Chore: address more zizmor flags

.github/dependabot.yml

@@ -164,6 +164,8 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       pre-commit-dependencies:
         patterns:

.github/workflows/ci-backend.yml

@@ -30,10 +30,13 @@ jobs:
           persist-credentials: false
       - name: Decide run mode
         id: force
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+          if [[ "${EVENT_NAME}" == "workflow_dispatch" ]]; then
             echo "run_all=true" >> "$GITHUB_OUTPUT"
-          elif [[ "${{ github.event_name }}" == "push" && ( "${{ github.ref_name }}" == "main" || "${{ github.ref_name }}" == "dev" ) ]]; then
+          elif [[ "${EVENT_NAME}" == "push" && ( "${REF_NAME}" == "main" || "${REF_NAME}" == "dev" ) ]]; then
             echo "run_all=true" >> "$GITHUB_OUTPUT"
           else
             echo "run_all=false" >> "$GITHUB_OUTPUT"
@@ -41,15 +44,22 @@ jobs:
       - name: Set diff range
         id: range
         if: steps.force.outputs.run_all != 'true'
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          EVENT_CREATED: ${{ github.event.created }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          SHA: ${{ github.sha }}
         run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "base=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT"
-          elif [[ "${{ github.event.created }}" == "true" ]]; then
-            echo "base=${{ github.event.repository.default_branch }}" >> "$GITHUB_OUTPUT"
+          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
+            echo "base=${PR_BASE_SHA}" >> "$GITHUB_OUTPUT"
+          elif [[ "${EVENT_CREATED}" == "true" ]]; then
+            echo "base=${DEFAULT_BRANCH}" >> "$GITHUB_OUTPUT"
           else
-            echo "base=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
+            echo "base=${BEFORE_SHA}" >> "$GITHUB_OUTPUT"
           fi
-          echo "ref=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          echo "ref=${SHA}" >> "$GITHUB_OUTPUT"
       - name: Detect changes
         id: filter
         if: steps.force.outputs.run_all != 'true'
@@ -104,9 +114,11 @@ jobs:
         run: |
           sudo cp docker/rootfs/etc/ImageMagick-6/paperless-policy.xml /etc/ImageMagick-6/policy.xml
       - name: Install Python dependencies
+        env:
+          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
         run: |
           uv sync \
-            --python ${{ steps.setup-python.outputs.python-version }} \
+            --python "${PYTHON_VERSION}" \
             --group testing \
             --frozen
       - name: List installed Python dependencies
@@ -114,14 +126,15 @@ jobs:
           uv pip list
       - name: Install NLTK data
         run: |
-          uv run python -m nltk.downloader punkt punkt_tab snowball_data stopwords -d ${{ env.NLTK_DATA }}
+          uv run python -m nltk.downloader punkt punkt_tab snowball_data stopwords -d "${NLTK_DATA}"
       - name: Run tests
         env:
           NLTK_DATA: ${{ env.NLTK_DATA }}
           PAPERLESS_CI_TEST: 1
+          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
         run: |
           uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
+            --python "${PYTHON_VERSION}" \
             --dev \
             --frozen \
             pytest
@@ -169,9 +182,11 @@ jobs:
           enable-cache: true
           python-version: ${{ steps.setup-python.outputs.python-version }}
       - name: Install Python dependencies
+        env:
+          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
         run: |
           uv sync \
-            --python ${{ steps.setup-python.outputs.python-version }} \
+            --python "${PYTHON_VERSION}" \
             --group testing \
             --group typing \
             --frozen
@@ -207,19 +222,23 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Check gate
+        env:
+          BACKEND_CHANGED: ${{ needs.changes.outputs.backend_changed }}
+          TEST_RESULT: ${{ needs.test.result }}
+          TYPING_RESULT: ${{ needs.typing.result }}
         run: |
-          if [[ "${{ needs.changes.outputs.backend_changed }}" != "true" ]]; then
+          if [[ "${BACKEND_CHANGED}" != "true" ]]; then
             echo "No backend-relevant changes detected."
             exit 0
           fi
 
-          if [[ "${{ needs.test.result }}" != "success" ]]; then
-            echo "::error::Backend test job result: ${{ needs.test.result }}"
+          if [[ "${TEST_RESULT}" != "success" ]]; then
+            echo "::error::Backend test job result: ${TEST_RESULT}"
             exit 1
           fi
 
-          if [[ "${{ needs.typing.result }}" != "success" ]]; then
-            echo "::error::Backend typing job result: ${{ needs.typing.result }}"
+          if [[ "${TYPING_RESULT}" != "success" ]]; then
+            echo "::error::Backend typing job result: ${TYPING_RESULT}"
             exit 1
           fi
 

.github/workflows/ci-docker.yml

@@ -166,6 +166,7 @@ jobs:
     runs-on: ubuntu-24.04
     needs: build-arch
     if: needs.build-arch.outputs.should-push == 'true'
+    environment: image-publishing
     permissions:
       contents: read
       packages: write

