Enhancement: navbar upload button

src-ui/jest.config.js

@@ -26,7 +26,7 @@ module.exports = {
     'abstract-paperless-service',
   ],
   transformIgnorePatterns: [
-    'node_modules/(?!.*(\\.mjs$|tslib|lodash-es|normalize-diacritics|marked|@angular/common/locales/.*\\.js$))',
+    'node_modules/(?!.*(\\.mjs$|tslib|lodash-es|normalize-diacritics|@angular/common/locales/.*\\.js$))',
   ],
   moduleNameMapper: {
     ...esmPreset.moduleNameMapper,

src-ui/package.json

@@ -30,7 +30,6 @@
     "bootstrap": "^5.3.8",
     "file-saver": "^2.0.5",
     "lodash-es": "^4.18.1",
-    "marked": "~18.0.14",
     "mime-names": "^1.0.0",
     "ngx-bootstrap-icons": "^1.9.3",
     "ngx-color": "^10.1.0",

src-ui/pnpm-lock.yaml

@@ -53,9 +53,6 @@ importers:
       lodash-es:
         specifier: ^4.18.1
         version: 4.18.1
-      marked:
-        specifier: ~18.0.14
-        version: 18.0.14
       mime-names:
         specifier: ^1.0.0
         version: 1.0.0
@@ -3229,11 +3226,6 @@ packages:
   make-error@1.3.6:
     resolution: {integrity: sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==}
 
-  marked@18.0.14:
-    resolution: {integrity: sha512-mBHK6FBHuBAlhgRe88w9F0O1AbwwXJUcQibUbC/QcdTbVGAD7aWza+xt3N6oT/jCZx3/OMeS+8rnuiHZcQ9s7A==}
-    engines: {node: '>= 20'}
-    hasBin: true
-
   material-colors@1.2.6:
     resolution: {integrity: sha512-6qE4B9deFBIa9YSpOc9O0Sgc43zTeVYbgDT5veRKSlB2+ZuHNoVVxA1L/ckMUayV9Ay9y7Z/SZCLcGteW9i7bg==}
 
@@ -7417,8 +7409,6 @@ snapshots:
 
   make-error@1.3.6: {}
 
-  marked@18.0.14: {}
-
   material-colors@1.2.6: {}
 
   merge-stream@2.0.0: {}

src-ui/src/app/components/app-frame/app-frame.component.html

@@ -29,8 +29,13 @@
   </div>
   <div class="search-container flex-grow-1 py-2 pb-3 pb-sm-2 me-sm-auto order-3 order-sm-1"
     [class.mobile-hidden]="mobileSearchHidden()">
-    <div class="col-12 header-search mx-auto">
-      <pngx-global-search></pngx-global-search>
+    <div class="col-12 header-search mx-auto d-flex align-items-stretch gap-3">
+      <pngx-global-search class="flex-grow-1"></pngx-global-search>
+      <button *pngxIfPermissions="{ action: PermissionAction.Add, type: PermissionType.Document }"
+        class="btn btn-sm header-upload border-0 d-flex align-items-center justify-content-center flex-shrink-0 py-0 px-2" type="button"
+        (click)="fileUpload.click()" aria-label="Upload documents" i18n-aria-label>
+        <i-bs class="d-flex" width="1.1em" height="1.1em" name="file-earmark-arrow-up"></i-bs><span class="ms-2 d-sm-none d-md-inline" i18n>Upload</span>
+      </button>
     </div>
   </div>
   <ul ngbNav class="order-sm-3">
@@ -70,6 +75,8 @@
   </ul>
 </nav>
 
+<input type="file" class="visually-hidden" (change)="onFileSelected($event)" multiple #fileUpload tabindex="-1" aria-hidden="true">
+
 <div class="container-fluid">
   <div class="row">
     <nav id="sidebarMenu" class="d-md-block bg-light sidebar collapse"

src-ui/src/app/components/app-frame/app-frame.component.scss

@@ -532,7 +532,23 @@ main {
 
 .header-search {
   width: 100%;
-  max-width: 55rem;
+  max-width: 50rem;
+}
+
+.header-search pngx-global-search {
+  min-width: 0;
+}
+
+// light w shadow to stand out against search
+.header-upload {
+  --bs-btn-bg: rgba(255, 255, 255, .15);
+  --bs-btn-hover-bg: rgba(255, 255, 255, .22);
+  --bs-btn-active-bg: rgba(255, 255, 255, .3);
+  color: var(--pngx-primary-text-contrast) !important; // .navbar .dropdown > .btn in styles.scss
+
+  &:not(:focus) {
+    box-shadow: 0 1px 3px rgba(0, 0, 0, .35), 0 1px 1px rgba(0, 0, 0, .2); // leave room for the .btn:focus ring
+  }
 }
 
 @media screen and (max-width: 575.98px) {
@@ -662,3 +678,7 @@ main {
 ::ng-deep .navItemDrag .position-absolute i-bs {
   display: none;
 }
+
+.smaller {
+  font-size: 0.75rem;
+}

src-ui/src/app/components/app-frame/app-frame.component.spec.ts

@@ -33,6 +33,7 @@ import { SearchService } from 'src/app/services/rest/search.service'
 import { SettingsService } from 'src/app/services/settings.service'
 import { TasksService } from 'src/app/services/tasks.service'
 import { ToastService } from 'src/app/services/toast.service'
+import { UploadDocumentsService } from 'src/app/services/upload-documents.service'
 import { environment } from 'src/environments/environment'
 import { ProfileEditDialogComponent } from '../common/profile-edit-dialog/profile-edit-dialog.component'
 import { DocumentDetailComponent } from '../document-detail/document-detail.component'
@@ -462,6 +463,29 @@ describe('AppFrameComponent', () => {
     expect(routerSpy).toHaveBeenCalled()
   })
 
+  it('should upload files selected from the navbar upload button', () => {
+    const uploadDocumentsService = TestBed.inject(UploadDocumentsService)
+    const uploadSpy = jest
+      .spyOn(uploadDocumentsService, 'uploadFiles')
+      .mockImplementation(() => {})
+    const toastSpy = jest.spyOn(toastService, 'showInfo')
+    const file = new File(['testing'], 'file.pdf')
+    const input = window.document.createElement('input')
+    jest.spyOn(input, 'files', 'get').mockReturnValue([file] as any)
+
+    component.onFileSelected({ target: input } as unknown as Event)
+    expect(toastSpy).toHaveBeenCalled()
+    expect(uploadSpy).toHaveBeenCalledWith([file])
+  })
+
+  it('should not upload when no files are selected from the navbar', () => {
+    const uploadDocumentsService = TestBed.inject(UploadDocumentsService)
+    const uploadSpy = jest.spyOn(uploadDocumentsService, 'uploadFiles')
+    const input = window.document.createElement('input')
+    component.onFileSelected({ target: input } as unknown as Event)
+    expect(uploadSpy).not.toHaveBeenCalled()
+  })
+
   it('should close all documents on logout', () => {
     const closeAllSpy = jest.spyOn(openDocumentsService, 'closeAll')
     component.onLogout()

src-ui/src/app/components/app-frame/app-frame.component.ts

@@ -48,12 +48,13 @@ import { SavedViewService } from 'src/app/services/rest/saved-view.service'
 import { SettingsService } from 'src/app/services/settings.service'
 import { TasksService } from 'src/app/services/tasks.service'
 import { ToastService } from 'src/app/services/toast.service'
+import { UploadDocumentsService } from 'src/app/services/upload-documents.service'
 import { environment } from 'src/environments/environment'
 import { ChatComponent } from '../chat/chat/chat.component'
+import { SwitchComponent } from '../common/input/switch/switch.component'
 import { BrandMarkComponent } from '../common/logo/brand-mark/brand-mark.component'
 import { LogoComponent } from '../common/logo/logo.component'
 import { ProfileEditDialogComponent } from '../common/profile-edit-dialog/profile-edit-dialog.component'
-import { SwitchComponent } from '../common/input/switch/switch.component'
 import { DocumentDetailComponent } from '../document-detail/document-detail.component'
 import { ComponentWithPermissions } from '../with-permissions/with-permissions.component'
 import { GlobalSearchComponent } from './global-search/global-search.component'
@@ -101,6 +102,7 @@ export class AppFrameComponent
   private modalService = inject(NgbModal)
   permissionsService = inject(PermissionsService)
   private djangoMessagesService = inject(DjangoMessagesService)
+  private uploadDocumentsService = inject(UploadDocumentsService)
 
   readonly appRemoteVersion = signal<AppRemoteVersion>(null)
   readonly isMenuCollapsed = signal(true)
@@ -511,6 +513,15 @@ export class AppFrameComponent
     }
   }
 
+  onFileSelected(event: Event) {
+    const input = event.target as HTMLInputElement
+    const files = Array.from(input.files ?? [])
+    input.value = ''
+    if (!files.length) return
+    this.toastService.showInfo($localize`Initiating upload...`, 3000)
+    this.uploadDocumentsService.uploadFiles(files)
+  }
+
   onLogout() {
     this.openDocumentsService.closeAll()
   }

src-ui/src/app/components/chat/chat/chat.component.html

@@ -5,16 +5,14 @@
   </button>
   <div ngbDropdownMenu class="dropdown-menu-end shadow p-3" aria-labelledby="chatDropdown">
     <div class="chat-container bg-light p-2">
-      <div class="chat-messages small">
+      <div class="chat-messages font-monospace small">
         @for (message of messages(); track message) {
           <div class="message d-flex flex-row small" [class.justify-content-end]="message.role === 'user'">
             <div class="p-2 m-2" [class.bg-body]="message.role === 'user'">
-              @if (message.role === 'assistant') {
-                <div class="chat-markdown text-break text-wrap" [innerHTML]="message.content | markdown"></div>
+              <span class="text-break">
+                {{ message.content }}
                 @if (message.isStreaming) { <span class="blinking-cursor">|</span> }
-              } @else {
-                <span class="text-break">{{ message.content }}</span>
-              }
+              </span>
               @if (message.role === 'assistant' && message.references?.length) {
                 <div class="chat-references list-group mt-3">
                   @for (reference of message.references; track reference.id) {

src-ui/src/app/components/chat/chat/chat.component.scss

@@ -8,6 +8,10 @@
   white-space: pre-wrap;
 }
 
+.chat-references {
+  font-family: var(--bs-font-sans-serif);
+}
+
 .dropdown-toggle::after {
   display: none;
 }
@@ -36,19 +40,3 @@
     opacity: 1;
   }
 }
-
-.chat-markdown ::ng-deep {
-  h1, h2, h3, h4, h5, h6 {
-    font-size: 1em;
-    font-weight: bold;
-  }
-
-  th, td {
-    padding: 0.15rem 0.4rem;
-    border: 1px solid var(--bs-border-color);
-  }
-
-  > :last-child {
-    margin-bottom: 0;
-  }
-}

