Update consumer.py

Ok, wire up the remote_ocr_mode with allow_remote for consumer
Docs for remote_ocr_mode
2026-08-10 21:03:18 +00:00 · 2026-08-10 10:13:18 -07:00 · 2026-08-10 10:13:18 -07:00 · 2026-08-10 10:13:18 -07:00 · 2026-08-10 10:13:18 -07:00 · 2026-08-10 10:13:18 -07:00
74 changed files with 2204 additions and 1801 deletions
@@ -227,7 +227,6 @@ Version-aware endpoints:
 - `PATCH /api/documents/{id}/`: content updates target the selected version (`?version={version_id}`) or latest version by default; non-content metadata updates target the root document.
 - `GET /api/documents/{id}/download/`, `GET /api/documents/{id}/preview/`, `GET /api/documents/{id}/thumb/`, `GET /api/documents/{id}/metadata/`: accept `?version={version_id}`.
 - `POST /api/documents/{id}/update_version/`: uploads a new version using multipart form field `document` and optional `version_label`.
- `POST /api/documents/merge_as_versions/`: merges existing top-level documents as versions of a selected root. The JSON body must contain `documents` (at least two document IDs) and `root_document_id` (one of those IDs). When merging one source document, an optional `version_label` may be provided.
 - `PATCH /api/documents/{id}/versions/{version_id}/`: updates the `version_label` of a specific version.
 - `DELETE /api/documents/{root_id}/versions/{version_id}/`: deletes a non-root version.

@@ -2047,6 +2047,18 @@ password. All of these options come from their similarly-named [Django settings]

    Defaults to None.

+#### [`PAPERLESS_REMOTE_OCR_MODE=<str>`](#PAPERLESS_REMOTE_OCR_MODE) {#PAPERLESS_REMOTE_OCR_MODE}
+
+: Which documents are sent to the remote OCR engine.
+
+    - `always`: every document of a supported file type is sent to the remote
+      engine, bypassing the local OCR engine.
+    - `workflow_only`: documents are processed locally unless a workflow
+      explicitly enables remote OCR for them, letting you use the remote engine
+      selectively.
+
+    Defaults to "always".
+
 ## AI {#ai}

 #### [`PAPERLESS_AI_ENABLED=<bool>`](#PAPERLESS_AI_ENABLED) {#PAPERLESS_AI_ENABLED}
@@ -456,6 +456,20 @@ def score(
    return 10
 ```

+**Remote services**
+
+If your parser sends document content to a remote service, declare it:
+
+```python
+class MyCustomParser:
+    uses_remote_service = True
+```
+
+Paperless-ngx excludes such parsers when the document being consumed has not
+been marked for remote processing, so users can keep remote OCR off by default
+and enable it selectively with a workflow. Parsers that do not declare the
+attribute are treated as fully local and are always considered.
+
 **Archive and rendition flags**

 ```python
@@ -99,8 +99,6 @@ Think of versions as **file history** for a document.
 - By default, search and document content use the latest version.
 - In document detail, selecting a version switches the preview, file metadata and content (and download etc buttons) to that version.
 - Deleting a non-root version keeps metadata and falls back to the latest remaining version.
- From the document list, select two or more documents and choose **Merge as versions** to combine them under one entry. Select the root document whose metadata and permissions should be retained; the other selected documents become file versions. The root may already have versions, but documents being added as versions must not have version histories of their own.
- From a document's **Versions** menu, choose **Existing** to search for another document and add it as a version of the current document.

 ### Management Lists

@@ -1086,11 +1084,16 @@ Paperless-ngx supports performing OCR on documents using remote services. At the
 [Microsoft's Azure "Document Intelligence" service](https://azure.microsoft.com/en-us/products/ai-services/ai-document-intelligence).
 This is of course a paid service (with a free tier) which requires an Azure account and subscription. Azure AI is not affiliated with
 Paperless-ngx in any way. When enabled, Paperless-ngx will automatically send appropriate documents to Azure for OCR processing, bypassing
-the local OCR engine. See the [configuration](configuration.md#PAPERLESS_REMOTE_OCR_ENGINE) options for more details.
+the local OCR engine. See the [configuration](configuration.md#PAPERLESS_REMOTE_OCR_ENGINE) options for more details. These
+settings can be supplied as environment variables or via **Application Configuration**.

 Additionally, when using a commercial service with this feature, consider both potential costs as well as any associated file size
 or page limitations (e.g. with a free tier).

+By default, every document of a supported file type is sent to the remote engine. To use it more selectively, set the
+[remote OCR mode](configuration.md#PAPERLESS_REMOTE_OCR_MODE) to `workflow_only`. Documents are then processed locally
+unless a workflow explicitly enables remote OCR for them, so you can limit the remote engine to particular documents.
+
 ## Architecture

 Paperless-ngx consists of the following components:
@@ -38,7 +38,6 @@ dependencies = [
  "django-soft-delete~=1.0.18",
  "django-treenode>=0.24",
  "djangorestframework~=3.16",
-  "djangorestframework-guardian~=0.4.0",
  "drf-spectacular~=0.30",
  "drf-spectacular-sidecar~=2026.7.1",
  "drf-writable-nested~=0.7.1",
@@ -1703,7 +1703,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
-          <context context-type="linenumber">28</context>
+          <context context-type="linenumber">34</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/widgets/statistics-widget/statistics-widget.component.html</context>
@@ -3279,7 +3279,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
-          <context context-type="linenumber">40</context>
+          <context context-type="linenumber">46</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/widgets/statistics-widget/statistics-widget.component.html</context>
@@ -7070,32 +7070,39 @@
          <context context-type="linenumber">143</context>
        </context-group>
      </trans-unit>
+      <trans-unit id="8336346011691074629" datatype="html">
+        <source>No suggestions</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
+          <context context-type="linenumber">11,12</context>
+        </context-group>
+      </trans-unit>
      <trans-unit id="5320136382998259826" datatype="html">
        <source>Suggest</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
-          <context context-type="linenumber">8,9</context>
+          <context context-type="linenumber">13,14</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6934085657687954669" datatype="html">
        <source>Show suggestions</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
-          <context context-type="linenumber">17,18</context>
+          <context context-type="linenumber">23,24</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3834115140127576673" datatype="html">
        <source>No novel suggestions</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
-          <context context-type="linenumber">24,25</context>
+          <context context-type="linenumber">30,31</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4369111787961525769" datatype="html">
        <source>Document Types</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
-          <context context-type="linenumber">34</context>
+          <context context-type="linenumber">40</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/widgets/statistics-widget/statistics-widget.component.html</context>
@@ -66,5 +66,5 @@
    "ts-node": "~10.9.1",
    "typescript": "^6.0.3"
  },
-  "packageManager": "pnpm@10.26.0"
+  "packageManager": "pnpm@11.15.1"
 }
@@ -5,6 +5,7 @@ trustPolicy: no-downgrade
 trustPolicyExclude:
  - "chokidar@4.0.3"
  - "semver@6.3.1 || 5.7.2"
+blockExoticSubdeps: true
 allowBuilds:
  "@parcel/watcher": true
  canvas: true
@@ -14,43 +14,48 @@
                <a ngbNavLink>{{category}}</a>
                <ng-template ngbNavContent>
                    <div class="p-3">
-                        <div class="row row-cols-1 row-cols-md-2 row-cols-lg-3 g-2">
-                            @for (option of getCategoryOptions(category); track option.key) {
-                                <div class="col">
-                                    <div class="card bg-light">
-                                        <div class="card-body">
-                                            <div class="card-title d-flex align-items-center">
-                                                <h6 class="mb-0">
-                                                  {{option.title}}
-                                                </h6>
-                                                <a class="btn btn-sm btn-link" title="Read the documentation about this setting" i18n-title [href]="getDocsUrl(option.config_key)" target="_blank" referrerpolicy="no-referrer">
-                                                    <i-bs name="info-circle"></i-bs>
-                                                </a>
-                                                @if (isSet(option.key)) {
-                                                  <button type="button" class="btn btn-sm btn-link text-danger ms-auto pe-0" title="Reset" i18n-title (click)="resetOption(option.key)">
-                                                      <i-bs class="me-1" name="x"></i-bs><ng-container i18n>Reset</ng-container>
-                                                  </button>
+                        @for (section of getCategorySections(category); track section) {
+                            @if (section) {
+                                <h5 class="mt-4 mb-3">{{section}}</h5>
+                            }
+                            <div class="row row-cols-1 row-cols-md-2 row-cols-lg-3 g-2">
+                                @for (option of getCategoryOptions(category, section); track option.key) {
+                                    <div class="col">
+                                        <div class="card bg-light">
+                                            <div class="card-body">
+                                                <div class="card-title d-flex align-items-center">
+                                                    <h6 class="mb-0">
+                                                      {{option.title}}
+                                                    </h6>
+                                                    <a class="btn btn-sm btn-link" title="Read the documentation about this setting" i18n-title [href]="getDocsUrl(option.config_key)" target="_blank" referrerpolicy="no-referrer">
+                                                        <i-bs name="info-circle"></i-bs>
+                                                    </a>
+                                                    @if (isSet(option.key)) {
+                                                      <button type="button" class="btn btn-sm btn-link text-danger ms-auto pe-0" title="Reset" i18n-title (click)="resetOption(option.key)">
+                                                          <i-bs class="me-1" name="x"></i-bs><ng-container i18n>Reset</ng-container>
+                                                      </button>
+                                                    }
+                                                </div>
+                                                <div class="mb-n3">
+                                                    @switch (option.type) {
+                                                        @case (ConfigOptionType.Select) { <pngx-input-select [formControlName]="option.key" [error]="errors[option.key]" [items]="option.choices" [allowNull]="true"></pngx-input-select> }
+                                                        @case (ConfigOptionType.Number) { <pngx-input-number [formControlName]="option.key" [error]="errors[option.key]" [showAdd]="false"></pngx-input-number> }
+                                                        @case (ConfigOptionType.Boolean) { <pngx-input-switch [formControlName]="option.key" [error]="errors[option.key]" [showUnsetNote]="true" [horizontal]="true" title="Enable" i18n-title></pngx-input-switch> }
+                                                        @case (ConfigOptionType.String) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
+                                                        @case (ConfigOptionType.JSON) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
+                                                        @case (ConfigOptionType.File) { <pngx-input-file [formControlName]="option.key" (upload)="uploadFile($event, option.key)" [error]="errors[option.key]"></pngx-input-file> }
+                                                        @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-password> }
+                                                    }
+                                                </div>
+                                                @if (option.note) {
+                                                    <div class="form-text fst-italic">{{option.note}}</div>
                                                }
                                            </div>
-                                            <div class="mb-n3">
-                                                @switch (option.type) {
-                                                    @case (ConfigOptionType.Select) { <pngx-input-select [formControlName]="option.key" [error]="errors[option.key]" [items]="option.choices" [allowNull]="true"></pngx-input-select> }
-                                                    @case (ConfigOptionType.Number) { <pngx-input-number [formControlName]="option.key" [error]="errors[option.key]" [showAdd]="false"></pngx-input-number> }
-                                                    @case (ConfigOptionType.Boolean) { <pngx-input-switch [formControlName]="option.key" [error]="errors[option.key]" [showUnsetNote]="true" [horizontal]="true" title="Enable" i18n-title></pngx-input-switch> }
-                                                    @case (ConfigOptionType.String) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
-                                                    @case (ConfigOptionType.JSON) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
-                                                    @case (ConfigOptionType.File) { <pngx-input-file [formControlName]="option.key" (upload)="uploadFile($event, option.key)" [error]="errors[option.key]"></pngx-input-file> }
-                                                    @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-password> }
-                                                }
-                                            </div>
-                                            @if (option.note) {
-                                                <div class="form-text fst-italic">{{option.note}}</div>
-                                            }
                                        </div>
                                    </div>
-                                </div>
-                            }
-                        </div>
+                                }
+                            </div>
+                        }
                    </div>
                </ng-template>
            </li>
@@ -8,7 +8,11 @@ import { NgbModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgSelectModule } from '@ng-select/ng-select'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { of, throwError } from 'rxjs'
-import { OutputTypeConfig } from 'src/app/data/paperless-config'
+import {
+  ConfigCategory,
+  ConfigSection,
+  OutputTypeConfig,
+} from 'src/app/data/paperless-config'
 import { ConfigService } from 'src/app/services/config.service'
 import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
@@ -158,4 +162,24 @@ describe('ConfigComponent', () => {
    component.resetOption('barcodes_enabled')
    expect(component.configForm.get('barcodes_enabled').value).toBeNull()
  })
+
+  it('should group options into sections within a category, or not', () => {
+    const sections = component.getCategorySections(ConfigCategory.OCR)
+    expect(sections).toEqual([null, ConfigSection.RemoteOCR])
+    expect(
+      component
+        .getCategoryOptions(ConfigCategory.OCR)
+        .map((option) => option.key)
+    ).toContain('output_type')
+    expect(
+      component
+        .getCategoryOptions(ConfigCategory.OCR, ConfigSection.RemoteOCR)
+        .map((option) => option.key)
+    ).toEqual([
+      'remote_ocr_engine',
+      'remote_ocr_api_key',
+      'remote_ocr_endpoint',
+      'remote_ocr_mode',
+    ])
+  })
 })
@@ -74,8 +74,20 @@ export class ConfigComponent
    return Object.values(ConfigCategory)
  }

-  getCategoryOptions(category: string): ConfigOption[] {
-    return PaperlessConfigOptions.filter((o) => o.category === category)
+  getCategorySections(category: string): string[] {
+    return [
+      ...new Set(
+        PaperlessConfigOptions.filter((o) => o.category === category).map(
+          (o) => o.section ?? null // null means no section
+        )
+      ),
+    ]
+  }
+
+  getCategoryOptions(category: string, section: string = null): ConfigOption[] {
+    return PaperlessConfigOptions.filter(
+      (o) => o.category === category && (o.section ?? null) === section
+    )
  }

  initialConfig: PaperlessConfig
@@ -1,48 +0,0 @@
-<div class="modal-header">
-  <h4 class="modal-title" id="modal-basic-title">{{title}}</h4>
-  <button type="button" class="btn-close" aria-label="Close" (click)="cancel()"></button>
-</div>
-<div class="modal-body">
-  <p>{{message}}</p>
-  <div class="form-group">
-    <span class="form-label d-inline-block" i18n>Versions:</span>
-    <ul class="list-group">
-      @for (documentID of versionDocumentIDs(); track documentID) {
-        @let document = getDocument(documentID);
-        @if (document) {
-          <li class="list-group-item d-flex align-items-center">
-            <div class="d-flex flex-column">
-              <div>
-                @if (document.correspondent) {
-                  <b>{{document.correspondent | correspondentName | async}}: </b>
-                }{{document.title}}
-              </div>
-              <small class="text-muted">
-                {{document.created | customDate:'mediumDate'}}
-                @if (document.page_count) {
-                  | {document.page_count, plural, =1 {One page} other {{{document.page_count}} pages}}
-                }
-              </small>
-            </div>
-          </li>
-        }
-      }
-    </ul>
-  </div>
-  <div class="form-group mt-4">
-    <label class="form-label" for="rootDocumentID" i18n>Root document:</label>
-    <select id="rootDocumentID" class="form-select" [ngModel]="rootDocumentID()" (ngModelChange)="rootDocumentID.set($event)">
-      @for (document of documents(); track document.id) {
-        <option [ngValue]="document.id">{{document.title}}</option>
-      }
-    </select>
-  </div>
-</div>
-<div class="modal-footer">
-  <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
-    <span class="d-inline-block" style="padding-bottom: 1px;">{{cancelBtnCaption}}</span>
-  </button>
-  <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled">
-    {{btnCaption}}
-  </button>
-</div>
@@ -1,56 +0,0 @@
-import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'
-import { provideHttpClientTesting } from '@angular/common/http/testing'
-import { ComponentFixture, TestBed } from '@angular/core/testing'
-import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
-import { of } from 'rxjs'
-import { DocumentService } from 'src/app/services/rest/document.service'
-import { MergeAsVersionsConfirmDialogComponent } from './merge-as-versions-confirm-dialog.component'
-
-describe('MergeAsVersionsConfirmDialogComponent', () => {
-  let component: MergeAsVersionsConfirmDialogComponent
-  let fixture: ComponentFixture<MergeAsVersionsConfirmDialogComponent>
-  let documentService: DocumentService
-
-  beforeEach(async () => {
-    await TestBed.configureTestingModule({
-      imports: [MergeAsVersionsConfirmDialogComponent],
-      providers: [
-        NgbActiveModal,
-        provideHttpClient(withInterceptorsFromDi()),
-        provideHttpClientTesting(),
-      ],
-    }).compileComponents()
-
-    fixture = TestBed.createComponent(MergeAsVersionsConfirmDialogComponent)
-    documentService = TestBed.inject(DocumentService)
-    component = fixture.componentInstance
-    fixture.detectChanges()
-  })
-
-  it('should fetch selected documents', () => {
-    const documents = [
-      { id: 1, title: 'Document 1' },
-      { id: 2, title: 'Document 2' },
-    ]
-    jest.spyOn(documentService, 'getFew').mockReturnValue(
-      of({
-        all: [1, 2],
-        count: 2,
-        results: documents,
-      })
-    )
-    component.documentIDs.set([1, 2])
-
-    component.ngOnInit()
-
-    expect(component.documents()).toEqual(documents)
-    expect(documentService.getFew).toHaveBeenCalledWith([1, 2])
-  })
-
-  it('should exclude the root from the draggable documents', () => {
-    component.documentIDs.set([1, 2, 3])
-    component.rootDocumentID.set(2)
-
-    expect(component.versionDocumentIDs()).toEqual([1, 3])
-  })
-})
@@ -1,41 +0,0 @@
-import { AsyncPipe } from '@angular/common'
-import { Component, OnInit, computed, inject, signal } from '@angular/core'
-import { FormsModule } from '@angular/forms'
-import { takeUntil } from 'rxjs'
-import { Document } from 'src/app/data/document'
-import { CorrespondentNamePipe } from 'src/app/pipes/correspondent-name.pipe'
-import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
-import { DocumentService } from 'src/app/services/rest/document.service'
-import { ConfirmDialogComponent } from '../confirm-dialog.component'
-
-@Component({
-  selector: 'pngx-merge-as-versions-confirm-dialog',
-  templateUrl: './merge-as-versions-confirm-dialog.component.html',
-  imports: [AsyncPipe, CorrespondentNamePipe, CustomDatePipe, FormsModule],
-})
-export class MergeAsVersionsConfirmDialogComponent
-  extends ConfirmDialogComponent
-  implements OnInit
-{
-  private readonly documentService = inject(DocumentService)
-
-  readonly documentIDs = signal<number[]>([])
-  readonly documents = signal<Document[]>([])
-  readonly rootDocumentID = signal(-1)
-  readonly versionDocumentIDs = computed(() =>
-    this.documentIDs().filter(
-      (documentID) => documentID !== this.rootDocumentID()
-    )
-  )
-
-  ngOnInit() {
-    this.documentService
-      .getFew(this.documentIDs())
-      .pipe(takeUntil(this.unsubscribeNotifier))
-      .subscribe((response) => this.documents.set(response.results))
-  }
-
-  getDocument(documentID: number): Document {
-    return this.documents().find((document) => document.id === documentID)
-  }
-}
@@ -36,7 +36,7 @@
        </div>
    <div class="form-group mt-4">
        <label class="form-label" for="metadataDocumentID" i18n>Use metadata from:</label>
-        <select id="metadataDocumentID" class="form-select" [ngModel]="metadataDocumentID()" (ngModelChange)="metadataDocumentID.set($event)">
+        <select class="form-select" [ngModel]="metadataDocumentID()" (ngModelChange)="metadataDocumentID.set($event)">
            <option [ngValue]="-1" i18n>Regenerate all metadata</option>
            @for (document of documents(); track document.id) {
              <option [ngValue]="document.id">{{document.title}}</option>
@@ -151,6 +151,13 @@
  inset: 0;
  pointer-events: none;

