New Crowdin translations by GitHub Action

Co-authored-by: Crowdin Bot <support+bot@crowdin.com>

docs/usage.md

@@ -493,7 +493,7 @@ fields and permissions, which will be merged.
 
 #### Types {#workflow-trigger-types}
 
-Currently, there are four events that correspond to workflow trigger 'types':
+Currently, there are five events that correspond to workflow trigger 'types':
 
 1. **Consumption Started**: _before_ a document is consumed, so events can include filters by source (mail, consumption
    folder or API), file path, file name, mail rule
@@ -505,8 +505,10 @@ Currently, there are four events that correspond to workflow trigger 'types':
 4. **Scheduled**: a scheduled trigger that can be used to run workflows at a specific time. The date used can be either the document
    added, created, updated date or you can specify a (date) custom field. You can also specify a day offset from the date (positive
    offsets will trigger after the date, negative offsets will trigger before).
+5. **Manual**: a trigger that only runs when you explicitly choose to run the workflow against one or more existing documents. See
+   [running a workflow manually](#running-a-workflow-manually) below.
 
-The following flow diagram illustrates the four document trigger types:
+The following flow diagram illustrates the document trigger types:
 
 ```mermaid
 flowchart TD
@@ -526,6 +528,10 @@ flowchart TD
     matching
     trigger(s)"}
 
+    manual{"Matching
+    'Manual'
+    trigger(s)"}
+
     A[New Document] --> consumption
     consumption --> |Yes| C[Workflow Actions Run]
     consumption --> |No| D
@@ -543,6 +549,10 @@ flowchart TD
     scheduled --> |Yes| N[Workflow Actions Run]
     scheduled --> |No| O[Document Saved]
     N --> O
+    P[User Runs Workflow] --> manual
+    manual --> |Yes| Q[Workflow Actions Run]
+    manual --> |No| R[Document Saved]
+    Q --> R
 ```
 
 #### Filters {#workflow-trigger-filters}
@@ -554,9 +564,9 @@ Workflows allow you to filter by:
 - File path, including wildcards. Note that enabling `PAPERLESS_CONSUMER_RECURSIVE` would allow, for
   example, automatically assigning documents to different owners based on the upload directory.
 - Mail rule. Choosing this option will force 'mail fetch' to be the workflow source.
-- Content matching (`Added`, `Updated` and `Scheduled` triggers only). Filter document content using the matching settings.
+- Content matching (`Added`, `Updated`, `Scheduled` and `Manual` triggers only). Filter document content using the matching settings.
 
-There are also 'advanced' filters available for `Added`, `Updated` and `Scheduled` triggers:
+There are also 'advanced' filters available for `Added`, `Updated`, `Scheduled` and `Manual` triggers:
 
 - Any Tags: Filter for documents with any of the specified tags.
 - All Tags: Filter for documents with all of the specified tags.
@@ -569,6 +579,22 @@ There are also 'advanced' filters available for `Added`, `Updated` and `Schedule
 - Not Storage paths: Filter documents without any of these storage paths.
 - Custom field query: Filter documents with a custom field query (the same as used for the document list filters).
 
+#### Running a workflow manually {#running-a-workflow-manually}
+
+A workflow with a **Manual** trigger does not run automatically. Instead, it can be run on demand against existing
+documents from the web UI:
+
+- From the document list, select one or more documents and choose **Run workflow** from the "Actions" menu.
+- From an individual document, choose **Run workflow** from the "Actions" menu.
+
+You will be asked which workflow to run. From the document list, the workflow's trigger filters apply by default, so
+documents that do not match are skipped. You can choose to **run on all selected documents** to ignore the filters.
+From an individual document, the option to ignore trigger filters is selected by default. Clear it to run the workflow
+only if the document matches its trigger filters.
+
+Manual runs happen in the background. As with scheduled workflows, the document list is not refreshed automatically when
+they finish, so you may need to reload the list to see the results.
+
 ### Workflow Actions
 
 #### Types {#workflow-action-types}
@@ -649,7 +675,7 @@ new version of the same document, this time with normal OCR/text extraction appl
 a password-protected file added with this trigger will briefly exist as an un-OCR'd version before
 the properly processed version is created.
 