.github/workflows/ci-frontend.yml

@@ -27,10 +27,13 @@ jobs:
           persist-credentials: false
       - name: Decide run mode
         id: force
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+          if [[ "${EVENT_NAME}" == "workflow_dispatch" ]]; then
             echo "run_all=true" >> "$GITHUB_OUTPUT"
-          elif [[ "${{ github.event_name }}" == "push" && ( "${{ github.ref_name }}" == "main" || "${{ github.ref_name }}" == "dev" ) ]]; then
+          elif [[ "${EVENT_NAME}" == "push" && ( "${REF_NAME}" == "main" || "${REF_NAME}" == "dev" ) ]]; then
             echo "run_all=true" >> "$GITHUB_OUTPUT"
           else
             echo "run_all=false" >> "$GITHUB_OUTPUT"
@@ -38,15 +41,22 @@ jobs:
       - name: Set diff range
         id: range
         if: steps.force.outputs.run_all != 'true'
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          EVENT_CREATED: ${{ github.event.created }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          SHA: ${{ github.sha }}
         run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "base=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT"
-          elif [[ "${{ github.event.created }}" == "true" ]]; then
-            echo "base=${{ github.event.repository.default_branch }}" >> "$GITHUB_OUTPUT"
+          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
+            echo "base=${PR_BASE_SHA}" >> "$GITHUB_OUTPUT"
+          elif [[ "${EVENT_CREATED}" == "true" ]]; then
+            echo "base=${DEFAULT_BRANCH}" >> "$GITHUB_OUTPUT"
           else
-            echo "base=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
+            echo "base=${BEFORE_SHA}" >> "$GITHUB_OUTPUT"
           fi
-          echo "ref=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          echo "ref=${SHA}" >> "$GITHUB_OUTPUT"
       - name: Detect changes
         id: filter
         if: steps.force.outputs.run_all != 'true'
@@ -224,6 +234,7 @@ jobs:
     needs: [changes, unit-tests, e2e-tests]
     if: needs.changes.outputs.frontend_changed == 'true'
     runs-on: ubuntu-24.04
+    environment: bundle-analysis
     permissions:
       contents: read
     steps:

.github/workflows/ci-release.yml

@@ -64,17 +64,21 @@ jobs:
           enable-cache: false
           python-version: ${{ steps.setup-python.outputs.python-version }}
       - name: Install Python dependencies
+        env:
+          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
         run: |
-          uv sync --python ${{ steps.setup-python.outputs.python-version }} --dev --frozen
+          uv sync --python "${PYTHON_VERSION}" --dev --frozen
       - name: Install system dependencies
         run: |
           sudo apt-get update -qq
           sudo apt-get install -qq --no-install-recommends gettext liblept5
       # ---- Build Documentation ----
       - name: Build documentation
+        env:
+          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
         run: |
           uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
+            --python "${PYTHON_VERSION}" \
             --dev \
             --frozen \
             zensical build --clean
@@ -83,16 +87,20 @@ jobs:
         run: |
           uv export --quiet --no-dev --all-extras --format requirements-txt --output-file requirements.txt
       - name: Compile messages
+        env:
+          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
         run: |
           cd src/
           uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
+            --python "${PYTHON_VERSION}" \
             manage.py compilemessages
       - name: Collect static files
+        env:
+          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
         run: |
           cd src/
           uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
+            --python "${PYTHON_VERSION}" \
             manage.py collectstatic --no-input --clear
       - name: Assemble release package
         run: |
@@ -210,9 +218,13 @@ jobs:
         working-directory: docs
         env:
           CHANGELOG: ${{ needs.publish-release.outputs.changelog }}
+          PYTHON_VERSION: ${{ steps.setup-python.outputs.python-version }}
+          VERSION: ${{ needs.publish-release.outputs.version }}
         run: |
-          git branch ${{ needs.publish-release.outputs.version }}-changelog
-          git checkout ${{ needs.publish-release.outputs.version }}-changelog
+          branch_name="${VERSION}-changelog"
+
+          git branch "${branch_name}"
+          git checkout "${branch_name}"
 
           printf '# Changelog\n\n%s\n' "${CHANGELOG}" > changelog-new.md
 
@@ -227,24 +239,28 @@ jobs:
           mv changelog-new.md changelog.md
 
           uv run \
-            --python ${{ steps.setup-python.outputs.python-version }} \
+            --python "${PYTHON_VERSION}" \
             --dev \
             prek run --files changelog.md || true
 
           git config --global user.name "github-actions"
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git commit -am "Changelog ${{ needs.publish-release.outputs.version }} - GHA"
-          git push origin ${{ needs.publish-release.outputs.version }}-changelog
+          git commit -am "Changelog ${VERSION} - GHA"
+          git push origin "${branch_name}"
       - name: Create pull request
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          VERSION: ${{ needs.publish-release.outputs.version }}
         with:
           script: |
             const { repo, owner } = context.repo;
+            const version = process.env.VERSION;
+            const head = `${version}-changelog`;
             const result = await github.rest.pulls.create({
-              title: 'Documentation: Add ${{ needs.publish-release.outputs.version }} changelog',
+              title: `Documentation: Add ${version} changelog`,
               owner,
               repo,
-              head: '${{ needs.publish-release.outputs.version }}-changelog',
+              head,
               base: 'main',
               body: 'This PR is auto-generated by CI.'
             });

.github/workflows/cleanup-tags.yml

@@ -18,6 +18,7 @@ jobs:
     name: Cleanup Image Tags for ${{ matrix.primary-name }}
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
+    environment: registry-maintenance
     strategy:
       fail-fast: false
       matrix:
@@ -44,6 +45,7 @@ jobs:
     runs-on: ubuntu-24.04
     needs:
       - cleanup-images
+    environment: registry-maintenance
     strategy:
       fail-fast: false
       matrix:

.github/workflows/crowdin.yml

@@ -14,6 +14,7 @@ jobs:
     name: Crowdin Sync
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
+    environment: translation-sync
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/translate-strings.yml