+  & section {
+    position: absolute;
+    text-align: initial;
+    box-sizing: border-box;
+    transform-origin: 0 0;
+  }
+
  & .annotationTextContent {
    opacity: 0;
  }
@@ -13,6 +13,7 @@ import {
  ViewChild,
 } from '@angular/core'
 import {
+  AnnotationMode,
  getDocument,
  GlobalWorkerOptions,
  PDFDocumentLoadingTask,
@@ -221,6 +222,7 @@ export class PngxPdfViewerComponent
      linkService: this.linkService,
      findController: this.findController,
      textLayerMode,
+      annotationMode: AnnotationMode.ENABLE,
      enableSelectionRendering: false,
      removePageBorders: true,
    }
@@ -2,10 +2,16 @@
  <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="disabled() || loading() || (suggestions() && !aiEnabled())">
    @if (loading()) {
      <div class="spinner-border spinner-border-sm" role="status"></div>
+    } @else if (noSuggestions) {
+      <i-bs width="1.2em" height="1.2em" name="check-circle"></i-bs>
    } @else {
      <i-bs width="1.2em" height="1.2em" name="stars"></i-bs>
    }
-    <span class="d-none d-lg-inline ps-1" i18n>Suggest</span>
+    @if (noSuggestions) {
+      <span class="d-none d-lg-inline ps-1" i18n>No suggestions</span>
+    } @else {
+      <span class="d-none d-lg-inline ps-1" i18n>Suggest</span>
+    }
    @if (totalSuggestions > 0) {
      <span class="badge bg-primary ms-2">{{ totalSuggestions }}</span>
    }
@@ -19,7 +25,7 @@

      <div ngbDropdownMenu aria-labelledby="suggestionsDropdown" class="shadow suggestions-dropdown">
        <div class="list-group list-group-flush small pb-0">
-          @if (!suggestions()?.suggested_tags && !suggestions()?.suggested_document_types && !suggestions()?.suggested_correspondents) {
+          @if (totalSuggestions === 0) {
            <div class="list-group-item text-muted fst-italic">
              <small class="text-muted small fst-italic" i18n>No novel suggestions</small>
            </div>
@@ -30,6 +30,34 @@ describe('SuggestionsDropdownComponent', () => {
    expect(component.totalSuggestions).toBe(4)
  })

+  it('should show when a completed request returned no suggestions', () => {
+    fixture.componentRef.setInput('suggestions', {
+      correspondents: [],
+      tags: [],
+      document_types: [],
+      storage_paths: [],
+      dates: [],
+    })
+    fixture.detectChanges()
+
+    expect(component.noSuggestions).toBeTruthy()
+    expect(fixture.nativeElement.textContent).toContain('No suggestions')
+  })
+
+  it('should not show the empty state before a request or with suggestions', () => {
+    expect(component.noSuggestions).toBeFalsy()
+
+    fixture.componentRef.setInput('suggestions', {
+      correspondents: [],
+      tags: [42],
+      document_types: [],
+      storage_paths: [],
+      dates: [],
+    })
+
+    expect(component.noSuggestions).toBeFalsy()
+  })
+
  it('should emit getSuggestions when clickSuggest is called and suggestions are null', () => {
    jest.spyOn(component.getSuggestions, 'emit')
    fixture.componentRef.setInput('suggestions', null)
@@ -59,5 +87,6 @@ describe('SuggestionsDropdownComponent', () => {
    })
    component.clickSuggest()
    expect(component.dropdown.open).toBeTruthy()
+    expect(fixture.nativeElement.textContent).toContain('No novel suggestions')
  })
 })
@@ -61,4 +61,21 @@ export class SuggestionsDropdownComponent {
        this.suggestions()?.suggested_document_types?.length || 0
    )
  }
+
+  get noSuggestions(): boolean {
+    const suggestions = this.suggestions()
+    return (
+      suggestions != null &&
+      !suggestions.title &&
+      !suggestions.tags?.length &&
+      !suggestions.suggested_tags?.length &&
+      !suggestions.correspondents?.length &&
+      !suggestions.suggested_correspondents?.length &&
+      !suggestions.document_types?.length &&
+      !suggestions.suggested_document_types?.length &&
+      !suggestions.storage_paths?.length &&
+      !suggestions.suggested_storage_paths?.length &&
+      !suggestions.dates?.length
+    )
+  }
 }
@@ -1,18 +0,0 @@
-<div class="modal-header">
-  <h4 class="modal-title" i18n>Add existing document as version</h4>
-  <button type="button" class="btn-close" aria-label="Close" (click)="cancel()"></button>
-</div>
-<div class="modal-body">
-  <pngx-input-document-link
-    [(ngModel)]="selectedDocumentIDs"
-    [parentDocumentID]="rootDocumentID"
-    [minimal]="true"
-    placeholder="Search for a document"
-    i18n-placeholder
-  ></pngx-input-document-link>
-  <div class="form-text mt-2" i18n>Select one document to add as a version.</div>
-</div>
-<div class="modal-footer">
-  <button type="button" class="btn btn-outline-secondary" (click)="cancel()" [disabled]="!buttonsEnabled" i18n>Cancel</button>
-  <button type="button" class="btn btn-primary" (click)="confirm()" [disabled]="!buttonsEnabled || selectedDocumentIDs.length !== 1" i18n>Add version</button>
-</div>
@@ -1,56 +0,0 @@
-import { ComponentFixture, TestBed } from '@angular/core/testing'
-import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
-import { DocumentService } from 'src/app/services/rest/document.service'
-import { AddExistingDocumentVersionDialogComponent } from './add-existing-document-version-dialog.component'
-
-describe('AddExistingDocumentVersionDialogComponent', () => {
-  let component: AddExistingDocumentVersionDialogComponent
-  let fixture: ComponentFixture<AddExistingDocumentVersionDialogComponent>
-  let activeModal: jest.Mocked<Pick<NgbActiveModal, 'dismiss'>>
-
-  beforeEach(async () => {
-    activeModal = { dismiss: jest.fn() }
-    await TestBed.configureTestingModule({
-      imports: [AddExistingDocumentVersionDialogComponent],
-      providers: [
-        {
-          provide: NgbActiveModal,
-          useValue: activeModal,
-        },
-        {
-          provide: DocumentService,
-          useValue: {},
-        },
-      ],
-    }).compileComponents()
-
-    fixture = TestBed.createComponent(AddExistingDocumentVersionDialogComponent)
-    component = fixture.componentInstance
-    component.rootDocumentID = 3
-    fixture.detectChanges()
-  })
-
-  it('should emit the single selected document', () => {
-    const emitSpy = jest.spyOn(component.confirmClicked, 'emit')
-    component.selectedDocumentIDs = [20]
-
-    component.confirm()
-
-    expect(emitSpy).toHaveBeenCalledWith(20)
-  })
-
-  it('should require exactly one selected document', () => {
-    const emitSpy = jest.spyOn(component.confirmClicked, 'emit')
-    component.selectedDocumentIDs = [20, 21]
-
-    component.confirm()
-
-    expect(emitSpy).not.toHaveBeenCalled()
-  })
-
-  it('should dismiss on cancel', () => {
-    component.cancel()
-
-    expect(activeModal.dismiss).toHaveBeenCalled()
-  })
-})
@@ -1,28 +0,0 @@
-import { Component, EventEmitter, Input, Output, inject } from '@angular/core'
-import { FormsModule } from '@angular/forms'
-import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
-import { DocumentLinkComponent } from 'src/app/components/common/input/document-link/document-link.component'
-
-@Component({
-  selector: 'pngx-add-existing-document-version-dialog',
-  templateUrl: './add-existing-document-version-dialog.component.html',
-  imports: [DocumentLinkComponent, FormsModule],
-})
-export class AddExistingDocumentVersionDialogComponent {
-  private readonly activeModal = inject(NgbActiveModal)
-
-  @Input() rootDocumentID: number
-  @Output() confirmClicked = new EventEmitter<number>()
-
-  selectedDocumentIDs: number[] = []
-  buttonsEnabled = true
-
-  confirm(): void {
-    if (this.selectedDocumentIDs.length !== 1) return
-    this.confirmClicked.emit(this.selectedDocumentIDs[0])
-  }
-
-  cancel(): void {
-    this.activeModal.dismiss()
-  }
-}
@@ -24,26 +24,13 @@
          class="visually-hidden"
          (change)="onVersionFileSelected($event)"
        />
-        <div class="btn-group btn-group-sm w-100">
-          <button
-            class="btn btn-sm btn-outline-secondary w-100"
-            (click)="versionFileInput.click()"
-            [disabled]="!userIsOwner || !userCanEdit"
-            title="Upload a new version"
-            i18n-title
-          >
-            <i-bs name="file-earmark-plus"></i-bs><span class="ps-1" i18n>Upload</span>
-          </button>
-          <button
-            class="btn btn-sm btn-outline-secondary w-100"
-            (click)="addExistingDocumentAsVersion()"
-            [disabled]="!userIsOwner || !userCanEdit"
-            title="Use an existing document"
-            i18n-title
-          >
-            <i-bs name="file-earmark"></i-bs><span class="ps-1" i18n>Existing</span>
-          </button>
-        </div>
+        <button
+          class="btn btn-sm btn-outline-secondary w-100"
+          (click)="versionFileInput.click()"
+          [disabled]="!userIsOwner || !userCanEdit"
+        >
+          <i-bs name="file-earmark-plus"></i-bs><span class="ps-1" i18n>Add new version</span>
+        </button>
      } @else {
        @switch (versionUploadState()) {
          @case (UploadState.Uploading) {
@@ -1,7 +1,6 @@
 import { DatePipe } from '@angular/common'
 import { SimpleChange } from '@angular/core'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
-import { NgbModal } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { Subject, of, throwError } from 'rxjs'
 import { DocumentVersionInfo } from 'src/app/data/document'
@@ -20,17 +19,12 @@ describe('DocumentVersionDropdownComponent', () => {
  let documentService: jest.Mocked<
    Pick<
      DocumentService,
-      | 'deleteVersion'
-      | 'getVersions'
-      | 'mergeDocumentsAsVersions'
-      | 'uploadVersion'
-      | 'updateVersionLabel'
+      'deleteVersion' | 'getVersions' | 'uploadVersion' | 'updateVersionLabel'
    >
  >
  let toastService: jest.Mocked<Pick<ToastService, 'showError' | 'showInfo'>>
  let finished$: Subject<{ taskId: string }>
  let failed$: Subject<{ taskId: string; message?: string }>
-  let modalService: jest.Mocked<Pick<NgbModal, 'open'>>

  beforeEach(async () => {
    finished$ = new Subject<{ taskId: string }>()
@@ -38,11 +32,9 @@ describe('DocumentVersionDropdownComponent', () => {
    documentService = {
      deleteVersion: jest.fn(),
      getVersions: jest.fn(),
-      mergeDocumentsAsVersions: jest.fn(),
      uploadVersion: jest.fn(),
      updateVersionLabel: jest.fn(),
    }
-    modalService = { open: jest.fn() }
    toastService = {
      showError: jest.fn(),
      showInfo: jest.fn(),
@@ -69,10 +61,6 @@ describe('DocumentVersionDropdownComponent', () => {
          provide: ToastService,
          useValue: toastService,
        },
-        {
-          provide: NgbModal,
-          useValue: modalService,
-        },
        {
          provide: WebsocketStatusService,
          useValue: {
@@ -335,43 +323,4 @@ describe('DocumentVersionDropdownComponent', () => {
    expect(component.editingVersionId).toBeNull()
    expect(component.versionLabelDraft).toEqual('')
  })
-
-  it('addExistingDocumentAsVersion should merge with a label and refresh versions', () => {
-    const confirmClicked = new Subject<number>()
-    const modal = {
-      componentInstance: {
-        rootDocumentID: null,
-        buttonsEnabled: true,
-        confirmClicked,
-      },
-      close: jest.fn(),
-    }
-    modalService.open.mockReturnValue(modal as any)
-    documentService.mergeDocumentsAsVersions.mockReturnValue(of({} as any))
-    const versions: DocumentVersionInfo[] = [
-      { id: 3, is_root: true, checksum: 'aaaa' },
-      { id: 20, is_root: false, checksum: 'cccc' },
-    ]
-    documentService.getVersions.mockReturnValue(of({ id: 3, versions } as any))
-    component.newVersionLabel = '  Imported  '
-    const versionsEmitSpy = jest.spyOn(component.versionsUpdated, 'emit')
-    const selectedEmitSpy = jest.spyOn(component.versionSelected, 'emit')
-
-    component.addExistingDocumentAsVersion()
-    expect(modal.componentInstance.rootDocumentID).toEqual(3)
-    confirmClicked.next(20)
-
-    expect(documentService.mergeDocumentsAsVersions).toHaveBeenCalledWith(
-      [3, 20],
-      3,
-      'Imported'
-    )
-    expect(documentService.updateVersionLabel).not.toHaveBeenCalled()
-    expect(documentService.getVersions).toHaveBeenCalledWith(3)
-    expect(versionsEmitSpy).toHaveBeenCalledWith(versions)
-    expect(selectedEmitSpy).toHaveBeenCalledWith(20)
-    expect(component.newVersionLabel).toEqual('')
-    expect(modal.close).toHaveBeenCalled()
-    expect(toastService.showInfo).toHaveBeenCalled()
-  })
 })
@@ -11,7 +11,7 @@ import {
  SimpleChanges,
 } from '@angular/core'
 import { FormsModule } from '@angular/forms'
-import { NgbDropdownModule, NgbModal } from '@ng-bootstrap/ng-bootstrap'
+import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { merge, of, Subject } from 'rxjs'
 import {
@@ -33,7 +33,6 @@ import {
  WebsocketStatusService,
 } from 'src/app/services/websocket-status.service'
 import { ConfirmButtonComponent } from '../../common/confirm-button/confirm-button.component'
-import { AddExistingDocumentVersionDialogComponent } from './add-existing-document-version-dialog/add-existing-document-version-dialog.component'

@Component({
  selector: 'pngx-document-version-dropdown',
@@ -70,7 +69,6 @@ export class DocumentVersionDropdownComponent implements OnChanges, OnDestroy {
  private readonly documentsService = inject(DocumentService)
  private readonly toastService = inject(ToastService)
  private readonly websocketStatusService = inject(WebsocketStatusService)
-  private readonly modalService = inject(NgbModal)
  private readonly destroy$ = new Subject<void>()
  private readonly documentChange$ = new Subject<void>()

@@ -280,56 +278,6 @@ export class DocumentVersionDropdownComponent implements OnChanges, OnDestroy {
      })
  }

-  addExistingDocumentAsVersion(): void {
-    const modal = this.modalService.open(
-      AddExistingDocumentVersionDialogComponent,
-      { backdrop: 'static' }
-    )
-    const dialog =
-      modal.componentInstance as AddExistingDocumentVersionDialogComponent
-    dialog.rootDocumentID = this.documentId
-    dialog.confirmClicked
-      .pipe(takeUntil(this.destroy$), takeUntil(this.documentChange$))
-      .subscribe((existingDocumentID) => {
-        dialog.buttonsEnabled = false
-        const versionLabel = this.newVersionLabel?.trim()
-        this.documentsService
-          .mergeDocumentsAsVersions(
-            [this.documentId, existingDocumentID],
-            this.documentId,
-            versionLabel
-          )
-          .pipe(
-            switchMap(() => this.documentsService.getVersions(this.documentId)),
-            first(),
-            finalize(() => (dialog.buttonsEnabled = true)),
-            takeUntil(this.destroy$),
-            takeUntil(this.documentChange$)
-          )
-          .subscribe({
-            next: (document) => {
-              if (document?.versions) {
-                this.versionsUpdated.emit(document.versions)
-                this.versionSelected.emit(
-                  Math.max(...document.versions.map((version) => version.id))
-                )
-              }
-              this.newVersionLabel = ''
-              modal.close()
-              this.toastService.showInfo(
-                $localize`Existing document added as a version.`
-              )
-            },
-            error: (error) => {
-              this.toastService.showError(
-                $localize`Error adding existing document as a version`,
-                error
-              )
-            },
-          })
-      })
-  }
-
  clearVersionUploadStatus(): void {
    this.versionUploadState.set(UploadState.Idle)
    this.versionUploadError.set(null)
@@ -95,9 +95,6 @@
          <button ngbDropdownItem (click)="mergeSelected()" [disabled]="!userCanAdd || list.allSelected || list.selectedCount < 2">
            <i-bs name="journals" class="me-1"></i-bs><ng-container i18n>Merge</ng-container>
          </button>
-          <button ngbDropdownItem (click)="mergeSelectedAsVersions()" [disabled]="!userOwnsAll || !userCanEditAll || list.allSelected || list.selectedCount < 2">
-            <i-bs name="journal-bookmark-fill" class="me-1"></i-bs><ng-container i18n>Merge as versions</ng-container>
-          </button>
        </div>
      </div>
    </div>
@@ -1248,52 +1248,6 @@ describe('BulkEditorComponent', () => {
    expect(documentListViewService.selected.size).toEqual(0)
  })

-  it('should support merging documents as versions', () => {
-    let modal: NgbModalRef
-    modalService.activeInstances.subscribe((m) => (modal = m[0]))
-    jest.spyOn(permissionsService, 'currentUserCan').mockReturnValue(true)
-    jest
-      .spyOn(documentListViewService, 'documents', 'get')
-      .mockReturnValue([{ id: 3 }, { id: 4 }])
-    jest.spyOn(documentService, 'getFew').mockReturnValue(
-      of({
-        all: [3, 4],
-        count: 2,
-        results: [
-          { id: 3, title: 'Document 3' },
-          { id: 4, title: 'Document 4' },
-        ],
-      })
-    )
-    jest
-      .spyOn(documentListViewService, 'selected', 'get')
-      .mockReturnValue(new Set([3, 4]))
-    jest
-      .spyOn(permissionsService, 'currentUserHasObjectPermissions')
-      .mockReturnValue(true)
-    jest
-      .spyOn(permissionsService, 'currentUserOwnsObject')
-      .mockReturnValue(true)
-    const mergeAsVersionsSpy = jest
-      .spyOn(documentService, 'mergeDocumentsAsVersions')
-      .mockReturnValue(of(true))
-    fixture.detectChanges()
-
-    component.mergeSelectedAsVersions()
-    expect(modal).not.toBeUndefined()
-    modal.componentInstance.rootDocumentID.set(4)
-    modal.componentInstance.confirm()
-
-    expect(mergeAsVersionsSpy).toHaveBeenCalledWith([3, 4], 4)
-    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
-    )
-    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
-    )
-    expect(documentListViewService.selected.size).toEqual(0)
-  })
-
  it('should support bulk download with archive, originals or both and file formatting', () => {
    jest.spyOn(permissionsService, 'currentUserCan').mockReturnValue(true)
    jest
@@ -50,7 +50,6 @@ import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { flattenTags } from 'src/app/utils/flatten-tags'
 import { queryParamsFromFilterRules } from 'src/app/utils/query-params'
-import { MergeAsVersionsConfirmDialogComponent } from '../../common/confirm-dialog/merge-as-versions-confirm-dialog/merge-as-versions-confirm-dialog.component'
 import { MergeConfirmDialogComponent } from '../../common/confirm-dialog/merge-confirm-dialog/merge-confirm-dialog.component'
 import { RotateConfirmDialogComponent } from '../../common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component'
 import { CorrespondentEditDialogComponent } from '../../common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component'
@@ -1003,34 +1002,6 @@ export class BulkEditorComponent
      })
  }