-**Document Added**, **Document Updated**, **Scheduled**: these triggers run against a document that
+**Document Added**, **Document Updated**, **Scheduled**, **Manual**: these triggers run against a document that
 already exists, so password removal happens immediately: the decrypted content is queued for
 consumption as a new version right away. Note that if the document's initial consumption also
 happened while it was still encrypted, that original version will likewise be missing OCR text.

src-ui/src/app/components/common/bootstrap-icon/icons.ts

@@ -118,6 +118,7 @@ import personFill from 'bootstrap-icons/icons/person-fill.svg'
 import personLock from 'bootstrap-icons/icons/person-lock.svg'
 import personSquare from 'bootstrap-icons/icons/person-square.svg'
 import person from 'bootstrap-icons/icons/person.svg'
+import playCircle from 'bootstrap-icons/icons/play-circle.svg'
 import playFill from 'bootstrap-icons/icons/play-fill.svg'
 import plusCircle from 'bootstrap-icons/icons/plus-circle.svg'
 import plus from 'bootstrap-icons/icons/plus.svg'
@@ -279,6 +280,7 @@ export const icons: Record<string, string> = {
   personFillLock,
   personLock,
   personSquare,
+  playCircle,
   playFill,
   plus,
   plusCircle,

src-ui/src/app/components/common/confirm-dialog/run-workflow-confirm-dialog/run-workflow-confirm-dialog.component.html

@@ -0,0 +1,37 @@
+<div class="modal-header">
+  <h4 class="modal-title" id="modal-basic-title">{{title}}</h4>
+  <button type="button" class="btn-close" aria-label="Close" (click)="cancel()">
+  </button>
+</div>
+<div class="modal-body">
+  @if (message) {
+    <p class="text-break" [innerHTML]="message"></p>
+  }
+  <div class="mb-3">
+    <label class="form-label" for="runWorkflowSelect" i18n>Workflow</label>
+    <select class="form-select" id="runWorkflowSelect" [(ngModel)]="workflowId" (ngModelChange)="workflowSelected()">
+      <option [ngValue]="null" disabled i18n>Select a workflow</option>
+      @for (workflow of workflows; track workflow.id) {
+        <option [ngValue]="workflow.id">{{workflow.name}}</option>
+      }
+    </select>
+  </div>
+  <div class="form-check">
+    <input class="form-check-input" type="checkbox" id="runWorkflowForce" [(ngModel)]="force" />
+    @if (singleDocument) {
+      <label class="form-check-label" for="runWorkflowForce" i18n>Run on this document regardless of trigger filters</label>
+      <div class="form-text" i18n>Ignore the workflow's trigger filters for this document.</div>
+    } @else {
+      <label class="form-check-label" for="runWorkflowForce" i18n>Run on all selected documents</label>
+      <div class="form-text" i18n>Ignore the workflow's trigger filters and run on every selected document.</div>
+    }
+  </div>
+</div>
+<div class="modal-footer">
+  <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
+    <span class="d-inline-block" style="padding-bottom: 1px;">{{cancelBtnCaption}}</span>
+  </button>
+  <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled">
+    {{btnCaption}}
+  </button>
+</div>

src-ui/src/app/components/common/confirm-dialog/run-workflow-confirm-dialog/run-workflow-confirm-dialog.component.spec.ts

@@ -0,0 +1,63 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing'
+import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
+import { RunWorkflowConfirmDialogComponent } from './run-workflow-confirm-dialog.component'
+
+describe('RunWorkflowConfirmDialogComponent', () => {
+  let component: RunWorkflowConfirmDialogComponent
+  let fixture: ComponentFixture<RunWorkflowConfirmDialogComponent>
+
+  beforeEach(async () => {
+    TestBed.configureTestingModule({
+      providers: [NgbActiveModal],
+      imports: [RunWorkflowConfirmDialogComponent],
+    }).compileComponents()
+
+    fixture = TestBed.createComponent(RunWorkflowConfirmDialogComponent)
+    component = fixture.componentInstance
+    component.workflows = [{ id: 5, name: 'Manual workflow' } as any]
+    fixture.detectChanges()
+  })
+
+  it('should disable confirm until a workflow is selected and not force by default', () => {
+    expect(component.confirmButtonEnabled).toBeFalsy()
+    expect(component.force).toBeFalsy()
+
+    component.workflowId = 5
+    component.workflowSelected()
+    expect(component.confirmButtonEnabled).toBeTruthy()
+
+    component.workflowId = null
+    component.workflowSelected()
+    expect(component.confirmButtonEnabled).toBeFalsy()
+  })
+
+  it('should render an option per workflow', () => {
+    const options = fixture.nativeElement.querySelectorAll(
+      '#runWorkflowSelect option'
+    )
+    // placeholder option + one per workflow
+    expect(options).toHaveLength(2)
+    expect(options[1].textContent).toContain('Manual workflow')
+  })
+
+  it('should describe the checkbox for a selection or a single document', async () => {
+    const checkbox = fixture.nativeElement.querySelector('#runWorkflowForce')
+    expect(checkbox.checked).toBe(false)
+    expect(fixture.nativeElement.textContent).toContain(
+      'Run on all selected documents'
+    )
+
+    component.singleDocument = true
+    component.force = true
+    fixture.detectChanges()
+    await fixture.whenStable()
+    fixture.detectChanges()
+    expect(checkbox.checked).toBe(true)
+    expect(fixture.nativeElement.textContent).toContain(
+      'Run on this document regardless of trigger filters'
+    )
+    expect(fixture.nativeElement.textContent).not.toContain(
+      'Run on all selected documents'
+    )
+  })
+})

src-ui/src/app/components/common/confirm-dialog/run-workflow-confirm-dialog/run-workflow-confirm-dialog.component.ts