@@ -7,6 +7,7 @@ jobs:
   generate-translate-strings:
     name: Generate Translation Strings
     runs-on: ubuntu-latest
+    environment: translation-sync
     permissions:
       contents: write
     steps:

.github/zizmor.yml

@@ -3,54 +3,22 @@ rules:
     ignore:
       # github.event_name is a GitHub-internal constant (push/pull_request/etc.),
       # not attacker-controllable.
-      - ci-backend.yml:35
       - ci-docker.yml:74
       - ci-docs.yml:33
-      - ci-frontend.yml:32
       # github.event.repository.default_branch refers to the target repo's setting,
       # which only admins can change; not influenced by fork PR authors.
-      - ci-backend.yml:47
       - ci-docs.yml:45
-      - ci-frontend.yml:44
       # steps.setup-python.outputs.python-version is always a semver string (e.g. "3.12.0")
       # produced by actions/setup-python from a hardcoded env var input.
-      - ci-backend.yml:106
-      - ci-backend.yml:121
-      - ci-backend.yml:169
       - ci-docs.yml:88
       - ci-docs.yml:92
-      - ci-release.yml:69
-      - ci-release.yml:78
-      - ci-release.yml:90
-      - ci-release.yml:96
-      - ci-release.yml:229
       # needs.*.result is always one of: success/failure/cancelled/skipped.
-      - ci-backend.yml:211
-      - ci-backend.yml:212
-      - ci-backend.yml:216
       - ci-docs.yml:131
       - ci-docs.yml:132
-      - ci-frontend.yml:259
-      - ci-frontend.yml:260
-      - ci-frontend.yml:264
-      - ci-frontend.yml:269
-      - ci-frontend.yml:274
-      - ci-frontend.yml:279
       # needs.changes.outputs.* is always "true" or "false".
-      - ci-backend.yml:206
       - ci-docs.yml:126
-      - ci-frontend.yml:254
       # steps.build.outputs.digest is always a SHA256 digest (sha256:[a-f0-9]{64}).
       - ci-docker.yml:152
-      # needs.publish-release.outputs.version is the git tag name (e.g. v2.14.0);
-      # only maintainers can push tags upstream, and the tag pattern excludes
-      # shell metacharacters. Used in git commands and github-script JS, not eval.
-      - ci-release.yml:215
-      - ci-release.yml:216
-      - ci-release.yml:231
-      - ci-release.yml:237
-      - ci-release.yml:245
-      - ci-release.yml:248
   dangerous-triggers:
     ignore:
       # Both workflows use pull_request_target solely to label/comment on fork PRs

docs/usage.md

@@ -398,27 +398,25 @@ Global permissions define what areas of the app and API endpoints users can acce
 determine if a user can create, edit, delete or view _any_ documents, but individual documents themselves
 still have "object-level" permissions.
 
-| Type             | Details                                                                                                                                                                                                                         |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| AppConfig        | _Change_ or higher permissions grants access to the "Application Configuration" area.                                                                                                                                           |
-| Correspondent    | Add, edit, delete or view Correspondents.                                                                                                                                                                                       |
-| CustomField      | Add, edit, delete or view Custom Fields.                                                                                                                                                                                        |
-| Document         | Add, edit, delete or view Documents.                                                                                                                                                                                            |
-| DocumentType     | Add, edit, delete or view Document Types.                                                                                                                                                                                       |
-| Group            | Add, edit, delete or view Groups.                                                                                                                                                                                               |
-| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents.                                                                                                                           |
-| MailAccount      | Add, edit, delete or view Mail Accounts.                                                                                                                                                                                        |
-| MailRule         | Add, edit, delete or view Mail Rules.                                                                                                                                                                                           |
-| Note             | Add, edit, delete or view Notes.                                                                                                                                                                                                |
-| PaperlessTask    | View or dismiss (_Change_) File Tasks.                                                                                                                                                                                          |
-| SavedView        | Add, edit, delete or view Saved Views.                                                                                                                                                                                          |
-| ShareLink        | Add, delete or view Share Links.                                                                                                                                                                                                |
-| StoragePath      | Add, edit, delete or view Storage Paths.                                                                                                                                                                                        |
-| SystemStatus     | View the system status dialog and corresponding API endpoint. Admin users also retain system status access.                                                                                                                     |
-| Tag              | Add, edit, delete or view Tags.                                                                                                                                                                                                 |
-| UISettings       | Add, edit, delete or view the UI settings that are used by the web app.<br/>:warning: **Users that will access the web UI must be granted at least _View_ permissions.**                                                        |
-| User             | Add, edit, delete or view Users.                                                                                                                                                                                                |
-| Workflow         | Add, edit, delete or view Workflows.<br/>Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions). |
+| Type          | Details                                                                                                                                                                                                                         |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| AppConfig     | _Change_ or higher permissions grants access to the "Application Configuration" area.                                                                                                                                           |
+| Correspondent | Add, edit, delete or view Correspondents.                                                                                                                                                                                       |
+| CustomField   | Add, edit, delete or view Custom Fields.                                                                                                                                                                                        |
+| Document      | Add, edit, delete or view Documents.                                                                                                                                                                                            |
+| DocumentType  | Add, edit, delete or view Document Types.                                                                                                                                                                                       |
+| Group         | Add, edit, delete or view Groups.                                                                                                                                                                                               |
+| MailAccount   | Add, edit, delete or view Mail Accounts.                                                                                                                                                                                        |
+| MailRule      | Add, edit, delete or view Mail Rules.                                                                                                                                                                                           |
+| Note          | Add, edit, delete or view Notes.                                                                                                                                                                                                |
+| PaperlessTask | View or dismiss (_Change_) File Tasks.                                                                                                                                                                                          |
+| SavedView     | Add, edit, delete or view Saved Views.                                                                                                                                                                                          |
+| ShareLink     | Add, delete or view Share Links.                                                                                                                                                                                                |
+| StoragePath   | Add, edit, delete or view Storage Paths.                                                                                                                                                                                        |
+| Tag           | Add, edit, delete or view Tags.                                                                                                                                                                                                 |
+| UISettings    | Add, edit, delete or view the UI settings that are used by the web app.<br/>:warning: **Users that will access the web UI must be granted at least _View_ permissions.**                                                        |
+| User          | Add, edit, delete or view Users.                                                                                                                                                                                                |
+| Workflow      | Add, edit, delete or view Workflows.<br/>Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions). |
 