-  mergeSelectedAsVersions() {
-    let modal = this.modalService.open(MergeAsVersionsConfirmDialogComponent, {
-      backdrop: 'static',
-    })
-    const mergeDialog =
-      modal.componentInstance as MergeAsVersionsConfirmDialogComponent
-    const documentIDs = Array.from(this.list.selected)
-    mergeDialog.title = $localize`Merge as versions`
-    mergeDialog.message = $localize`The selected documents will become versions of the root document.`
-    mergeDialog.btnCaption = $localize`Proceed`
-    mergeDialog.documentIDs.set(documentIDs)
-    mergeDialog.rootDocumentID.set(documentIDs[0])
-    mergeDialog.confirmClicked
-      .pipe(takeUntil(this.unsubscribeNotifier))
-      .subscribe(() => {
-        mergeDialog.buttonsEnabled = false
-        this.executeDocumentAction(
-          modal,
-          this.documentService.mergeDocumentsAsVersions(
-            mergeDialog.documentIDs(),
-            mergeDialog.rootDocumentID()
-          ),
-          { deleteOriginals: true }
-        )
-        this.toastService.showInfo($localize`Documents merged as versions.`)
-      })
-  }
-
  public setCustomFieldValues(changedCustomFields: ChangedItems) {
    const modal = this.modalService.open(CustomFieldsBulkEditDialogComponent, {
      backdrop: 'static',
@@ -88,7 +88,7 @@
      @if (depth > 0) {
        <div class="indicator"></div>
      }
-      <button class="btn btn-link ms-0 ps-0 text-start" style="user-select: text;" (click)="userCanEdit(object) ? openEditDialog(object) : null; $event.stopPropagation()">{{ object.name }}</button>
+      <button class="btn btn-link ms-0 ps-0 text-start" style="user-select: text;" [disabled]="!userCanEdit(object)" (click)="userCanEdit(object) ? openEditDialog(object) : null; $event.stopPropagation()">{{ object.name }}</button>
    </td>
    <td class="d-none d-sm-table-cell">{{ getMatching(object) }}</td>
    <td>{{ getDocumentCount(object) }}</td>
@@ -54,6 +54,10 @@ export const ConfigCategory = {
  AI: $localize`AI Settings`,
 }

+export const ConfigSection = {
+  RemoteOCR: $localize`Remote OCR`,
+}
+
 export const LLMEmbeddingBackendConfig = {
  OPENAI_LIKE: 'openai-like',
  HUGGINGFACE: 'huggingface',
@@ -65,6 +69,15 @@ export const LLMBackendConfig = {
  OLLAMA: 'ollama',
 }

+export const RemoteOCREngineConfig = {
+  AZURE_AI: 'azureai',
+}
+
+export const RemoteOCRModeConfig = {
+  ALWAYS: 'always',
+  WORKFLOW_ONLY: 'workflow_only',
+}
+
 export interface ConfigOption {
  key: string
  title: string
@@ -72,6 +85,7 @@ export interface ConfigOption {
  choices?: Array<{ id: string; name: string }>
  config_key?: string
  category: string
+  section?: string
  note?: string
 }

@@ -181,6 +195,43 @@ export const PaperlessConfigOptions: ConfigOption[] = [
    config_key: 'PAPERLESS_OCR_USER_ARGS',
    category: ConfigCategory.OCR,
  },
+  {
+    key: 'remote_ocr_engine',
+    title: $localize`Remote OCR Engine`,
+    type: ConfigOptionType.Select,
+    choices: mapToItems(RemoteOCREngineConfig),
+    config_key: 'PAPERLESS_REMOTE_OCR_ENGINE',
+    category: ConfigCategory.OCR,
+    section: ConfigSection.RemoteOCR,
+    note: $localize`Enabling remote OCR sends documents to a third-party service for processing. Consider the privacy implications as well as potential costs before enabling.`,
+  },
+  {
+    key: 'remote_ocr_api_key',
+    title: $localize`Remote OCR API Key`,
+    type: ConfigOptionType.Password,
+    config_key: 'PAPERLESS_REMOTE_OCR_API_KEY',
+    category: ConfigCategory.OCR,
+    section: ConfigSection.RemoteOCR,
+  },
+  {
+    key: 'remote_ocr_endpoint',
+    title: $localize`Remote OCR Endpoint`,
+    type: ConfigOptionType.String,
+    config_key: 'PAPERLESS_REMOTE_OCR_ENDPOINT',
+    category: ConfigCategory.OCR,
+    section: ConfigSection.RemoteOCR,
+    note: $localize`Required when using the Azure AI engine.`,
+  },
+  {
+    key: 'remote_ocr_mode',
+    title: $localize`Remote OCR Mode`,
+    type: ConfigOptionType.Select,
+    choices: mapToItems(RemoteOCRModeConfig),
+    config_key: 'PAPERLESS_REMOTE_OCR_MODE',
+    category: ConfigCategory.OCR,
+    section: ConfigSection.RemoteOCR,
+    note: $localize`Which documents are sent to the remote engine. Use 'workflow_only' to keep remote OCR off unless a workflow enables it for a document.`,
+  },
  {
    key: 'app_logo',
    title: $localize`Application Logo`,
@@ -398,6 +449,10 @@ export interface PaperlessConfig extends ObjectWithId {
  barcode_enable_tag: boolean
  barcode_tag_mapping: object
  barcode_tag_split: boolean
+  remote_ocr_engine: string
+  remote_ocr_api_key: string
+  remote_ocr_endpoint: string
+  remote_ocr_mode: string
  ai_enabled: boolean
  llm_embedding_backend: string
  llm_embedding_model: string
@@ -316,34 +316,6 @@ describe(`DocumentService`, () => {
    })
  })

-  it('should call appropriate api endpoint for merging documents as versions', () => {
-    const ids = [1, 2, 3]
-    subscription = service.mergeDocumentsAsVersions(ids, 2).subscribe()
-    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}${endpoint}/merge_as_versions/`
-    )
-    expect(req.request.method).toEqual('POST')
-    expect(req.request.body).toEqual({
-      documents: ids,
-      root_document_id: 2,
-    })
-  })
-
-  it('should include an optional label when merging one document as a version', () => {
-    const ids = [1, 2]
-    subscription = service
-      .mergeDocumentsAsVersions(ids, 2, 'Imported')
-      .subscribe()
-    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}${endpoint}/merge_as_versions/`
-    )
-    expect(req.request.body).toEqual({
-      documents: ids,
-      root_document_id: 2,
-      version_label: 'Imported',
-    })
-  })
-
  it('should call appropriate api endpoint for edit pdf', () => {
    const ids = [1]
    const args = { operations: [{ page: 1, rotate: 90, doc: 0 }] }
@@ -374,18 +374,6 @@ export class DocumentService extends AbstractPaperlessService<Document> {
    })
  }

-  mergeDocumentsAsVersions(
-    ids: number[],
-    rootDocumentId: number,
-    versionLabel?: string
-  ) {
-    return this.http.post(this.getResourceUrl(null, 'merge_as_versions'), {
-      documents: ids,
-      root_document_id: rootDocumentId,
-      ...(versionLabel ? { version_label: versionLabel } : {}),
-    })
-  }
-
  editPdfDocuments(ids: number[], request: EditPdfDocumentsRequest) {
    return this.http.post(this.getResourceUrl(null, 'edit_pdf'), {
      documents: ids,
@@ -101,7 +101,6 @@ import {
  house,
  infoCircle,
  journals,
-  journalBookmarkFill,
  link,
  listNested,
  listTask,
@@ -324,7 +323,6 @@ const icons = {
  hddStack,
  house,
  infoCircle,
-  journalBookmarkFill,
  journals,
  link,
  listNested,
@@ -19,6 +19,13 @@ export const GlobalWorkerOptions = {
  workerSrc: '',
 }

+export const AnnotationMode = {
+  DISABLE: 0,
+  ENABLE: 1,
+  ENABLE_FORMS: 2,
+  ENABLE_STORAGE: 3,
+}
+
 export const getDocument = (_src: unknown): PDFDocumentLoadingTask => {
  return new PDFDocumentLoadingTask(Promise.resolve(new PDFDocumentProxy()))
 }
@@ -12,7 +12,6 @@ from celery import group
 from celery import shared_task
 from django.conf import settings
 from django.db import transaction
-from django.db.models import Max
 from django.db.models import Q
 from django.utils import timezone

@@ -31,7 +30,6 @@ from documents.permissions import set_permissions_for_object
 from documents.plugins.helpers import DocumentsStatusManager
 from documents.tasks import bulk_update_documents
 from documents.tasks import consume_file
-from documents.tasks import remove_document_from_index
 from documents.tasks import update_document_content_maybe_archive_file
 from documents.versioning import get_latest_version_for_root
 from documents.versioning import get_root_document
@@ -614,77 +612,6 @@ def merge(
    return "OK"


-def merge_as_versions(
-    doc_ids: list[int],
-    *,
-    root_document_id: int,
-    version_label: str | None = None,
-) -> Literal["OK"]:
-    with transaction.atomic():
-        documents = list(
-            Document.objects.select_for_update().filter(id__in=doc_ids),
-        )
-        documents_by_id = {document.id: document for document in documents}
-
-        if len(documents) != len(doc_ids):
-            raise ValueError("Some documents do not exist or were specified twice.")
-        if root_document_id not in documents_by_id:
-            raise ValueError("The root document must be selected.")
-        if any(document.root_document_id is not None for document in documents):
-            raise ValueError("Only top-level documents can be merged as versions.")
-
-        source_ids = sorted(doc_id for doc_id in doc_ids if doc_id != root_document_id)
-        if version_label is not None and len(source_ids) != 1:
-            raise ValueError(
-                "A version label can only be set when merging one source document.",
-            )
-        if Document.objects.filter(root_document_id__in=source_ids).exists():
-            raise ValueError(
-                "Documents with existing versions cannot be merged into another document.",
-            )
-
-        root_document = documents_by_id[root_document_id]
-        next_version_index = (
-            Document.global_objects.filter(
-                root_document_id=root_document_id,
-            ).aggregate(max_index=Max("version_index"))["max_index"]
-            or 0
-        )
-
-        for source_id in source_ids:
-            source_document = documents_by_id[source_id]
-            next_version_index += 1
-            source_document.root_document = root_document
-            source_document.version_index = next_version_index
-            update_fields = [
-                "root_document",
-                "version_index",
-                "archive_serial_number",
-            ]
-            if version_label is not None:
-                source_document.version_label = version_label
-                update_fields.append("version_label")
-            source_document.archive_serial_number = None
-            source_document.save(update_fields=update_fields)
-
-        root_document.modified = timezone.now()
-        root_document.save(update_fields=["modified"])
-
-    for source_id in source_ids:
-        remove_document_from_index.apply_async(args=[source_id])
-
-    bulk_update_documents.apply_async(
-        kwargs={"document_ids": [root_document_id]},
-        headers={"trigger_source": PaperlessTask.TriggerSource.SYSTEM},
-    )
-
-    # And as far as the frontend is concerned, they're deleted
-    status_mgr = DocumentsStatusManager()
-    status_mgr.send_documents_deleted(source_ids)
-
-    return "OK"
-
-
 def split(
    doc_ids: list[int],
    pages: list[list[int]],
@@ -53,6 +53,7 @@ from documents.utils import copy_basic_file_stats
 from documents.utils import copy_file_with_basic_stats
 from documents.utils import run_subprocess
 from paperless.config import OcrConfig
+from paperless.config import RemoteOCRConfig
 from paperless.models import ArchiveFileGenerationChoices
 from paperless.parsers import ParserContext
 from paperless.parsers import ParserProtocol
@@ -451,12 +452,19 @@ class ConsumerPlugin(
                except Exception as e:
                    self.log.error(f"Error attempting to clean PDF: {e}")

+            # Workflows have already run at this point, so the metadata knows
+            # whether this document was singled out for remote OCR
+            allow_remote = (
+                self.metadata.remote_ocr or RemoteOCRConfig().remote_ocr_by_default
+            )
+
            # Based on the mime type, get the parser for that type
            parser_class: type[ParserProtocol] | None = (
                get_parser_registry().get_parser_for_file(
                    mime_type,
                    self.filename,
                    self.working_copy,
+                    allow_remote=allow_remote,
                )
            )
            if not parser_class:
@@ -34,6 +34,7 @@ class DocumentMetadataOverrides:
    skip_asn_if_exists: bool = False
    version_label: str | None = None
    actor_id: int | None = None
+    remote_ocr: bool = False

    def update(self, other: "DocumentMetadataOverrides") -> "DocumentMetadataOverrides":
        """
@@ -57,6 +58,8 @@ class DocumentMetadataOverrides:
            self.actor_id = other.actor_id
        if other.skip_asn_if_exists:
            self.skip_asn_if_exists = True
+        if other.remote_ocr:
+            self.remote_ocr = True
        if other.version_label is not None:
            self.version_label = other.version_label

@@ -39,7 +39,6 @@ from guardian.utils import get_user_obj_perms_model
 from rest_framework import serializers
 from rest_framework.filters import BaseFilterBackend
 from rest_framework.filters import OrderingFilter
-from rest_framework_guardian.filters import ObjectPermissionsFilter

 from documents.models import Correspondent
 from documents.models import CustomField
@@ -51,7 +50,7 @@ from documents.models import ShareLink
 from documents.models import ShareLinkBundle
 from documents.models import StoragePath
 from documents.models import Tag
-from documents.permissions import permitted_document_ids
+from documents.permissions import permitted_object_ids

 if TYPE_CHECKING:
    from collections.abc import Callable
@@ -1028,59 +1027,41 @@ class PaperlessTaskFilterSet(FilterSet):
        return queryset.exclude(status__in=PaperlessTask.COMPLETE_STATUSES)


-class ObjectOwnedOrGrantedPermissionsFilter(ObjectPermissionsFilter):
+class PermittedObjectsFilter(BaseFilterBackend):
    """
-    A filter backend that limits results to those where the requesting user
-    has read object level permissions, owns the objects, or objects without
-    an owner (for backwards compat)
+    Filters a queryset down to objects the requesting user owns, are
+    unowned, or (when ``include_granted`` is True) has an explicit
+    user/group guardian permission on. Backed by ``permitted_object_ids``
+    -- a single ``id__in`` subquery, not a join -- so it can't produce
+    duplicate rows even when the base queryset already carries independent
+    joins (e.g. multi-value ``tags__id__all`` filtering), and stays
+    index-friendly at scale instead of falling back to guardian's
+    varchar-cast join.
+
+    Set ``include_granted = False`` on a subclass for endpoints that
+    intentionally only show owned/unowned objects regardless of explicit
+    shares (e.g. ``TrashView``).
    """

+    include_granted: bool = True
+    perm_codename: str | None = None
+
    def filter_queryset(self, request, queryset, view):
+        # Before the superuser and owner-only paths, neither of which consults
+        # permitted_object_ids. Scoped to authenticated users so anonymous
+        # access (AnonymousUser.is_active is False) keeps its existing
+        # unowned-only behaviour.
+        if request.user.is_authenticated and not request.user.is_active:
+            return queryset.none()
        if request.user.is_superuser:
            return queryset
-        objects_with_perms = super().filter_queryset(request, queryset, view)
-        objects_owned = queryset.filter(owner=request.user)
-        objects_unowned = queryset.filter(owner__isnull=True)
-        return objects_with_perms | objects_owned | objects_unowned
-
-
-class DocumentPermissionsFilter(BaseFilterBackend):
-    """
-    A filter backend limiting Document results to those the requesting user
-    owns, are unowned, or has explicit (user- or group-level) view
-    permission on.
-
-    Unlike ``ObjectOwnedOrGrantedPermissionsFilter``, this does not build an
-    ``objects_with_perms | objects_owned | objects_unowned`` union of
-    querysets derived from the same base queryset. When that base queryset
-    already carries independent joins on a multi-valued relation (e.g. two
-    separate joins from ``tags__id__all`` filtering on two tags), each
-    OR-ed branch can end up pairing those joins' aliases differently,
-    letting more than one row out of the join's cross product satisfy the
-    combined WHERE -- returning the same document more than once. Filtering
-    via a single ``id__in`` against ``permitted_document_ids`` (a plain
-    subquery, not a join) sidesteps that entirely and is also cheaper than
-    guardian's join-based permission check.
-    """
-
-    def filter_queryset(self, request, queryset, view):
-        if request.user.is_superuser:
-            return queryset
-        return queryset.filter(id__in=permitted_document_ids(request.user))
-
-
-class ObjectOwnedPermissionsFilter(ObjectPermissionsFilter):
-    """
-    A filter backend that limits results to those where the requesting user
-    owns the objects or objects without an owner (for backwards compat)
-    """
-
-    def filter_queryset(self, request, queryset, view):
-        if request.user.is_superuser:
-            return queryset
-        objects_owned = queryset.filter(owner=request.user)
-        objects_unowned = queryset.filter(owner__isnull=True)
-        return objects_owned | objects_unowned
+        if not self.include_granted:
+            return queryset.filter(Q(owner=request.user) | Q(owner__isnull=True))
+        model = queryset.model
+        perm = self.perm_codename or f"view_{model._meta.model_name}"
+        return queryset.filter(
+            id__in=permitted_object_ids(request.user, model, perm),
+        )


 class DocumentsOrderingFilter(OrderingFilter):
@@ -19,7 +19,7 @@ from documents.models import StoragePath
 from documents.models import Tag
 from documents.models import Workflow
 from documents.models import WorkflowTrigger
-from documents.permissions import get_objects_for_user_owner_aware
+from documents.permissions import permitted_object_ids
 from documents.regex import safe_regex_search

 if TYPE_CHECKING:
@@ -55,10 +55,8 @@ def match_correspondents(document: Document, classifier: DocumentClassifier, use
        user = document.owner

    if user is not None:
-        correspondents = get_objects_for_user_owner_aware(
-            user,
-            "documents.view_correspondent",
-            Correspondent,
+        correspondents = Correspondent.objects.filter(
+            id__in=permitted_object_ids(user, Correspondent, "view_correspondent"),
        )
    else:
        correspondents = Correspondent.objects.all()
@@ -86,10 +84,8 @@ def match_document_types(document: Document, classifier: DocumentClassifier, use
        user = document.owner

    if user is not None:
-        document_types = get_objects_for_user_owner_aware(
-            user,
-            "documents.view_documenttype",
-            DocumentType,
+        document_types = DocumentType.objects.filter(
+            id__in=permitted_object_ids(user, DocumentType, "view_documenttype"),
        )
    else:
        document_types = DocumentType.objects.all()
@@ -116,7 +112,9 @@ def match_tags(document: Document, classifier: DocumentClassifier, user=None):
        user = document.owner

    if user is not None:
-        tags = get_objects_for_user_owner_aware(user, "documents.view_tag", Tag)
+        tags = Tag.objects.filter(
+            id__in=permitted_object_ids(user, Tag, "view_tag"),
+        )
    else:
        tags = Tag.objects.all()

@@ -145,10 +143,8 @@ def match_storage_paths(document: Document, classifier: DocumentClassifier, user
        user = document.owner

    if user is not None:
-        storage_paths = get_objects_for_user_owner_aware(
-            user,
-            "documents.view_storagepath",
-            StoragePath,
+        storage_paths = StoragePath.objects.filter(
+            id__in=permitted_object_ids(user, StoragePath, "view_storagepath"),
        )
    else:
        storage_paths = StoragePath.objects.all()
@@ -7,6 +7,7 @@ from django.contrib.contenttypes.models import ContentType
 from django.db.models import Case
 from django.db.models import Count
 from django.db.models import IntegerField
+from django.db.models import Model
 from django.db.models import Q
 from django.db.models import QuerySet
 from django.db.models import Value
@@ -53,11 +54,15 @@ class PaperlessObjectPermissions(DjangoObjectPermissions):

 class PaperlessAdminPermissions(BasePermission):
    def has_permission(self, request, view):
-        return request.user.is_staff
+        return request.user.is_active and request.user.is_staff


 def has_global_statistics_permission(user: User | None) -> bool:
-    if user is None or not getattr(user, "is_authenticated", False):
+    if (
+        user is None
+        or not getattr(user, "is_active", False)
+        or not getattr(user, "is_authenticated", False)
+    ):
        return False

    return getattr(user, "is_superuser", False) or user.has_perm(
@@ -66,7 +71,11 @@ def has_global_statistics_permission(user: User | None) -> bool:


 def has_system_status_permission(user: User | None) -> bool:
-    if user is None or not getattr(user, "is_authenticated", False):
+    if (
+        user is None
+        or not getattr(user, "is_active", False)
+        or not getattr(user, "is_authenticated", False)
+    ):
        return False

    return (
@@ -163,30 +172,39 @@ def set_permissions_for_object(
                        )