@@ -0,0 +1,26 @@
+import { Component } from '@angular/core'
+import { FormsModule } from '@angular/forms'
+import { Workflow } from 'src/app/data/workflow'
+import { ConfirmDialogComponent } from '../confirm-dialog.component'
+
+@Component({
+  selector: 'pngx-run-workflow-confirm-dialog',
+  templateUrl: './run-workflow-confirm-dialog.component.html',
+  imports: [FormsModule],
+})
+export class RunWorkflowConfirmDialogComponent extends ConfirmDialogComponent {
+  public workflows: Workflow[] = []
+
+  public workflowId: number = null
+
+  public singleDocument: boolean = false
+
+  // i.e. ignore the workflow's trigger filters
+  public force: boolean = false
+
+  override confirmButtonEnabled = false
+
+  public workflowSelected(): void {
+    this.confirmButtonEnabled = !!this.workflowId
+  }
+}

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html

@@ -164,7 +164,7 @@
           <pngx-input-text i18n-title title="Filter path" formControlName="filter_path" horizontal="true" i18n-hint hint="Apply to documents that match this path. Wildcards specified as * are allowed. Case-normalized." [error]="error?.filter_path"></pngx-input-text>
           <pngx-input-select i18n-title title="Filter mail rule" [items]="mailRules()" horizontal="true" [allowNull]="true" formControlName="filter_mailrule" i18n-hint hint="Apply to documents consumed via this mail rule." [error]="error?.filter_mailrule"></pngx-input-select>
         }
-        @if (formGroup.get('type').value === WorkflowTriggerType.DocumentAdded || formGroup.get('type').value === WorkflowTriggerType.DocumentUpdated || formGroup.get('type').value === WorkflowTriggerType.Scheduled) {
+        @if (formGroup.get('type').value === WorkflowTriggerType.DocumentAdded || formGroup.get('type').value === WorkflowTriggerType.DocumentUpdated || formGroup.get('type').value === WorkflowTriggerType.Scheduled || formGroup.get('type').value === WorkflowTriggerType.Manual) {
           <pngx-input-select i18n-title title="Content matching algorithm" horizontal="true" [items]="getMatchingAlgorithms()" formControlName="matching_algorithm"></pngx-input-select>
           @if (matchingPatternRequired(formGroup)) {
             <pngx-input-text i18n-title title="Content matching pattern" horizontal="true" formControlName="match" [error]="error?.match"></pngx-input-text>
@@ -175,7 +175,7 @@
         }
       </div>
     </div>
-    @if (formGroup.get('type').value === WorkflowTriggerType.DocumentAdded || formGroup.get('type').value === WorkflowTriggerType.DocumentUpdated || formGroup.get('type').value === WorkflowTriggerType.Scheduled) {
+    @if (formGroup.get('type').value === WorkflowTriggerType.DocumentAdded || formGroup.get('type').value === WorkflowTriggerType.DocumentUpdated || formGroup.get('type').value === WorkflowTriggerType.Scheduled || formGroup.get('type').value === WorkflowTriggerType.Manual) {
       <div class="row mt-3">
         <div class="col">
           <div class="trigger-filters mb-3">

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts

@@ -123,6 +123,10 @@ export const WORKFLOW_TYPE_OPTIONS = [
     id: WorkflowTriggerType.Scheduled,
     name: $localize`Scheduled`,
   },
+  {
+    id: WorkflowTriggerType.Manual,
+    name: $localize`Manual`,
+  },
 ]
 
 export const WORKFLOW_ACTION_OPTIONS = [

src-ui/src/app/components/document-detail/document-detail.component.html

@@ -49,6 +49,12 @@
         <pngx-bs-icon width="1em" height="1em" name="arrow-counterclockwise" class="me-2"></pngx-bs-icon><span i18n>Reprocess</span>
       </button>
 