src-ui/src/app/components/chat/chat/chat.component.spec.ts

@@ -207,33 +207,4 @@ describe('ChatComponent', () => {
     component.searchInputKeyDown(event)
     expect(component.sendMessage).not.toHaveBeenCalled()
   })
-
-  it('should render markdown for assistant messages only', () => {
-    component.messages.set([
-      { role: 'user', content: '**user**' },
-      { role: 'assistant', content: '**assistant** <script>x</script>' },
-    ])
-    fixture.detectChanges()
-    const el: HTMLElement = fixture.nativeElement
-    expect(el.querySelector('.chat-markdown strong')?.textContent).toBe(
-      'assistant'
-    )
-    expect(el.querySelector('.chat-markdown script')).toBeNull()
-    expect(el.textContent).toContain('**user**')
-  })
-
-  it('should keep the destination hostname visible after sanitizing chat links', () => {
-    component.messages.set([
-      {
-        role: 'assistant',
-        content:
-          '[View original document](https://otherdomain.example/?data=secret)',
-      },
-    ])
-    fixture.detectChanges()
-    const el: HTMLElement = fixture.nativeElement
-    const link = el.querySelector('.chat-markdown a')
-    expect(link?.textContent).toBe('View original document')
-    expect(link?.nextElementSibling?.textContent).toBe('(otherdomain.example)')
-  })
 })

src-ui/src/app/components/chat/chat/chat.component.ts

@@ -10,7 +10,6 @@ import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { NavigationEnd, Router, RouterModule } from '@angular/router'
 import { NgbDropdownModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
-import { MarkdownPipe } from 'src/app/pipes/markdown.pipe'
 import { filter, map } from 'rxjs'
 import {
   ChatMessage,
@@ -26,7 +25,6 @@ import {
     RouterModule,
     NgxBootstrapIconsModule,
     NgbDropdownModule,
-    MarkdownPipe,
   ],
   templateUrl: './chat.component.html',
   styleUrl: './chat.component.scss',

src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.spec.ts

@@ -85,15 +85,11 @@ describe('UploadFileWidgetComponent', () => {
       'file.pdf'
     )
     const fileInput = fixture.debugElement.query(By.css('input'))
-    jest.spyOn(fileInput.nativeElement, 'files', 'get').mockReturnValue({
-      item: () => file,
-      length: 1,
-      [Symbol.iterator]: () => ({
-        next: () => ({ done: false, value: file }),
-      }),
-    } as any)
+    jest
+      .spyOn(fileInput.nativeElement, 'files', 'get')
+      .mockReturnValue([file] as any)
     fileInput.nativeElement.dispatchEvent(new Event('change'))
-    expect(uploadSpy).toHaveBeenCalled()
+    expect(uploadSpy).toHaveBeenCalledWith(file)
   })
 
   it('should generate stats summary', () => {

src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts

@@ -130,11 +130,9 @@ export class UploadFileWidgetComponent extends ComponentWithPermissions {
   }
 
   public onFileSelected(event: Event) {
-    const files = (event.target as HTMLInputElement).files
-    for (let i = 0; i < files?.length; i++) {
-      const file = files.item(i)
-      file && this.uploadDocumentsService.uploadFile(file)
-    }
+    const input = event.target as HTMLInputElement
+    this.uploadDocumentsService.uploadFiles(Array.from(input.files ?? []))
+    input.value = ''
   }
 
   get slimSidebarEnabled(): boolean {

src-ui/src/app/components/file-drop/file-drop.component.ts

@@ -135,7 +135,7 @@ export class FileDropComponent {
         .then((results) => {
           files.push(...[].concat(...results))
           this.toastService.showInfo($localize`Initiating upload...`, 3000)
-          files.forEach((file) => this.uploadDocumentsService.uploadFile(file))
+          this.uploadDocumentsService.uploadFiles(files)
         })
         .catch((e) => {
           this.toastService.showError(
@@ -144,7 +144,7 @@ export class FileDropComponent {
         })
     } else if (files.length) {
       this.toastService.showInfo($localize`Initiating upload...`, 3000)
-      files.forEach((file) => this.uploadDocumentsService.uploadFile(file))
+      this.uploadDocumentsService.uploadFiles(files)
     }
 
     this.onDragLeave(event, true)

src-ui/src/app/pipes/markdown.pipe.spec.ts

@@ -1,90 +0,0 @@
-import { MarkdownPipe } from './markdown.pipe'
-
-describe('MarkdownPipe', () => {
-  const pipe = new MarkdownPipe()
-
-  it('should return empty string for empty input', () => {
-    expect(pipe.transform(null)).toEqual('')
-    expect(pipe.transform(undefined)).toEqual('')
-    expect(pipe.transform('')).toEqual('')
-  })
-
-  it('should render basic markdown', () => {
-    const html = pipe.transform(
-      '**bold** _em_ `code`\n\n- one\n- two\n\n| a | b |\n|---|---|\n| 1 | 2 |'
-    )
-    expect(html).toContain('<strong>bold</strong>')
-    expect(html).toContain('<em>em</em>')
-    expect(html).toContain('<code>code</code>')
-    expect(html).toContain('<li>one</li>')
-    expect(html).toContain('<table>')
-  })
-
-  it('should escape raw html', () => {
-    const html = pipe.transform(
-      'hi <img src=x onerror="alert(1)"> <b>x</b>\n\n<script>alert(1)</script>'
-    )
-    expect(html).not.toContain('<img')
-    expect(html).not.toContain('<script')
-    expect(html).not.toContain('<b>')
-    expect(html).toContain('&lt;script&gt;')
-  })
-
-  it('should not render images', () => {
-    const html = pipe.transform(
-      '![secret](https://otherdomain.example/x.png?d=1)'
-    )
-    expect(html).not.toContain('<img')
-    expect(html).not.toContain('otherdomain.example')
-    expect(html).toContain('secret')
-  })
-
-  it('should render safe links with target and rel', () => {
-    const html = pipe.transform('[docs](https://docs.paperless-ngx.com "Docs")')
-    expect(html).toContain(
-      '<a target="_blank" rel="noopener noreferrer nofollow" href="https://docs.paperless-ngx.com" title="Docs">docs</a>'
-    )
-    expect(pipe.transform('[mail](mailto:a@b.c)')).toContain(
-      'href="mailto:a@b.c"'
-    )
-  })
-
-  it('should drop unsafe or relative links but keep their text', () => {
-    for (const href of [
-      'javascript:alert(1)',
-      'JaVaScRiPt:alert(1)',
-      'data:text/html,<script>alert(1)</script>',
-      'vbscript:msgbox',
-      '/api/documents/',
-    ]) {
-      const html = pipe.transform(`[click](${href})`)
-      expect(html).not.toContain('<a')
-      expect(html).toContain('click')
-    }
-  })
-
-  it('should show the actual hostname beside web links with misleading labels', () => {
-    for (const protocol of ['http', 'https']) {
-      const html = pipe.transform(
-        `[docs.paperless-ngx.com](${protocol}://docs.paperless-ngx.com@otherdomain.example/path?secret=1)`
-      )
-      expect(html).toContain(
-        '</a> <span class="text-muted small">(otherdomain.example)</span>'
-      )
-      expect(html).not.toContain('(docs.paperless-ngx.com)')
-    }
-  })
-
-  it('should omit the hostname label for mailto links', () => {
-    expect(pipe.transform('[mail](mailto:a@b.c)')).toBe(
-      '<p><a target="_blank" rel="noopener noreferrer nofollow" href="mailto:a@b.c">mail</a></p>\n'
-    )
-  })
-
-  it('should escape link titles', () => {
-    const html = pipe.transform(
-      '[x](https://a.example "a\\" onmouseover=\\"1")'
-    )
-    expect(html).not.toMatch(/"\s*onmouseover=/)
-  })
-})

src-ui/src/app/pipes/markdown.pipe.ts

@@ -1,52 +0,0 @@
-import { Pipe, PipeTransform } from '@angular/core'
-import { Marked, Renderer, Tokens } from 'marked'
-
-const ALLOWED_LINK_PROTOCOLS = new Set(['http:', 'https:', 'mailto:'])
-
-function allowedUrl(href: string): URL | null {
-  try {
-    const url = new URL(href)
-    return ALLOWED_LINK_PROTOCOLS.has(url.protocol) ? url : null
-  } catch {
-    return null
-  }
-}
-
-// Treat chat content as untrusted: no raw HTML, no images, and only
-// absolute links. All escaping is done by marked's default renderer, and
-// Angular's sanitizer runs on top of this as well.
-const renderer: Partial<Renderer> = {
-  html(this: Renderer, { raw, text }: Tokens.HTML | Tokens.Tag): string {
-    return this.text({ type: 'text', raw, text })
-  },
-  image(this: Renderer, { raw, text }: Tokens.Image): string {
-    return this.text({ type: 'text', raw, text })
-  },
-  link(this: Renderer, token: Tokens.Link): string {
-    const url = allowedUrl(token.href)
-    if (!url) return this.parser.parseInline(token.tokens)
-    const anchor = Renderer.prototype.link
-      .call(this, token)
-      .replace('<a ', '<a target="_blank" rel="noopener noreferrer nofollow" ')
-    if (!url.hostname) return anchor
-    const hostname = this.text({ type: 'text', raw: '', text: url.hostname })
-    return `${anchor} <span class="text-muted small">(${hostname})</span>`
-  },
-}
-
-const markdown = new Marked({
-  async: false,
-  gfm: true,
-  breaks: true,
-  renderer,
-})
-
-@Pipe({
-  name: 'markdown',
-})
-export class MarkdownPipe implements PipeTransform {
-  transform(value: string | null | undefined): string {
-    if (!value) return ''
-    return markdown.parse(value) as string
-  }
-}

src-ui/src/app/services/upload-documents.service.spec.ts

@@ -54,6 +54,18 @@ describe('UploadDocumentsService', () => {
     req[0].flush('123-456')
   })
 
+  it('uploads each file when given multiple files', () => {
+    const uploadSpy = jest.spyOn(uploadDocumentsService, 'uploadFile')
+    const file1 = new File(['one'], 'one.pdf')
+    const file2 = new File(['two'], 'two.pdf')
+    uploadDocumentsService.uploadFiles([file1, file2])
+    expect(uploadSpy).toHaveBeenCalledWith(file1)
+    expect(uploadSpy).toHaveBeenCalledWith(file2)
+    httpTestingController
+      .match(`${environment.apiBaseUrl}documents/post_document/`)
+      .forEach((req) => req.flush('123-456'))
+  })
+
   it('updates progress during upload and failure', () => {
     const file = new File(
       [new Blob(['testing'], { type: 'application/pdf' })],

src-ui/src/app/services/upload-documents.service.ts

@@ -16,6 +16,12 @@ export class UploadDocumentsService {
 
   private uploadSubscriptions: Array<Subscription> = []
 
+  public uploadFiles(files: Iterable<File>) {
+    for (const file of files) {
+      this.uploadFile(file)
+    }
+  }
+
   public uploadFile(file: File) {
     let formData = new FormData()
     formData.append('document', file, file.name)

src-ui/src/main.ts

@@ -90,6 +90,7 @@ import {
   exclamationTriangleFill,
   eye,
   fileEarmark,
+  fileEarmarkArrowUp,
   fileEarmarkCheck,
   fileEarmarkDiff,
   fileEarmarkFill,
@@ -341,6 +342,7 @@ const icons = {
   exclamationTriangleFill,
   eye,
   fileEarmark,
+  fileEarmarkArrowUp,
   fileEarmarkCheck,
   fileEarmarkDiff,
   fileEarmarkFill,

src-ui/tsconfig.json

@@ -15,7 +15,7 @@
     "target": "ES2022",
     "module": "es2020",
     "lib": [
-      "es2022",
+      "es2020",
       "dom"
     ],
     "useDefineForClassFields": false

src/documents/bulk_edit.py

@@ -13,14 +13,8 @@ from celery import group
 from celery import shared_task
 from django.conf import settings
 from django.db import transaction
-from django.db.models import Case
-from django.db.models import F
 from django.db.models import Max
-from django.db.models import OuterRef
 from django.db.models import Q
-from django.db.models import Subquery
-from django.db.models import When
-from django.db.models.functions import Coalesce
 from django.utils import timezone
 
 from documents.data_models import ConsumableDocument
@@ -42,7 +36,6 @@ from documents.tasks import remove_document_from_index
 from documents.tasks import update_document_content_maybe_archive_file
 from documents.versioning import get_latest_version_for_root
 from documents.versioning import get_root_document
-from documents.versioning import versions_newest_first
 
 if TYPE_CHECKING:
     from collections.abc import Mapping
@@ -415,28 +408,10 @@ def reprocess(doc_ids: list[int], *, remote_ocr: bool = False) -> Literal["OK"]:
 