-def permitted_document_ids(
-    user,
+def permitted_object_ids(
+    user: User | None,
+    model: type[Model],
+    perm: str,
    *,
-    perm: str = "view_document",
    include_deleted: bool = False,
-):
+) -> QuerySet[int]:
    """
-    Return a queryset of document IDs the user has ``perm`` on (default
-    ``"view_document"``). By default limited to non-deleted documents; pass
-    ``include_deleted=True`` for callers that need to check permission on
-    soft-deleted documents (e.g. trash restore). This intentionally avoids
-    ``get_objects_for_user`` to keep the subquery small and index-friendly.
+    Generic version of ``permitted_document_ids`` for any model with an
+    ``owner`` field and guardian object-level permissions. ``include_deleted``
+    only has an effect for models exposing a ``global_objects``/``deleted_at``
+    soft-delete pattern (currently only ``Document``); for every other model
+    it is accepted but has no effect, since those models have no soft-delete
+    concept.
    """
-
-    manager = Document.global_objects if include_deleted else Document.objects
-    base_docs = manager.all()
-    base_docs = base_docs.only("id", "owner")
+    has_soft_delete = hasattr(model, "global_objects")
+    manager = (
+        model.global_objects if include_deleted and has_soft_delete else model.objects
+    )
+    base_qs = manager.all().only("id", "owner")

    if user is None or not getattr(user, "is_authenticated", False):
-        # Just Anonymous user e.g. for drf-spectacular
-        return base_docs.filter(owner__isnull=True).values_list("id", flat=True)
+        return base_qs.filter(owner__isnull=True).values_list("id", flat=True)
+
+    # Deactivated users get nothing, deactivated superusers included, so this
+    # has to come before the superuser shortcut. guardian's
+    # ObjectPermissionChecker denies inactive users, but get_objects_for_user
+    # (the pattern this replaces) does not, so it would not be inherited.
+    if not getattr(user, "is_active", False):
+        return base_qs.none().values_list("id", flat=True)

    if getattr(user, "is_superuser", False):
-        return base_docs.values_list("id", flat=True)
+        return base_qs.values_list("id", flat=True)

    # Guardian's UserObjectPermission/GroupObjectPermission always store a bare
    # codename, but has_perm()-style callers commonly pass the qualified
@@ -194,31 +212,46 @@ def permitted_document_ids(
    # codename, so just drop any prefix rather than silently under-permitting.
    perm = perm.rsplit(".", 1)[-1]

-    document_ct = ContentType.objects.get_for_model(Document)
+    content_type = ContentType.objects.get_for_model(model)
    perm_filter = {
        "permission__codename": perm,
-        "permission__content_type": document_ct,
+        "permission__content_type": content_type,
    }

-    user_perm_docs = (
+    user_perm_ids = (
        UserObjectPermission.objects.filter(user=user, **perm_filter)
        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
        .values_list("object_pk_int", flat=True)
    )
-
-    group_perm_docs = (
+    group_perm_ids = (
        GroupObjectPermission.objects.filter(group__user=user, **perm_filter)
        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
        .values_list("object_pk_int", flat=True)
    )
+    permitted_ids = user_perm_ids.union(group_perm_ids)

-    permitted_documents = user_perm_docs.union(group_perm_docs)
-
-    return base_docs.filter(
-        Q(owner=user) | Q(owner__isnull=True) | Q(id__in=permitted_documents),
+    return base_qs.filter(
+        Q(owner=user) | Q(owner__isnull=True) | Q(id__in=permitted_ids),
    ).values_list("id", flat=True)


+def permitted_document_ids(
+    user: User | None,
+    *,
+    perm: str = "view_document",
+    include_deleted: bool = False,
+) -> QuerySet[int]:
+    """
+    Document-specific convenience wrapper around ``permitted_object_ids``.
+    Return a queryset of document IDs the user has ``perm`` on (default
+    ``"view_document"``). By default limited to non-deleted documents; pass
+    ``include_deleted=True`` for callers that need to check permission on
+    soft-deleted documents (e.g. trash restore). This intentionally avoids
+    ``get_objects_for_user`` to keep the subquery small and index-friendly.
+    """
+    return permitted_object_ids(user, Document, perm, include_deleted=include_deleted)
+
+
 def get_document_count_filter_for_user(user, related_name: str = "documents"):
    """
    Return the Q object used to filter document counts for the given user.
@@ -341,6 +374,13 @@ def get_objects_for_user_owner_aware(
    """
    Returns objects the user owns, are unowned, or has explicit perms.
    When include_deleted is True, soft-deleted items are also included.
+
+    Legacy slow path (guardian-backed, O(n) style permission resolution).
+    Most queryset-filtering call sites have migrated onto
+    ``PermittedObjectsFilter``/``permitted_object_ids()``, but this function
+    is kept because production callers still remain. Several callers remain
+    across ``documents/``, ``paperless_mail/``, and ``paperless_ai/`` --
+    grep for this function name before removing it.
    """
    manager = (
        Model.global_objects
@@ -360,6 +400,15 @@ def get_objects_for_user_owner_aware(


 def has_perms_owner_aware(user, perms, obj):
+    """
+    Legacy slow path (guardian-backed) single-object permission check.
+
+    The queryset-filtering side of this migrated onto
+    ``PermittedObjectsFilter``/``permitted_object_ids()``, but this
+    single-object check still has many production callers. Several callers
+    remain across ``documents/``, ``paperless_mail/``, and ``paperless_ai/``
+    -- grep for this function name before removing it.
+    """
    checker = ObjectPermissionChecker(user)
    return obj.owner is None or obj.owner == user or checker.has_perm(perms, obj)

@@ -1675,52 +1675,6 @@ class MergeDocumentsSerializer(DocumentListSerializer, SourceModeValidationMixin
    from_webui = serializers.BooleanField(required=False, default=False)


-class MergeDocumentsAsVersionsSerializer(DocumentListSerializer):
-    root_document_id = serializers.IntegerField(required=True)
-    version_label = serializers.CharField(
-        required=False,
-        allow_blank=True,
-        allow_null=True,
-        max_length=64,
-    )
-
-    def validate_version_label(self, value):
-        if value is None:
-            return None
-        normalized = value.strip()
-        return normalized or None
-
-    def validate(self, attrs):
-        documents = attrs["documents"]
-        if len(documents) < 2:
-            raise serializers.ValidationError(
-                "At least two documents are required.",
-            )
-        if "version_label" in attrs and len(documents) != 2:
-            raise serializers.ValidationError(
-                "version_label can only be used when merging one source document.",
-            )
-        if attrs["root_document_id"] not in documents:
-            raise serializers.ValidationError(
-                "root_document_id must be one of the selected documents.",
-            )
-
-        selected_documents = Document.objects.filter(id__in=documents)
-        if selected_documents.filter(root_document__isnull=False).exists():
-            raise serializers.ValidationError(
-                "Only top-level documents can be merged as versions.",
-            )
-
-        source_document_ids = set(documents) - {attrs["root_document_id"]}
-        if Document.objects.filter(
-            root_document_id__in=source_document_ids,
-        ).exists():
-            raise serializers.ValidationError(
-                "Documents with existing versions cannot be merged into another document.",
-            )
-        return attrs
-
-
 class EditPdfDocumentsSerializer(DocumentListSerializer, SourceModeValidationMixin):
    operations = serializers.ListField(required=True)
    delete_original = serializers.BooleanField(required=False, default=False)
@@ -66,6 +66,7 @@ from documents.utils import compute_checksum
 from documents.utils import identity
 from documents.workflows.utils import get_workflows_for_trigger
 from paperless.config import AIConfig
+from paperless.config import RemoteOCRConfig
 from paperless.logging import consume_task_id
 from paperless.parsers import ParserContext
 from paperless.parsers.registry import get_parser_registry
@@ -337,10 +338,17 @@ def bulk_update_documents(document_ids) -> None:


@shared_task
-def update_document_content_maybe_archive_file(document_id) -> None:
+def update_document_content_maybe_archive_file(
+    document_id,
+    *,
+    remote_ocr: bool = False,
+) -> None:
    """
    Re-creates OCR content and thumbnail for a document, and archive file if
    it exists.
+
+    Remote OCR is used only when the engine is configured to handle everything
+    or if explicitly asked for via ``remote_ocr``.
    """
    document = Document.objects.get(id=document_id)

@@ -350,6 +358,7 @@ def update_document_content_maybe_archive_file(document_id) -> None:
        mime_type,
        document.original_filename or "",
        document.source_path,
+        allow_remote=remote_ocr or RemoteOCRConfig().remote_ocr_by_default,
    )

    if not parser_class:
@@ -72,6 +72,10 @@ class TestApiAppConfig(DirectoriesMixin, APITestCase):
                "barcode_enable_tag": None,
                "barcode_tag_mapping": None,
                "barcode_tag_split": None,
+                "remote_ocr_engine": None,
+                "remote_ocr_api_key": None,
+                "remote_ocr_endpoint": None,
+                "remote_ocr_mode": None,
                "ai_enabled": False,
                "llm_embedding_backend": None,
                "llm_embedding_model": None,
@@ -870,6 +874,49 @@ class TestApiAppConfig(DirectoriesMixin, APITestCase):
        config.refresh_from_db()
        self.assertEqual(config.llm_api_key, None)

+    def test_update_remote_ocr_api_key(self) -> None:
+        """
+        GIVEN:
+            - Existing config with remote_ocr_api_key specified
+        WHEN:
+            - API to update remote_ocr_api_key is called with all *s
+            - API to update remote_ocr_api_key is called with empty string
+        THEN:
+            - remote_ocr_api_key is unchanged
+            - remote_ocr_api_key is set to None
+        """
+        config = ApplicationConfiguration.objects.first()
+        assert config is not None
+        config.remote_ocr_api_key = "1234567890"
+        config.save()
+
+        # Test with all *
+        response = self.client.patch(
+            f"{self.ENDPOINT}1/",
+            json.dumps(
+                {
+                    "remote_ocr_api_key": "*" * 32,
+                },
+            ),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        config.refresh_from_db()
+        self.assertEqual(config.remote_ocr_api_key, "1234567890")
+        # Test with empty string
+        response = self.client.patch(
+            f"{self.ENDPOINT}1/",
+            json.dumps(
+                {
+                    "remote_ocr_api_key": "",
+                },
+            ),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        config.refresh_from_db()
+        self.assertEqual(config.remote_ocr_api_key, None)
+
    def test_enable_ai_index_triggers_update(self) -> None:
        """
        GIVEN:
@@ -48,7 +48,6 @@ class TestApiSchema(APITestCase):
        self.assertIn("/api/documents/reprocess/", paths)
        self.assertIn("/api/documents/rotate/", paths)
        self.assertIn("/api/documents/merge/", paths)
-        self.assertIn("/api/documents/merge_as_versions/", paths)
        self.assertIn("/api/documents/edit_pdf/", paths)
        self.assertIn("/api/documents/remove_password/", paths)

@@ -1559,6 +1559,72 @@ class PostConsumeTestCase(DirectoriesMixin, GetConsumerMixin, TestCase):
                        consumer.run_post_consume_script(doc)


+class TestConsumerRemoteOCR(
+    DirectoriesMixin,
+    FileSystemAssertsMixin,
+    GetConsumerMixin,
+    TestCase,
+):
+    """
+    The consumer resolves the remote OCR mode and the per-document request from
+    workflows into the allow_remote flag it hands to the parser registry.
+    """
+
+    def setUp(self) -> None:
+        super().setUp()
+
+        patcher = mock.patch("documents.consumer.get_parser_registry")
+        self.mock_registry = patcher.start()
+        self.mock_registry.return_value.get_parser_for_file.return_value = DummyParser
+        self.addCleanup(patcher.stop)
+
+    def _consume(self, *, overrides: DocumentMetadataOverrides | None = None) -> bool:
+        src = (
+            Path(__file__).parent
+            / "samples"
+            / "documents"
+            / "originals"
+            / "0000001.pdf"
+        )
+        dst = self.dirs.scratch_dir / "sample.pdf"
+        shutil.copy(src, dst)
+
+        with self.get_consumer(dst, overrides=overrides) as consumer:
+            consumer.run()
+
+        _, kwargs = self.mock_registry.return_value.get_parser_for_file.call_args
+        return kwargs["allow_remote"]
+
+    @override_settings(REMOTE_OCR_MODE="always")
+    def test_always_mode_allows_remote(self) -> None:
+        """
+        GIVEN: Remote OCR mode is 'always'.
+        WHEN:  A document is consumed without any workflow asking for it.
+        THEN:  The registry is allowed to pick the remote parser.
+        """
+        self.assertTrue(self._consume())
+
+    @override_settings(REMOTE_OCR_MODE="workflow_only")
+    def test_workflow_only_mode_denies_remote_by_default(self) -> None:
+        """
+        GIVEN: Remote OCR mode is 'workflow_only'.
+        WHEN:  A document is consumed and nothing asked for remote OCR.
+        THEN:  The remote parser is excluded.
+        """
+        self.assertFalse(self._consume())
+
+    @override_settings(REMOTE_OCR_MODE="workflow_only")
+    def test_workflow_only_mode_allows_remote_when_requested(self) -> None:
+        """
+        GIVEN: Remote OCR mode is 'workflow_only'.
+        WHEN:  A workflow set remote_ocr on the metadata overrides.
+        THEN:  The registry is allowed to pick the remote parser.
+        """
+        self.assertTrue(
+            self._consume(overrides=DocumentMetadataOverrides(remote_ocr=True)),
+        )
+
+
 class TestMetadataOverrides(TestCase):
    def test_update_skip_asn_if_exists(self) -> None:
        base = DocumentMetadataOverrides()
@@ -1566,6 +1632,20 @@ class TestMetadataOverrides(TestCase):
        base.update(incoming)
        self.assertTrue(base.skip_asn_if_exists)