+      @if (manualWorkflows().length > 0) {
+        <button ngbDropdownItem (click)="runWorkflow()" [disabled]="!userCanEdit || !userIsOwner">
+          <pngx-bs-icon width="1em" height="1em" name="play-circle" class="me-2"></pngx-bs-icon><span i18n>Run workflow</span>
+        </button>
+      }
+
       <button ngbDropdownItem (click)="printDocument()" [hidden]="useNativePdfViewer || isMobile">
         <pngx-bs-icon width="1em" height="1em" name="printer" class="me-2"></pngx-bs-icon><span i18n>Print</span>
       </button>

src-ui/src/app/components/document-detail/document-detail.component.spec.ts

@@ -1030,6 +1030,45 @@ describe('DocumentDetailComponent', () => {
     expect(modalCloseSpy).toHaveBeenCalled()
   })
 
+  it('should run a workflow on the document, confirm and close modal', () => {
+    initNormally()
+    const bulkEditSpy = jest.spyOn(documentService, 'bulkEdit')
+    bulkEditSpy.mockReturnValue(of(true))
+    let openModal: NgbModalRef
+    modalService.activeInstances.subscribe((modal) => (openModal = modal[0]))
+    const toastSpy = jest.spyOn(toastService, 'showInfo')
+    component.runWorkflow()
+    expect(openModal.componentInstance.singleDocument).toBe(true)
+    expect(openModal.componentInstance.force).toBe(true)
+    const modalCloseSpy = jest.spyOn(openModal, 'close')
+    openModal.componentInstance.workflowId = 5
+    openModal.componentInstance.confirmClicked.next()
+    expect(bulkEditSpy).toHaveBeenCalledWith(
+      { documents: [doc.id] },
+      'run_workflow',
+      { workflow: 5, filter_documents: false }
+    )
+    expect(toastSpy).toHaveBeenCalled()
+    expect(modalCloseSpy).toHaveBeenCalled()
+  })
+
+  it('should apply workflow filters when the single-document checkbox is cleared', () => {
+    initNormally()
+    const bulkEditSpy = jest.spyOn(documentService, 'bulkEdit')
+    bulkEditSpy.mockReturnValue(of(true))
+    let openModal: NgbModalRef
+    modalService.activeInstances.subscribe((modal) => (openModal = modal[0]))
+    component.runWorkflow()
+    openModal.componentInstance.workflowId = 5
+    openModal.componentInstance.force = false
+    openModal.componentInstance.confirmClicked.next()
+    expect(bulkEditSpy).toHaveBeenCalledWith(
+      { documents: [doc.id] },
+      'run_workflow',
+      { workflow: 5, filter_documents: true }
+    )
+  })
+
   it('should pass remote OCR choice when reprocessing', () => {
     initNormally()
     const reprocessSpy = jest.spyOn(documentService, 'reprocessDocuments')

src-ui/src/app/components/document-detail/document-detail.component.ts

@@ -68,6 +68,8 @@ import { StoragePath } from 'src/app/data/storage-path'
 import { Tag } from 'src/app/data/tag'
 import { SETTINGS_KEYS, SuggestionSource } from 'src/app/data/ui-settings'
 import { User } from 'src/app/data/user'
+import { Workflow } from 'src/app/data/workflow'
+import { WorkflowTriggerType } from 'src/app/data/workflow-trigger'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe'
@@ -93,6 +95,7 @@ import { SavedViewService } from 'src/app/services/rest/saved-view.service'
 import { StoragePathService } from 'src/app/services/rest/storage-path.service'
 import { TagService } from 'src/app/services/rest/tag.service'
 import { UserService } from 'src/app/services/rest/user.service'
+import { WorkflowService } from 'src/app/services/rest/workflow.service'
 import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { TrashService } from 'src/app/services/trash.service'
@@ -104,6 +107,7 @@ import { DocumentDetailFieldID } from '../admin/settings/settings.component'
 import { ConfirmDialogComponent } from '../common/confirm-dialog/confirm-dialog.component'
 import { PasswordRemovalConfirmDialogComponent } from '../common/confirm-dialog/password-removal-confirm-dialog/password-removal-confirm-dialog.component'
 import { ReprocessConfirmDialogComponent } from '../common/confirm-dialog/reprocess-confirm-dialog/reprocess-confirm-dialog.component'
+import { RunWorkflowConfirmDialogComponent } from '../common/confirm-dialog/run-workflow-confirm-dialog/run-workflow-confirm-dialog.component'
 import { CustomFieldsDropdownComponent } from '../common/custom-fields-dropdown/custom-fields-dropdown.component'
 import { CorrespondentEditDialogComponent } from '../common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component'
 import { DocumentTypeEditDialogComponent } from '../common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component'
@@ -233,6 +237,7 @@ export class DocumentDetailComponent
   private componentRouterService = inject(ComponentRouterService)
   private deviceDetectorService = inject(DeviceDetectorService)
   private savedViewService = inject(SavedViewService)
+  private readonly workflowService = inject(WorkflowService)
   private readonly websocketStatusService = inject(WebsocketStatusService)
   private readonly useNativePdfViewerSetting = this.settings.getSignal<boolean>(
     SETTINGS_KEYS.USE_NATIVE_PDF_VIEWER
@@ -295,6 +300,7 @@ export class DocumentDetailComponent
   readonly correspondents = signal<Correspondent[]>(undefined)
   readonly documentTypes = signal<DocumentType[]>(undefined)
   readonly storagePaths = signal<StoragePath[]>(undefined)
+  readonly manualWorkflows = signal<Workflow[]>([])
 
