Enhancement: allow regex timeout configuration

docs/configuration.md

@@ -1209,6 +1209,14 @@ left unassigned, preventing low-confidence guesses from being applied.
 
     Defaults to 0.6.
 
+#### [`PAPERLESS_MATCH_REGEX_TIMEOUT_SECONDS=<float>`](#PAPERLESS_MATCH_REGEX_TIMEOUT_SECONDS) {#PAPERLESS_MATCH_REGEX_TIMEOUT_SECONDS}
+
+: Sets the timeout, in seconds, for regular expression matching. Increase this
+value if date parsing or user-defined matching rules time out when processing
+long documents, especially on slower hardware.
+
+    Defaults to 0.1 seconds.
+
 #### [`PAPERLESS_DATE_PARSER_LANGUAGES=<lang>`](#PAPERLESS_DATE_PARSER_LANGUAGES) {#PAPERLESS_DATE_PARSER_LANGUAGES}
 
 : Specifies which language Paperless should use when parsing dates from documents.

src/documents/permissions.py

@@ -657,41 +657,16 @@ class ViewDocumentsPermissions(BasePermission):
         return request.user.has_perms(self.perms_map.get(request.method, []))
 
 
-class TrashPermissions(BasePermission):
-    """Check the global document permission for each trash operation."""
-
-    perms_map = {
-        "OPTIONS": ["documents.view_document"],
-        "HEAD": ["documents.view_document"],
-        "GET": ["documents.view_document"],
-        "POST": ["documents.delete_document"],
-    }
-
-    def has_permission(self, request, view):
-        if not request.user or not request.user.is_authenticated:  # pragma: no cover
-            return False
-
-        return request.user.has_perms(self.perms_map.get(request.method, []))
-
-
 class PaperlessNotePermissions(BasePermission):
     """
     Permissions class that checks for model permissions for Notes.
     """
 
     perms_map = {
-        "OPTIONS": ["documents.view_note", "documents.view_document"],
-        "GET": ["documents.view_note", "documents.view_document"],
-        "POST": [
-            "documents.add_note",
-            "documents.view_document",
-            "documents.change_document",
-        ],
-        "DELETE": [
-            "documents.delete_note",
-            "documents.view_document",
-            "documents.change_document",
-        ],
+        "OPTIONS": ["documents.view_note"],
+        "GET": ["documents.view_note"],
+        "POST": ["documents.add_note"],
+        "DELETE": ["documents.delete_note"],
     }
 
     def has_permission(self, request, view):

src/documents/serialisers.py

@@ -1335,7 +1335,6 @@ class DocumentSerializer(
             "root_document",
             "versions",
         )
-        read_only_fields = ("deleted_at",)
         list_serializer_class = OwnedObjectListSerializer
 
 
@@ -2840,14 +2839,10 @@ class ShareLinkSerializer(OwnedObjectSerializer):
         return super().create(validated_data)
 
     def validate_document(self, document):
-        if (
-            self.user is not None
-            and self.user.has_perm("documents.view_document")
-            and has_perms_owner_aware(
-                self.user,
-                "view_document",
-                document,
-            )
+        if self.user is not None and has_perms_owner_aware(
+            self.user,
+            "view_document",
+            document,
         ):
             return document
         raise PermissionDenied(
@@ -3608,8 +3603,6 @@ class WorkflowSerializer(serializers.ModelSerializer[Workflow]):
 
         if "actions" in validated_data:
             actions = validated_data.pop("actions")
-            for action in actions:
-                action.pop("id", None)
 
         instance = super().create(validated_data)
 

src/documents/tests/test_api_bulk_download.py

@@ -4,7 +4,6 @@ import json
 import shutil
 import zipfile
 
-from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.test import override_settings
 from django.utils import timezone
@@ -327,9 +326,6 @@ class TestBulkDownload(DirectoriesMixin, SampleDirMixin, APITestCase):
 
     def test_download_insufficient_permissions(self) -> None:
         user = User.objects.create_user(username="temp_user")
-        user.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         self.client.force_authenticate(user=user)
 
         self.doc2.owner = self.user

src/documents/tests/test_api_bulk_edit.py

@@ -1084,8 +1084,6 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
         user1 = User.objects.create(username="user1")
         self.client.force_authenticate(user=user1)
 