+    def test_update_remote_ocr(self) -> None:
+        base = DocumentMetadataOverrides()
+        base.update(DocumentMetadataOverrides(remote_ocr=True))
+        self.assertTrue(base.remote_ocr)
+
+    def test_update_remote_ocr_is_not_unset(self) -> None:
+        """
+        A later workflow that says nothing must not undo an earlier one that
+        asked for remote OCR.
+        """
+        base = DocumentMetadataOverrides(remote_ocr=True)
+        base.update(DocumentMetadataOverrides())
+        self.assertTrue(base.remote_ocr)
+
    def test_update_actor_and_version_label(self) -> None:
        base = DocumentMetadataOverrides(
            actor_id=1,
@@ -1,402 +0,0 @@
-import json
-from unittest import mock
-
-from django.contrib.auth.models import Permission
-from django.contrib.auth.models import User
-from django.test import TestCase
-from rest_framework import status
-from rest_framework.test import APITestCase
-
-from documents.bulk_edit import merge_as_versions
-from documents.models import Document
-from documents.serialisers import MergeDocumentsAsVersionsSerializer
-
-
-class TestMergeDocumentsAsVersionsSerializer(TestCase):
-    def setUp(self) -> None:
-        self.doc1 = Document.objects.create(checksum="A", title="A")
-        self.doc2 = Document.objects.create(checksum="B", title="B")
-        self.doc3 = Document.objects.create(checksum="C", title="C")
-
-    def test_accepts_selected_root_document(self) -> None:
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [self.doc1.id, self.doc2.id, self.doc3.id],
-                "root_document_id": self.doc2.id,
-            },
-        )
-
-        self.assertTrue(serializer.is_valid(), serializer.errors)
-        self.assertEqual(
-            serializer.validated_data,
-            {
-                "documents": [self.doc1.id, self.doc2.id, self.doc3.id],
-                "root_document_id": self.doc2.id,
-            },
-        )
-
-    def test_requires_at_least_two_documents(self) -> None:
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [self.doc1.id],
-                "root_document_id": self.doc1.id,
-            },
-        )
-
-        self.assertFalse(serializer.is_valid())
-        self.assertEqual(
-            serializer.errors["non_field_errors"][0],
-            "At least two documents are required.",
-        )
-
-    def test_accepts_version_label_for_one_source_document(self) -> None:
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [self.doc1.id, self.doc2.id],
-                "root_document_id": self.doc1.id,
-                "version_label": "  Imported  ",
-            },
-        )
-
-        self.assertTrue(serializer.is_valid(), serializer.errors)
-        self.assertEqual(serializer.validated_data["version_label"], "Imported")
-
-    def test_rejects_version_label_for_multiple_source_documents(self) -> None:
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [self.doc1.id, self.doc2.id, self.doc3.id],
-                "root_document_id": self.doc1.id,
-                "version_label": "Imported",
-            },
-        )
-
-        self.assertFalse(serializer.is_valid())
-        self.assertEqual(
-            serializer.errors["non_field_errors"][0],
-            "version_label can only be used when merging one source document.",
-        )
-
-    def test_requires_root_document_to_be_selected(self) -> None:
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [self.doc1.id, self.doc2.id],
-                "root_document_id": self.doc3.id,
-            },
-        )
-
-        self.assertFalse(serializer.is_valid())
-        self.assertEqual(
-            serializer.errors["non_field_errors"][0],
-            "root_document_id must be one of the selected documents.",
-        )
-
-    def test_rejects_duplicate_documents(self) -> None:
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [self.doc1.id, self.doc1.id],
-                "root_document_id": self.doc1.id,
-            },
-        )
-
-        self.assertFalse(serializer.is_valid())
-        self.assertIn("documents", serializer.errors)
-
-    def test_rejects_selected_version(self) -> None:
-        version = Document.objects.create(
-            checksum="D",
-            title="D",
-            root_document=self.doc1,
-            version_index=1,
-        )
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [version.id, self.doc2.id],
-                "root_document_id": self.doc2.id,
-            },
-        )
-
-        self.assertFalse(serializer.is_valid())
-        self.assertEqual(
-            serializer.errors["non_field_errors"][0],
-            "Only top-level documents can be merged as versions.",
-        )
-
-    def test_rejects_source_document_with_versions(self) -> None:
-        Document.objects.create(
-            checksum="D",
-            title="D",
-            root_document=self.doc1,
-            version_index=1,
-        )
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [self.doc1.id, self.doc2.id],
-                "root_document_id": self.doc2.id,
-            },
-        )
-
-        self.assertFalse(serializer.is_valid())
-        self.assertEqual(
-            serializer.errors["non_field_errors"][0],
-            "Documents with existing versions cannot be merged into another document.",
-        )
-
-    def test_allows_root_document_with_versions(self) -> None:
-        Document.objects.create(
-            checksum="D",
-            title="D",
-            root_document=self.doc1,
-            version_index=1,
-        )
-        serializer = MergeDocumentsAsVersionsSerializer(
-            data={
-                "documents": [self.doc1.id, self.doc2.id],
-                "root_document_id": self.doc1.id,
-            },
-        )
-
-        self.assertTrue(serializer.is_valid(), serializer.errors)
-
-
-class TestMergeDocumentsAsVersions(TestCase):
-    @mock.patch("documents.bulk_edit.DocumentsStatusManager")
-    @mock.patch("documents.bulk_edit.bulk_update_documents.apply_async")
-    @mock.patch("documents.bulk_edit.remove_document_from_index.apply_async")
-    def test_merges_documents_in_creation_order(
-        self,
-        remove_from_index_mock,
-        bulk_update_mock,
-        status_manager_mock,
-    ) -> None:
-        root = Document.objects.create(checksum="A", title="Root")
-        existing_version = Document.objects.create(
-            checksum="B",
-            title="Existing version",
-            root_document=root,
-            version_index=3,
-        )
-        source1 = Document.objects.create(
-            checksum="C",
-            title="Source 1",
-            archive_serial_number=1,
-        )
-        source2 = Document.objects.create(
-            checksum="D",
-            title="Source 2",
-            archive_serial_number=2,
-        )
-        original_modified = root.modified
-
-        result = merge_as_versions(
-            [source2.id, root.id, source1.id],
-            root_document_id=root.id,
-        )
-
-        self.assertEqual(result, "OK")
-        source1.refresh_from_db()
-        source2.refresh_from_db()
-        root.refresh_from_db()
-        self.assertEqual(source2.root_document_id, root.id)
-        self.assertEqual(source2.version_index, 5)
-        self.assertEqual(source1.root_document_id, root.id)
-        self.assertEqual(source1.version_index, 4)
-        self.assertIsNone(source1.archive_serial_number)
-        self.assertIsNone(source2.archive_serial_number)
-        self.assertGreater(root.modified, original_modified)
-        self.assertEqual(existing_version.root_document_id, root.id)
-
-        self.assertEqual(
-            [call.kwargs["args"] for call in remove_from_index_mock.call_args_list],
-            [[source1.id], [source2.id]],
-        )
-        bulk_update_mock.assert_called_once_with(
-            kwargs={"document_ids": [root.id]},
-            headers={"trigger_source": "system"},
-        )
-        status_manager_mock.return_value.send_documents_deleted.assert_called_once_with(
-            [source1.id, source2.id],
-        )
-
-    @mock.patch("documents.bulk_edit.DocumentsStatusManager")
-    @mock.patch("documents.bulk_edit.bulk_update_documents.apply_async")
-    @mock.patch("documents.bulk_edit.remove_document_from_index.apply_async")
-    def test_sets_version_label_for_one_source_document(
-        self,
-        _remove_from_index_mock,
-        _bulk_update_mock,
-        _status_manager_mock,
-    ) -> None:
-        root = Document.objects.create(checksum="A", title="Root")
-        source = Document.objects.create(checksum="B", title="Source")
-
-        merge_as_versions(
-            [root.id, source.id],
-            root_document_id=root.id,
-            version_label="Imported",
-        )
-
-        source.refresh_from_db()
-        self.assertEqual(source.version_label, "Imported")
-
-    @mock.patch("documents.bulk_edit.DocumentsStatusManager")
-    @mock.patch("documents.bulk_edit.bulk_update_documents.apply_async")
-    @mock.patch("documents.bulk_edit.remove_document_from_index.apply_async")
-    def test_rejects_source_document_with_versions(
-        self,
-        remove_from_index_mock,
-        bulk_update_mock,
-        status_manager_mock,
-    ) -> None:
-        source = Document.objects.create(checksum="A", title="Source")
-        Document.objects.create(
-            checksum="B",
-            title="Source version",
-            root_document=source,
-            version_index=1,
-        )
-        root = Document.objects.create(checksum="C", title="Root")
-
-        with self.assertRaisesRegex(ValueError, "existing versions"):
-            merge_as_versions(
-                [source.id, root.id],
-                root_document_id=root.id,
-            )
-
-        source.refresh_from_db()
-        self.assertIsNone(source.root_document_id)
-        remove_from_index_mock.assert_not_called()
-        bulk_update_mock.assert_not_called()
-        status_manager_mock.assert_not_called()
-
-
-class TestMergeDocumentsAsVersionsAPI(APITestCase):
-    def setUp(self) -> None:
-        self.user = User.objects.create_user(username="user")
-        self.user.user_permissions.add(
-            Permission.objects.get(codename="change_document"),
-            Permission.objects.get(codename="view_document"),
-        )
-        self.doc1 = Document.objects.create(
-            checksum="A",
-            title="A",
-            owner=self.user,
-        )
-        self.doc2 = Document.objects.create(
-            checksum="B",
-            title="B",
-            owner=self.user,
-        )
-        self.client.force_authenticate(user=self.user)
-
-    @mock.patch("documents.views.bulk_edit.merge_as_versions")
-    def test_merges_documents_as_versions(self, merge_mock) -> None:
-        merge_mock.return_value = "OK"
-        merge_mock.__name__ = "merge_as_versions"
-
-        response = self.client.post(
-            "/api/documents/merge_as_versions/",
-            json.dumps(
-                {
-                    "documents": [self.doc1.id, self.doc2.id],
-                    "root_document_id": self.doc2.id,
-                    "version_label": "Imported",
-                },
-            ),
-            content_type="application/json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data, {"result": "OK"})
-        merge_mock.assert_called_once_with(
-            [self.doc1.id, self.doc2.id],
-            root_document_id=self.doc2.id,
-            version_label="Imported",
-        )
-
-    @mock.patch("documents.views.bulk_edit.merge_as_versions")
-    def test_requires_change_permission(self, merge_mock) -> None:
-        merge_mock.__name__ = "merge_as_versions"
-        user = User.objects.create_user(username="no-change")
-        self.doc1.owner = user
-        self.doc1.save()
-        self.doc2.owner = user
-        self.doc2.save()
-        self.client.force_authenticate(user=user)
-
-        response = self.client.post(
-            "/api/documents/merge_as_versions/",
-            {
-                "documents": [self.doc1.id, self.doc2.id],
-                "root_document_id": self.doc1.id,
-            },
-            format="json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
-        merge_mock.assert_not_called()
-
-    @mock.patch("documents.views.bulk_edit.merge_as_versions")
-    def test_rejects_unselected_root(self, merge_mock) -> None:
-        doc3 = Document.objects.create(
-            checksum="C",
-            title="C",
-            owner=self.user,
-        )
-
-        response = self.client.post(
-            "/api/documents/merge_as_versions/",
-            {
-                "documents": [self.doc1.id, self.doc2.id],
-                "root_document_id": doc3.id,
-            },
-            format="json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-        merge_mock.assert_not_called()
-
-    @mock.patch("documents.bulk_edit.DocumentsStatusManager")
-    @mock.patch("documents.bulk_edit.bulk_update_documents.apply_async")
-    @mock.patch("documents.bulk_edit.remove_document_from_index.apply_async")
-    def test_merges_and_returns_documents_as_versions(
-        self,
-        remove_from_index_mock,
-        bulk_update_mock,
-        status_manager_mock,
-    ) -> None:
-        response = self.client.post(
-            "/api/documents/merge_as_versions/",
-            {
-                "documents": [self.doc1.id, self.doc2.id],
-                "root_document_id": self.doc2.id,
-                "version_label": "Imported",
-            },
-            format="json",
-        )
-
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.doc1.refresh_from_db()
-        self.assertEqual(self.doc1.root_document_id, self.doc2.id)
-        self.assertEqual(self.doc1.version_label, "Imported")
-
-        detail_response = self.client.get(
-            f"/api/documents/{self.doc2.id}/?fields=id,versions",
-        )
-        self.assertEqual(detail_response.status_code, status.HTTP_200_OK)
-        versions = detail_response.data["versions"]
-        self.assertEqual(
-            {version["id"] for version in versions},
-            {self.doc1.id, self.doc2.id},
-        )
-        self.assertEqual(
-            [version["id"] for version in versions if version["is_root"]],
-            [self.doc2.id],
-        )
-        remove_from_index_mock.assert_called_once_with(args=[self.doc1.id])
-        bulk_update_mock.assert_called_once_with(
-            kwargs={"document_ids": [self.doc2.id]},
-            headers={"trigger_source": "system"},
-        )
-        status_manager_mock.return_value.send_documents_deleted.assert_called_once_with(
-            [self.doc1.id],
-        )
@@ -12,9 +12,22 @@ from django.test import override_settings
 from guardian.shortcuts import assign_perm
 from rest_framework.test import APIClient

+from documents.matching import match_correspondents
+from documents.matching import match_document_types
+from documents.matching import match_storage_paths
+from documents.matching import match_tags
+from documents.models import Correspondent
+from documents.models import DocumentType
+from documents.models import StoragePath
+from documents.models import Tag
 from documents.permissions import permitted_document_ids
+from documents.permissions import permitted_object_ids
 from documents.serialisers import _get_viewable_duplicates
+from documents.tests.factories import CorrespondentFactory
 from documents.tests.factories import DocumentFactory
+from documents.tests.factories import DocumentTypeFactory
+from documents.tests.factories import StoragePathFactory
+from documents.tests.factories import TagFactory


 def assert_visible_document_ids(actual_ids, *, expected_visible, expected_hidden):
@@ -431,3 +444,342 @@ class TestTrashRestorePermissionBoundary:
            format="json",
        )
        assert response.status_code == HTTPStatus.OK
+
+
+@pytest.mark.django_db
+class TestTrashViewExcludesExplicitlyGrantedDocuments:
+    """
+    Regression test pinning TrashView's use of
+    ``_TrashPermittedObjectsFilter`` (``include_granted = False``). If that
+    flag were ever flipped to the default ``True``, or the subclass removed
+    in favor of the base ``PermittedObjectsFilter``, a trashed document
+    would leak into ``/api/trash/`` results for any user holding an
+    explicit guardian grant on it, even though they are neither the owner
+    nor a superuser.
+    """
+
+    def test_explicit_grant_does_not_leak_trashed_document(self, rest_api_client):
+        owner = User.objects.create_user(username="trash_owner")
+        grantee = User.objects.create_user(username="trash_grantee")
+        doc = DocumentFactory(owner=owner)
+        doc.delete()  # soft delete
+        assign_perm("view_document", grantee, doc)
+
+        rest_api_client.force_authenticate(user=grantee)
+        response = rest_api_client.get("/api/trash/")
+
+        assert response.status_code == HTTPStatus.OK
+        result_ids = {result["id"] for result in response.data["results"]}
+        assert doc.pk not in result_ids
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize(
+    ("model", "factory", "perm"),
+    [
+        (Tag, TagFactory, "view_tag"),
+        (Correspondent, CorrespondentFactory, "view_correspondent"),
+        (DocumentType, DocumentTypeFactory, "view_documenttype"),
+        (StoragePath, StoragePathFactory, "view_storagepath"),
+    ],
+)
+class TestPermittedObjectIdsGenericModels:
+    def test_owner_sees_own_object(self, model, factory, perm):
+        owner = User.objects.create_user(username=f"owner_{model.__name__}")
+        stranger = User.objects.create_user(username=f"stranger_{model.__name__}")
+        owned = factory(owner=owner)
+        strangers = factory(owner=stranger)
+
+        assert_visible_document_ids(
+            permitted_object_ids(owner, model, perm),
+            expected_visible=[owned.pk],
+            expected_hidden=[strangers.pk],
+        )
+
+    @pytest.mark.parametrize("is_superuser", [False, True])
+    def test_inactive_user_sees_nothing(self, model, factory, perm, is_superuser):
+        suffix = f"{model.__name__}_{is_superuser}"
+        user = User.objects.create_user(
+            username=f"inactive_{suffix}",
+            is_active=False,
+            is_superuser=is_superuser,
+        )
+        other = User.objects.create_user(username=f"other_{suffix}")
+        granted = factory(owner=other)
+        assign_perm(perm, user, granted)
+
+        assert_visible_document_ids(
+            permitted_object_ids(user, model, perm),
+            expected_visible=[],
+            expected_hidden=[
+                factory(owner=None).pk,
+                factory(owner=user).pk,
+                granted.pk,
+            ],
+        )
+
+    def test_unowned_object_visible_to_everyone(self, model, factory, perm):
+        user = User.objects.create_user(username=f"user_{model.__name__}")
+        unowned = factory(owner=None)
+
+        assert_visible_document_ids(
+            permitted_object_ids(user, model, perm),
+            expected_visible=[unowned.pk],
+            expected_hidden=[],
+        )
+
+    def test_explicit_permission_grants_visibility(self, model, factory, perm):
+        owner = User.objects.create_user(username=f"owner2_{model.__name__}")
+        grantee = User.objects.create_user(username=f"grantee_{model.__name__}")
+        stranger = User.objects.create_user(username=f"stranger2_{model.__name__}")
+        shared = factory(owner=owner)
+        not_shared = factory(owner=owner)
+        assign_perm(perm, grantee, shared)
+
+        assert_visible_document_ids(
+            permitted_object_ids(grantee, model, perm),
+            expected_visible=[shared.pk],
+            expected_hidden=[not_shared.pk],
+        )
+        assert_visible_document_ids(
+            permitted_object_ids(stranger, model, perm),
+            expected_visible=[],
+            expected_hidden=[shared.pk, not_shared.pk],
+        )
+
+    def test_group_permission_grants_visibility_to_members_only(
+        self,
+        model,
+        factory,
+        perm,
+    ):
+        owner = User.objects.create_user(username=f"owner3_{model.__name__}")
+        member = User.objects.create_user(username=f"member_{model.__name__}")
+        non_member = User.objects.create_user(username=f"nonmember_{model.__name__}")
+        group = Group.objects.create(name=f"group_{model.__name__}")
+        member.groups.add(group)
+        shared = factory(owner=owner)
+        assign_perm(perm, group, shared)
+
+        assert_visible_document_ids(
+            permitted_object_ids(member, model, perm),
+            expected_visible=[shared.pk],
+            expected_hidden=[],
+        )
+        assert_visible_document_ids(
+            permitted_object_ids(non_member, model, perm),
+            expected_visible=[],
+            expected_hidden=[shared.pk],
+        )
+
+    def test_superuser_sees_everything(self, model, factory, perm):
+        superuser = User.objects.create_superuser(username=f"root_{model.__name__}")
+        owner = User.objects.create_user(username=f"owner4_{model.__name__}")
+        obj = factory(owner=owner)
+
+        assert_visible_document_ids(
+            permitted_object_ids(superuser, model, perm),
+            expected_visible=[obj.pk],
+            expected_hidden=[],
+        )
+
+
+@pytest.mark.django_db
+class TestMatchingRespectsObjectPermissions:
+    def test_match_tags_only_considers_tags_visible_to_user(self):
+        owner = User.objects.create_user(username="tag_owner")
+        classifying_user = User.objects.create_user(username="classifier_user")
+        visible_tag = TagFactory(
+            owner=owner,
+            match="invoice",
+            matching_algorithm=Tag.MATCH_LITERAL,
+        )
+        hidden_tag = TagFactory(
+            owner=owner,
+            match="invoice",
+            matching_algorithm=Tag.MATCH_LITERAL,
+        )
+        assign_perm("view_tag", classifying_user, visible_tag)
+        doc = DocumentFactory(owner=classifying_user, content="an invoice document")
+
+        matched = match_tags(doc, classifier=None, user=classifying_user)
+        matched_ids = {t.pk for t in matched}
+        assert visible_tag.pk in matched_ids
+        assert hidden_tag.pk not in matched_ids
+
+    def test_match_correspondents_only_considers_correspondents_visible_to_user(self):
+        owner = User.objects.create_user(username="correspondent_owner")
+        classifying_user = User.objects.create_user(username="classifier_user2")
+        visible_correspondent = CorrespondentFactory(
+            owner=owner,
+            match="invoice",
+            matching_algorithm=Correspondent.MATCH_LITERAL,
+        )
+        hidden_correspondent = CorrespondentFactory(
+            owner=owner,
+            match="invoice",
+            matching_algorithm=Correspondent.MATCH_LITERAL,
+        )
+        assign_perm("view_correspondent", classifying_user, visible_correspondent)
+        doc = DocumentFactory(owner=classifying_user, content="an invoice document")
+
+        matched = match_correspondents(doc, classifier=None, user=classifying_user)
+        matched_ids = {c.pk for c in matched}
+        assert visible_correspondent.pk in matched_ids
+        assert hidden_correspondent.pk not in matched_ids
+
+    def test_match_document_types_only_considers_document_types_visible_to_user(self):
+        owner = User.objects.create_user(username="document_type_owner")
+        classifying_user = User.objects.create_user(username="classifier_user3")
+        visible_document_type = DocumentTypeFactory(
+            owner=owner,
+            match="invoice",
+            matching_algorithm=DocumentType.MATCH_LITERAL,
+        )
+        hidden_document_type = DocumentTypeFactory(
+            owner=owner,
+            match="invoice",
+            matching_algorithm=DocumentType.MATCH_LITERAL,
+        )
+        assign_perm("view_documenttype", classifying_user, visible_document_type)
+        doc = DocumentFactory(owner=classifying_user, content="an invoice document")
+
+        matched = match_document_types(doc, classifier=None, user=classifying_user)
+        matched_ids = {dt.pk for dt in matched}
+        assert visible_document_type.pk in matched_ids
+        assert hidden_document_type.pk not in matched_ids
+
+    def test_match_storage_paths_only_considers_storage_paths_visible_to_user(self):
+        owner = User.objects.create_user(username="storage_path_owner")
+        classifying_user = User.objects.create_user(username="classifier_user4")
+        visible_storage_path = StoragePathFactory(
+            owner=owner,
+            match="invoice",
+            matching_algorithm=StoragePath.MATCH_LITERAL,
+        )
+        hidden_storage_path = StoragePathFactory(
+            owner=owner,
+            match="invoice",
+            matching_algorithm=StoragePath.MATCH_LITERAL,
+        )
+        assign_perm("view_storagepath", classifying_user, visible_storage_path)
+        doc = DocumentFactory(owner=classifying_user, content="an invoice document")
+
+        matched = match_storage_paths(doc, classifier=None, user=classifying_user)
+        matched_ids = {sp.pk for sp in matched}
+        assert visible_storage_path.pk in matched_ids
+        assert hidden_storage_path.pk not in matched_ids
+
+
+@pytest.mark.django_db
+class TestBulkEditObjectsApplyToAllPermissionBoundary:
+    def test_apply_to_all_tags_excludes_unpermitted_tag(self, rest_api_client):
+        owner = User.objects.create_user(username="tags_owner")
+        requester = User.objects.create_user(username="tags_requester")
+        # grant the global change_tag permission so the object-level
+        # filtering (not the global has_perm check) is what's under test
+        requester.user_permissions.add(
+            Permission.objects.get(codename="change_tag"),
+        )
+        rest_api_client.force_authenticate(user=requester)
+        visible = TagFactory(owner=owner)
+        hidden = TagFactory(owner=owner)
+        assign_perm("view_tag", requester, visible)
+        assign_perm("change_tag", requester, visible)
+
+        response = rest_api_client.post(
+            "/api/bulk_edit_objects/",
+            {
+                "object_type": "tags",
+                "operation": "set_permissions",
+                "all": True,
+                "filters": {},
+                "owner": requester.pk,
+            },
+            format="json",
+        )
+        assert response.status_code == HTTPStatus.OK
+
+        # The apply_to_all dispatch must resolve permitted objects up front:
+        # the visible tag (object-level change_tag granted) gets its owner
+        # reassigned, while the hidden tag (no object-level grant) is
+        # excluded entirely and keeps its original owner.
+        visible.refresh_from_db()
+        hidden.refresh_from_db()
+        assert visible.owner == requester
+        assert hidden.owner == owner
+
+
+@pytest.mark.django_db
+class TestBulkEditObjectsTagDescendantPartialPermission:
+    def test_apply_to_all_descendant_expansion_respects_per_object_permissions(
+        self,
+        rest_api_client,
+    ):
+        """
+        GIVEN:
+            - A tag hierarchy (parent -> permitted_child, unpermitted_child)
+            - A non-superuser requester with object-level change_tag granted
+              on the parent and on only ONE of the two children
+        WHEN:
+            - bulk_edit_objects is called with all=True and a filter that
+              matches only the root (parent) tag, engaging the
+              tag-descendant-expansion logic in BulkEditObjectsView.post
+        THEN:
+            - The descendant expansion only pulls in descendants the
+              requester actually has permission on: the permitted child's
+              owner is reassigned alongside the parent's, while the
+              unpermitted child keeps its original owner. This pins that the
+              expansion checks per-object permissions (editable_ids), not
+              merely "is a descendant of a filter match".
+
+        NOTE: this uses ``set_permissions`` (owner reassignment) rather than
+        ``delete`` as the operation, because Tag.tn_parent (django-treenode)
+        cascades deletes to descendants at the database/ORM level regardless
+        of which tags the view resolved into ``objs`` -- a delete-based test
+        would pass/fail based on FK cascade behavior, not on whether the
+        descendant-expansion logic itself respected per-object permissions.
+        """
+        owner = User.objects.create_user(username="tag_hierarchy_owner")
+        requester = User.objects.create_user(username="tag_hierarchy_requester")
+        # global change_tag permission so the has_perm() gate passes and the
+        # object-level permitted_object_ids filtering is what's under test
+        requester.user_permissions.add(
+            Permission.objects.get(codename="change_tag"),
+        )
+        rest_api_client.force_authenticate(user=requester)
+
+        parent = TagFactory(owner=owner, name="parent-tag")
+        permitted_child = TagFactory(
+            owner=owner,
+            name="permitted-child-tag",
+            tn_parent=parent,
+        )
+        unpermitted_child = TagFactory(
+            owner=owner,
+            name="unpermitted-child-tag",
+            tn_parent=parent,
+        )
+        assign_perm("change_tag", requester, parent)
+        assign_perm("change_tag", requester, permitted_child)
+        # unpermitted_child is intentionally NOT granted change_tag
+
+        response = rest_api_client.post(
+            "/api/bulk_edit_objects/",
+            {
+                "object_type": "tags",
+                "operation": "set_permissions",
+                "all": True,
+                "filters": {"is_root": True},
+                "owner": requester.pk,
+            },
+            format="json",
+        )
+        assert response.status_code == HTTPStatus.OK
+
+        parent.refresh_from_db()
+        permitted_child.refresh_from_db()
+        unpermitted_child.refresh_from_db()
+        assert parent.owner == requester
+        assert permitted_child.owner == requester
+        assert unpermitted_child.owner == owner
@@ -0,0 +1,111 @@
+import pytest
+from django.contrib.auth.models import User
+from guardian.shortcuts import assign_perm
+from rest_framework.test import APIRequestFactory
+
+from documents.filters import PermittedObjectsFilter
+from documents.models import Tag
+from documents.tests.factories import TagFactory
+
+
+class _DummyView:
+    queryset = Tag.objects.all()
+
+
+@pytest.mark.django_db
+class TestPermittedObjectsFilter:
+    def test_superuser_bypasses_filtering_entirely(self):
+        superuser = User.objects.create_superuser(username="root")
+        owner = User.objects.create_user(username="owner")
+        TagFactory(owner=owner)
+        request = APIRequestFactory().get("/")
+        request.user = superuser
+
+        result = PermittedObjectsFilter().filter_queryset(
+            request,
+            Tag.objects.all(),
+            _DummyView(),
+        )
+        assert result.count() == Tag.objects.count()
+
+    def test_non_superuser_sees_only_owned_unowned_and_granted(self):
+        owner = User.objects.create_user(username="owner")
+        grantee = User.objects.create_user(username="grantee")
+        owned = TagFactory(owner=grantee)
+        unowned = TagFactory(owner=None)
+        granted = TagFactory(owner=owner)
+        hidden = TagFactory(owner=owner)
+        assign_perm("view_tag", grantee, granted)
+        request = APIRequestFactory().get("/")
+        request.user = grantee
+
+        result = PermittedObjectsFilter().filter_queryset(
+            request,
+            Tag.objects.all(),
+            _DummyView(),
+        )
+        visible_ids = set(result.values_list("id", flat=True))
+        assert visible_ids == {owned.pk, unowned.pk, granted.pk}
+        assert hidden.pk not in visible_ids
+
+    def test_include_granted_false_excludes_explicitly_shared_objects(self):
+        owner = User.objects.create_user(username="owner2")
+        grantee = User.objects.create_user(username="grantee2")
+        owned = TagFactory(owner=grantee)
+        granted = TagFactory(owner=owner)
+        assign_perm("view_tag", grantee, granted)
+        request = APIRequestFactory().get("/")
+        request.user = grantee
+
+        class _OwnerOnlyFilter(PermittedObjectsFilter):
+            include_granted = False
+
+        result = _OwnerOnlyFilter().filter_queryset(
+            request,
+            Tag.objects.all(),
+            _DummyView(),
+        )
+        visible_ids = set(result.values_list("id", flat=True))
+        assert visible_ids == {owned.pk}
+        assert granted.pk not in visible_ids
+
+    @pytest.mark.parametrize(
+        ("username", "is_superuser"),
+        [("inactive", False), ("inactive_super", True)],
+    )
+    def test_inactive_user_sees_nothing(self, username: str, *, is_superuser: bool):
+        user = User.objects.create_user(
+            username=username,
+            is_active=False,
+            is_superuser=is_superuser,
+        )
+        TagFactory(owner=None)
+        TagFactory(owner=user)
+        granted = TagFactory(owner=User.objects.create_user(username=f"o_{username}"))
+        assign_perm("view_tag", user, granted)
+        request = APIRequestFactory().get("/")
+        request.user = user
+
+        result = PermittedObjectsFilter().filter_queryset(
+            request,
+            Tag.objects.all(),
+            _DummyView(),
+        )
+        assert result.count() == 0
+
+    def test_inactive_user_sees_nothing_with_include_granted_false(self):
+        user = User.objects.create_user(username="inactive_owner", is_active=False)
+        TagFactory(owner=user)
+        TagFactory(owner=None)
+        request = APIRequestFactory().get("/")
+        request.user = user
+
+        class _OwnerOnlyFilter(PermittedObjectsFilter):
+            include_granted = False
+
+        result = _OwnerOnlyFilter().filter_queryset(
+            request,
+            Tag.objects.all(),
+            _DummyView(),
+        )
+        assert result.count() == 0
@@ -287,6 +287,45 @@ class TestUpdateContent(DirectoriesMixin, TestCase):
        self.assertNotEqual(Document.objects.get(pk=doc.pk).content, "test")