     Consumption workflows do not run here, so ``remote_ocr`` is how the user
     asks for the remote engine when it is not configured to handle everything.
-
-    A root document with versions reprocesses its latest version, which is the
-    file whose content, archive and thumbnail are shown for it.
     """
-    latest_version = versions_newest_first(
-        Document.objects.filter(root_document=OuterRef("pk")),
-    ).values("id")[:1]
-    source_ids = (
-        Document.objects.filter(id__in=doc_ids)
-        .annotate(
-            source_id=Case(
-                When(root_document__isnull=False, then=F("id")),
-                default=Coalesce(Subquery(latest_version), F("id")),
-            ),
-        )
-        .order_by()
-        .values_list("source_id", flat=True)
-        .distinct()
-    )
-    for source_id in source_ids:
+    for document_id in doc_ids:
         update_document_content_maybe_archive_file.apply_async(
-            kwargs={"document_id": source_id, "remote_ocr": remote_ocr},
+            kwargs={"document_id": document_id, "remote_ocr": remote_ocr},
             headers={"trigger_source": PaperlessTask.TriggerSource.MANUAL},
         )
 

src/documents/permissions.py

@@ -6,9 +6,7 @@ from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
 from django.db.models import Case
-from django.db.models import CharField
 from django.db.models import Count
-from django.db.models import F
 from django.db.models import IntegerField
 from django.db.models import Model
 from django.db.models import Q
@@ -16,7 +14,6 @@ from django.db.models import QuerySet
 from django.db.models import Value
 from django.db.models import When
 from django.db.models.functions import Cast
-from django.db.models.functions import Coalesce
 from guardian.core import ObjectPermissionChecker
 from guardian.models import GroupObjectPermission
 from guardian.models import UserObjectPermission
@@ -351,7 +348,6 @@ def permitted_object_ids(
     perm: str,
     *,
     include_deleted: bool = False,
-    parent_field: str | None = None,
 ) -> QuerySet[int]:
     """
     Generic version of ``permitted_document_ids`` for any model with an
@@ -360,24 +356,6 @@ def permitted_object_ids(
     soft-delete pattern (currently only ``Document``); for every other model
     it is accepted but has no effect, since those models have no soft-delete
     concept.
-
-    ``parent_field`` names a self-referencing foreign key whose target
-    authorizes the row (``Document.root_document``). A row with a parent is
-    visible exactly when its parent is, judged by the parent's owner and
-    grants, so the row's own owner and grants are ignored.
-
-    Guardian stores ``object_pk`` as a string, so the row key is cast to a
-    string and tested against the user's and groups' grants with a single
-    uncorrelated ``IN``. Postgres and SQLite build that set once. MariaDB
-    evaluates it as an index probe per row, which is cheap because the
-    lookups use guardian's unique indexes. Casting every ``object_pk`` to an
-    integer instead cannot use an index, and MariaDB cannot materialize it
-    inside the owner ``OR``, so it re-scans the user's grants for every row.
-    A correlated ``EXISTS`` per grant fixes MariaDB too, but Postgres and
-    SQLite re-run it for every row and end up slower than the original. The
-    user's groups are matched with an ``IN`` subquery rather than a join
-    through the membership table, which SQLite plans badly once the grant
-    tables grow.
     """
     has_soft_delete = hasattr(model, "global_objects")
     manager = (
@@ -385,21 +363,8 @@ def permitted_object_ids(
     )
     base_qs = manager.all().only("id", "owner")
 
-    owner_field, key_field = "owner", "pk"
-    if parent_field is not None:
-        owner_field, key_field = "authorizing_owner", "authorizing_id"
-        base_qs = base_qs.annotate(
-            authorizing_id=Coalesce(f"{parent_field}_id", "id"),
-            authorizing_owner=Case(
-                When(**{f"{parent_field}_id__isnull": True}, then=F("owner_id")),
-                default=F(f"{parent_field}__owner_id"),
-                output_field=IntegerField(),
-            ),
-        )
-    unowned = Q(**{f"{owner_field}__isnull": True})
-
     if user is None or not getattr(user, "is_authenticated", False):
-        return base_qs.filter(unowned).values_list("id", flat=True)
+        return base_qs.filter(owner__isnull=True).values_list("id", flat=True)
 
     # Deactivated users get nothing, deactivated superusers included, so this
     # has to come before the superuser shortcut. guardian's
@@ -423,26 +388,21 @@ def permitted_object_ids(
         "permission__content_type": content_type,
     }
 
-    # Both grant sets are compared to the row key as strings, exactly as
-    # guardian stores them, and are uncorrelated, so each engine can build the
-    # set once instead of probing per row.
-    user_keys = UserObjectPermission.objects.filter(
-        user=user,
-        **perm_filter,
-    ).values_list("object_pk", flat=True)
-    group_keys = GroupObjectPermission.objects.filter(
-        group_id__in=user.groups.values("id"),
-        **perm_filter,
-    ).values_list("object_pk", flat=True)
-    permitted_keys = user_keys.union(group_keys, all=True)
-
-    return (
-        base_qs.annotate(permitted_key=Cast(key_field, CharField(max_length=64)))
-        .filter(
-            Q(**{owner_field: user.pk}) | unowned | Q(permitted_key__in=permitted_keys),
-        )
-        .values_list("id", flat=True)
+    user_perm_ids = (
+        UserObjectPermission.objects.filter(user=user, **perm_filter)
+        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
+        .values_list("object_pk_int", flat=True)
     )
+    group_perm_ids = (
+        GroupObjectPermission.objects.filter(group__user=user, **perm_filter)
+        .annotate(object_pk_int=Cast("object_pk", IntegerField()))
+        .values_list("object_pk_int", flat=True)
+    )
+    permitted_ids = user_perm_ids.union(group_perm_ids)
+
+    return base_qs.filter(
+        Q(owner=user) | Q(owner__isnull=True) | Q(id__in=permitted_ids),
+    ).values_list("id", flat=True)
 
 
 ModelT = TypeVar("ModelT", bound=Model)
@@ -510,17 +470,8 @@ def permitted_document_ids(
     ``include_deleted=True`` for callers that need to check permission on
     soft-deleted documents (e.g. trash restore). This intentionally avoids
     ``get_objects_for_user`` to keep the subquery small and index-friendly.
-
-    A version is authorized by its root document, so a version's own owner and
-    grants never matter.
     """
-    return permitted_object_ids(
-        user,
-        Document,
-        perm,
-        include_deleted=include_deleted,
-        parent_field="root_document",
-    )
+    return permitted_object_ids(user, Document, perm, include_deleted=include_deleted)
 
 
 def get_document_count_filter_for_user(user, related_name: str = "documents"):

src/documents/search/_backend.py

@@ -7,7 +7,6 @@ import threading
 import time
 from datetime import UTC
 from datetime import datetime
-from datetime import timedelta
 from enum import StrEnum
 from itertools import islice
 from typing import TYPE_CHECKING
@@ -56,19 +55,6 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger("paperless.search")
 
-# tantivy stores dates as signed 64-bit nanoseconds since the Unix epoch, which
-# covers 1677-09-21T00:12:43 to 2262-04-11T23:47:16 UTC
-_INDEX_DATE_NANOS_MIN: Final[int] = -(2**63)
-_INDEX_DATE_NANOS_MAX: Final[int] = 2**63 - 1
-_UNIX_EPOCH: Final[datetime] = datetime(1970, 1, 1, tzinfo=UTC)
-
-
-def _is_indexable_date(value: datetime) -> bool:
-    """Whether value, at whole-second precision, fits tantivy's date range."""
-    nanos = ((value - _UNIX_EPOCH) // timedelta(seconds=1)) * 1_000_000_000
-    return _INDEX_DATE_NANOS_MIN <= nanos <= _INDEX_DATE_NANOS_MAX
-
-
 _LOCK_TIMEOUT_SECONDS: Final[float] = 10.0  # per-attempt acquire timeout
 _LOCK_RETRY_ATTEMPTS: Final[int] = 4  # total attempts (1 initial + 3 retries)
 _LOCK_BACKOFF_BASE: Final[float] = 1.0  # seconds
@@ -642,15 +628,7 @@ class TantivyBackend:
             document.created.day,
             tzinfo=UTC,
         )
-        if _is_indexable_date(created_date):
-            doc.add_date("created", created_date)
-        else:
-            logger.warning(
-                "Document %s has a created date (%s) outside the range the search "
-                "index can store; it will be indexed without a created date",
-                document.pk,
-                document.created,
-            )
+        doc.add_date("created", created_date)
         doc.add_date("modified", document.modified)
         doc.add_date("added", document.added)
 

src/documents/serialisers.py

@@ -90,7 +90,6 @@ from documents.templating.utils import convert_format_str_to_template_format
 from documents.templating.workflows import validate_workflow_template
 from documents.validators import uri_validator
 from documents.validators import url_validator
-from documents.versioning import get_root_document
 from documents.versioning import has_prefetched_effective_content
 from documents.versioning import sort_versions_newest_first
 
@@ -2895,7 +2894,7 @@ class ShareLinkSerializer(OwnedObjectSerializer):
             and has_perms_owner_aware(
                 self.user,
                 "view_document",
-                get_root_document(document),
+                document,
             )
         ):
             return document

src/documents/tasks.py

@@ -490,23 +490,18 @@ def update_document_content_maybe_archive_file(
                     shutil.move(thumbnail, document.thumbnail_path)
 
             document.refresh_from_db()
-            root_document = (
-                document.root_document if document.root_document_id else document
-            )
             logger.info(
-                f"Updating index for document {root_document.pk} ({document.archive_checksum})",
+                f"Updating index for document {document_id} ({document.archive_checksum})",
             )
             from documents.search import get_backend
 
-            get_backend().add_or_update(root_document)
+            get_backend().add_or_update(document)
 
             ai_config = AIConfig()
             if ai_config.llm_index_enabled:
-                llm_index_add_or_update_document(root_document)
+                llm_index_add_or_update_document(document)
 
             clear_document_caches(document.pk)
-            if root_document.pk != document.pk:
-                clear_document_caches(root_document.pk)
 
         except Exception:
             logger.exception(

src/documents/tests/search/test_backend.py

@@ -1,6 +1,4 @@
 import json
-import logging
-from datetime import date
 from pathlib import Path
 
 import pytest
@@ -906,79 +904,6 @@ class TestRebuild:
         assert ids == [doc.pk]
 
