From f68093fcb8cf4f410171e95383c0762e84bb3b47 Mon Sep 17 00:00:00 2001 From: stumpylog <797416+stumpylog@users.noreply.github.com> Date: Wed, 22 Jul 2026 10:44:21 -0700 Subject: [PATCH] Fix (beta): don't batch permissions for tantivy search results UnifiedSearchViewSet.list() returns SearchHit/dict-like objects for text/title/query/more_like_id search requests, not Document ORM instances. Adding BulkPermissionMixin to DocumentViewSet (previous commit) meant its get_serializer_context() ran for search responses too, and its _get_object_perms() -- which expects real model instances with .pk -- crashed on the dict-like hits with AttributeError, turning every search request into a 400. Skip the batching specifically for search requests (existing _is_search_request() check) by calling past BulkPermissionMixin in the MRO; non-search list() calls (which return a real Document queryset) are unaffected and still get the batching. Co-authored-by: Claude Sonnet 5 --- src/documents/views.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/documents/views.py b/src/documents/views.py index 1e4527018..10eaae00c 100644 --- a/src/documents/views.py +++ b/src/documents/views.py @@ -2290,6 +2290,15 @@ class UnifiedSearchViewSet(DocumentViewSet): return SearchResultSerializer return DocumentSerializer + def get_serializer_context(self): + if self._is_search_request(): + # BulkPermissionMixin.get_serializer_context() (inherited via + # DocumentViewSet) assumes it's batching permissions for a page of + # real Document instances. Tantivy search results are SearchHit/ + # dict-like objects instead, so skip straight past it here. + return super(BulkPermissionMixin, self).get_serializer_context() + return super().get_serializer_context() + def _get_active_search_params(self, request: Request | None = None) -> list[str]: request = request or self.request return [