 #### Detailed Explanation of Object Permissions {#object-permissions}
 

src-ui/src/app/components/admin/settings/settings.component.html

@@ -7,7 +7,7 @@
   <button class="btn btn-sm btn-outline-primary" (click)="tourService.start()">
     <i-bs class="me-2" name="airplane"></i-bs><ng-container i18n>Start tour</ng-container>
   </button>
-  @if (canViewSystemStatus) {
+  @if (permissionsService.isAdmin()) {
     <button class="btn btn-sm btn-outline-primary position-relative ms-md-5 me-1" (click)="showSystemStatus()"
       [disabled]="!systemStatus">
       @if (!systemStatus) {
@@ -26,8 +26,6 @@
       }
       <ng-container i18n>System Status</ng-container>
     </button>
-  }
-  @if (permissionsService.isAdmin()) {
     <a class="btn btn-sm btn-primary" href="admin/" target="_blank">
       <ng-container i18n>Open Django Admin</ng-container>
       <i-bs class="ms-2" name="arrow-up-right"></i-bs>

src-ui/src/app/components/admin/settings/settings.component.spec.ts

@@ -29,11 +29,7 @@ import { IfOwnerDirective } from 'src/app/directives/if-owner.directive'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { PermissionsGuard } from 'src/app/guards/permissions.guard'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
-import {
-  PermissionAction,
-  PermissionType,
-  PermissionsService,
-} from 'src/app/services/permissions.service'
+import { PermissionsService } from 'src/app/services/permissions.service'
 import { GroupService } from 'src/app/services/rest/group.service'
 import { SavedViewService } from 'src/app/services/rest/saved-view.service'
 import { UserService } from 'src/app/services/rest/user.service'
@@ -332,13 +328,7 @@ describe('SettingsComponent', () => {
 
   it('should load system status on initialize, show errors if needed', () => {
     jest.spyOn(systemStatusService, 'get').mockReturnValue(of(status))
-    jest
-      .spyOn(permissionsService, 'currentUserCan')
-      .mockImplementation(
-        (action, type) =>
-          action === PermissionAction.View &&
-          type === PermissionType.SystemStatus
-      )
+    jest.spyOn(permissionsService, 'isAdmin').mockReturnValue(true)
     completeSetup()
     expect(component['systemStatus']).toEqual(status) // private
     expect(component.systemStatusHasErrors).toBeTruthy()
@@ -354,13 +344,7 @@ describe('SettingsComponent', () => {
   it('should open system status dialog', () => {
     const modalOpenSpy = jest.spyOn(modalService, 'open')
     jest.spyOn(systemStatusService, 'get').mockReturnValue(of(status))
-    jest
-      .spyOn(permissionsService, 'currentUserCan')
-      .mockImplementation(
-        (action, type) =>
-          action === PermissionAction.View &&
-          type === PermissionType.SystemStatus
-      )
+    jest.spyOn(permissionsService, 'isAdmin').mockReturnValue(true)
     completeSetup()
     component.showSystemStatus()
     expect(modalOpenSpy).toHaveBeenCalledWith(SystemStatusDialogComponent, {

src-ui/src/app/components/admin/settings/settings.component.ts

@@ -429,7 +429,7 @@ export class SettingsComponent
       this.settingsForm.patchValue(currentFormValue)
     }
 
-    if (this.canViewSystemStatus) {
+    if (this.permissionsService.isAdmin()) {
       this.systemStatusService.get().subscribe((status) => {
         this.systemStatus = status
       })
@@ -647,16 +647,6 @@ export class SettingsComponent
       .setValue(Array.from(hiddenFields))
   }
 
-  public get canViewSystemStatus(): boolean {
-    return (
-      this.permissionsService.isAdmin() ||
-      this.permissionsService.currentUserCan(
-        PermissionAction.View,
-        PermissionType.SystemStatus
-      )
-    )
-  }
-
   showSystemStatus() {
     const modal: NgbModalRef = this.modalService.open(
       SystemStatusDialogComponent,

src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html

@@ -23,11 +23,11 @@
             </div>
             <div class="form-check form-switch form-check-inline">
               <input type="checkbox" class="form-check-input" id="is_staff" formControlName="is_staff">
-              <label class="form-check-label" for="is_staff"><ng-container i18n>Admin</ng-container> <small class="form-text text-muted ms-1" i18n>Access system status, logs, Django backend</small></label>
+              <label class="form-check-label" for="is_staff"><ng-container i18n>Admin</ng-container> <small class="form-text text-muted ms-1" i18n>Access logs, Django backend</small></label>
             </div>
             <div class="form-check form-switch form-check-inline">
               <input type="checkbox" class="form-check-input" id="is_superuser" formControlName="is_superuser" (change)="onToggleSuperUser()">
-              <label class="form-check-label" for="is_superuser"><ng-container i18n>Superuser</ng-container> <small class="form-text text-muted ms-1" i18n>Grants all permissions and can view all objects</small></label>
+              <label class="form-check-label" for="is_superuser"><ng-container i18n>Superuser</ng-container> <small class="form-text text-muted ms-1" i18n>(Grants all permissions and can view objects)</small></label>
             </div>
           </div>
 

src-ui/src/app/components/common/permissions-select/permissions-select.component.html