 
-class TestCreatedDateOutOfRange:
-    """The index stores dates as nanosecond i64 values (1677-09-22 to 2262-04-11).
-
-    A document whose created date falls outside that window must not abort
-    indexing: it is indexed without a created value and a warning names it.
-    """
-
-    @pytest.mark.parametrize(
-        ("created", "expected_warnings"),
-        [
-            pytest.param(date(1677, 9, 22), 0, id="first-representable-day"),
-            pytest.param(date(2262, 4, 11), 0, id="last-representable-day"),
-            pytest.param(date(1677, 9, 21), 1, id="day-before-first"),
-            pytest.param(date(2262, 4, 12), 1, id="day-after-last"),
-            pytest.param(date(16, 8, 30), 1, id="two-digit-year-read-as-year-16"),
-            pytest.param(date(9999, 12, 31), 1, id="max-python-date"),
-        ],
-    )
-    def test_add_or_update_indexes_document_and_warns_when_out_of_range(
-        self,
-        backend: TantivyBackend,
-        caplog: pytest.LogCaptureFixture,
-        created: date,
-        expected_warnings: int,
-    ) -> None:
-        """
-        GIVEN:
-            - A document with a created date at or beyond the index date limits
-        WHEN:
-            - The document is added to the index
-        THEN:
-            - The document is indexed and searchable either way
-            - A warning naming the document is logged only for out-of-range dates
-        """
-        doc = DocumentFactory(created=created, content="boundarycontent")
-
-        with caplog.at_level(logging.WARNING, logger="paperless.search"):
-            backend.add_or_update(doc)
-
-        assert backend.search_ids("boundarycontent", user=None) == [doc.pk]
-        warnings = [r for r in caplog.records if r.levelno == logging.WARNING]
-        assert len(warnings) == expected_warnings
-        if expected_warnings:
-            assert f"Document {doc.pk}" in warnings[0].getMessage()
-
-    def test_rebuild_continues_past_out_of_range_document(
-        self,
-        backend: TantivyBackend,
-        caplog: pytest.LogCaptureFixture,
-    ) -> None:
-        """
-        GIVEN:
-            - A document with an unrepresentable created date among valid ones
-        WHEN:
-            - The index is rebuilt
-        THEN:
-            - Rebuild completes and every document is searchable
-            - A warning names the offending document
-        """
-        good = DocumentFactory(created=date(2016, 8, 30), content="rebuildcontent")
-        bad = DocumentFactory(created=date(16, 8, 30), content="rebuildcontent")
-
-        with caplog.at_level(logging.WARNING, logger="paperless.search"):
-            backend.rebuild(Document.objects.all())
-
-        assert sorted(backend.search_ids("rebuildcontent", user=None)) == sorted(
-            [good.pk, bad.pk],
-        )
-        warnings = [r for r in caplog.records if r.levelno == logging.WARNING]
-        assert len(warnings) == 1
-        assert f"Document {bad.pk}" in warnings[0].getMessage()
-
-
 class TestAutocomplete:
     """Test autocomplete functionality."""
 

src/documents/tests/test_api_document_versions.py

@@ -8,7 +8,6 @@ from auditlog.models import LogEntry  # type: ignore[import-untyped]
 from django.contrib.contenttypes.models import ContentType
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.test import TestCase as DjangoTestCase
-from django.test import override_settings
 from django.utils import timezone
 from rest_framework import status
 from rest_framework.test import APITestCase
@@ -17,17 +16,13 @@ from documents.data_models import DocumentSource
 from documents.filters import EffectiveContentFilter
 from documents.filters import TitleContentFilter
 from documents.models import Document
-from documents.models import Note
-from documents.models import ShareLink
 from documents.versioning import annotate_effective_content
 from documents.views import DocumentSelectionMixin
 from paperless_testing.dirs import DirectoriesMixin
 from paperless_testing.factories import DocumentFactory
 from paperless_testing.factories import UserFactory
 from paperless_testing.http import read_streaming_response
-from paperless_testing.permissions import grant_all_global
 from paperless_testing.permissions import grant_global
-from paperless_testing.permissions import grant_object
 
 if TYPE_CHECKING:
     from pathlib import Path
@@ -1048,152 +1043,3 @@ class TestBulkSelectionExcludesVersions(DjangoTestCase):
         )
 
         self.assertEqual(selected, [root.id])
-
-
-class TestVersionActionPermissions(DirectoriesMixin, APITestCase):
-    def setUp(self):
-        super().setUp()
-        self.user = UserFactory()
-        grant_all_global(self.user)
-        self.client.force_authenticate(self.user)
-        self.root = DocumentFactory(owner=UserFactory())
-        self.version = DocumentFactory(root_document=self.root, owner=None)
-
-    @override_settings(AUDIT_LOG_ENABLED=True)
-    def test_actions_reject_stale_version_ownership(self):
-        note = Note.objects.create(document=self.version, note="Version note")
-        for owner in (None, self.user):
-            self.version.owner = owner
-            self.version.save(update_fields=["owner"])
-            for action in (
-                "notes",
-                "suggestions",
-                "ai_suggestions",
-                "history",
-                "share_links",
-            ):
-                with self.subTest(owner=owner, action=action):
-                    response = self.client.get(
-                        f"/api/documents/{self.version.pk}/{action}/",
-                    )
-                    self.assertEqual(response.status_code, 403)
-            response = self.client.post(
-                f"/api/documents/{self.version.pk}/notes/",
-                {"note": "New note"},
-            )
-            self.assertEqual(response.status_code, 403)
-            response = self.client.delete(
-                f"/api/documents/{self.version.pk}/notes/?id={note.pk}",
-            )
-            self.assertEqual(response.status_code, 403)
-            response = self.client.post(
-                "/api/share_links/",
-                {"document": self.version.pk, "file_version": "original"},
-            )
-            self.assertEqual(response.status_code, 403)
-            response = self.client.post(
-                "/api/share_link_bundles/",
-                {"document_ids": [self.version.pk], "file_version": "original"},
-                format="json",
-            )
-            self.assertEqual(response.status_code, 400)
-            response = self.client.post(
-                "/api/documents/email/",
-                {
-                    "documents": [self.version.pk],
-                    "addresses": "recipient@example.com",
-                    "subject": "Version",
-                    "message": "Version",
-                },
-                format="json",
-            )
-            self.assertEqual(response.status_code, 403)
-            with (
-                mock.patch("documents.views.AIConfig") as ai_config,
-                mock.patch("documents.views.stream_chat_with_documents") as chat,
-            ):
-                ai_config.return_value.ai_enabled = True
-                response = self.client.post(
-                    "/api/documents/chat/",
-                    {"q": "Version?", "document_id": self.version.pk},
-                    format="json",
-                )
-            self.assertEqual(response.status_code, 403)
-            chat.assert_not_called()
-        self.assertTrue(Note.objects.filter(pk=note.pk).exists())
-        self.assertFalse(ShareLink.objects.exists())
-
-    @mock.patch("documents.views.build_share_link_bundle.apply_async")
-    def test_root_permissions_allow_sharing_a_private_version(self, build_mock):
-        self.version.owner = UserFactory()
-        self.version.save(update_fields=["owner"])
-        grant_object(self.user, self.root, "view_document", "change_document")
-        note = Note.objects.create(document=self.version, note="Version note")
-        response = self.client.get(f"/api/documents/{self.version.pk}/notes/")
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(response.data[0]["id"], note.pk)
-        response = self.client.post(
-            "/api/share_links/",
-            {"document": self.version.pk, "file_version": "original"},
-        )
-        self.assertEqual(response.status_code, 201)
-        self.assertEqual(ShareLink.objects.get().document_id, self.version.pk)
-        response = self.client.get(f"/api/documents/{self.version.pk}/share_links/")
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(len(response.data), 1)
-        response = self.client.post(
-            "/api/share_link_bundles/",
-            {"document_ids": [self.version.pk], "file_version": "original"},
-            format="json",
-        )
-        self.assertEqual(response.status_code, 201)
-        build_mock.assert_called_once()
-
-    def test_root_view_permission_does_not_allow_note_changes(self):
-        grant_object(self.user, self.root, "view_document")
-        note = Note.objects.create(document=self.version, note="Version note")
-        response = self.client.get(f"/api/documents/{self.version.pk}/notes/")
-        self.assertEqual(response.status_code, 200)
-        response = self.client.post(
-            f"/api/documents/{self.version.pk}/notes/",
-            {"note": "New note"},
-        )
-        self.assertEqual(response.status_code, 403)
-        response = self.client.delete(
-            f"/api/documents/{self.version.pk}/notes/?id={note.pk}",
-        )
-        self.assertEqual(response.status_code, 403)
-        self.assertTrue(Note.objects.filter(pk=note.pk).exists())
-
-    @override_settings(AUDIT_LOG_ENABLED=True)
-    def test_history_uses_root_ownership(self):
-        self.root.owner = self.user
-        self.root.save(update_fields=["owner"])
-        self.version.owner = UserFactory()
-        self.version.save(update_fields=["owner"])
-        response = self.client.get(f"/api/documents/{self.version.pk}/history/")
-        self.assertEqual(response.status_code, 200)
-
-    def test_selection_data_rejects_stale_version_ownership(self):
-        for owner in (None, self.user):
-            self.version.owner = owner
-            self.version.save(update_fields=["owner"])
-            with self.subTest(owner=owner):
-                response = self.client.post(
-                    "/api/documents/selection_data/",
-                    {"documents": [self.version.pk]},
-                    format="json",
-                )
-                self.assertEqual(response.status_code, 403)
-
-    def test_selection_data_allows_private_version_of_permitted_root(self):
-        self.version.owner = UserFactory()
-        self.version.save(update_fields=["owner"])
-        grant_object(self.user, self.root, "view_document")
-        other = DocumentFactory(owner=self.user)
-        response = self.client.post(
-            "/api/documents/selection_data/",
-            {"documents": [self.version.pk, other.pk]},
-            format="json",
-        )
-        self.assertEqual(response.status_code, 200)

src/documents/tests/test_api_trash.py

@@ -6,7 +6,6 @@ from rest_framework.test import APITestCase
 
 from documents.models import Document
 from paperless_testing.dirs import DirectoriesMixin
-from paperless_testing.factories import DocumentFactory
 from paperless_testing.factories import UserFactory
 from paperless_testing.permissions import grant_all_global
 