   documentForm: FormGroup = new FormGroup({
     title: new FormControl(''),
@@ -836,6 +842,20 @@ export class DocumentDetailComponent
         .pipe(first(), takeUntil(this.unsubscribeNotifier))
         .subscribe((result) => this.users.set(result.results))
     }
+    if (
+      this.permissionsService.currentUserCan(
+        PermissionAction.View,
+        PermissionType.Workflow
+      )
+    ) {
+      this.workflowService
+        .list(1, 100000, null, null, {
+          trigger_type: WorkflowTriggerType.Manual,
+          enabled: true,
+        })
+        .pipe(first(), takeUntil(this.unsubscribeNotifier))
+        .subscribe((result) => this.manualWorkflows.set(result.results))
+    }
 
     this.getCustomFields()
 
@@ -1559,6 +1579,41 @@ export class DocumentDetailComponent
     })
   }
 
+  runWorkflow() {
+    const modal = this.modalService.open(RunWorkflowConfirmDialogComponent, {
+      backdrop: 'static',
+    })
+    modal.componentInstance.title = $localize`Run workflow`
+    modal.componentInstance.message = $localize`Run a workflow on "${this.document().title}".`
+    modal.componentInstance.btnCaption = $localize`Run`
+    modal.componentInstance.workflows = this.manualWorkflows()
+    modal.componentInstance.singleDocument = true
+    modal.componentInstance.force = true
+    modal.componentInstance.confirmClicked.subscribe(() => {
+      modal.componentInstance.buttonsEnabled.set(false)
+      this.documentsService
+        .bulkEdit({ documents: [this.document().id] }, 'run_workflow', {
+          workflow: modal.componentInstance.workflowId,
+          filter_documents: !modal.componentInstance.force,
+        })
+        .subscribe({
+          next: () => {
+            this.toastService.showInfo(
+              $localize`Workflow will run on "${this.document().title}" in the background.`
+            )
+            modal.close()
+          },
+          error: (error) => {
+            modal.componentInstance.buttonsEnabled.set(true)
+            this.toastService.showError(
+              $localize`Error executing operation`,
+              error
+            )
+          },
+        })
+    })
+  }
+
   private getSelectedNonLatestVersionId(): number | null {
     const versions = this.document()?.versions ?? []
     if (!versions.length || !this.selectedVersionId()) {

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.html

@@ -98,6 +98,11 @@
           <button ngbDropdownItem (click)="mergeSelectedAsVersions()" [disabled]="!userOwnsAll || !userCanEditAll || !userCanDelete || list.allSelected || list.selectedCount < 2">
             <pngx-bs-icon name="journal-bookmark-fill" class="me-2"></pngx-bs-icon><ng-container i18n>Merge as versions</ng-container>
           </button>
+          @if (manualWorkflows.length > 0) {
+            <button ngbDropdownItem (click)="runWorkflowSelected()" [disabled]="!canRunWorkflow">
+              <pngx-bs-icon name="play-circle" class="me-2"></pngx-bs-icon><ng-container i18n>Run workflow</ng-container>
+            </button>
+          }
         </div>
       </div>
     </div>

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.spec.ts

@@ -17,6 +17,7 @@ import { FILTER_TITLE } from 'src/app/data/filter-rule-type'
 import { Results } from 'src/app/data/results'
 import { StoragePath } from 'src/app/data/storage-path'
 import { Tag } from 'src/app/data/tag'
+import { WorkflowTriggerType } from 'src/app/data/workflow-trigger'
 import { FilterPipe } from 'src/app/pipes/filter.pipe'
 import { DocumentListViewService } from 'src/app/services/document-list-view.service'
 import {
@@ -36,6 +37,7 @@ import { ShareLinkBundleService } from 'src/app/services/rest/share-link-bundle.
 import { StoragePathService } from 'src/app/services/rest/storage-path.service'
 import { TagService } from 'src/app/services/rest/tag.service'
 import { UserService } from 'src/app/services/rest/user.service'
+import { WorkflowService } from 'src/app/services/rest/workflow.service'
 import { SettingsService } from 'src/app/services/settings.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { TrashService } from 'src/app/services/trash.service'
@@ -83,6 +85,7 @@ describe('BulkEditorComponent', () => {
   let customFieldsService: CustomFieldsService
   let httpTestingController: HttpTestingController
   let shareLinkBundleService: ShareLinkBundleService
+  let workflowService: WorkflowService
   let router: Router
 