@@ -26,8 +26,8 @@
           <input type="checkbox" class="form-check-input" id="{{type}}_all" (change)="toggleAll($event, type)" [checked]="typesWithAllActions.has(type) || isInherited(type)" [attr.disabled]="disabled || isInherited(type) ? true : null">
           <label class="form-check-label visually-hidden" for="{{type}}_all" i18n>All</label>
         </div>
-        @for (action of PermissionAction | keyvalue: sortActions; track action.key) {
-          <div class="col form-check form-check-inline" [class.invisible]="!isActionSupported(PermissionType[type], action.value)" [ngbPopover]="inheritedWarning" [disablePopover]="!isInherited(type, action.key)" placement="left" triggers="mouseenter:mouseleave">
+        @for (action of PermissionAction | keyvalue; track action) {
+          <div class="col form-check form-check-inline" [ngbPopover]="inheritedWarning" [disablePopover]="!isInherited(type, action.key)" placement="left" triggers="mouseenter:mouseleave">
             <input type="checkbox" class="form-check-input" id="{{type}}_{{action.key}}" formControlName="{{action.key}}">
             <label class="form-check-label visually-hidden" for="{{type}}_{{action.key}}">{{action.key}}</label>
           </div>

src-ui/src/app/components/common/permissions-select/permissions-select.component.spec.ts

@@ -26,6 +26,7 @@ const inheritedPermissions = ['change_tag', 'view_documenttype']
 describe('PermissionsSelectComponent', () => {
   let component: PermissionsSelectComponent
   let fixture: ComponentFixture<PermissionsSelectComponent>
+  let permissionsChangeResult: Permissions
   let settingsService: SettingsService
 
   beforeEach(async () => {
@@ -44,7 +45,7 @@ describe('PermissionsSelectComponent', () => {
     fixture = TestBed.createComponent(PermissionsSelectComponent)
     fixture.debugElement.injector.get(NG_VALUE_ACCESSOR)
     component = fixture.componentInstance
-    component.registerOnChange((r) => r)
+    component.registerOnChange((r) => (permissionsChangeResult = r))
     fixture.detectChanges()
   })
 
@@ -74,6 +75,7 @@ describe('PermissionsSelectComponent', () => {
   it('should update on permissions set', () => {
     component.ngOnInit()
     component.writeValue(permissions)
+    expect(permissionsChangeResult).toEqual(permissions)
     expect(component.typesWithAllActions).toContain('Document')
   })
 
@@ -90,12 +92,13 @@ describe('PermissionsSelectComponent', () => {
   it('disable checkboxes when permissions are inherited', () => {
     component.ngOnInit()
     component.inheritedPermissions = inheritedPermissions
-    fixture.detectChanges()
     expect(component.isInherited('Document', 'Add')).toBeFalsy()
     expect(component.isInherited('Document')).toBeFalsy()
     expect(component.isInherited('Tag', 'Change')).toBeTruthy()
-    expect(component.form.get('Document').get('Add').disabled).toBeFalsy()
-    expect(component.form.get('Tag').get('Change').disabled).toBeTruthy()
+    const input1 = fixture.debugElement.query(By.css('input#Document_Add'))
+    expect(input1.nativeElement.disabled).toBeFalsy()
+    const input2 = fixture.debugElement.query(By.css('input#Tag_Change'))
+    expect(input2.nativeElement.disabled).toBeTruthy()
   })
 
   it('should exclude history permissions if disabled', () => {
@@ -104,60 +107,4 @@ describe('PermissionsSelectComponent', () => {
     component = fixture.componentInstance
     expect(component.allowedTypes).not.toContain('History')
   })
-
-  it('should treat global statistics as view-only', () => {
-    component.ngOnInit()
-    fixture.detectChanges()
-
-    expect(
-      component.isActionSupported(
-        PermissionType.GlobalStatistics,
-        PermissionAction.View
-      )
-    ).toBeTruthy()
-    expect(
-      component.isActionSupported(
-        PermissionType.GlobalStatistics,
-        PermissionAction.Add
-      )
-    ).toBeFalsy()
-
-    const addInput = fixture.debugElement.query(
-      By.css('input#GlobalStatistics_Add')
-    )
-    const viewInput = fixture.debugElement.query(
-      By.css('input#GlobalStatistics_View')
-    )
-
-    expect(addInput.nativeElement.disabled).toBeTruthy()
-    expect(viewInput.nativeElement.disabled).toBeFalsy()
-  })
-
-  it('should treat system status as view-only', () => {
-    component.ngOnInit()
-    fixture.detectChanges()
-
-    expect(
-      component.isActionSupported(
-        PermissionType.SystemStatus,
-        PermissionAction.View
-      )
-    ).toBeTruthy()
-    expect(
-      component.isActionSupported(
-        PermissionType.SystemStatus,
-        PermissionAction.Change
-      )
-    ).toBeFalsy()
-
-    const changeInput = fixture.debugElement.query(
-      By.css('input#SystemStatus_Change')
-    )
-    const viewInput = fixture.debugElement.query(
-      By.css('input#SystemStatus_View')
-    )
-
-    expect(changeInput.nativeElement.disabled).toBeTruthy()
-    expect(viewInput.nativeElement.disabled).toBeFalsy()
-  })
 })

src-ui/src/app/components/common/permissions-select/permissions-select.component.ts