@@ -280,53 +279,3 @@ class TestTrashAPI(DirectoriesMixin, APITestCase):
             Document.objects.filter(root_document=root).values_list("id", flat=True),
             [version.pk for version in versions],
         )
-
-    def test_api_trash_version_follows_root_owner(self) -> None:
-        """
-        GIVEN:
-            - A deleted version of user2's document, owned by nobody
-            - A deleted version of the user's document, owned by user2
-        WHEN:
-            - The user lists the trash and tries to restore or empty the versions
-        THEN:
-            - Only the version of the user's own document is listed
-            - The other version can't be restored or emptied
-            - The version of the user's own document can be restored
-        """
-        user2 = UserFactory(username="user2")
-        other_version = DocumentFactory(
-            root_document=DocumentFactory(owner=user2),
-            version_index=1,
-        )
-        other_version.delete()
-        own_version = DocumentFactory(
-            owner=user2,
-            root_document=DocumentFactory(owner=self.user),
-            version_index=1,
-        )
-        own_version.delete()
-
-        resp = self.client.get("/api/trash/")
-        self.assertEqual(resp.status_code, status.HTTP_200_OK)
-        self.assertEqual(
-            [doc["id"] for doc in resp.data["results"]],
-            [own_version.pk],
-        )
-
-        for action in ("restore", "empty"):
-            with self.subTest(action=action):
-                resp = self.client.post(
-                    "/api/trash/",
-                    {"action": action, "documents": [other_version.pk]},
-                )
-                self.assertEqual(resp.status_code, status.HTTP_403_FORBIDDEN)
-                self.assertTrue(
-                    Document.deleted_objects.filter(pk=other_version.pk).exists(),
-                )
-
-        resp = self.client.post(
-            "/api/trash/",
-            {"action": "restore", "documents": [own_version.pk]},
-        )
-        self.assertEqual(resp.status_code, status.HTTP_200_OK)
-        self.assertTrue(Document.objects.filter(pk=own_version.pk).exists())

src/documents/tests/test_bulk_edit.py

@@ -4,7 +4,6 @@ from pathlib import Path
 from unittest import mock
 
 import pikepdf
-import pytest
 from django.contrib.auth.models import Group
 from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
@@ -13,7 +12,6 @@ from django.test import TestCase
 from django.test.utils import CaptureQueriesContext
 from guardian.shortcuts import get_groups_with_perms
 from guardian.shortcuts import get_users_with_perms
-from pytest_mock import MockerFixture
 
 from documents import bulk_edit
 from documents.models import Correspondent
@@ -25,7 +23,6 @@ from documents.models import StoragePath
 from documents.models import Tag
 from documents.permissions import set_permissions_for_objects
 from paperless_testing.dirs import DirectoriesMixin
-from paperless_testing.factories import DocumentFactory
 from paperless_testing.permissions import grant_object
 
 
@@ -1973,22 +1970,18 @@ class TestPDFActions(DirectoriesMixin, TestCase):
         self.assertIn("Error removing password from document", cm.output[0])
 
 
-@pytest.mark.django_db
-class TestBulkEditReprocess:
-    @pytest.fixture
-    def mock_task(self, mocker: MockerFixture) -> mock.MagicMock:
-        return mocker.patch(
-            "documents.bulk_edit.update_document_content_maybe_archive_file",
+class TestBulkEditReprocess(DirectoriesMixin, TestCase):
+    def setUp(self) -> None:
+        super().setUp()
+
+        self.doc = Document.objects.create(
+            title="test",
+            checksum="A",
+            mime_type="application/pdf",
         )
 
-    @staticmethod
-    def _queued_ids(mock_task: mock.MagicMock) -> list[int]:
-        return [
-            call.kwargs["kwargs"]["document_id"]
-            for call in mock_task.apply_async.call_args_list
-        ]
-
-    def test_reprocess_defaults_to_local(self, mock_task: mock.MagicMock) -> None:
+    @mock.patch("documents.bulk_edit.update_document_content_maybe_archive_file")
+    def test_reprocess_defaults_to_local(self, mock_task: mock.Mock) -> None:
         """
         GIVEN:
             - A reprocess request that says nothing about remote OCR
@@ -1997,17 +1990,18 @@ class TestBulkEditReprocess:
         THEN:
             - The task is queued without asking for the remote engine
         """
-        doc = DocumentFactory()
-
-        assert bulk_edit.reprocess([doc.id]) == "OK"
+        result = bulk_edit.reprocess([self.doc.id])
 
+        self.assertEqual(result, "OK")
         mock_task.apply_async.assert_called_once()
-        assert mock_task.apply_async.call_args.kwargs["kwargs"] == {
-            "document_id": doc.id,
-            "remote_ocr": False,
-        }
+        _, kwargs = mock_task.apply_async.call_args
+        self.assertEqual(
+            kwargs["kwargs"],
+            {"document_id": self.doc.id, "remote_ocr": False},
+        )
 
-    def test_reprocess_passes_remote_ocr(self, mock_task: mock.MagicMock) -> None:
+    @mock.patch("documents.bulk_edit.update_document_content_maybe_archive_file")
+    def test_reprocess_passes_remote_ocr(self, mock_task: mock.Mock) -> None:
         """
         GIVEN:
             - A reprocess request that explicitly asks for remote OCR
@@ -2016,72 +2010,14 @@ class TestBulkEditReprocess:
         THEN:
             - The request is forwarded to the task for every document
         """
-        docs = DocumentFactory.create_batch(2)
-
-        bulk_edit.reprocess([doc.id for doc in docs], remote_ocr=True)
-
-        assert mock_task.apply_async.call_count == 2
-        for call in mock_task.apply_async.call_args_list:
-            assert call.kwargs["kwargs"]["remote_ocr"]
-
-    def test_reprocess_root_uses_latest_version(
-        self,
-        mock_task: mock.MagicMock,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with two versions
-        WHEN:
-            - reprocess is called with the root document
-        THEN:
-            - The latest version is reprocessed, not the root's original file
-        """
-        root = DocumentFactory()
-        DocumentFactory(root_document=root, version_index=1)
-        latest = DocumentFactory(root_document=root, version_index=2)
-
-        bulk_edit.reprocess([root.id])
-
-        assert self._queued_ids(mock_task) == [latest.id]
-
-    def test_reprocess_explicit_version(self, mock_task: mock.MagicMock) -> None:
-        """
-        GIVEN:
-            - A root document with two versions
-        WHEN:
-            - reprocess is called with the older version
-        THEN:
-            - That version is reprocessed
-        """
-        root = DocumentFactory()
-        older = DocumentFactory(root_document=root, version_index=1)
-        DocumentFactory(root_document=root, version_index=2)
-
-        bulk_edit.reprocess([older.id])
-
-        assert self._queued_ids(mock_task) == [older.id]
-
-    def test_reprocess_root_and_latest_version_dispatches_once(
-        self,
-        mock_task: mock.MagicMock,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with two versions, the latest created on a
-              different date than the root
-        WHEN:
-            - reprocess is called with both the root and its latest version
-        THEN:
-            - The latest version is reprocessed only once
-        """
-        root = DocumentFactory(created=date(2024, 1, 1))
-        DocumentFactory(root_document=root, version_index=1)
-        latest = DocumentFactory(
-            root_document=root,
-            version_index=2,
-            created=date(2025, 1, 1),
+        other = Document.objects.create(
+            title="test2",
+            checksum="B",
+            mime_type="application/pdf",
         )
 
-        bulk_edit.reprocess([root.id, latest.id])
+        bulk_edit.reprocess([self.doc.id, other.id], remote_ocr=True)
 
-        assert self._queued_ids(mock_task) == [latest.id]
+        self.assertEqual(mock_task.apply_async.call_count, 2)
+        for call in mock_task.apply_async.call_args_list:
+            self.assertTrue(call.kwargs["kwargs"]["remote_ocr"])

src/documents/tests/test_permission_filtering_security.py

@@ -32,8 +32,6 @@ from paperless_testing.permissions import grant_global
 from paperless_testing.permissions import grant_object
 
 if TYPE_CHECKING:
-    from django.contrib.auth.models import User
-
     from paperless_testing.dirs import PaperlessDirs
 
 
@@ -180,296 +178,6 @@ class TestPermittedDocumentIdsIncludeDeleted:
         )
 