-        assign_perm("view_document", user1, self.doc2)
-
         response = self.client.post(
             "/api/documents/selection_data/",
             json.dumps({"documents": [self.doc2.id]}),
@@ -1093,18 +1091,7 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
         )
 
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
-        user1.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
-        user1 = User.objects.get(pk=user1.pk)
-        self.client.force_authenticate(user=user1)
-        response = self.client.post(
-            "/api/documents/selection_data/",
-            json.dumps({"documents": [self.doc2.id]}),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.content, b"Insufficient permissions")
 
     @mock.patch("documents.serialisers.bulk_edit.set_permissions")
     def test_set_permissions(self, m) -> None:

src/documents/tests/test_api_documents.py

@@ -3615,55 +3615,6 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
         self.assertEqual(response.content, b"Insufficient permissions to delete notes")
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
 
-    def test_notes_require_global_document_permissions(self) -> None:
-        user = User.objects.create_user(username="note_editor")
-        user.user_permissions.add(
-            *Permission.objects.filter(
-                codename__in=["view_note", "add_note", "delete_note"],
-            ),
-        )
-        doc = Document.objects.create(
-            title="test",
-            mime_type="application/pdf",
-            content="notes",
-            owner=user,
-        )
-        note = Note.objects.create(note="Existing", document=doc, user=user)
-        self.client.force_authenticate(user)
-
-        response = self.client.get(f"/api/documents/{doc.pk}/notes/")
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
-        user.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
-        user = User.objects.get(pk=user.pk)
-        self.client.force_authenticate(user)
-        response = self.client.get(f"/api/documents/{doc.pk}/notes/")
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-
-        response = self.client.post(
-            f"/api/documents/{doc.pk}/notes/",
-            data={"note": "New"},
-        )
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
-        user.user_permissions.add(
-            Permission.objects.get(codename="change_document"),
-        )
-        user = User.objects.get(pk=user.pk)
-        self.client.force_authenticate(user)
-        response = self.client.post(
-            f"/api/documents/{doc.pk}/notes/",
-            data={"note": "New"},
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-
-        response = self.client.delete(
-            f"/api/documents/{doc.pk}/notes/?id={note.pk}",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-
     def test_delete_note(self) -> None:
         """
         GIVEN:
@@ -4030,21 +3981,6 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
 
         assign_perm("view_document", user1, doc)
 
-        create_resp = self.client.post(
-            "/api/share_links/",
-            data={
-                "document": doc.pk,
-                "file_version": "original",
-            },
-            format="json",
-        )
-        self.assertEqual(create_resp.status_code, status.HTTP_403_FORBIDDEN)
-
-        user1.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
-        user1 = User.objects.get(pk=user1.pk)
-        self.client.force_authenticate(user1)
         create_resp = self.client.post(
             "/api/share_links/",
             data={

src/documents/tests/test_api_objects.py

@@ -457,9 +457,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase):
     def test_test_storage_path_requires_document_view_permission(self) -> None:
         owner = User.objects.create_user(username="owner")
         unprivileged = User.objects.create_user(username="unprivileged")
-        unprivileged.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         document = Document.objects.create(
             mime_type="application/pdf",
             owner=owner,
@@ -491,23 +488,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase):
         )
         assign_perm("view_document", viewer, document)
 