+class TestUpdateContentRemoteOCR(DirectoriesMixin, TestCase):
+    """
+    Consumption workflows do not run on reprocess, so the remote parser is
+    used only in 'always' mode or when the caller explicitly asks for it.
+    """
+
+    def setUp(self) -> None:
+        super().setUp()
+
+        patcher = mock.patch("documents.tasks.get_parser_registry")
+        self.mock_registry = patcher.start()
+        self.mock_registry.return_value.get_parser_for_file.return_value = None
+        self.addCleanup(patcher.stop)
+
+        self.doc = Document.objects.create(
+            title="test",
+            content="my document",
+            checksum="wow",
+            mime_type="application/pdf",
+        )
+
+    def _allow_remote(self, **kwargs) -> bool:
+        tasks.update_document_content_maybe_archive_file(self.doc.pk, **kwargs)
+        _, call_kwargs = self.mock_registry.return_value.get_parser_for_file.call_args
+        return call_kwargs["allow_remote"]
+
+    @override_settings(REMOTE_OCR_MODE="always")
+    def test_always_mode_allows_remote(self) -> None:
+        self.assertTrue(self._allow_remote())
+
+    @override_settings(REMOTE_OCR_MODE="workflow_only")
+    def test_workflow_only_mode_denies_remote_by_default(self) -> None:
+        self.assertFalse(self._allow_remote())
+
+    @override_settings(REMOTE_OCR_MODE="workflow_only")
+    def test_workflow_only_mode_allows_remote_when_requested(self) -> None:
+        self.assertTrue(self._allow_remote(remote_ocr=True))
+
+
 class TestAIIndex(DirectoriesMixin, TestCase):
    @override_settings(
        AI_ENABLED=True,
@@ -133,12 +133,10 @@ from documents.file_handling import format_filename
 from documents.filters import CorrespondentFilterSet
 from documents.filters import CustomFieldFilterSet
 from documents.filters import DocumentFilterSet
-from documents.filters import DocumentPermissionsFilter
 from documents.filters import DocumentsOrderingFilter
 from documents.filters import DocumentTypeFilterSet
-from documents.filters import ObjectOwnedOrGrantedPermissionsFilter
-from documents.filters import ObjectOwnedPermissionsFilter
 from documents.filters import PaperlessTaskFilterSet
+from documents.filters import PermittedObjectsFilter
 from documents.filters import ShareLinkBundleFilterSet
 from documents.filters import ShareLinkFilterSet
 from documents.filters import StoragePathFilterSet
@@ -178,6 +176,7 @@ from documents.permissions import has_global_statistics_permission
 from documents.permissions import has_perms_owner_aware
 from documents.permissions import has_system_status_permission
 from documents.permissions import permitted_document_ids
+from documents.permissions import permitted_object_ids
 from documents.permissions import set_permissions_for_object
 from documents.plugins.date_parsing import get_date_parser
 from documents.schema import generate_object_with_permissions_schema
@@ -196,7 +195,6 @@ from documents.serialisers import DocumentVersionLabelSerializer
 from documents.serialisers import DocumentVersionSerializer
 from documents.serialisers import EditPdfDocumentsSerializer
 from documents.serialisers import EmailSerializer
-from documents.serialisers import MergeDocumentsAsVersionsSerializer
 from documents.serialisers import MergeDocumentsSerializer
 from documents.serialisers import NotesSerializer
 from documents.serialisers import PostDocumentSerializer
@@ -551,7 +549,7 @@ class CorrespondentViewSet(
    filter_backends = (
        DjangoFilterBackend,
        OrderingFilter,
-        ObjectOwnedOrGrantedPermissionsFilter,
+        PermittedObjectsFilter,
    )
    filterset_class = CorrespondentFilterSet
    ordering_fields = (
@@ -592,7 +590,7 @@ class TagViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet[Tag]):
    filter_backends = (
        DjangoFilterBackend,
        OrderingFilter,
-        ObjectOwnedOrGrantedPermissionsFilter,
+        PermittedObjectsFilter,
    )
    filterset_class = TagFilterSet
    ordering_fields = ("color", "name", "matching_algorithm", "match", "document_count")
@@ -684,7 +682,7 @@ class DocumentTypeViewSet(
    filter_backends = (
        DjangoFilterBackend,
        OrderingFilter,
-        ObjectOwnedOrGrantedPermissionsFilter,
+        PermittedObjectsFilter,
    )
    filterset_class = DocumentTypeFilterSet
    ordering_fields = ("name", "matching_algorithm", "match", "document_count")
@@ -988,7 +986,7 @@ class DocumentViewSet(
        DjangoFilterBackend,
        SearchFilter,
        DocumentsOrderingFilter,
-        DocumentPermissionsFilter,
+        PermittedObjectsFilter,
    )
    filterset_class = DocumentFilterSet
    search_fields = ("title", "correspondent__name", "effective_content")
@@ -2674,7 +2672,7 @@ class SavedViewViewSet(BulkPermissionMixin, PassUserMixin, ModelViewSet[SavedVie
    permission_classes = (IsAuthenticated, PaperlessObjectPermissions)
    filter_backends = (
        OrderingFilter,
-        ObjectOwnedOrGrantedPermissionsFilter,
+        PermittedObjectsFilter,
    )
    ordering_fields = ("name",)

@@ -2809,7 +2807,6 @@ class DocumentOperationPermissionMixin(PassUserMixin, DocumentSelectionMixin):
                    bulk_edit.rotate,
                    bulk_edit.delete_pages,
                    bulk_edit.edit_pdf,
-                    bulk_edit.merge_as_versions,
                    bulk_edit.remove_password,
                ]
            )
@@ -3096,33 +3093,6 @@ class MergeDocumentsView(DocumentOperationPermissionMixin):
        )


-@extend_schema_view(
-    post=extend_schema(
-        operation_id="documents_merge_as_versions",
-        description="Merge selected documents as versions of a chosen root document",
-        responses={
-            200: inline_serializer(
-                name="MergeDocumentsAsVersionsResult",
-                fields={
-                    "result": serializers.CharField(),
-                },
-            ),
-        },
-    ),
-)
-class MergeDocumentsAsVersionsView(DocumentOperationPermissionMixin):
-    serializer_class = MergeDocumentsAsVersionsSerializer
-
-    def post(self, request, *args, **kwargs):
-        serializer = self.get_serializer(data=request.data)
-        serializer.is_valid(raise_exception=True)
-        return self._execute_document_action(
-            method=bulk_edit.merge_as_versions,
-            validated_data=serializer.validated_data,
-            operation_label="document merge as versions",
-        )
-
-
@extend_schema_view(
    post=extend_schema(
        operation_id="documents_delete",
@@ -3949,7 +3919,7 @@ class StoragePathViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet[Storag
    filter_backends = (
        DjangoFilterBackend,
        OrderingFilter,
-        ObjectOwnedOrGrantedPermissionsFilter,
+        PermittedObjectsFilter,
    )
    filterset_class = StoragePathFilterSet
    ordering_fields = ("name", "path", "matching_algorithm", "match", "document_count")
@@ -4480,7 +4450,7 @@ class ShareLinkViewSet(
    filter_backends = (
        DjangoFilterBackend,
        OrderingFilter,
-        ObjectOwnedOrGrantedPermissionsFilter,
+        PermittedObjectsFilter,
    )
    filterset_class = ShareLinkFilterSet
    ordering_fields = ("created", "expiration", "document")
@@ -4510,7 +4480,7 @@ class ShareLinkBundleViewSet(PassUserMixin, ModelViewSet[ShareLinkBundle]):
    filter_backends = (
        DjangoFilterBackend,
        OrderingFilter,
-        ObjectOwnedOrGrantedPermissionsFilter,
+        PermittedObjectsFilter,
    )
    filterset_class = ShareLinkBundleFilterSet
    ordering_fields = ("created", "expiration", "status")
@@ -4793,10 +4763,8 @@ class BulkEditObjectsView(PassUserMixin):
                "document_types": DocumentTypeFilterSet,
                "storage_paths": StoragePathFilterSet,
            }[object_type]
-            user_permitted_objects = get_objects_for_user_owner_aware(
-                user,
-                perm_codename,
-                object_class,
+            user_permitted_objects = object_class.objects.filter(
+                id__in=permitted_object_ids(user, object_class, perm_codename),
            )
            objs = filterset_class(
                data=filters,
@@ -4821,8 +4789,11 @@ class BulkEditObjectsView(PassUserMixin):

        if not user.is_superuser:
            perm = f"documents.{perm_codename}"
-            has_perms = user.has_perm(perm) and all(
-                has_perms_owner_aware(user, perm_codename, obj) for obj in objs
+            has_perms = (
+                user.has_perm(perm)
+                and not objs.exclude(
+                    pk__in=permitted_object_ids(user, object_class, perm_codename),
+                ).exists()
            )

            if not has_perms:
@@ -5323,7 +5294,11 @@ class SystemStatusView(PassUserMixin):
 class TrashView(ListModelMixin, PassUserMixin):
    permission_classes = (IsAuthenticated,)
    serializer_class = TrashSerializer
-    filter_backends = (ObjectOwnedPermissionsFilter,)
+
+    class _TrashPermittedObjectsFilter(PermittedObjectsFilter):
+        include_granted = False
+
+    filter_backends = (_TrashPermittedObjectsFilter,)
    pagination_class = StandardPagination

    model = Document
@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-08-07 20:00+0000\n"
+"POT-Creation-Date: 2026-08-10 02:25+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -21,39 +21,39 @@ msgstr ""
 msgid "Documents"
 msgstr ""

-#: documents/filters.py:472
+#: documents/filters.py:471
 msgid "Value must be valid JSON."
 msgstr ""

-#: documents/filters.py:491
+#: documents/filters.py:490
 msgid "Invalid custom field query expression"
 msgstr ""

-#: documents/filters.py:501
+#: documents/filters.py:500
 msgid "Invalid expression list. Must be nonempty."
 msgstr ""

-#: documents/filters.py:522
+#: documents/filters.py:521
 msgid "Invalid logical operator {op!r}"
 msgstr ""

-#: documents/filters.py:536
+#: documents/filters.py:535
 msgid "Maximum number of query conditions exceeded."
 msgstr ""

-#: documents/filters.py:600
+#: documents/filters.py:599
 msgid "{name!r} is not a valid custom field."
 msgstr ""

-#: documents/filters.py:637
+#: documents/filters.py:636
 msgid "{data_type} does not support query expr {expr!r}."
 msgstr ""

-#: documents/filters.py:756 documents/models.py:136
+#: documents/filters.py:755 documents/models.py:136
 msgid "Maximum nesting depth exceeded."
 msgstr ""

-#: documents/filters.py:1098
+#: documents/filters.py:1079
 msgid "Custom field not found"
 msgstr ""

@@ -1352,7 +1352,7 @@ msgid "workflow runs"
 msgstr ""

 #: documents/serialisers.py:521 documents/serialisers.py:873
-#: documents/serialisers.py:2767 documents/views.py:300 documents/views.py:2556
+#: documents/serialisers.py:2767 documents/views.py:299 documents/views.py:2555
 #: paperless_mail/serialisers.py:155
 msgid "Insufficient permissions."
 msgstr ""
@@ -1393,7 +1393,7 @@ msgstr ""
 msgid "Duplicate document identifiers are not allowed."
 msgstr ""

-#: documents/serialisers.py:2853 documents/views.py:4510
+#: documents/serialisers.py:2853 documents/views.py:4509
 #, python-format
 msgid "Documents not found: %(ids)s"
 msgstr ""
@@ -1661,36 +1661,36 @@ msgstr ""
 msgid "Unable to parse URI {value}"
 msgstr ""

-#: documents/views.py:293 documents/views.py:2553
+#: documents/views.py:292 documents/views.py:2552
 msgid "Invalid more_like_id"
 msgstr ""

-#: documents/views.py:1567
+#: documents/views.py:1566
 msgid "Invalid AI configuration."
 msgstr ""

-#: documents/views.py:1576
+#: documents/views.py:1575
 msgid "AI backend request timed out."
 msgstr ""

-#: documents/views.py:2378 documents/views.py:2699
+#: documents/views.py:2377 documents/views.py:2698
 msgid "Specify only one of text, title_search, query, or more_like_id."
 msgstr ""

-#: documents/views.py:4523
+#: documents/views.py:4522
 #, python-format
 msgid "Insufficient permissions to share document %(id)s."
 msgstr ""

-#: documents/views.py:4569
+#: documents/views.py:4568
 msgid "Bundle is already being processed."
 msgstr ""

-#: documents/views.py:4630
+#: documents/views.py:4629
 msgid "The share link bundle is still being prepared. Please try again later."
 msgstr ""

-#: documents/views.py:4640
+#: documents/views.py:4639
 msgid "The share link bundle is unavailable."
 msgstr ""

@@ -19,7 +19,10 @@ class AutoLoginMiddleware(MiddlewareMixin):
        if request.path.startswith("/api/token/") and request.method == "POST":
            return None
        try:
-            request.user = User.objects.get(username=settings.AUTO_LOGIN_USERNAME)
+            request.user = User.objects.get(
+                username=settings.AUTO_LOGIN_USERNAME,
+                is_active=True,
+            )
            auth.login(
                request=request,
                user=request.user,
@@ -339,16 +339,30 @@ def check_deprecated_v2_ocr_env_vars(