 
-@pytest.mark.django_db
-class TestPermittedDocumentIdsVersions:
-    """
-    A version is authorized by its root document: the version's own owner and
-    grants never matter.
-    """
-
-    @pytest.mark.parametrize(
-        ("root_owner", "version_owner", "expected_visible"),
-        [
-            pytest.param(
-                "other",
-                "nobody",
-                False,
-                id="unowned-version-of-private-root",
-            ),
-            pytest.param("other", "user", False, id="own-version-of-private-root"),
-            pytest.param("user", "other", True, id="foreign-version-of-own-root"),
-            pytest.param("user", "nobody", True, id="unowned-version-of-own-root"),
-            pytest.param("nobody", "other", True, id="private-version-of-unowned-root"),
-        ],
-    )
-    def test_version_follows_root_owner(
-        self,
-        root_owner: str,
-        version_owner: str,
-        *,
-        expected_visible: bool,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document and a version with differing owners
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - The version is visible exactly when its root is
-        """
-        user = UserFactory()
-        owners = {"user": user, "other": UserFactory(), "nobody": None}
-        root = DocumentFactory(owner=owners[root_owner])
-        version = DocumentFactory(root_document=root, owner=owners[version_owner])
-
-        visible = set(permitted_document_ids(user))
-
-        assert (version.pk in visible) is expected_visible
-        assert (root.pk in visible) is expected_visible
-
-    @staticmethod
-    def grantee(user: User, kind: str) -> User | Group:
-        """The user itself, or a new group the user belongs to."""
-        if kind == "user":
-            return user
-        group = Group.objects.create(name="shared")
-        user.groups.add(group)
-        return group
-
-    @pytest.mark.parametrize(
-        "grantee_kind",
-        [pytest.param("user", id="user"), pytest.param("group", id="group")],
-    )
-    def test_grant_on_root_applies_to_version(self, grantee_kind: str) -> None:
-        """
-        GIVEN:
-            - A private root document shared with a user or one of their groups
-            - A version of it owned by someone else
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - Both the root and the version are visible
-            - A user without the grant sees neither
-        """
-        user = UserFactory()
-        stranger = UserFactory()
-        root = DocumentFactory(owner=UserFactory())
-        version = DocumentFactory(root_document=root, owner=UserFactory())
-        grant_object(self.grantee(user, grantee_kind), root, "view_document")
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[root.pk, version.pk],
-            expected_hidden=[],
-        )
-        assert_visible_document_ids(
-            permitted_document_ids(stranger),
-            expected_visible=[],
-            expected_hidden=[root.pk, version.pk],
-        )
-
-    @pytest.mark.parametrize(
-        "grantee_kind",
-        [pytest.param("user", id="user"), pytest.param("group", id="group")],
-    )
-    def test_grant_on_version_is_ignored(self, grantee_kind: str) -> None:
-        """
-        GIVEN:
-            - A private root document
-            - A version with an explicit grant for the user or one of their groups
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - Neither the root nor the version is visible
-        """
-        user = UserFactory()
-        root = DocumentFactory(owner=UserFactory())
-        version = DocumentFactory(root_document=root, owner=UserFactory())
-        grant_object(self.grantee(user, grantee_kind), version, "view_document")
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[],
-            expected_hidden=[root.pk, version.pk],
-        )
-
-    def test_grant_on_one_root_does_not_reach_another_roots_version(self) -> None:
-        """
-        GIVEN:
-            - Two private roots, each with a version
-            - The user may view only the first root
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - Only the first root and its version are visible
-        """
-        user = UserFactory()
-        first = DocumentFactory(owner=UserFactory())
-        first_version = DocumentFactory(root_document=first, owner=UserFactory())
-        second = DocumentFactory(owner=UserFactory())
-        second_version = DocumentFactory(root_document=second, owner=user)
-        grant_object(user, first, "view_document")
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[first.pk, first_version.pk],
-            expected_hidden=[second.pk, second_version.pk],
-        )
-
-    def test_user_in_several_groups(self) -> None:
-        """
-        GIVEN:
-            - A user in two groups
-            - Two private roots shared with one group each, and a third shared with nobody
-            - A version of each root
-        WHEN:
-            - The permitted document ids are resolved for the user
-        THEN:
-            - The two shared roots and their versions are visible
-            - The third root and its version are not
-        """
-        user = UserFactory()
-        groups = [Group.objects.create(name=f"group{i}") for i in range(2)]
-        user.groups.add(*groups)
-        shared = [DocumentFactory(owner=UserFactory()) for _ in groups]
-        for root, group in zip(shared, groups, strict=True):
-            grant_object(group, root, "view_document")
-        unshared = DocumentFactory(owner=UserFactory())
-        shared_versions = [
-            DocumentFactory(root_document=root, owner=UserFactory()) for root in shared
-        ]
-        unshared_version = DocumentFactory(root_document=unshared, owner=None)
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[
-                *(root.pk for root in shared),
-                *(version.pk for version in shared_versions),
-            ],
-            expected_hidden=[unshared.pk, unshared_version.pk],
-        )
-
-    def test_permission_is_resolved_through_the_root(self) -> None:
-        """
-        GIVEN:
-            - A private root document where the user may view and change
-        WHEN:
-            - The permitted ids are resolved for view, change and delete
-        THEN:
-            - The version is visible for view and change only
-        """
-        user = UserFactory()
-        root = DocumentFactory(owner=UserFactory())
-        version = DocumentFactory(root_document=root, owner=UserFactory())
-        grant_object(user, root, "view_document", "change_document")
-
-        assert version.pk in set(permitted_document_ids(user))
-        assert version.pk in set(permitted_document_ids(user, perm="change_document"))
-        assert version.pk in set(
-            permitted_document_ids(user, perm="documents.change_document"),
-        )
-        assert version.pk not in set(
-            permitted_document_ids(user, perm="delete_document"),
-        )
-
-    def test_anonymous_sees_versions_of_unowned_roots_only(self) -> None:
-        """
-        GIVEN:
-            - A version owned by nobody under a private root
-            - A version owned by someone under an unowned root
-        WHEN:
-            - The permitted document ids are resolved for an anonymous user
-        THEN:
-            - Only the version of the unowned root is visible
-        """
-        private_root = DocumentFactory(owner=UserFactory())
-        private_version = DocumentFactory(root_document=private_root, owner=None)
-        open_root = DocumentFactory(owner=None)
-        open_version = DocumentFactory(root_document=open_root, owner=UserFactory())
-
-        assert_visible_document_ids(
-            permitted_document_ids(AnonymousUser()),
-            expected_visible=[open_root.pk, open_version.pk],
-            expected_hidden=[private_root.pk, private_version.pk],
-        )
-
-    def test_deleted_versions_follow_their_deleted_root(self) -> None:
-        """
-        GIVEN:
-            - A soft-deleted root document and its version, which deleting the
-              root soft-deletes too; the version is owned by someone else
-        WHEN:
-            - The permitted document ids are resolved with and without deleted
-              documents
-        THEN:
-            - Nothing is visible by default
-            - With deleted documents included, the version is visible to the
-              root's owner and not to the version's own owner
-        """
-        owner = UserFactory()
-        version_owner = UserFactory()
-        root = DocumentFactory(owner=owner)
-        version = DocumentFactory(root_document=root, owner=version_owner)
-        root.delete()
-
-        assert not {root.pk, version.pk} & set(permitted_document_ids(owner))
-        assert_visible_document_ids(
-            permitted_document_ids(owner, include_deleted=True),
-            expected_visible=[root.pk, version.pk],
-            expected_hidden=[],
-        )
-        assert_visible_document_ids(
-            permitted_document_ids(version_owner, include_deleted=True),
-            expected_visible=[],
-            expected_hidden=[root.pk, version.pk],
-        )
-
-    @pytest.mark.parametrize(
-        "is_superuser",
-        [
-            pytest.param(False, id="regular-user"),
-            pytest.param(True, id="superuser"),
-        ],
-    )
-    def test_inactive_user_sees_no_versions(self, *, is_superuser: bool) -> None:
-        """
-        GIVEN:
-            - An inactive user, possibly a superuser, who owns a root and its version
-        WHEN:
-            - The permitted document ids are resolved for them
-        THEN:
-            - Nothing is visible
-        """
-        user = UserFactory(is_active=False, is_superuser=is_superuser)
-        root = DocumentFactory(owner=user)
-        version = DocumentFactory(root_document=root, owner=user)
-
-        assert_visible_document_ids(
-            permitted_document_ids(user),
-            expected_visible=[],
-            expected_hidden=[root.pk, version.pk],
-        )
-
-    def test_superuser_sees_all_versions(self) -> None:
-        """
-        GIVEN:
-            - A private root owned by someone else, with a version
-        WHEN:
-            - The permitted document ids are resolved for a superuser
-        THEN:
-            - Both the root and the version are visible
-        """
-        superuser = UserFactory(superuser=True)
-        root = DocumentFactory(owner=UserFactory())
-        version = DocumentFactory(root_document=root, owner=UserFactory())
-
-        assert_visible_document_ids(
-            permitted_document_ids(superuser),
-            expected_visible=[root.pk, version.pk],
-            expected_hidden=[],
-        )
-
-
 @pytest.mark.django_db
 class TestAiChatAllDocumentsPermissionBoundary:
     """

src/documents/tests/test_share_link_bundles.py

@@ -90,13 +90,10 @@ class ShareLinkBundleAPITests(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
         self.assertIn("document_ids", response.data)
 
-    def test_create_bundle_rejects_insufficient_permissions(self) -> None:
-        requester = UserFactory(username="bundle_creator")
-        grant_global(requester, "add_sharelinkbundle", "view_document")
-        self.client.force_authenticate(requester)
-        document = DocumentFactory(owner=UserFactory(username="document_owner"))
+    @mock.patch("documents.views.permitted_document_ids", return_value=set())
+    def test_create_bundle_rejects_insufficient_permissions(self, perms_mock) -> None:
         payload = {
-            "document_ids": [self.document.pk, document.pk],
+            "document_ids": [self.document.pk],
             "file_version": ShareLink.FileVersion.ARCHIVE,
             "expiration_days": 7,
         }
@@ -104,8 +101,8 @@ class ShareLinkBundleAPITests(DirectoriesMixin, APITestCase):
         response = self.client.post(self.ENDPOINT, payload, format="json")
 
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-        self.assertIn(str(document.pk), str(response.data["document_ids"]))
-        self.assertFalse(ShareLinkBundle.objects.exists())
+        self.assertIn("document_ids", response.data)
+        perms_mock.assert_called()
 
     @mock.patch("documents.views.build_share_link_bundle.apply_async")
     def test_rebuild_bundle_resets_state(self, delay_mock) -> None:

src/documents/tests/test_tasks.py

@@ -20,7 +20,6 @@ from documents.sanity_checker import SanityCheckMessages
 from documents.tests.helpers import dummy_preprocess
 from paperless_testing.assertions import FileSystemAssertsMixin
 from paperless_testing.dirs import DirectoriesMixin
-from paperless_testing.factories import DocumentFactory
 
 
 @pytest.mark.django_db
@@ -288,82 +287,6 @@ class TestUpdateContent(DirectoriesMixin, TestCase):
         tasks.update_document_content_maybe_archive_file(doc.pk)
         self.assertNotEqual(Document.objects.get(pk=doc.pk).content, "test")
 
-    def _create_root_with_version(self) -> tuple[Document, Document]:
-        sample1 = self.dirs.scratch_dir / "sample.pdf"
-        shutil.copy(
-            Path(__file__).parent
-            / "samples"
-            / "documents"
-            / "originals"
-            / "0000001.pdf",
-            sample1,
-        )
-        root = DocumentFactory(content="root content", mime_type="application/pdf")
-        version = DocumentFactory(
-            content="my document",
-            filename=sample1,
-            mime_type="application/pdf",
-            root_document=root,
-            version_index=1,
-        )
-        return root, version
-
-    @mock.patch("documents.tasks.clear_document_caches")
-    @mock.patch("documents.search.get_backend")
-    def test_update_content_version_indexes_root(
-        self,
-        mock_get_backend: mock.Mock,
-        mock_clear_caches: mock.Mock,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-        WHEN:
-            - Update content task is called for the version
-        THEN:
-            - The version's content is updated
-            - The root document is indexed rather than the version
-            - Caches are cleared for both
-        """
-        root, version = self._create_root_with_version()
-
-        tasks.update_document_content_maybe_archive_file(version.pk)
-
-        self.assertNotEqual(
-            Document.objects.get(pk=version.pk).content,
-            "my document",
-        )
-        self.assertEqual(Document.objects.get(pk=root.pk).content, "root content")
-        indexed = mock_get_backend.return_value.add_or_update.call_args.args[0]
-        self.assertEqual(indexed.pk, root.pk)
-        mock_clear_caches.assert_has_calls(
-            [mock.call(version.pk), mock.call(root.pk)],
-        )
-
-    @override_settings(AI_ENABLED=True, LLM_EMBEDDING_BACKEND="huggingface")
-    @mock.patch("documents.tasks.llm_index_add_or_update_document")
-    @mock.patch("documents.search.get_backend")
-    def test_update_content_version_updates_llm_index_for_root(
-        self,
-        mock_get_backend: mock.Mock,
-        mock_llm_index: mock.Mock,
-    ) -> None:
-        """
-        GIVEN:
-            - A root document with a version
-            - The LLM index is enabled
-        WHEN:
-            - Update content task is called for the version
-        THEN:
-            - The LLM index is updated for the root document, not the version
-        """
-        root, version = self._create_root_with_version()
-
-        tasks.update_document_content_maybe_archive_file(version.pk)
-
-        mock_llm_index.assert_called_once()
-        self.assertEqual(mock_llm_index.call_args.args[0].pk, root.pk)
-
 
 class TestUpdateContentRemoteOCR(DirectoriesMixin, TestCase):
     """

src/documents/views.py

@@ -1550,16 +1550,13 @@ class DocumentViewSet(
     )
     def suggestions(self, request, pk=None):
         doc = get_object_or_404(
-            Document.objects.select_related(
-                "owner",
-                "root_document__owner",
-            ).prefetch_related("versions"),
+            Document.objects.select_related("owner").prefetch_related("versions"),
             pk=pk,
         )
         if request.user is not None and not has_perms_owner_aware(
             request.user,
             "change_document",
-            get_root_document(doc),
+            doc,
         ):
             return HttpResponseForbidden("Insufficient permissions")
 
@@ -1613,16 +1610,13 @@ class DocumentViewSet(
     @method_decorator(cache_control(no_cache=True))
     def ai_suggestions(self, request, pk=None):
         doc = get_object_or_404(
-            Document.objects.select_related(
-                "owner",
-                "root_document__owner",
-            ).prefetch_related("versions"),
+            Document.objects.select_related("owner").prefetch_related("versions"),
             pk=pk,
         )
         if request.user is not None and not has_perms_owner_aware(
             request.user,
             "change_document",
-            get_root_document(doc),
+            doc,
         ):
             return HttpResponseForbidden("Insufficient permissions")
 
@@ -1862,20 +1856,15 @@ class DocumentViewSet(
         currentUser = request.user
         try:
             doc = (
-                Document.objects.select_related("owner", "root_document__owner")
+                Document.objects.select_related("owner")
                 .prefetch_related("notes")
-                .only(
-                    "pk",
-                    "owner__id",
-                    "root_document__id",
-                    "root_document__owner__id",
-                )
+                .only("pk", "owner__id")
                 .get(pk=pk)
             )
             if currentUser is not None and not has_perms_owner_aware(
                 currentUser,
                 "view_document",
-                get_root_document(doc),
+                doc,
             ):
                 return HttpResponseForbidden("Insufficient permissions to view notes")
         except Document.DoesNotExist:
@@ -1897,7 +1886,7 @@ class DocumentViewSet(
                 if currentUser is not None and not has_perms_owner_aware(
                     currentUser,
                     "change_document",
-                    get_root_document(doc),
+                    doc,
                 ):
                     return HttpResponseForbidden(
                         "Insufficient permissions to create notes",
@@ -1940,7 +1929,7 @@ class DocumentViewSet(
             if currentUser is not None and not has_perms_owner_aware(
                 currentUser,
                 "change_document",
-                get_root_document(doc),
+                doc,
             ):
                 return HttpResponseForbidden("Insufficient permissions to delete notes")
 