   beforeEach(async () => {
@@ -173,6 +176,22 @@ describe('BulkEditorComponent', () => {
             delete: jest.fn(),
           },
         },
+        {
+          provide: WorkflowService,
+          useValue: {
+            list: jest.fn(() =>
+              of({
+                results: [
+                  {
+                    id: 5,
+                    name: 'Manual workflow',
+                    triggers: [{ type: WorkflowTriggerType.Manual }],
+                  },
+                ],
+              })
+            ),
+          },
+        },
         {
           provide: Router,
           useValue: { navigate: jest.fn().mockResolvedValue(true) },
@@ -195,6 +214,7 @@ describe('BulkEditorComponent', () => {
     customFieldsService = TestBed.inject(CustomFieldsService)
     httpTestingController = TestBed.inject(HttpTestingController)
     shareLinkBundleService = TestBed.inject(ShareLinkBundleService)
+    workflowService = TestBed.inject(WorkflowService)
     router = TestBed.inject(Router)
 
     fixture = TestBed.createComponent(BulkEditorComponent)
@@ -654,6 +674,81 @@ describe('BulkEditorComponent', () => {
     )
   })
 
+  it('should load manual workflows on init', () => {
+    jest.spyOn(permissionsService, 'currentUserCan').mockReturnValue(true)
+    fixture.detectChanges()
+    expect(workflowService.list).toHaveBeenCalledWith(1, 100000, null, null, {
+      trigger_type: WorkflowTriggerType.Manual,
+      enabled: true,
+    })
+    expect(component.manualWorkflows).toHaveLength(1)
+    expect(component.manualWorkflows[0].id).toEqual(5)
+  })
+
+  it('should run a workflow on the selection via the run workflow dialog', () => {
+    const toast = jest.spyOn(toastService, 'show')
+    const infoToast = jest.spyOn(toastService, 'showInfo')
+    let modal: NgbModalRef
+    modalService.activeInstances.subscribe((m) => (modal = m[0]))
+    jest.spyOn(permissionsService, 'currentUserCan').mockReturnValue(true)
+    jest
+      .spyOn(documentListViewService, 'documents', 'get')
+      .mockReturnValue([{ id: 3 }, { id: 4 }])
+    jest
+      .spyOn(documentListViewService, 'selected', 'get')
+      .mockReturnValue(new Set([3, 4]))
+    fixture.detectChanges()
+    component.runWorkflowSelected()
+    expect(modal).not.toBeUndefined()
+    expect(modal.componentInstance.workflows).toEqual(component.manualWorkflows)
+    expect(modal.componentInstance.singleDocument).toBe(false)
+    expect(modal.componentInstance.force).toBe(false)
+    modal.componentInstance.workflowId = 5
+    modal.componentInstance.force = true
+    modal.componentInstance.confirm()
+    const req = httpTestingController.expectOne(
+      `${environment.apiBaseUrl}documents/bulk_edit/`
+    )
+    expect(req.request.body.method).toEqual('run_workflow')
+    expect(req.request.body.parameters).toEqual({
+      workflow: 5,
+      filter_documents: false,
+    })
+    req.flush({ result: 'OK' })
+    expect(infoToast).toHaveBeenCalledWith(
+      'Workflow will run on the selected documents in the background.'
+    )
+    expect(toast.mock.calls.at(-1)[0].actionName).toBeUndefined()
+    expect(documentListViewService.selected.size).toBe(0)
+    httpTestingController.match(
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
+    ) // list reload
+    httpTestingController.match(
+      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
+    ) // listAllFilteredIds
+  })
+
+  it('should require ownership of selected documents to run a workflow', () => {
+    component.manualWorkflows = [{ id: 5 }] as any
+    jest.spyOn(permissionsService, 'currentUserCan').mockReturnValue(true)
+    jest
+      .spyOn(permissionsService, 'currentUserHasObjectPermissions')
+      .mockReturnValue(true)
+    const ownsDocument = jest
+      .spyOn(permissionsService, 'currentUserOwnsObject')
+      .mockReturnValue(false)
+    jest
+      .spyOn(documentListViewService, 'documents', 'get')
+      .mockReturnValue([{ id: 3 }])
+    jest
+      .spyOn(documentListViewService, 'selected', 'get')
+      .mockReturnValue(new Set([3]))
+
+    expect(component.canRunWorkflow).toBe(false)
+    ownsDocument.mockReturnValue(true)
+    expect(component.canRunWorkflow).toBe(true)
+  })
+
   it('should set modal dialog text accordingly for tag edit confirmation', () => {
     let modal: NgbModalRef
     modalService.activeInstances.subscribe((m) => (modal = m[m.length - 1]))