@register()
 def check_remote_parser_configured(app_configs: Any, **kwargs: Any) -> list[Error]:
+    # Import here because checks.py runs before the app registry is ready
+    from paperless.models import RemoteOCRMode
+
+    errors = []
+
    if settings.REMOTE_OCR_ENGINE == "azureai" and not (
        settings.REMOTE_OCR_ENDPOINT and settings.REMOTE_OCR_API_KEY
    ):
-        return [
+        errors.append(
            Error(
                "Azure AI remote parser requires endpoint and API key to be configured.",
            ),
-        ]
+        )

-    return []
+    valid_modes = {mode.value for mode in RemoteOCRMode}
+    if settings.REMOTE_OCR_MODE not in valid_modes:
+        errors.append(
+            Error(
+                f"PAPERLESS_REMOTE_OCR_MODE is set to {settings.REMOTE_OCR_MODE!r}, "
+                f"expected one of {sorted(valid_modes)}.",
+            ),
+        )
+
+    return errors


 def get_tesseract_langs():
@@ -9,6 +9,7 @@ from paperless.models import CleanChoices
 from paperless.models import ColorConvertChoices
 from paperless.models import ModeChoices
 from paperless.models import OutputTypeChoices
+from paperless.models import RemoteOCRMode


@dataclasses.dataclass
@@ -185,6 +186,45 @@ class GeneralConfig(BaseConfig):
        self.app_logo = app_config.app_logo.url if app_config.app_logo else None


+@dataclasses.dataclass
+class RemoteOCRConfig(BaseConfig):
+    """
+    Settings for the remote (cloud) OCR parser
+    """
+
+    remote_ocr_engine: str | None = dataclasses.field(init=False)
+    remote_ocr_api_key: str | None = dataclasses.field(init=False)
+    remote_ocr_endpoint: str | None = dataclasses.field(init=False)
+    remote_ocr_mode: RemoteOCRMode = dataclasses.field(init=False)
+
+    def __post_init__(self) -> None:
+        app_config = self._get_config_instance()
+
+        self.remote_ocr_engine = (
+            app_config.remote_ocr_engine or settings.REMOTE_OCR_ENGINE
+        )
+        self.remote_ocr_api_key = (
+            app_config.remote_ocr_api_key or settings.REMOTE_OCR_API_KEY
+        )
+        self.remote_ocr_endpoint = (
+            app_config.remote_ocr_endpoint or settings.REMOTE_OCR_ENDPOINT
+        )
+        self.remote_ocr_mode = app_config.remote_ocr_mode or RemoteOCRMode(
+            settings.REMOTE_OCR_MODE,
+        )
+
+    @property
+    def remote_ocr_by_default(self) -> bool:
+        """
+        Whether every supported document goes to the remote engine.
+
+        When False the remote engine is used only for documents that
+        explicitly asked for it, i.e. a workflow matched during consumption or
+        the user ticked the box when reprocessing.
+        """
+        return self.remote_ocr_mode == RemoteOCRMode.ALWAYS
+
+
@dataclasses.dataclass
 class AIConfig(BaseConfig):
    """
@@ -0,0 +1,44 @@
+# Generated by Django 5.2.16 on 2026-08-10 14:37
+
+from django.db import migrations
+from django.db import models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("paperless", "0013_applicationconfiguration_llm_request_timeout"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="applicationconfiguration",
+            name="remote_ocr_api_key",
+            field=models.CharField(
+                blank=True,
+                max_length=1024,
+                null=True,
+                verbose_name="Sets the remote OCR API key",
+            ),
+        ),
+        migrations.AddField(
+            model_name="applicationconfiguration",
+            name="remote_ocr_endpoint",
+            field=models.CharField(
+                blank=True,
+                max_length=256,
+                null=True,
+                verbose_name="Sets the remote OCR endpoint",
+            ),
+        ),
+        migrations.AddField(
+            model_name="applicationconfiguration",
+            name="remote_ocr_engine",
+            field=models.CharField(
+                blank=True,
+                choices=[("azureai", "Azure AI Document Intelligence")],
+                max_length=32,
+                null=True,
+                verbose_name="Sets the remote OCR engine",
+            ),
+        ),
+    ]
@@ -0,0 +1,27 @@
+# Generated by Django 5.2.16 on 2026-08-10 15:43
+
+from django.db import migrations
+from django.db import models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("paperless", "0014_applicationconfiguration_remote_ocr_api_key_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="applicationconfiguration",
+            name="remote_ocr_mode",
+            field=models.CharField(
+                blank=True,
+                choices=[
+                    ("always", "All supported documents"),
+                    ("workflow_only", "Only when a workflow enables it"),
+                ],
+                max_length=32,
+                null=True,
+                verbose_name="Sets which documents are sent to the remote OCR engine",
+            ),
+        ),
+    ]
@@ -74,6 +74,23 @@ class ColorConvertChoices(models.TextChoices):
    CMYK = ("CMYK", _("CMYK"))


+class RemoteOCREngine(models.TextChoices):
+    """
+    Matches to PAPERLESS_REMOTE_OCR_ENGINE
+    """
+
+    AZURE_AI = ("azureai", _("Azure AI Document Intelligence"))
+
+
+class RemoteOCRMode(models.TextChoices):
+    """
+    Matches to PAPERLESS_REMOTE_OCR_MODE
+    """
+
+    ALWAYS = ("always", _("All supported documents"))
+    WORKFLOW_ONLY = ("workflow_only", _("Only when a workflow enables it"))
+
+
 class LLMEmbeddingBackend(models.TextChoices):
    OPENAI_LIKE = ("openai-like", _("OpenAI-compatible"))
    HUGGINGFACE = ("huggingface", _("Huggingface"))
@@ -286,6 +303,44 @@ class ApplicationConfiguration(AbstractSingletonModel):
        null=True,
    )

+    """
+    Settings for the remote OCR parser
+    """
+
+    # PAPERLESS_REMOTE_OCR_ENGINE
+    remote_ocr_engine = models.CharField(
+        verbose_name=_("Sets the remote OCR engine"),
+        blank=True,
+        null=True,
+        max_length=32,
+        choices=RemoteOCREngine.choices,
+    )
+
+    # PAPERLESS_REMOTE_OCR_API_KEY
+    remote_ocr_api_key = models.CharField(
+        verbose_name=_("Sets the remote OCR API key"),
+        blank=True,
+        null=True,
+        max_length=1024,
+    )
+
+    # PAPERLESS_REMOTE_OCR_ENDPOINT
+    remote_ocr_endpoint = models.CharField(
+        verbose_name=_("Sets the remote OCR endpoint"),
+        blank=True,
+        null=True,
+        max_length=256,
+    )
+
+    # PAPERLESS_REMOTE_OCR_MODE
+    remote_ocr_mode = models.CharField(
+        verbose_name=_("Sets which documents are sent to the remote OCR engine"),
+        blank=True,
+        null=True,
+        max_length=32,
+        choices=RemoteOCRMode.choices,
+    )
+
    """
    AI related settings
    """
@@ -134,6 +134,11 @@ class ParserProtocol(Protocol):
        Author or organisation name.
    url : str
        URL for documentation, source code, or issue tracker.
+
+    Parsers that send document content to a remote service should additionally
+    set ``uses_remote_service = True`` so the registry can exclude them when
+    remote processing has not been requested for a document. The attribute is
+    optional so a parser that omits it is treated as fully local.
    """

    # ------------------------------------------------------------------
@@ -145,6 +150,10 @@ class ParserProtocol(Protocol):
    author: str
    url: str

+    # NOTE: uses_remote_service is not declared here, the registry reads it
+    # with getattr(cls, ..., False) for backwards-compatibility with existing
+    # parsers
+
    # ------------------------------------------------------------------
    # Class methods
    # ------------------------------------------------------------------
@@ -334,6 +334,8 @@ class ParserRegistry:
        mime_type: str,
        filename: str,
        path: Path | None = None,
+        *,
+        allow_remote: bool = True,
    ) -> type[ParserProtocol] | None:
        """Return the best parser class for the given file, or None.

@@ -359,6 +361,11 @@ class ParserRegistry:
        path:
            Optional filesystem path to the file. Forwarded to each
            parser's score method.
+        allow_remote:
+            When False, parsers that declare ``uses_remote_service = True``
+            are excluded from consideration, so a document is never sent to
+            a remote service. Parsers that do not declare the attribute
+            are treated as local and are always considered.

        Returns
        -------
@@ -374,6 +381,13 @@ class ParserRegistry:
            if mime_type not in parser_class.supported_mime_types():
                continue

+            if not allow_remote and getattr(
+                parser_class,
+                "uses_remote_service",
+                False,
+            ):
+                continue
+
            score = parser_class.score(mime_type, filename, path)
            if score is None:
                continue
@@ -57,6 +57,18 @@ class RemoteEngineConfig:
        self.api_key = api_key
        self.endpoint = endpoint

+    @classmethod
+    def from_app_config(cls) -> Self:
+        """Build the config from the app config, falling back to the env."""
+        from paperless.config import RemoteOCRConfig
+
+        app_config = RemoteOCRConfig()
+        return cls(
+            engine=app_config.remote_ocr_engine,
+            api_key=app_config.remote_ocr_api_key,
+            endpoint=app_config.remote_ocr_endpoint,
+        )
+
    def engine_is_valid(self) -> bool:
        """Return True when the engine is known and fully configured."""
        return (
@@ -83,6 +95,9 @@ class RemoteDocumentParser:
        Maintainer name.
    url : str
        Issue tracker / source URL.
+    uses_remote_service : bool
+        Content is sent to a remote service, True so that the registry
+        can skip this parser if remote processing was not requested.
    """

    name: str = "Paperless-ngx Remote OCR Parser"
@@ -90,6 +105,8 @@ class RemoteDocumentParser:
    author: str = "Paperless-ngx Contributors"
    url: str = "https://github.com/paperless-ngx/paperless-ngx"

+    uses_remote_service: bool = True
+
    # ------------------------------------------------------------------
    # Class methods
    # ------------------------------------------------------------------
@@ -138,11 +155,7 @@ class RemoteDocumentParser:
            20 when the remote engine is configured and the MIME type is
            supported, otherwise None.
        """
-        config = RemoteEngineConfig(
-            engine=settings.REMOTE_OCR_ENGINE,
-            api_key=settings.REMOTE_OCR_API_KEY,
-            endpoint=settings.REMOTE_OCR_ENDPOINT,
-        )
+        config = RemoteEngineConfig.from_app_config()
        if not config.engine_is_valid():
            return None
        if mime_type not in _SUPPORTED_MIME_TYPES:
@@ -228,11 +241,7 @@ class RemoteDocumentParser:
            Ignored — the remote engine always returns a searchable PDF,
            which is stored as the archive copy regardless of this flag.
        """
-        config = RemoteEngineConfig(
-            engine=settings.REMOTE_OCR_ENGINE,
-            api_key=settings.REMOTE_OCR_API_KEY,
-            endpoint=settings.REMOTE_OCR_ENDPOINT,
-        )
+        config = RemoteEngineConfig.from_app_config()

        if not config.engine_is_valid():
            logger.warning(
@@ -217,7 +217,15 @@ class ApplicationConfigurationSerializer(
    llm_api_key = ObfuscatedPasswordField(
        required=False,
        allow_null=True,
+        max_length=1024,
    )
+    remote_ocr_api_key = ObfuscatedPasswordField(
+        required=False,
+        allow_null=True,
+        max_length=1024,
+    )
+
+    OBFUSCATED_FIELDS = ("llm_api_key", "remote_ocr_api_key")

    def run_validation(self, data):
        # Empty strings treated as None to avoid unexpected behavior
@@ -229,11 +237,13 @@ class ApplicationConfigurationSerializer(
            data["language"] = None
        if "llm_output_language" in data and data["llm_output_language"] == "":
            data["llm_output_language"] = None
-        if "llm_api_key" in data and data["llm_api_key"] is not None:
-            if data["llm_api_key"] == "":
-                data["llm_api_key"] = None
-            elif len(data["llm_api_key"].replace("*", "")) == 0:
-                del data["llm_api_key"]
+        for field in self.OBFUSCATED_FIELDS:
+            if field in data and data[field] is not None:
+                if data[field] == "":
+                    data[field] = None
+                # Not a real value, don't overwrite the stored one
+                elif len(data[field].replace("*", "")) == 0:
+                    del data[field]
        return super().run_validation(data)

    def update(self, instance, validated_data):
@@ -1197,6 +1197,7 @@ WEBHOOKS_ALLOW_INTERNAL_REQUESTS = get_bool_from_env(
 REMOTE_OCR_ENGINE = os.getenv("PAPERLESS_REMOTE_OCR_ENGINE")
 REMOTE_OCR_API_KEY = os.getenv("PAPERLESS_REMOTE_OCR_API_KEY")
 REMOTE_OCR_ENDPOINT = os.getenv("PAPERLESS_REMOTE_OCR_ENDPOINT")
+REMOTE_OCR_MODE = os.getenv("PAPERLESS_REMOTE_OCR_MODE", "always")

 ################################################################################
 # AI Settings                                                                  #
@@ -21,6 +21,7 @@ from unittest.mock import Mock
 import pytest

 from documents.parsers import ParseError
+from paperless.models import ApplicationConfiguration
 from paperless.parsers import ParserContext
 from paperless.parsers import ParserProtocol
 from paperless.parsers.remote import RemoteDocumentParser
@@ -33,6 +34,10 @@ if TYPE_CHECKING:
    from pytest_mock import MockerFixture


+# Remote ocr config from ApplicationConfiguration needs DB access
+pytestmark = pytest.mark.django_db
+
+
 # ---------------------------------------------------------------------------
 # Module-local fixtures
 # ---------------------------------------------------------------------------
@@ -227,6 +232,18 @@ class TestRemoteParserScore:
        score = RemoteDocumentParser.score("application/pdf", "doc.pdf")
        assert score is not None and score > 10

+    @pytest.mark.usefixtures("no_engine_settings")
+    def test_score_uses_app_config_when_env_unset(self) -> None:
+        """The app config alone is enough to activate the parser."""
+        config = ApplicationConfiguration.objects.first()
+        assert config is not None
+        config.remote_ocr_engine = "azureai"
+        config.remote_ocr_api_key = "app-config-key"
+        config.remote_ocr_endpoint = "https://config.cognitiveservices.azure.com"
+        config.save()
+
+        assert RemoteDocumentParser.score("application/pdf", "doc.pdf") == 20
+

 # ---------------------------------------------------------------------------
 # Properties
@@ -1277,6 +1277,8 @@ class TestParserFileTypes:
 # ---------------------------------------------------------------------------


+# Remote ocr config from ApplicationConfiguration needs DB access
+@pytest.mark.django_db
 class TestRasterisedDocumentParserRegistry:
    def test_registered_in_defaults(self) -> None:
        from paperless.parsers.registry import ParserRegistry
@@ -0,0 +1,53 @@
+from django.contrib.auth.models import AnonymousUser
+from django.contrib.auth.models import User
+from django.test import RequestFactory
+from django.test import TestCase
+from django.test import override_settings
+
+from paperless.auth import AutoLoginMiddleware
+
+
+@override_settings(AUTO_LOGIN_USERNAME="autologin")
+class TestAutoLoginMiddleware(TestCase):
+    def setUp(self) -> None:
+        super().setUp()
+        self.factory = RequestFactory()
+        self.middleware = AutoLoginMiddleware(lambda request: None)
+
+    def _process(self, request):
+        # login() needs a session to write to
+        request.session = self.client.session
+        self.middleware.process_request(request)
+        return request
+
+    def test_active_user_is_logged_in(self) -> None:
+        """
+        GIVEN:
+            - AUTO_LOGIN_USERNAME names an active user
+        WHEN:
+            - A request is processed by the middleware
+        THEN:
+            - That user is attached to the request
+        """
+        user = User.objects.create_user(username="autologin")
+
+        request = self._process(self.factory.get("/"))
+
+        self.assertEqual(request.user, user)
+
+    def test_deactivated_user_is_not_logged_in(self) -> None:
+        """
+        GIVEN:
+            - AUTO_LOGIN_USERNAME names a user who has been deactivated
+        WHEN:
+            - A request is processed by the middleware
+        THEN:
+            - The request is left anonymous rather than authenticated as them
+        """
+        User.objects.create_user(username="autologin", is_active=False)
+
+        request = self.factory.get("/")
+        request.user = AnonymousUser()
+        self._process(request)
+
+        self.assertFalse(request.user.is_authenticated)
@@ -655,6 +655,23 @@ class TestRemoteParserChecks:
            in msg.msg
        )

+    def test_valid_mode(self, settings: SettingsWrapper) -> None:
+        settings.REMOTE_OCR_ENGINE = None
+        settings.REMOTE_OCR_MODE = "workflow_only"
+
+        msgs = check_remote_parser_configured(None)
+
+        assert len(msgs) == 0
+
+    def test_invalid_mode(self, settings: SettingsWrapper) -> None:
+        settings.REMOTE_OCR_ENGINE = None
+        settings.REMOTE_OCR_MODE = "sometimes"
+
+        msgs = check_remote_parser_configured(None)
+
+        assert len(msgs) == 1
+        assert "PAPERLESS_REMOTE_OCR_MODE is set to 'sometimes'" in msgs[0].msg
+

 class TestTesseractChecks:
    def test_default_language(self) -> None:
@@ -468,6 +468,124 @@ class TestParserRegistryGetParserForFile:
        assert result is AcceptingBuiltin


+class TestParserRegistryRemoteParsers:
+    """Verify the allow_remote filter in ParserRegistry.get_parser_for_file()."""
+
+    @staticmethod
+    def _remote_parser_cls() -> type:
+        class RemoteParser:
+            name = "remote"
+            version = "1.0"
+            author = "A"
+            url = "https://example.com/remote"
+            uses_remote_service = True
+
+            @classmethod
+            def supported_mime_types(cls):
+                return {"text/plain": ".txt"}
+
+            @classmethod
+            def score(cls, mime_type, filename, path=None):
+                return 20
+
+        return RemoteParser
+
+    def test_remote_parser_wins_when_remote_allowed(
+        self,
+        dummy_parser_cls: type,
+    ) -> None:
+        """
+        GIVEN: A remote parser scoring 20 and a local parser scoring 10.
+        WHEN:  get_parser_for_file() is called with allow_remote=True.
+        THEN:  The remote parser is returned.
+        """
+        remote_parser_cls = self._remote_parser_cls()
+        registry = ParserRegistry()
+        registry.register_builtin(dummy_parser_cls)
+        registry.register_builtin(remote_parser_cls)
+
+        result = registry.get_parser_for_file(
+            "text/plain",
+            "readme.txt",
+            allow_remote=True,
+        )
+        assert result is remote_parser_cls
+
+    def test_remote_parser_skipped_when_remote_not_allowed(
+        self,
+        dummy_parser_cls: type,
+    ) -> None:
+        """
+        GIVEN: A remote parser scoring 20 and a local parser scoring 10.
+        WHEN:  get_parser_for_file() is called with allow_remote=False.
+        THEN:  The local parser is returned despite its lower score.
+        """
+        registry = ParserRegistry()
+        registry.register_builtin(dummy_parser_cls)
+        registry.register_builtin(self._remote_parser_cls())
+
+        result = registry.get_parser_for_file(
+            "text/plain",
+            "readme.txt",
+            allow_remote=False,
+        )
+        assert result is dummy_parser_cls
+
+    def test_no_parser_when_only_remote_available_and_not_allowed(self) -> None:
+        """
+        GIVEN: A registry whose only candidate declares uses_remote_service.
+        WHEN:  get_parser_for_file() is called with allow_remote=False.
+        THEN:  None is returned — the remote parser is never used as a
+               fallback when remote processing was not requested.
+        """
+        registry = ParserRegistry()
+        registry.register_builtin(self._remote_parser_cls())
+
+        result = registry.get_parser_for_file(
+            "text/plain",
+            "readme.txt",
+            allow_remote=False,
+        )
+        assert result is None
+
+    def test_parser_without_attribute_treated_as_local(
+        self,
+        dummy_parser_cls: type,
+    ) -> None:
+        """
+        GIVEN: A third-party parser predating uses_remote_service, so it does
+               not declare the attribute at all.
+        WHEN:  get_parser_for_file() is called with allow_remote=False.
+        THEN:  It is still considered, i.e. treated as fully local, rather
+               than raising AttributeError.
+        """
+        assert not hasattr(dummy_parser_cls, "uses_remote_service")
+
+        registry = ParserRegistry()
+        registry.register_builtin(dummy_parser_cls)
+
+        result = registry.get_parser_for_file(
+            "text/plain",
+            "readme.txt",
+            allow_remote=False,
+        )
+        assert result is dummy_parser_cls
+
+    def test_remote_allowed_by_default(self) -> None:
+        """
+        GIVEN: A registry containing only a remote parser.
+        WHEN:  get_parser_for_file() is called without allow_remote.
+        THEN:  The remote parser is returned — callers that do not opt in to
+               the filter keep the previous behaviour.
+        """
+        remote_parser_cls = self._remote_parser_cls()
+        registry = ParserRegistry()
+        registry.register_builtin(remote_parser_cls)
+
+        result = registry.get_parser_for_file("text/plain", "readme.txt")
+        assert result is remote_parser_cls
+
+
 class TestDiscover:
    """Verify entrypoint discovery in ParserRegistry.discover()."""