@@ -1,4 +1,4 @@
-import { KeyValue, KeyValuePipe } from '@angular/common'
+import { KeyValuePipe } from '@angular/common'
 import { Component, forwardRef, inject, Input, OnInit } from '@angular/core'
 import {
   AbstractControl,
@@ -58,13 +58,6 @@ export class PermissionsSelectComponent
 
   typesWithAllActions: Set<string> = new Set()
 
-  private readonly actionOrder = [
-    PermissionAction.Add,
-    PermissionAction.Change,
-    PermissionAction.Delete,
-    PermissionAction.View,
-  ]
-
   _inheritedPermissions: string[] = []
 
   @Input()
@@ -93,7 +86,7 @@ export class PermissionsSelectComponent
     }
     this.allowedTypes.forEach((type) => {
       const control = new FormGroup({})
-      for (const action of Object.keys(PermissionAction)) {
+      for (const action in PermissionAction) {
         control.addControl(action, new FormControl(null))
       }
       this.form.addControl(type, control)
@@ -113,14 +106,18 @@ export class PermissionsSelectComponent
         this.permissionsService.getPermissionKeys(permissionStr)
 
       if (actionKey && typeKey) {
-        this.form
-          .get(typeKey)
-          ?.get(actionKey)
-          ?.patchValue(true, { emitEvent: false })
+        if (this.form.get(typeKey)?.get(actionKey)) {
+          this.form
+            .get(typeKey)
+            .get(actionKey)
+            .patchValue(true, { emitEvent: false })
+        }
       }
     })
     this.allowedTypes.forEach((type) => {
-      if (this.typeHasAllActionsSelected(type)) {
+      if (
+        Object.values(this.form.get(type).value).every((val) => val == true)
+      ) {
         this.typesWithAllActions.add(type)
       } else {
         this.typesWithAllActions.delete(type)
@@ -152,16 +149,12 @@ export class PermissionsSelectComponent
     this.form.valueChanges.subscribe((newValue) => {
       let permissions = []
       Object.entries(newValue).forEach(([typeKey, typeValue]) => {
+        // e.g. [Document, { Add: true, View: true ... }]
         const selectedActions = Object.entries(typeValue).filter(
-          ([actionKey, actionValue]) =>
-            actionValue &&
-            this.isActionSupported(
-              PermissionType[typeKey],
-              PermissionAction[actionKey]
-            )
+          ([actionKey, actionValue]) => actionValue == true
         )
 
-        selectedActions.forEach(([actionKey]) => {
+        selectedActions.forEach(([actionKey, actionValue]) => {
           permissions.push(
             (PermissionType[typeKey] as string).replace(
               '%s',
@@ -170,7 +163,7 @@ export class PermissionsSelectComponent
           )
         })
 
-        if (this.typeHasAllActionsSelected(typeKey)) {
+        if (selectedActions.length == Object.entries(typeValue).length) {
           this.typesWithAllActions.add(typeKey)
         } else {
           this.typesWithAllActions.delete(typeKey)
@@ -181,23 +174,19 @@ export class PermissionsSelectComponent
         permissions.filter((p) => !this._inheritedPermissions.includes(p))
       )
     })
-
-    this.updateDisabledStates()
   }
 
   toggleAll(event, type) {
     const typeGroup = this.form.get(type)
-    Object.keys(PermissionAction)
-      .filter((action) =>
-        this.isActionSupported(PermissionType[type], PermissionAction[action])
-      )
-      .forEach((action) => {
-        typeGroup.get(action).patchValue(event.target.checked)
+    if (event.target.checked) {
+      Object.keys(PermissionAction).forEach((action) => {
+        typeGroup.get(action).patchValue(true)
       })
-
-    if (this.typeHasAllActionsSelected(type)) {
       this.typesWithAllActions.add(type)
     } else {
+      Object.keys(PermissionAction).forEach((action) => {
+        typeGroup.get(action).patchValue(false)
+      })
       this.typesWithAllActions.delete(type)
     }
   }
@@ -212,21 +201,14 @@ export class PermissionsSelectComponent
         )
       )
     } else {
-      return Object.keys(PermissionAction)
-        .filter((action) =>
-          this.isActionSupported(
-            PermissionType[typeKey],
-            PermissionAction[action]
+      return Object.values(PermissionAction).every((action) => {
+        return this._inheritedPermissions.includes(
+          this.permissionsService.getPermissionCode(
+            action as PermissionAction,
+            PermissionType[typeKey]
           )
         )
-        .every((action) => {
-          return this._inheritedPermissions.includes(
-            this.permissionsService.getPermissionCode(
-              PermissionAction[action],
-              PermissionType[typeKey]
-            )
-          )
-        })
+      })
     }
   }
 