-        self.client.force_authenticate(user=viewer)
-        response = self.client.post(
-            f"{self.ENDPOINT}test/",
-            json.dumps(
-                {
-                    "document": document.id,
-                    "path": "path/{{ title }}",
-                },
-            ),
-            content_type="application/json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
-        viewer.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
-        viewer = User.objects.get(pk=viewer.pk)
         self.client.force_authenticate(user=viewer)
         response = self.client.post(
             f"{self.ENDPOINT}test/",
@@ -550,9 +530,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase):
             password="password",
             email="owner@example.com",
         )
-        owner.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         document = Document.objects.create(
             mime_type="application/pdf",
             owner=owner,
@@ -628,9 +605,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase):
             checksum="123",
         )
         assign_perm("view_document", viewer, document)
-        viewer.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
 
         self.client.force_authenticate(user=viewer)
         response = self.client.post(
@@ -718,9 +692,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase):
         )
         document.tags.add(private_tag)
         assign_perm("view_document", viewer, document)
-        viewer.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
 
         self.client.force_authenticate(user=viewer)
         response = self.client.post(
@@ -774,9 +745,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase):
             value_int=42,
         )
         assign_perm("view_document", viewer, document)
-        viewer.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
 
         self.client.force_authenticate(user=viewer)
         response = self.client.post(

src/documents/tests/test_api_trash.py

@@ -69,16 +69,6 @@ class TestTrashAPI(DirectoriesMixin, APITestCase):
         self.assertEqual(resp.status_code, status.HTTP_200_OK)
         self.assertEqual(Document.global_objects.count(), 0)
 
-    def test_trash_list_requires_global_document_view_permission(self) -> None:
-        user = User.objects.create_user(username="trash_owner")
-        document = Document.objects.create(title="Owned", owner=user)
-        document.delete()
-        self.client.force_authenticate(user)
-
-        response = self.client.get("/api/trash/")
-
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
     def test_trash_api_empty_all(self) -> None:
         """
         GIVEN:

src/documents/tests/test_api_workflows.py

@@ -194,48 +194,6 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
         self.assertEqual(Workflow.objects.count(), 2)
 
-    def test_api_create_workflow_ignores_nested_action_id(self) -> None:
-        """
-        GIVEN:
-            - An existing workflow action
-        WHEN:
-            - API request to create a workflow includes that action's ID
-        THEN:
-            - A new action is created without changing the existing action
-        """
-        original_title = self.action.assign_title
-
-        response = self.client.post(
-            self.ENDPOINT,
-            json.dumps(
-                {
-                    "name": "Workflow 2",
-                    "order": 1,
-                    "triggers": [
-                        {
-                            "sources": [DocumentSource.ApiUpload],
-                            "type": WorkflowTrigger.WorkflowTriggerType.CONSUMPTION,
-                            "filter_filename": "*",
-                        },
-                    ],
-                    "actions": [
-                        {
-                            "id": self.action.id,
-                            "assign_title": "New Action Title",
-                        },
-                    ],
-                },
-            ),
-            content_type="application/json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
-        self.action.refresh_from_db()
-        self.assertEqual(self.action.assign_title, original_title)
-        new_action = Workflow.objects.get(name="Workflow 2").actions.get()
-        self.assertNotEqual(new_action.id, self.action.id)
-        self.assertEqual(new_action.assign_title, "New Action Title")
-
     def test_api_create_workflow_nested(self) -> None:
         """
         GIVEN:

src/documents/tests/test_permission_filtering_security.py

@@ -309,9 +309,6 @@ class TestEmailDocumentPermissionBoundary:
     ):
         owner = User.objects.create_user(username="owner")
         requester = User.objects.create_user(username="requester")
-        requester.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         rest_api_client.force_authenticate(user=requester)
         hidden = DocumentFactory(owner=owner)
 
@@ -367,27 +364,6 @@ class TestBulkEditChangePermissionBoundary:
 