src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.ts

@@ -34,6 +34,7 @@ import { CustomField } from 'src/app/data/custom-field'
 import { MatchingModel } from 'src/app/data/matching-model'
 import { SelectionDataItem } from 'src/app/data/results'
 import { SETTINGS_KEYS } from 'src/app/data/ui-settings'
+import { Workflow } from 'src/app/data/workflow'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { DocumentListViewService } from 'src/app/services/document-list-view.service'
 import { OpenDocumentsService } from 'src/app/services/open-documents.service'
@@ -53,6 +54,7 @@ import {
 } from 'src/app/services/rest/document.service'
 import { SavedViewService } from 'src/app/services/rest/saved-view.service'
 import { ShareLinkBundleService } from 'src/app/services/rest/share-link-bundle.service'
+import { WorkflowService } from 'src/app/services/rest/workflow.service'
 import { StoragePathService } from 'src/app/services/rest/storage-path.service'
 import { TagService } from 'src/app/services/rest/tag.service'
 import { SettingsService } from 'src/app/services/settings.service'
@@ -64,6 +66,7 @@ import { MergeAsVersionsConfirmDialogComponent } from '../../common/confirm-dial
 import { MergeConfirmDialogComponent } from '../../common/confirm-dialog/merge-confirm-dialog/merge-confirm-dialog.component'
 import { ReprocessConfirmDialogComponent } from '../../common/confirm-dialog/reprocess-confirm-dialog/reprocess-confirm-dialog.component'
 import { RotateConfirmDialogComponent } from '../../common/confirm-dialog/rotate-confirm-dialog/rotate-confirm-dialog.component'
+import { RunWorkflowConfirmDialogComponent } from '../../common/confirm-dialog/run-workflow-confirm-dialog/run-workflow-confirm-dialog.component'
 import { CorrespondentEditDialogComponent } from '../../common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component'
 import { CustomFieldEditDialogComponent } from '../../common/edit-dialog/custom-field-edit-dialog/custom-field-edit-dialog.component'
 import { DocumentTypeEditDialogComponent } from '../../common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component'
@@ -81,6 +84,7 @@ import { PermissionsDialogComponent } from '../../common/permissions-dialog/perm
 import { ShareLinkBundleDialogComponent } from '../../common/share-link-bundle-dialog/share-link-bundle-dialog.component'
 import { ComponentWithPermissions } from '../../with-permissions/with-permissions.component'
 import { CustomFieldsBulkEditDialogComponent } from './custom-fields-bulk-edit-dialog/custom-fields-bulk-edit-dialog.component'
+import { WorkflowTriggerType } from 'src/app/data/workflow-trigger'
 
 @Component({
   selector: 'pngx-bulk-editor',
@@ -114,8 +118,11 @@ export class BulkEditorComponent
   public readonly permissionService = inject(PermissionsService)
   private savedViewService = inject(SavedViewService)
   private readonly shareLinkBundleService = inject(ShareLinkBundleService)
+  private readonly workflowService = inject(WorkflowService)
   private readonly router = inject(Router)
 
+  public manualWorkflows: Workflow[] = []
+
   tagSelectionModel = new FilterableDropdownSelectionModel(true)
   correspondentSelectionModel = new FilterableDropdownSelectionModel()
   documentTypeSelectionModel = new FilterableDropdownSelectionModel()
@@ -258,6 +265,20 @@ export class BulkEditorComponent
           (result) => (this.customFieldsSelectionModel.items = result.results)
         )
     }
+    if (
+      this.permissionService.currentUserCan(
+        PermissionAction.View,
+        PermissionType.Workflow
+      )
+    ) {
+      this.workflowService
+        .list(1, 100000, null, null, {
+          trigger_type: WorkflowTriggerType.Manual,
+          enabled: true,
+        })
+        .pipe(first())
+        .subscribe((result) => (this.manualWorkflows = result.results))
+    }
 
     this.downloadForm
       .get('downloadFileTypeArchive')
@@ -286,6 +307,43 @@ export class BulkEditorComponent
     this.unsubscribeNotifier.complete()
   }
 