@@ -0,0 +1,113 @@
+"""Tests for RemoteOCRConfig precedence between app config and Django settings."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import pytest
+from django.test import override_settings
+
+from paperless.config import RemoteOCRConfig
+from paperless.models import RemoteOCRMode
+
+if TYPE_CHECKING:
+    from unittest.mock import MagicMock
+
+
+@pytest.fixture()
+def null_app_config(mocker) -> MagicMock:
+    """Mock ApplicationConfiguration with all fields None → falls back to Django settings."""
+    return mocker.MagicMock(
+        remote_ocr_engine=None,
+        remote_ocr_api_key=None,
+        remote_ocr_endpoint=None,
+        remote_ocr_mode=None,
+    )
+
+
+@pytest.fixture()
+def make_remote_ocr_config(mocker):
+    def _make(app_config, **django_settings_overrides):
+        mocker.patch(
+            "paperless.config.BaseConfig._get_config_instance",
+            return_value=app_config,
+        )
+        with override_settings(**django_settings_overrides):
+            return RemoteOCRConfig()
+
+    return _make
+
+
+class TestRemoteOCRConfig:
+    def test_falls_back_to_settings(
+        self,
+        make_remote_ocr_config,
+        null_app_config,
+    ) -> None:
+        cfg = make_remote_ocr_config(
+            null_app_config,
+            REMOTE_OCR_ENGINE="azureai",
+            REMOTE_OCR_API_KEY="env-key",
+            REMOTE_OCR_ENDPOINT="https://env.cognitiveservices.azure.com",
+            REMOTE_OCR_MODE=RemoteOCRMode.WORKFLOW_ONLY,
+        )
+        assert cfg.remote_ocr_engine == "azureai"
+        assert cfg.remote_ocr_api_key == "env-key"
+        assert cfg.remote_ocr_endpoint == "https://env.cognitiveservices.azure.com"
+        assert cfg.remote_ocr_mode == RemoteOCRMode.WORKFLOW_ONLY
+
+    def test_app_config_takes_precedence(
+        self,
+        make_remote_ocr_config,
+        mocker,
+    ) -> None:
+        app_config = mocker.MagicMock(
+            remote_ocr_engine="azureai",
+            remote_ocr_api_key="db-key",
+            remote_ocr_endpoint="https://db.cognitiveservices.azure.com",
+            remote_ocr_mode=RemoteOCRMode.WORKFLOW_ONLY,
+        )
+        cfg = make_remote_ocr_config(
+            app_config,
+            REMOTE_OCR_ENGINE=None,
+            REMOTE_OCR_API_KEY="env-key",
+            REMOTE_OCR_ENDPOINT="https://env.cognitiveservices.azure.com",
+            REMOTE_OCR_MODE=RemoteOCRMode.ALWAYS,
+        )
+        assert cfg.remote_ocr_engine == "azureai"
+        assert cfg.remote_ocr_api_key == "db-key"
+        assert cfg.remote_ocr_endpoint == "https://db.cognitiveservices.azure.com"
+        assert cfg.remote_ocr_mode == RemoteOCRMode.WORKFLOW_ONLY
+
+    def test_unset_everywhere(
+        self,
+        make_remote_ocr_config,
+        null_app_config,
+    ) -> None:
+        cfg = make_remote_ocr_config(
+            null_app_config,
+            REMOTE_OCR_ENGINE=None,
+            REMOTE_OCR_API_KEY=None,
+            REMOTE_OCR_ENDPOINT=None,
+        )
+        assert cfg.remote_ocr_engine is None
+        assert cfg.remote_ocr_api_key is None
+        assert cfg.remote_ocr_endpoint is None
+
+
+class TestRemoteOCRByDefault:
+    def test_always_mode(self, make_remote_ocr_config, null_app_config) -> None:
+        cfg = make_remote_ocr_config(
+            null_app_config,
+            REMOTE_OCR_MODE=RemoteOCRMode.ALWAYS,
+        )
+
+        assert cfg.remote_ocr_by_default is True
+
+    def test_workflow_only_mode(self, make_remote_ocr_config, null_app_config) -> None:
+        cfg = make_remote_ocr_config(
+            null_app_config,
+            REMOTE_OCR_MODE=RemoteOCRMode.WORKFLOW_ONLY,
+        )
+
+        assert cfg.remote_ocr_by_default is False
@@ -27,7 +27,6 @@ from documents.views import EditPdfDocumentsView
 from documents.views import GlobalSearchView
 from documents.views import IndexView
 from documents.views import LogViewSet
-from documents.views import MergeDocumentsAsVersionsView
 from documents.views import MergeDocumentsView
 from documents.views import PostDocumentView
 from documents.views import RemoteVersionView
@@ -173,11 +172,6 @@ urlpatterns = [
                                MergeDocumentsView.as_view(),
                                name="merge_documents",
                            ),
-                            re_path(
-                                "^merge_as_versions/",
-                                MergeDocumentsAsVersionsView.as_view(),
-                                name="merge_documents_as_versions",
-                            ),
                            re_path(
                                "^edit_pdf/",
                                EditPdfDocumentsView.as_view(),
@@ -757,3 +757,30 @@ class TestAPIProcessedMails(DirectoriesMixin, APITestCase):
            format="json",
        )
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+
+    def test_bulk_delete_processed_mails_rejects_mixed_batch_atomically(self) -> None:
+        """
+        GIVEN:
+            - A permitted processed mail and one the user may not delete
+        WHEN:
+            - API call bulk deletes both in a single request
+        THEN:
+            - The request is rejected and neither mail is deleted
+        """
+        user2 = User.objects.create_user(username="temp_admin2")
+        rule = MailRuleFactory()
+        # Created first so it sorts ahead of the forbidden mail, i.e. the
+        # permission check has to cover the whole batch before deleting rather
+        # than rejecting only once it reaches the forbidden one.
+        pm_owned = ProcessedMailFactory(rule=rule, owner=self.user)
+        pm_forbidden = ProcessedMailFactory(rule=rule, owner=user2)
+
+        response = self.client.post(
+            f"{self.ENDPOINT}bulk_delete/",
+            data={"mail_ids": [pm_owned.id, pm_forbidden.id]},
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertTrue(ProcessedMail.objects.filter(id=pm_owned.id).exists())
+        self.assertTrue(ProcessedMail.objects.filter(id=pm_forbidden.id).exists())
@@ -23,10 +23,11 @@ from rest_framework.response import Response
 from rest_framework.viewsets import ModelViewSet
 from rest_framework.viewsets import ReadOnlyModelViewSet

-from documents.filters import ObjectOwnedOrGrantedPermissionsFilter
+from documents.filters import PermittedObjectsFilter
 from documents.models import PaperlessTask
 from documents.permissions import PaperlessObjectPermissions
 from documents.permissions import has_perms_owner_aware
+from documents.permissions import permitted_object_ids
 from documents.views import PassUserMixin
 from paperless.views import StandardPagination
 from paperless_mail.filters import ProcessedMailFilterSet
@@ -75,7 +76,7 @@ class MailAccountViewSet(PassUserMixin, ModelViewSet[MailAccount]):
    serializer_class = MailAccountSerializer
    pagination_class = StandardPagination
    permission_classes = (IsAuthenticated, PaperlessObjectPermissions)
-    filter_backends = (ObjectOwnedOrGrantedPermissionsFilter,)
+    filter_backends = (PermittedObjectsFilter,)

    def get_permissions(self):
        if self.action == "test":
@@ -197,7 +198,7 @@ class ProcessedMailViewSet(PassUserMixin, ReadOnlyModelViewSet[ProcessedMail]):
    filter_backends = (
        DjangoFilterBackend,
        OrderingFilter,
-        ObjectOwnedOrGrantedPermissionsFilter,
+        PermittedObjectsFilter,
    )
    filterset_class = ProcessedMailFilterSet

@@ -211,10 +212,17 @@ class ProcessedMailViewSet(PassUserMixin, ReadOnlyModelViewSet[ProcessedMail]):
        ):
            return HttpResponseBadRequest("mail_ids must be a list of integers")
        mails = ProcessedMail.objects.filter(id__in=mail_ids)
-        for mail in mails:
-            if not has_perms_owner_aware(request.user, "delete_processedmail", mail):
-                return HttpResponseForbidden("Insufficient permissions")
-            mail.delete()
+        # Check every id up front so an unpermitted one rejects the whole
+        # request rather than deleting the mails ahead of it first.
+        if mails.exclude(
+            pk__in=permitted_object_ids(
+                request.user,
+                ProcessedMail,
+                "delete_processedmail",
+            ),
+        ).exists():
+            return HttpResponseForbidden("Insufficient permissions")
+        mails.delete()
        return Response({"result": "OK", "deleted_mail_ids": mail_ids})


@@ -225,7 +233,7 @@ class MailRuleViewSet(PassUserMixin, ModelViewSet[MailRule]):
    serializer_class = MailRuleSerializer
    pagination_class = StandardPagination
    permission_classes = (IsAuthenticated, PaperlessObjectPermissions)
-    filter_backends = (ObjectOwnedOrGrantedPermissionsFilter,)
+    filter_backends = (PermittedObjectsFilter,)


@extend_schema_view(
Author	SHA1	Message	Date
shamoon	7456b52e84	Update consumer.py	2026-08-10 10:13:18 -07:00
shamoon	6a392ea099	Ok, wire up the remote_ocr_mode with allow_remote for consumer	2026-08-10 10:13:18 -07:00
shamoon	2032ad1341	Docs for remote_ocr_mode	2026-08-10 10:13:18 -07:00
shamoon	cc8fee91c4	More tests for remote_ocr_mode	2026-08-10 10:13:18 -07:00
shamoon	a5d46a883e	Update config.component.spec.ts	2026-08-10 10:13:18 -07:00
shamoon	b0e1793093	Checks for remote_ocr_mode and fix import	2026-08-10 10:13:17 -07:00
shamoon	7e466d1f71	remote_ocr_mode config setting	2026-08-10 10:13:17 -07:00
shamoon	7b69a178c0	Add to parser dev docs	2026-08-10 10:13:17 -07:00
shamoon	22cd13a8a9	uses_remote_service + allow_remote to allow opt-in / out of remote OCR	2026-08-10 10:13:17 -07:00
shamoon	72a4676be0	Update test_tesseract_parser.py	2026-08-10 10:11:14 -07:00
shamoon	6673144d23	Docs	2026-08-10 10:11:13 -07:00
shamoon	994a84cf92	Frontend stuff, with sections	2026-08-10 10:11:13 -07:00
shamoon	654ce5d8f3	Backend tests	2026-08-10 10:11:13 -07:00
shamoon	5d5e9b6db4	Backend changes and migration for remote OCR Config	2026-08-10 10:11:13 -07:00
GitHub Actions	62089df2d8	Auto translate strings	2026-08-10 02:26:58 +00:00
Trenton HandGitHub	5e5f6a88a3	Fix: deny deactivated users in permission filtering and auto-login (#13623 ) * Fix: Hardening sweep, ensure a user is active, not just authenticated * Missed this test	2026-08-10 02:25:06 +00:00
shamoonandGitHub	02e6c49c62	Chore: update fpdf2 to 2.8.8 (#13629 )	2026-08-10 02:07:13 +00:00
shamoonandGitHub	3be64da4cb	Chore: udpate pnpm, add blockExoticSubdeps (#13628 )	2026-08-09 18:59:26 -07:00
Trenton HandGitHub	c28c532bef	Fix: check bulk mail delete permissions for the whole batch up front (#13620 ) ProcessedMailViewSet.bulk_delete checked permissions inside the delete loop, so an unpermitted id returned 403 only after the mails ahead of it had already been deleted. Resolve the permitted set once via permitted_object_ids and reject before deleting anything, which also drops the per-mail permission queries.	2026-08-09 13:55:49 +00:00
GitHub Actions	1d61f7fc62	Auto translate strings	2026-08-09 07:16:59 +00:00
shamoonandGitHub	aa67fd3aef	Tweak: improve no ML suggestions UX (#13621 )	2026-08-09 00:15:27 -07:00
Trenton HandGitHub	17dc482872	Fix: Allow DRF to validate the maximum API key length (#13614 )	2026-08-08 19:51:27 +00:00
GitHub Actions	b0e0e8a353	Auto translate strings	2026-08-08 14:29:01 +00:00
Trenton H GitHub Claude Sonnet 5	fc242bb570	Performance: unify permission-filtering backends, fixes Correspondent/Tag list slowness (#13601 ) * feat: add unified PermittedObjectsFilter backed by permitted_object_ids * refactor: migrate all ViewSets to unified PermittedObjectsFilter Replace the deprecated ObjectOwnedOrGrantedPermissionsFilter, DocumentPermissionsFilter, and ObjectOwnedPermissionsFilter aliases with PermittedObjectsFilter directly across documents/views.py (8 sites, including TrashView's include_granted=False subclass) and paperless_mail/views.py (3 sites), then delete the now-unreferenced alias classes from documents/filters.py. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UFyrt7FWbRRdTUAcdqBcsc * docs: document legacy status of get_objects_for_user_owner_aware/has_perms_owner_aware Stage 4's PermittedObjectsFilter/permitted_object_ids() covers the queryset-filtering use case, but both functions still have production callers outside this plan's scope (documents/views.py, documents/serialisers.py, documents/signals/handlers.py, paperless_ai/matching.py, paperless_ai/ai_classifier.py). Per Task 20 Step 2, they are kept in place rather than partially deleted, with docstrings updated to note their legacy status and remaining callers. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UFyrt7FWbRRdTUAcdqBcsc * Fix: address final review findings for permission-filter unification - Add a permanent regression test pinning TrashView's include_granted=False wiring: an explicit view_document grant on a trashed document must not leak it into /api/trash/ for a non-owner, non-superuser requester. - Drop the now-dead direct dependency djangorestframework-guardian; the last rest_framework_guardian import was removed by this branch's migration onto PermittedObjectsFilter. django-guardian is untouched. - Replace the hand-maintained, already-stale caller lists in get_objects_for_user_owner_aware/has_perms_owner_aware docstrings with a pointer to grep for remaining callers instead. - In PermittedObjectsFilter.filter_queryset, compute `model` only on the include_granted=True path that actually uses it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UFyrt7FWbRRdTUAcdqBcsc * perf: check bulk-edit-objects apply_to_all permissions via DB-side exclude/exists Materialized the full permitted_object_ids() set into a Python set() just to check membership for the request's objs queryset -- the same pattern already fixed at four other sites for Document. This one is used by apply_to_all, where objs can be an unbounded filtered selection (e.g. all tags matching a filter) rather than a small request-supplied ID list, making the wasted materialization worse here than at the sites already fixed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Cleans up the comment about why this is still here for now --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-08 07:27:18 -07:00
Trenton H GitHub Claude Sonnet 5	b192a419fd	perf: migrate bulk-edit-objects dispatch to permitted_object_ids (#13576 ) * perf: migrate bulk-edit-objects apply_to_all dispatch to permitted_object_ids Replaces get_objects_for_user_owner_aware/has_perms_owner_aware in the BulkEditObjectsView apply_to_all dispatch (Tag/Correspondent/DocumentType/ StoragePath) with permitted_object_ids and the resolve-once, check-membership pattern used elsewhere in this stage. Tag-descendant expansion logic left untouched. Adds a security test pinning that apply_to_all excludes objects the requester lacks object-level permission on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UmMBGW9FKyDgmKRJ5H9rif * test: add tag-descendant partial-permission coverage, verify pre-migration characterization Adds TestBulkEditObjectsTagDescendantPartialPermission, exercising the tag-descendant-expansion block in BulkEditObjectsView.post as a non-superuser with object-level change_tag granted on a parent tag and one of two children but not the other, confirming the expansion only pulls in descendants the requester actually has permission on. Verified both this test and the existing apply_to_all boundary test pass unchanged against the pre-migration get_objects_for_user_owner_aware/has_perms_owner_aware code (reverted via a scratch patch of the prior commit's views.py hunk, then restored), confirming they characterize genuine pre-existing behavior rather than something the permitted_object_ids migration made necessary. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UmMBGW9FKyDgmKRJ5H9rif --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-08 07:27:17 -07:00
Trenton H GitHub Claude Sonnet 5	3986150f95	perf: migrate matching.py's classification lookups to permitted_object_ids (#13575 ) * perf: migrate matching.py's 4 permission-filtered lookups to permitted_object_ids * test: add matching.py permission coverage for correspondents, document types, storage paths Completes the parametrized coverage started for tags -- proves all 4 matching.py lookups migrated to permitted_object_ids respect per-object view permissions, not just the tag case. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-08 07:27:17 -07:00
Trenton H GitHub Claude Sonnet 5	ee5588ade3	Performance: generalize permitted_document_ids into permitted_object_ids for any model (#13578 ) * feat: generalize permitted_document_ids into permitted_object_ids for any model Implements Task 14 of the permission-filtering consolidation plan: - Add generic permitted_object_ids(user, model, perm, include_deleted=False) - Refactor permitted_document_ids to delegate to permitted_object_ids - Add comprehensive tests for Tag/Correspondent/DocumentType/StoragePath - Preserve exact public behavior of permitted_document_ids (100% regression-free) All 38 tests pass (18 existing + 20 new). The include_deleted parameter correctly handles soft-delete patterns (effective only for Document). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * refactor: add type hints to permitted_object_ids and permitted_document_ids Add missing type annotations to match the established conventions in this file (see get_objects_for_user_owner_aware). Also added Model import from django.db.models. - permitted_object_ids: user: User \| None, model: type[Model], return -> QuerySet[int] - permitted_document_ids: user: User \| None, return -> QuerySet[int] All 38 permission filtering security tests pass; this is a type-annotation-only change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UmMBGW9FKyDgmKRJ5H9rif * refactor: remove redundant deleted_at filter in permitted_object_ids SoftDeleteManager's own get_queryset() already excludes soft-deleted rows, so the extra deleted_at__isnull=True filter was dead code. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-08 07:27:16 -07:00
shamoonandGitHub	2635a12281	Fix: render PDF form values in annotation layer (#13607 )	2026-08-07 23:15:42 -07:00
shamoonandGitHub	1f396e51f3	QoL: disable name button without perms (#13606 )	2026-08-07 23:01:24 -07:00