@@ -1984,13 +1973,11 @@ class DocumentViewSet(
     def share_links(self, request, pk=None):
         currentUser = request.user
         try:
-            doc = Document.objects.select_related("owner", "root_document__owner").get(
-                pk=pk,
-            )
+            doc = Document.objects.select_related("owner").get(pk=pk)
             if currentUser is not None and not has_perms_owner_aware(
                 currentUser,
                 "change_document",
-                get_root_document(doc),
+                doc,
             ):
                 return HttpResponseForbidden(
                     "Insufficient permissions to add share link",
@@ -2021,11 +2008,10 @@ class DocumentViewSet(
         if not settings.AUDIT_LOG_ENABLED:
             return HttpResponseBadRequest("Audit log is disabled")
         try:
-            doc = Document.objects.select_related("root_document__owner").get(pk=pk)
-            root_doc = get_root_document(doc)
+            doc = Document.objects.get(pk=pk)
             if not request.user.has_perm("auditlog.view_logentry") or (
-                root_doc.owner is not None
-                and root_doc.owner != request.user
+                doc.owner is not None
+                and doc.owner != request.user
                 and not request.user.is_superuser
             ):
                 return HttpResponseForbidden(
@@ -2116,7 +2102,9 @@ class DocumentViewSet(
         documents = Document.objects.filter(pk__in=document_ids)
         if (
             request.user is not None
-            and documents.exclude(id__in=permitted_document_ids(request.user)).exists()
+            and documents.exclude(
+                pk__in=permitted_document_ids(request.user),
+            ).exists()
         ):
             return HttpResponseForbidden("Insufficient permissions")
 
@@ -2442,17 +2430,11 @@ class ChatStreamingView(GenericAPIView[Any]):
 
         if doc_id:
             try:
-                document = Document.objects.select_related(
-                    "root_document__owner",
-                ).get(id=doc_id)
+                document = Document.objects.get(id=doc_id)
             except Document.DoesNotExist:
                 return HttpResponseBadRequest("Document not found")
 
-            if not has_perms_owner_aware(
-                request.user,
-                "view_document",
-                get_root_document(document),
-            ):
+            if not has_perms_owner_aware(request.user, "view_document", document):
                 return HttpResponseForbidden("Insufficient permissions")
 
             documents = Document.objects.filter(pk=document.pk)
@@ -3008,8 +2990,12 @@ class DocumentOperationPermissionMixin(PassUserMixin, DocumentSelectionMixin):
             user.has_perm(
                 "documents.change_document",
             )
-            and not Document.global_objects.filter(pk__in=documents)
-            .exclude(pk__in=permitted_document_ids(user, perm="change_document"))
+            and not Document.global_objects.filter(
+                pk__in=[doc.pk for doc in root_docs],
+            )
+            .exclude(
+                pk__in=permitted_document_ids(user, perm="change_document"),
+            )
             .exists()
         )
 
@@ -3619,11 +3605,10 @@ class SelectionDataView(DocumentSelectionMixin, GenericAPIView[Any]):
             user=request.user,
             validated_data=serializer.validated_data,
         )
-        documents = Document.objects.filter(pk__in=ids)
-        if (
-            documents.count() != len(ids)
-            or documents.exclude(id__in=permitted_document_ids(request.user)).exists()
-        ):
+        permitted_documents = Document.objects.filter(
+            id__in=permitted_document_ids(request.user),
+        )
+        if permitted_documents.filter(pk__in=ids).count() != len(ids):
             return HttpResponseForbidden("Insufficient permissions")
 
         correspondents = Correspondent.objects.annotate(
@@ -4119,16 +4104,21 @@ class BulkDownloadView(DocumentSelectionMixin, GenericAPIView[Any]):
             validated_data=serializer.validated_data,
         )
         documents = Document.objects.filter(pk__in=ids)
+        versioned_documents = []
         compression = serializer.validated_data.get("compression")
         content = serializer.validated_data.get("content")
         follow_filename_format = serializer.validated_data.get("follow_formatting")
 
-        if documents.exclude(id__in=permitted_document_ids(request.user)).exists():
-            return HttpResponseForbidden("Insufficient permissions")
-        versioned_documents = [
-            get_latest_version_for_root(get_root_document(document))
-            for document in documents
-        ]
+        permitted_ids = set(permitted_document_ids(request.user))
+        for document in documents:
+            root_doc = get_root_document(document)
+            if root_doc.pk not in permitted_ids:
+                return HttpResponseForbidden("Insufficient permissions")
+            versioned_documents.append(
+                get_latest_version_for_root(
+                    root_doc,
+                ),
+            )
 
         if content == "both":
             strategy_class = OriginalAndArchiveStrategy
@@ -4800,23 +4790,19 @@ class ShareLinkBundleViewSet(PassUserMixin, ModelViewSet[ShareLinkBundle]):
                 },
             )
 
-        denied_id = (
-            documents_qs.exclude(id__in=permitted_document_ids(request.user))
-            .order_by("pk")
-            .values_list("pk", flat=True)
-            .first()
-        )
-        if denied_id is not None:
-            raise ValidationError(
-                {
-                    "document_ids": _(
-                        "Insufficient permissions to share document %(id)s.",
-                    )
-                    % {"id": denied_id},
-                },
-            )
-
         documents = list(documents_qs)
+        permitted_ids = set(permitted_document_ids(request.user))
+        for document in documents:
+            if document.pk not in permitted_ids:
+                raise ValidationError(
+                    {
+                        "document_ids": _(
+                            "Insufficient permissions to share document %(id)s.",
+                        )
+                        % {"id": document.pk},
+                    },
+                )
+
         document_map = {document.pk: document for document in documents}
         ordered_documents = [document_map[doc_id] for doc_id in document_ids]
 
@@ -5601,23 +5587,6 @@ class TrashView(ListModelMixin, PassUserMixin):
     class _TrashPermittedObjectsFilter(PermittedObjectsFilter):
         include_granted = False
 
-        def filter_queryset(self, request, queryset, view):
-            if request.user.is_superuser or not request.user.is_active:
-                return super().filter_queryset(request, queryset, view)
-
-            # A version belongs to whoever owns its root
-            def owned_or_unowned(prefix: str) -> Q:
-                return Q(**{f"{prefix}owner": request.user}) | Q(
-                    **{f"{prefix}owner__isnull": True},
-                )
-
-            return queryset.filter(
-                (Q(root_document__isnull=True) & owned_or_unowned(""))
-                | (
-                    Q(root_document__isnull=False) & owned_or_unowned("root_document__")
-                ),
-            )
-
     filter_backends = (_TrashPermittedObjectsFilter,)
     pagination_class = StandardPagination
 
@@ -5648,7 +5617,7 @@ class TrashView(ListModelMixin, PassUserMixin):
             else self.filter_queryset(self.get_queryset()).all()
         )
         if docs.exclude(
-            id__in=permitted_document_ids(
+            pk__in=permitted_document_ids(
                 request.user,
                 perm="delete_document",
                 include_deleted=True,

src/locale/en_US/LC_MESSAGES/django.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-10-10 22:04+0000\n"
+"POT-Creation-Date: 2026-10-06 15:12+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -1652,49 +1652,49 @@ msgstr ""
 msgid "workflow runs"
 msgstr ""
 
-#: documents/serialisers.py:516 documents/serialisers.py:873
-#: documents/serialisers.py:2903 documents/views.py:343 documents/views.py:2750
+#: documents/serialisers.py:515 documents/serialisers.py:872
+#: documents/serialisers.py:2902 documents/views.py:343 documents/views.py:2732
 #: paperless_mail/serialisers.py:156
 msgid "Insufficient permissions."
 msgstr ""
 
-#: documents/serialisers.py:709
+#: documents/serialisers.py:708
 msgid "Invalid color."
 msgstr ""
 
-#: documents/serialisers.py:2370
+#: documents/serialisers.py:2369
 #, python-format
 msgid "File type %(type)s not supported"
 msgstr ""
 
-#: documents/serialisers.py:2414
+#: documents/serialisers.py:2413
 #, python-format
 msgid "Custom field id must be an integer: %(id)s"
 msgstr ""
 
-#: documents/serialisers.py:2421
+#: documents/serialisers.py:2420
 #, python-format
 msgid "Custom field with id %(id)s does not exist"
 msgstr ""
 
-#: documents/serialisers.py:2438 documents/serialisers.py:2448
+#: documents/serialisers.py:2437 documents/serialisers.py:2447
 msgid ""
 "Custom fields must be a list of integers or an object mapping ids to values."
 msgstr ""
 
-#: documents/serialisers.py:2443
+#: documents/serialisers.py:2442
 msgid "Some custom fields don't exist or were specified twice."
 msgstr ""
 
-#: documents/serialisers.py:2590
+#: documents/serialisers.py:2589
 msgid "Invalid variable detected."
 msgstr ""
 
-#: documents/serialisers.py:2959
+#: documents/serialisers.py:2958
 msgid "Duplicate document identifiers are not allowed."
 msgstr ""
 
-#: documents/serialisers.py:2989 documents/views.py:4797
+#: documents/serialisers.py:2988 documents/views.py:4787
 #, python-format
 msgid "Documents not found: %(ids)s"
 msgstr ""
@@ -1945,40 +1945,40 @@ msgstr ""
 msgid ", "
 msgstr ""
 
-#: documents/views.py:336 documents/views.py:2747
+#: documents/views.py:336 documents/views.py:2729
 msgid "Invalid more_like_id"
 msgstr ""
 
-#: documents/views.py:1682
+#: documents/views.py:1676
 msgid "Invalid AI configuration."
 msgstr ""
 
-#: documents/views.py:1693
+#: documents/views.py:1687
 msgid "AI backend request timed out."
 msgstr ""
 
-#: documents/views.py:1705
+#: documents/views.py:1699
 msgid "AI backend rejected the request. Check logs for details."
 msgstr ""
 
-#: documents/views.py:2572 documents/views.py:2888
+#: documents/views.py:2554 documents/views.py:2870
 msgid "Specify only one of text, title_search, query, or more_like_id."
 msgstr ""
 
-#: documents/views.py:4813
+#: documents/views.py:4800
 #, python-format
 msgid "Insufficient permissions to share document %(id)s."
 msgstr ""
 
-#: documents/views.py:4860
+#: documents/views.py:4846
 msgid "Bundle is already being processed."
 msgstr ""
 
-#: documents/views.py:4924
+#: documents/views.py:4910
 msgid "The share link bundle is still being prepared. Please try again later."
 msgstr ""
 
