 2)
         self.assertEqual(base.version_label, "v2")
 
+    def test_from_document_copies_user_and_group_grants_separately(self) -> None:
+        """
+        GIVEN:
+            - A document with view and change granted directly to one user and
+              to a group with another user as a member
+        WHEN:
+            - Overrides are built from the document
+        THEN:
+            - The user lists hold only the directly granted user
+            - The group lists hold the group
+        """
+        direct_user = UserFactory()
+        group_member = UserFactory()
+        group = Group.objects.create(name="group")
+        group_member.groups.add(group)
+        document = DocumentFactory()
+        grant_object(direct_user, document, "view_document", "change_document")
+        grant_object(group, document, "view_document", "change_document")
+
+        overrides = DocumentMetadataOverrides.from_document(document)
+
+        self.assertEqual(overrides.view_users, [direct_user.pk])
+        self.assertEqual(overrides.change_users, [direct_user.pk])
+        self.assertEqual(overrides.view_groups, [group.pk])
+        self.assertEqual(overrides.change_groups, [group.pk])
+
 
 class TestBarcodeApplyDetectedASN(TestCase):
     """