 @pytest.mark.django_db
 class TestBulkDownloadPermissionChecksRootDocument:
-    def test_download_requires_global_view_permission(
-        self,
-        rest_api_client,
-        paperless_dirs,
-        _media_settings,
-    ):
-        owner = User.objects.create_user(username="owner")
-        requester = User.objects.create_user(username="requester")
-        root = DocumentFactory(owner=owner)
-        root.source_path.write_bytes(b"%PDF-1.4 test")
-        assign_perm("view_document", requester, root)
-        rest_api_client.force_authenticate(user=requester)
-
-        response = rest_api_client.post(
-            "/api/documents/bulk_download/",
-            {"documents": [root.pk]},
-            format="json",
-        )
-
-        assert response.status_code == HTTPStatus.FORBIDDEN
-
     def test_permission_checked_on_root_not_on_version(
         self,
         rest_api_client,
@@ -396,9 +372,6 @@ class TestBulkDownloadPermissionChecksRootDocument:
     ):
         owner = User.objects.create_user(username="owner")
         requester = User.objects.create_user(username="requester")
-        requester.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         rest_api_client.force_authenticate(user=requester)
         root = DocumentFactory(owner=owner)
         # a version of root that the requester has NOT been individually granted
@@ -423,9 +396,6 @@ class TestBulkDownloadPermissionChecksRootDocument:
         # `stranger` case) can't tell the two apart, since they're denied
         # either way.
         version_only_grantee = User.objects.create_user(username="version_only_grantee")
-        version_only_grantee.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         assign_perm("view_document", version_only_grantee, version)
         rest_api_client.force_authenticate(user=version_only_grantee)
         response = rest_api_client.post(
@@ -447,9 +417,6 @@ class TestTrashRestorePermissionBoundary:
     ):
         owner = User.objects.create_user(username="owner")
         requester = User.objects.create_user(username="requester")
-        requester.user_permissions.add(
-            Permission.objects.get(codename="delete_document"),
-        )
         rest_api_client.force_authenticate(user=requester)
         doc = DocumentFactory(owner=owner)
         assign_perm("view_document", requester, doc)  # view only, NOT delete
@@ -468,9 +435,6 @@ class TestTrashRestorePermissionBoundary:
     ):
         owner = User.objects.create_user(username="owner")
         requester = User.objects.create_user(username="requester")
-        requester.user_permissions.add(
-            Permission.objects.get(codename="delete_document"),
-        )
         rest_api_client.force_authenticate(user=requester)
         doc = DocumentFactory(owner=owner)
         assign_perm("delete_document", requester, doc)
@@ -483,22 +447,6 @@ class TestTrashRestorePermissionBoundary:
         )
         assert response.status_code == HTTPStatus.OK
 
-    def test_restore_requires_global_delete_permission(self, rest_api_client):
-        owner = User.objects.create_user(username="owner")
-        requester = User.objects.create_user(username="requester")
-        rest_api_client.force_authenticate(user=requester)
-        doc = DocumentFactory(owner=owner)
-        assign_perm("delete_document", requester, doc)
-        doc.delete()
-
-        response = rest_api_client.post(
-            "/api/trash/",
-            {"documents": [doc.pk], "action": "restore"},
-            format="json",
-        )
-
-        assert response.status_code == HTTPStatus.FORBIDDEN
-
 
 @pytest.mark.django_db
 class TestTrashViewExcludesExplicitlyGrantedDocuments:
@@ -515,9 +463,6 @@ class TestTrashViewExcludesExplicitlyGrantedDocuments:
     def test_explicit_grant_does_not_leak_trashed_document(self, rest_api_client):
         owner = User.objects.create_user(username="trash_owner")
         grantee = User.objects.create_user(username="trash_grantee")
-        grantee.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         doc = DocumentFactory(owner=owner)
         doc.delete()  # soft delete
         assign_perm("view_document", grantee, doc)

src/documents/tests/test_regex.py

@@ -1,5 +1,6 @@
 import pytest
 import regex
+from django.conf import settings
 from pytest_mock import MockerFixture
 
 from documents.regex import safe_regex_finditer
@@ -9,6 +10,12 @@ from documents.regex import safe_regex_sub
 from documents.regex import validate_regex_pattern
 
 
+def test_regex_timeout_uses_configured_setting() -> None:
+    from documents.regex import REGEX_TIMEOUT_SECONDS
+
+    assert REGEX_TIMEOUT_SECONDS == settings.MATCH_REGEX_TIMEOUT_SECONDS
+
+
 class TestValidateRegexPattern:
     def test_valid_pattern(self) -> None:
         validate_regex_pattern(r"\d+")

src/documents/tests/test_share_link_bundles.py

@@ -6,10 +6,8 @@ from pathlib import Path
 from unittest import mock
 
 from django.conf import settings
-from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.utils import timezone
-from guardian.shortcuts import assign_perm
 from rest_framework import serializers
 from rest_framework import status
 from rest_framework.test import APITestCase
@@ -50,37 +48,6 @@ class ShareLinkBundleAPITests(DirectoriesMixin, APITestCase):
         delay_mock.assert_called_once()
         self.assertEqual(delay_mock.call_args.kwargs["kwargs"]["bundle_id"], bundle.pk)
 