-#: documents/views.py:4938
+#: documents/views.py:4924
 msgid "The share link bundle is unavailable."
 msgstr ""
 

src/paperless/checks.py

@@ -272,26 +272,27 @@ def check_deprecated_db_settings(
     Detects legacy advanced options that should be migrated to
     PAPERLESS_DB_OPTIONS. Returns one Warning per deprecated variable found.
     """
-    deprecated_vars = (
-        "PAPERLESS_DB_TIMEOUT",
-        "PAPERLESS_DB_POOLSIZE",
-        "PAPERLESS_DBSSLMODE",
-        "PAPERLESS_DBSSLROOTCERT",
-        "PAPERLESS_DBSSLCERT",
-        "PAPERLESS_DBSSLKEY",
-    )
+    deprecated_vars: dict[str, str] = {
+        "PAPERLESS_DB_TIMEOUT": "timeout",
+        "PAPERLESS_DB_POOLSIZE": "pool.min_size / pool.max_size",
+        "PAPERLESS_DBSSLMODE": "sslmode",
+        "PAPERLESS_DBSSLROOTCERT": "sslrootcert",
+        "PAPERLESS_DBSSLCERT": "sslcert",
+        "PAPERLESS_DBSSLKEY": "sslkey",
+    }
 
     warnings: list[Warning] = []
 
-    for var_name in deprecated_vars:
+    for var_name, db_option_key in deprecated_vars.items():
         if not os.getenv(var_name):
             continue
         warnings.append(
             Warning(
                 f"Deprecated environment variable: {var_name}",
                 hint=(
-                    f"{var_name} is deprecated. "
+                    f"{var_name} is no longer supported and will be removed in v3.2. "
                     f"Set the equivalent option via PAPERLESS_DB_OPTIONS instead. "
+                    f'Example: PAPERLESS_DB_OPTIONS=\'{{"{db_option_key}": "<value>"}}\'. '
                     "See https://docs.paperless-ngx.com/migration-v3/ for the full reference."
                 ),
                 id="paperless.W001",

src/paperless/tests/test_checks.py

@@ -211,14 +211,14 @@ class TestAuditLogChecks:
         assert "auditlog table was found but audit log is disabled." in msgs[0].msg
 
 
-DEPRECATED_VARS = (
-    "PAPERLESS_DB_TIMEOUT",
-    "PAPERLESS_DB_POOLSIZE",
-    "PAPERLESS_DBSSLMODE",
-    "PAPERLESS_DBSSLROOTCERT",
-    "PAPERLESS_DBSSLCERT",
-    "PAPERLESS_DBSSLKEY",
-)
+DEPRECATED_VARS: dict[str, str] = {
+    "PAPERLESS_DB_TIMEOUT": "timeout",
+    "PAPERLESS_DB_POOLSIZE": "pool.min_size / pool.max_size",
+    "PAPERLESS_DBSSLMODE": "sslmode",
+    "PAPERLESS_DBSSLROOTCERT": "sslrootcert",
+    "PAPERLESS_DBSSLCERT": "sslcert",
+    "PAPERLESS_DBSSLKEY": "sslkey",
+}
 
 
 class TestDeprecatedDbSettings:
@@ -234,11 +234,26 @@ class TestDeprecatedDbSettings:
         result = check_deprecated_db_settings(None)
         assert result == []
 
-    @pytest.mark.parametrize("env_var", DEPRECATED_VARS)
+    @pytest.mark.parametrize(
+        ("env_var", "db_option_key"),
+        [
+            pytest.param("PAPERLESS_DB_TIMEOUT", "timeout", id="db-timeout"),
+            pytest.param(
+                "PAPERLESS_DB_POOLSIZE",
+                "pool.min_size / pool.max_size",
+                id="db-poolsize",
+            ),
+            pytest.param("PAPERLESS_DBSSLMODE", "sslmode", id="ssl-mode"),
+            pytest.param("PAPERLESS_DBSSLROOTCERT", "sslrootcert", id="ssl-rootcert"),
+            pytest.param("PAPERLESS_DBSSLCERT", "sslcert", id="ssl-cert"),
+            pytest.param("PAPERLESS_DBSSLKEY", "sslkey", id="ssl-key"),
+        ],
+    )
     def test_single_deprecated_var_produces_one_warning(
         self,
         mocker: MockerFixture,
         env_var: str,
+        db_option_key: str,
     ) -> None:
         """Each deprecated var in isolation produces exactly one warning."""
         mocker.patch.dict(os.environ, {env_var: "some_value"}, clear=True)
@@ -249,8 +264,7 @@ class TestDeprecatedDbSettings:
         assert isinstance(warning, Warning)
         assert warning.id == "paperless.W001"
         assert env_var in warning.hint
-        assert "PAPERLESS_DB_OPTIONS" in warning.hint
-        assert "https://docs.paperless-ngx.com/migration-v3/" in warning.hint
+        assert db_option_key in warning.hint
 
     def test_multiple_deprecated_vars_produce_one_warning_each(
         self,

src/paperless_ai/ai_classifier.py

@@ -4,7 +4,8 @@ from django.conf import settings
 from django.contrib.auth.models import User
 
 from documents.models import Document
-from documents.permissions import permitted_document_ids
+from documents.permissions import permitted_object_ids
+from documents.permissions import restrict_queryset_to_visible
 from documents.permissions import user_is_unrestricted
 from paperless.config import AIConfig
 from paperless_ai.base_model import ClassificationSuggestions
@@ -53,8 +54,8 @@ def _fulltext_similar_documents(
     active superuser - see user_is_unrestricted) is normalized to ``None``
     before calling, since the backend's permission filter has no superuser
     short-circuit of its own. Results are re-checked with
-    permitted_document_ids() since Tantivy's indexed permission fields lag the
-    DB via async reindexing and judge a version by its own owner.
+    restrict_queryset_to_visible() since Tantivy's indexed permission fields
+    lag the DB via async reindexing.
     """
     from documents.search import get_backend
 
@@ -68,9 +69,10 @@ def _fulltext_similar_documents(
     )
     if not unrestricted:
         allowed_ids = set(
-            Document.objects.filter(
-                pk__in=similar_ids,
-                id__in=permitted_document_ids(user),
+            restrict_queryset_to_visible(
+                Document.objects.filter(pk__in=similar_ids),
+                user,
+                "view_document",
             ).values_list("pk", flat=True),
         )
         similar_ids = [doc_id for doc_id in similar_ids if doc_id in allowed_ids]
@@ -198,13 +200,13 @@ def get_taxonomy_context(
             # quadratic scan in the vector store at best, and past ~32,763
             # documents a hard sqlite3.OperationalError (SQLite's
             # bound-parameter limit) at worst.
-            # permitted_document_ids() has its own superuser shortcut that would
+            # permitted_object_ids() has its own superuser shortcut that would
             # return every Document's id anyway, so this changes nothing about
             # which documents are considered -- only how we get there.
             visible_document_ids = (
                 None
                 if user_is_unrestricted(user)
-                else list(permitted_document_ids(user))
+                else list(permitted_object_ids(user, Document, "view_document"))
             )
             nodes = retrieve_similar_nodes(
                 document,

src/paperless_ai/tests/test_ai_classifier.py

@@ -552,7 +552,7 @@ class TestGetTaxonomyContextVisibility:
             return_value=[],
         )
         mock_permitted = mocker.patch(
-            "paperless_ai.ai_classifier.permitted_document_ids",
+            "paperless_ai.ai_classifier.permitted_object_ids",
         )
         user = UserFactory.create(is_superuser=True)
 
@@ -582,7 +582,7 @@ class TestGetTaxonomyContextVisibility:
             return_value=[],
         )
         mock_permitted = mocker.patch(
-            "paperless_ai.ai_classifier.permitted_document_ids",
+            "paperless_ai.ai_classifier.permitted_object_ids",
         )
 
         get_taxonomy_context(document, None)
@@ -611,55 +611,16 @@ class TestGetTaxonomyContextVisibility:
             return_value=[],
         )
         mock_permitted = mocker.patch(
-            "paperless_ai.ai_classifier.permitted_document_ids",
+            "paperless_ai.ai_classifier.permitted_object_ids",
             return_value=[1, 2, 3],
         )
         user = UserFactory.create(is_superuser=False)
 
         get_taxonomy_context(document, user)
 
-        mock_permitted.assert_called_once_with(user)
+        mock_permitted.assert_called_once_with(user, Document, "view_document")
         assert mock_retrieve.call_args.kwargs["document_ids"] == [1, 2, 3]
 
-    @pytest.mark.django_db
-    @override_settings(LLM_EMBEDDING_BACKEND="huggingface")
-    def test_version_of_private_root_is_not_visible(
-        self,
-        mocker: pytest_mock.MockerFixture,
-    ) -> None:
-        """
-        GIVEN:
-            - A private root document owned by someone else
-            - A version of it whose own owner is unset, as when the root
-              changed hands after the version was created
-        WHEN:
-            - get_taxonomy_context() is called for a non-superuser
-        THEN:
-            - Neither the root nor the version is in the visible ids passed to
-              retrieve_similar_nodes(), since a version follows its root
-        """
-        owner = UserFactory.create()
-        viewer = UserFactory.create(is_superuser=False)
-        root = DocumentFactory.create(content="private", owner=owner)
-        version = DocumentFactory.create(
-            content="private",
-            owner=None,
-            root_document=root,
-            version_index=1,
-        )
-        source = DocumentFactory.create(content="Some content", owner=viewer)
-        mock_retrieve = mocker.patch(
-            "paperless_ai.ai_classifier.retrieve_similar_nodes",
-            return_value=[],
-        )
-
-        get_taxonomy_context(source, viewer)
-
-        visible = mock_retrieve.call_args.kwargs["document_ids"]
-        assert source.pk in visible
-        assert root.pk not in visible
-        assert version.pk not in visible
-
 
 @pytest.mark.django_db
 class TestFulltextSimilarDocuments:
@@ -842,7 +803,7 @@ class TestFulltextSimilarDocuments:
             - _fulltext_similar_documents() is called with that user
         THEN:
             - Only the still-permitted document is returned - the DB
-              re-check via permitted_document_ids() must catch the
+              re-check via restrict_queryset_to_visible() must catch the
               document Tantivy's stale index still thinks is visible
         """
         owner = UserFactory.create()
@@ -873,45 +834,6 @@ class TestFulltextSimilarDocuments:
 
         assert [s["document_id"] for s in result] == [permitted.pk]
 
-    def test_excludes_version_of_private_root_for_regular_user(
-        self,
-        fulltext_backend: TantivyBackend,
-    ) -> None:
-        """
-        GIVEN:
-            - A regular user and a private root owned by someone else
-            - A version of that root with no owner of its own, which the
-              Tantivy index therefore treats as visible to everyone
-        WHEN:
-            - _fulltext_similar_documents() is called with that user
-        THEN:
-            - The version is not returned, since the DB re-check judges it by
-              its root
-        """
-        owner = UserFactory.create()
-        viewer = UserFactory.create(is_superuser=False)
-        source = DocumentFactory.create(
-            content="shared content phrase",
-            owner=viewer,
-        )
-        root = DocumentFactory.create(
-            content="shared content phrase",
-            owner=owner,
-        )
-        version = DocumentFactory.create(
-            content="shared content phrase",
-            owner=None,
-            root_document=root,
-            version_index=1,
-        )
-        fulltext_backend.add_or_update(source)
-        fulltext_backend.add_or_update(root)
-        fulltext_backend.add_or_update(version)
-
-        result = _fulltext_similar_documents(source, user=viewer, top_k=5)
-
-        assert version.pk not in [s["document_id"] for s in result]
-
 
 @pytest.mark.django_db
 @override_settings(LLM_EMBEDDING_BACKEND="huggingface")