@@ -234,55 +216,12 @@ export class PermissionsSelectComponent
     this.allowedTypes.forEach((type) => {
       const control = this.form.get(type)
       let actionControl: AbstractControl
-      for (const action of Object.keys(PermissionAction)) {
+      for (const action in PermissionAction) {
         actionControl = control.get(action)
-        if (
-          !this.isActionSupported(
-            PermissionType[type],
-            PermissionAction[action]
-          )
-        ) {
-          actionControl.patchValue(false, { emitEvent: false })
-          actionControl.disable({ emitEvent: false })
-          continue
-        }
-
         this.isInherited(type, action) || this.disabled
-          ? actionControl.disable({ emitEvent: false })
-          : actionControl.enable({ emitEvent: false })
+          ? actionControl.disable()
+          : actionControl.enable()
       }
     })
   }
-
-  public isActionSupported(
-    type: PermissionType,
-    action: PermissionAction
-  ): boolean {
-    // Global statistics and system status only support view permissions
-    if (
-      type === PermissionType.GlobalStatistics ||
-      type === PermissionType.SystemStatus
-    ) {
-      return action === PermissionAction.View
-    }
-
-    return true
-  }
-
-  private typeHasAllActionsSelected(typeKey: string): boolean {
-    return Object.keys(PermissionAction)
-      .filter((action) =>
-        this.isActionSupported(
-          PermissionType[typeKey],
-          PermissionAction[action]
-        )
-      )
-      .every((action) => !!this.form.get(typeKey)?.get(action)?.value)
-  }
-
-  public sortActions = (
-    a: KeyValue<string, PermissionAction>,
-    b: KeyValue<string, PermissionAction>
-  ): number =>
-    this.actionOrder.indexOf(a.value) - this.actionOrder.indexOf(b.value)
 }

src-ui/src/app/services/permissions.service.spec.ts

@@ -6,11 +6,6 @@ import {
   PermissionsService,
 } from './permissions.service'
 
-const VIEW_ONLY_PERMISSION_TYPES = new Set<PermissionType>([
-  PermissionType.GlobalStatistics,
-  PermissionType.SystemStatus,
-])
-
 describe('PermissionsService', () => {
   let permissionsService: PermissionsService
 
@@ -269,8 +264,6 @@ describe('PermissionsService', () => {
         'change_applicationconfiguration',
         'delete_applicationconfiguration',
         'view_applicationconfiguration',
-        'view_global_statistics',
-        'view_system_status',
       ],
       {
         username: 'testuser',
@@ -281,10 +274,7 @@ describe('PermissionsService', () => {
 
     Object.values(PermissionType).forEach((type) => {
       Object.values(PermissionAction).forEach((action) => {
-        expect(permissionsService.currentUserCan(action, type)).toBe(
-          !VIEW_ONLY_PERMISSION_TYPES.has(type) ||
-            action === PermissionAction.View
-        )
+        expect(permissionsService.currentUserCan(action, type)).toBeTruthy()
       })
     })
 

src-ui/src/app/services/permissions.service.ts

@@ -29,8 +29,6 @@ export enum PermissionType {
   CustomField = '%s_customfield',
   Workflow = '%s_workflow',
   ProcessedMail = '%s_processedmail',
-  GlobalStatistics = '%s_global_statistics',
-  SystemStatus = '%s_system_status',
 }
 
 @Injectable({

src/documents/permissions.py

@@ -56,26 +56,6 @@ class PaperlessAdminPermissions(BasePermission):
         return request.user.is_staff
 
 
-def has_global_statistics_permission(user: User | None) -> bool:
-    if user is None or not getattr(user, "is_authenticated", False):
-        return False
-
-    return getattr(user, "is_superuser", False) or user.has_perm(
-        "paperless.view_global_statistics",
-    )
-
-
-def has_system_status_permission(user: User | None) -> bool:
-    if user is None or not getattr(user, "is_authenticated", False):
-        return False
-
-    return (
-        getattr(user, "is_superuser", False)
-        or getattr(user, "is_staff", False)
-        or user.has_perm("paperless.view_system_status")
-    )
-
-
 def get_groups_with_only_permission(obj, codename):
     ctype = ContentType.objects.get_for_model(obj)
     permission = Permission.objects.get(content_type=ctype, codename=codename)

src/documents/tests/test_api_custom_fields.py

@@ -1309,7 +1309,7 @@ class TestCustomFieldsAPI(DirectoriesMixin, APITestCase):
         # Test as user without access to the document
         non_superuser = User.objects.create_user(username="non_superuser")
         non_superuser.user_permissions.add(
-            *Permission.objects.exclude(codename="view_global_statistics"),
+            *Permission.objects.all(),
         )
         non_superuser.save()
         self.client.force_authenticate(user=non_superuser)

src/documents/tests/test_api_documents.py

@@ -1314,41 +1314,6 @@ class TestDocumentApi(DirectoriesMixin, DocumentConsumeDelayMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(response.data["documents_inbox"], 0)
 