-    @mock.patch("documents.views.build_share_link_bundle.apply_async")
-    def test_create_bundle_requires_global_document_view_permission(
-        self,
-        delay_mock,
-    ) -> None:
-        owner = User.objects.create_user(username="document_owner")
-        requester = User.objects.create_user(username="bundle_creator")
-        requester.user_permissions.add(
-            Permission.objects.get(codename="add_sharelinkbundle"),
-        )
-        document = DocumentFactory.create(owner=owner)
-        assign_perm("view_document", requester, document)
-        self.client.force_authenticate(requester)
-        payload = {
-            "document_ids": [document.pk],
-            "file_version": ShareLink.FileVersion.ARCHIVE,
-            "expiration_days": 7,
-        }
-
-        response = self.client.post(self.ENDPOINT, payload, format="json")
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
-        requester.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
-        requester = User.objects.get(pk=requester.pk)
-        self.client.force_authenticate(requester)
-        response = self.client.post(self.ENDPOINT, payload, format="json")
-        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
-        delay_mock.assert_called_once()
-
     def test_create_bundle_rejects_missing_documents(self) -> None:
         payload = {
             "document_ids": [9999],

src/documents/tests/test_views.py

@@ -141,9 +141,6 @@ class TestViews(DirectoriesMixin, TestCase):
             codename__contains="sharelink",
         )
         self.user.user_permissions.add(*sharelink_permissions)
-        self.user.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         self.user.save()
 
         self.client.force_login(self.user)
@@ -205,9 +202,6 @@ class TestViews(DirectoriesMixin, TestCase):
             codename__contains="sharelink",
         )
         self.user.user_permissions.add(*sharelink_permissions)
-        self.user.user_permissions.add(
-            Permission.objects.get(codename="view_document"),
-        )
         self.client.force_login(self.user)
 
         create_response = self.client.post(

src/documents/views.py

@@ -170,7 +170,6 @@ from documents.permissions import AcknowledgeTasksPermissions
 from documents.permissions import PaperlessAdminPermissions
 from documents.permissions import PaperlessNotePermissions
 from documents.permissions import PaperlessObjectPermissions
-from documents.permissions import TrashPermissions
 from documents.permissions import ViewDocumentsPermissions
 from documents.permissions import annotate_document_count_by_ids
 from documents.permissions import annotate_document_count_for_related_queryset
@@ -3520,7 +3519,7 @@ class PostDocumentView(GenericAPIView[Any]):
     ),
 )
 class SelectionDataView(GenericAPIView[Any]):
-    permission_classes = (IsAuthenticated, ViewDocumentsPermissions)
+    permission_classes = (IsAuthenticated,)
     serializer_class = DocumentListSerializer
     parser_classes = (parsers.MultiPartParser, parsers.JSONParser)
 
@@ -4011,7 +4010,7 @@ class StatisticsView(GenericAPIView[Any]):
     ),
 )
 class BulkDownloadView(DocumentSelectionMixin, GenericAPIView[Any]):
-    permission_classes = (IsAuthenticated, ViewDocumentsPermissions)
+    permission_classes = (IsAuthenticated,)
     serializer_class = BulkDownloadSerializer
     parser_classes = (parsers.JSONParser,)
 
@@ -4110,7 +4109,7 @@ class StoragePathViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet[Storag
     def get_permissions(self):
         if self.action == "test":
             # Test action does not require object level permissions
-            self.permission_classes = (IsAuthenticated, ViewDocumentsPermissions)
+            self.permission_classes = (IsAuthenticated,)
         return super().get_permissions()
 
     def destroy(self, request, *args, **kwargs):
@@ -4677,12 +4676,6 @@ class ShareLinkBundleViewSet(PassUserMixin, ModelViewSet[ShareLinkBundle]):
     filterset_class = ShareLinkBundleFilterSet
     ordering_fields = ("created", "expiration", "status")
 
-    def get_permissions(self):
-        permissions = super().get_permissions()
-        if self.action == "create":
-            permissions.append(ViewDocumentsPermissions())
-        return permissions
-
     def get_queryset(self):
         return (
             super()
@@ -5501,7 +5494,7 @@ class SystemStatusView(PassUserMixin):
 
 
 class TrashView(ListModelMixin, PassUserMixin):
-    permission_classes = (IsAuthenticated, TrashPermissions)
+    permission_classes = (IsAuthenticated,)
     serializer_class = TrashSerializer
 
     class _TrashPermittedObjectsFilter(PermittedObjectsFilter):

src/locale/en_US/LC_MESSAGES/django.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-09-12 23:18+0000\n"
+"POT-Creation-Date: 2026-09-11 15:47+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -1632,7 +1632,7 @@ msgid "workflow runs"
 msgstr ""
 
 #: documents/serialisers.py:525 documents/serialisers.py:882
-#: documents/serialisers.py:2854 documents/views.py:319 documents/views.py:2694
+#: documents/serialisers.py:2849 documents/views.py:318 documents/views.py:2693
 #: paperless_mail/serialisers.py:156
 msgid "Insufficient permissions."
 msgstr ""
@@ -1641,39 +1641,39 @@ msgstr ""
 msgid "Invalid color."
 msgstr ""
 
-#: documents/serialisers.py:2327
+#: documents/serialisers.py:2326
 #, python-format
 msgid "File type %(type)s not supported"
 msgstr ""
 
-#: documents/serialisers.py:2371
+#: documents/serialisers.py:2370
 #, python-format
 msgid "Custom field id must be an integer: %(id)s"
 msgstr ""
 
-#: documents/serialisers.py:2378
+#: documents/serialisers.py:2377
 #, python-format
 msgid "Custom field with id %(id)s does not exist"
 msgstr ""
 
-#: documents/serialisers.py:2395 documents/serialisers.py:2405
+#: documents/serialisers.py:2394 documents/serialisers.py:2404
 msgid ""
 "Custom fields must be a list of integers or an object mapping ids to values."
 msgstr ""
 
-#: documents/serialisers.py:2400
+#: documents/serialisers.py:2399
 msgid "Some custom fields don't exist or were specified twice."
 msgstr ""
 
-#: documents/serialisers.py:2547
+#: documents/serialisers.py:2546
 msgid "Invalid variable detected."
 msgstr ""
 
-#: documents/serialisers.py:2910
+#: documents/serialisers.py:2905
 msgid "Duplicate document identifiers are not allowed."
 msgstr ""
 
-#: documents/serialisers.py:2940 documents/views.py:4707
+#: documents/serialisers.py:2935 documents/views.py:4700
 #, python-format
 msgid "Documents not found: %(ids)s"
 msgstr ""
@@ -1941,40 +1941,40 @@ msgstr ""
 msgid "Unable to parse URI {value}"
 msgstr ""
 
-#: documents/views.py:312 documents/views.py:2691
+#: documents/views.py:311 documents/views.py:2690
 msgid "Invalid more_like_id"
 msgstr ""
 
-#: documents/views.py:1646
+#: documents/views.py:1645
 msgid "Invalid AI configuration."
 msgstr ""
 
-#: documents/views.py:1657
+#: documents/views.py:1656
 msgid "AI backend request timed out."
 msgstr ""
 
-#: documents/views.py:1669
+#: documents/views.py:1668
 msgid "AI backend rejected the request. Check logs for details."
 msgstr ""
 
-#: documents/views.py:2516 documents/views.py:2837
+#: documents/views.py:2515 documents/views.py:2836
 msgid "Specify only one of text, title_search, query, or more_like_id."
 msgstr ""
 