-    def test_statistics_with_statistics_permission(self) -> None:
-        owner = User.objects.create_user("owner")
-        stats_user = User.objects.create_user("stats-user")
-        stats_user.user_permissions.add(
-            Permission.objects.get(codename="view_global_statistics"),
-        )
-
-        inbox_tag = Tag.objects.create(
-            name="stats_inbox",
-            is_inbox_tag=True,
-            owner=owner,
-        )
-        Document.objects.create(
-            title="owned-doc",
-            checksum="stats-A",
-            mime_type="application/pdf",
-            content="abcdef",
-            owner=owner,
-        ).tags.add(inbox_tag)
-        Correspondent.objects.create(name="stats-correspondent", owner=owner)
-        DocumentType.objects.create(name="stats-type", owner=owner)
-        StoragePath.objects.create(name="stats-path", path="archive", owner=owner)
-
-        self.client.force_authenticate(user=stats_user)
-        response = self.client.get("/api/statistics/")
-
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data["documents_total"], 1)
-        self.assertEqual(response.data["documents_inbox"], 1)
-        self.assertEqual(response.data["inbox_tags"], [inbox_tag.pk])
-        self.assertEqual(response.data["character_count"], 6)
-        self.assertEqual(response.data["correspondent_count"], 1)
-        self.assertEqual(response.data["document_type_count"], 1)
-        self.assertEqual(response.data["storage_path_count"], 1)
-
     def test_upload(self) -> None:
         self.consume_file_mock.return_value = celery.result.AsyncResult(
             id=str(uuid.uuid4()),

src/documents/tests/test_api_status.py

@@ -5,14 +5,12 @@ from pathlib import Path
 from unittest import mock
 
 from celery import states
-from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.test import override_settings
 from rest_framework import status
 from rest_framework.test import APITestCase
 
 from documents.models import PaperlessTask
-from documents.permissions import has_system_status_permission
 from paperless import version
 
 
@@ -93,22 +91,6 @@ class TestSystemStatus(APITestCase):
         self.client.force_login(normal_user)
         response = self.client.get(self.ENDPOINT)
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-        # test the permission helper function directly for good measure
-        self.assertFalse(has_system_status_permission(None))
-
-    def test_system_status_with_system_status_permission(self) -> None:
-        response = self.client.get(self.ENDPOINT)
-        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
-
-        user = User.objects.create_user(username="status_user")
-        user.user_permissions.add(
-            Permission.objects.get(codename="view_system_status"),
-        )
-
-        self.client.force_login(user)
-        response = self.client.get(self.ENDPOINT)
-
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
 
     def test_system_status_with_bad_basic_auth_challenges(self) -> None:
         self.client.credentials(HTTP_AUTHORIZATION="Basic invalid")

src/documents/views.py

@@ -165,9 +165,7 @@ from documents.permissions import ViewDocumentsPermissions
 from documents.permissions import annotate_document_count_for_related_queryset
 from documents.permissions import get_document_count_filter_for_user
 from documents.permissions import get_objects_for_user_owner_aware
-from documents.permissions import has_global_statistics_permission
 from documents.permissions import has_perms_owner_aware
-from documents.permissions import has_system_status_permission
 from documents.permissions import set_permissions_for_object
 from documents.plugins.date_parsing import get_date_parser
 from documents.schema import generate_object_with_permissions_schema
@@ -3267,11 +3265,10 @@ class StatisticsView(GenericAPIView):
 
     def get(self, request, format=None):
         user = request.user if request.user is not None else None
-        can_view_global_stats = has_global_statistics_permission(user) or user is None
 
         documents = (
             Document.objects.all()
-            if can_view_global_stats
+            if user is None
             else get_objects_for_user_owner_aware(
                 user,
                 "documents.view_document",
@@ -3280,12 +3277,12 @@ class StatisticsView(GenericAPIView):
         )
         tags = (
             Tag.objects.all()
-            if can_view_global_stats
+            if user is None
             else get_objects_for_user_owner_aware(user, "documents.view_tag", Tag)
         ).only("id", "is_inbox_tag")
         correspondent_count = (
             Correspondent.objects.count()
-            if can_view_global_stats
+            if user is None
             else get_objects_for_user_owner_aware(
                 user,
                 "documents.view_correspondent",
@@ -3294,7 +3291,7 @@ class StatisticsView(GenericAPIView):
         )
         document_type_count = (
             DocumentType.objects.count()
-            if can_view_global_stats
+            if user is None
             else get_objects_for_user_owner_aware(
                 user,
                 "documents.view_documenttype",
@@ -3303,7 +3300,7 @@ class StatisticsView(GenericAPIView):
         )
         storage_path_count = (
             StoragePath.objects.count()
-            if can_view_global_stats
+            if user is None
             else get_objects_for_user_owner_aware(
                 user,
                 "documents.view_storagepath",
@@ -4260,7 +4257,7 @@ class SystemStatusView(PassUserMixin):
     permission_classes = (IsAuthenticated,)
 
     def get(self, request, format=None):
-        if not has_system_status_permission(request.user):
+        if not request.user.is_staff:
             return HttpResponseForbidden("Insufficient permissions")
 
         current_version = version.__full_version_str__

src/paperless/migrations/0009_alter_applicationconfiguration_options.py

@@ -1,22 +0,0 @@
-# Generated by Django 5.2.12 on 2026-04-07 23:13
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("paperless", "0008_replace_skip_archive_file"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="applicationconfiguration",
-            options={
-                "permissions": [
-                    ("view_global_statistics", "Can view global object counts"),
-                    ("view_system_status", "Can view system status information"),
-                ],
-                "verbose_name": "paperless application settings",
-            },
-        ),
-    ]

src/paperless/models.py

@@ -341,10 +341,6 @@ class ApplicationConfiguration(AbstractSingletonModel):
 
     class Meta:
         verbose_name = _("paperless application settings")
-        permissions = [
-            ("view_global_statistics", "Can view global object counts"),
-            ("view_system_status", "Can view system status information"),
-        ]
 
     def __str__(self) -> str:  # pragma: no cover
         return "ApplicationConfiguration"