-#: documents/views.py:4720
+#: documents/views.py:4713
 #, python-format
 msgid "Insufficient permissions to share document %(id)s."
 msgstr ""
 
-#: documents/views.py:4766
+#: documents/views.py:4759
 msgid "Bundle is already being processed."
 msgstr ""
 
-#: documents/views.py:4830
+#: documents/views.py:4823
 msgid "The share link bundle is still being prepared. Please try again later."
 msgstr ""
 
-#: documents/views.py:4844
+#: documents/views.py:4837
 msgid "The share link bundle is unavailable."
 msgstr ""
 

src/paperless/settings/__init__.py

@@ -102,6 +102,10 @@ CLASSIFIER_MATCH_THRESHOLD: Final[float] = get_float_from_env(
     "PAPERLESS_CLASSIFIER_MATCH_THRESHOLD",
     0.6,
 )
+MATCH_REGEX_TIMEOUT_SECONDS: Final[float] = get_float_from_env(
+    "PAPERLESS_MATCH_REGEX_TIMEOUT_SECONDS",
+    0.1,
+)
 LLM_INDEX_DIR = DATA_DIR / "llm_index"
 LLM_INDEX_LOCK = LLM_INDEX_DIR / "index.lock"
 # Cross-process read/write lock guarding the LLM index compaction/migration

src/paperless_mail/tests/test_api.py

@@ -854,36 +854,6 @@ class TestAPIProcessedMails(DirectoriesMixin, APITestCase):
         )
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
 
-    def test_bulk_delete_requires_global_delete_permission(self) -> None:
-        owner = User.objects.create_user(username="mail_owner")
-        requester = User.objects.create_user(username="mail_deleter")
-        requester.user_permissions.add(
-            Permission.objects.get(codename="add_processedmail"),
-        )
-        mail = ProcessedMailFactory(owner=owner)
-        assign_perm("delete_processedmail", requester, mail)
-        self.client.force_authenticate(requester)
-
-        response = self.client.post(
-            f"{self.ENDPOINT}bulk_delete/",
-            data={"mail_ids": [mail.pk]},
-            format="json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-
-        requester.user_permissions.add(
-            Permission.objects.get(codename="delete_processedmail"),
-        )
-        requester = User.objects.get(pk=requester.pk)
-        self.client.force_authenticate(requester)
-        response = self.client.post(
-            f"{self.ENDPOINT}bulk_delete/",
-            data={"mail_ids": [mail.pk]},
-            format="json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertFalse(ProcessedMail.objects.filter(pk=mail.pk).exists())
-
     def test_bulk_delete_processed_mails_rejects_mixed_batch_atomically(self) -> None:
         """
         GIVEN:

src/paperless_mail/views.py

@@ -18,7 +18,6 @@ from rest_framework import serializers
 from rest_framework.decorators import action
 from rest_framework.filters import OrderingFilter
 from rest_framework.generics import GenericAPIView
-from rest_framework.permissions import BasePermission
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.viewsets import ModelViewSet
@@ -45,15 +44,6 @@ from paperless_mail.serialisers import ProcessedMailSerializer
 from paperless_mail.tasks import process_mail_accounts
 
 
-class DeleteProcessedMailPermissions(BasePermission):
-    def has_permission(self, request, view):
-        return bool(
-            request.user
-            and request.user.is_authenticated
-            and request.user.has_perm("paperless_mail.delete_processedmail"),
-        )
-
-
 @extend_schema_view(
     test=extend_schema(
         operation_id="mail_account_test",
@@ -216,11 +206,7 @@ class ProcessedMailViewSet(PassUserMixin, ReadOnlyModelViewSet[ProcessedMail]):
 
     queryset = ProcessedMail.objects.all().order_by("-processed")
 
-    @action(
-        methods=["post"],
-        detail=False,
-        permission_classes=[IsAuthenticated, DeleteProcessedMailPermissions],
-    )
+    @action(methods=["post"], detail=False)
     def bulk_delete(self, request):
         mail_ids = request.data.get("mail_ids", [])
         if not isinstance(mail_ids, list) or not all(