+  get canRunWorkflow(): boolean {
+    return (
+      this.userCanEditAll && this.userOwnsAll && this.manualWorkflows.length > 0
+    )
+  }
+
+  runWorkflowSelected() {
+    const modal = this.modalService.open(RunWorkflowConfirmDialogComponent, {
+      backdrop: 'static',
+    })
+    modal.componentInstance.title = $localize`Run workflow`
+    modal.componentInstance.message = $localize`Run a workflow on ${this.getSelectionSize()} selected document(s).`
+    modal.componentInstance.btnCaption = $localize`Run`
+    modal.componentInstance.workflows = this.manualWorkflows
+    modal.componentInstance.confirmClicked
+      .pipe(takeUntil(this.unsubscribeNotifier))
+      .subscribe(() => {
+        modal.componentInstance.buttonsEnabled.set(false)
+        this.documentService
+          .bulkEdit(this.getSelectionQuery(), 'run_workflow', {
+            workflow: modal.componentInstance.workflowId,
+            filter_documents: !modal.componentInstance.force,
+          })
+          .pipe(first())
+          .subscribe({
+            next: () => {
+              modal.close()
+              this.list.selectNone()
+              this.toastService.showInfo(
+                $localize`Workflow will run on the selected documents in the background.`
+              )
+            },
+            error: (error) => this.handleOperationError(modal, error),
+          })
+      })
+  }
+
   private executeBulkEditMethod(
     modal: NgbModalRef,
     method: DocumentBulkEditMethod,

src-ui/src/app/components/document-notes/document-notes.component.html

@@ -2,26 +2,47 @@
   <div>
     <form [formGroup]="noteForm" class="needs-validation mt-3" *pngxIfPermissions="{ action: PermissionAction.Add, type: PermissionType.Note }" novalidate>
       <div class="form-group">
-        <textarea class="form-control form-control-sm" [class.is-invalid]="newNoteError" rows="3" formControlName="newNote" placeholder="Enter note" i18n-placeholder (keydown)="noteFormKeydown($event)" required></textarea>
+        <textarea class="form-control form-control-sm" [class.is-invalid]="newNoteError" [class.d-none]="noteView() !== NoteViewMode.Edit" [attr.aria-invalid]="newNoteError" aria-label="Note" i18n-aria-label aria-describedby="noteFeedback" rows="3" formControlName="newNote" placeholder="Enter note (Markdown is supported)" i18n-placeholder (keydown)="noteFormKeydown($event)" required></textarea>
-        <div class="invalid-feedback" i18n>
+        @if (noteView() === NoteViewMode.Preview) {
+          <section class="form-control form-control-sm note-preview" aria-label="Note preview" i18n-aria-label>
+            @if (noteForm.get('newNote').value) {
+              <div class="note-markdown text-break text-wrap" [innerHTML]="noteForm.get('newNote').value | markdown"></div>
+            } @else {
+              <span class="text-muted" i18n>Nothing to preview</span>
+            }
+          </section>
+        }
+        <div id="noteFeedback" class="invalid-feedback" i18n>
           Please enter a note.
         </div>
       </div>
-      <div class="form-group mt-2 d-flex justify-content-end align-items-center">
+      <div class="form-group mt-2 d-flex justify-content-between align-items-center">
         @if (networkActive()) {
           <div class="spinner-border spinner-border-sm fw-normal me-auto" role="status"></div>
         }
+        <fieldset class="btn-group btn-group-sm" aria-label="Note input mode" i18n-aria-label>
+          <input type="radio" class="btn-check" id="noteViewEdit" name="noteViewMode" [checked]="noteView() === NoteViewMode.Edit" (change)="noteView.set(NoteViewMode.Edit)">
+          <label class="btn btn-outline-secondary" for="noteViewEdit" i18n>Edit</label>
+          <input type="radio" class="btn-check" id="noteViewPreview" name="noteViewMode" [checked]="noteView() === NoteViewMode.Preview" (change)="noteView.set(NoteViewMode.Preview)">
+          <label class="btn btn-outline-secondary" for="noteViewPreview" i18n>Preview</label>
+        </fieldset>
         <button type="button" class="btn btn-primary btn-sm" [disabled]="networkActive() || addDisabled()" (click)="addNote()" i18n>Add note</button>
       </div>
     </form>
     <hr>
-      @for (note of notes(); track note) {
+      @for (note of notes(); track note.id) {
         <div class="card border mb-3">
           <div class="card-body text-dark">
+            @if (note.format === NoteFormat.Markdown) {
+              <div class="card-text note-markdown text-break text-wrap" [innerHTML]="note.note | markdown"></div>
+            } @else {
               <p class="card-text">{{note.note}}</p>
+            }
           </div>
           <div class="d-flex card-footer small bg-light text-primary justify-content-between align-items-center">
-            <span>{{displayName(note)}} - {{ note.created | customDate}}</span>
+            <span>
+              {{displayName(note)}} - {{ note.created | customDate}}
+            </span>
             <button type="button" class="btn btn-link btn-sm p-0 fade" title="Delete note" i18n-title (click)="deleteNote(note.id)" *pngxIfPermissions="{ action: PermissionAction.Delete, type: PermissionType.Note }">
               <pngx-bs-icon name="trash"></pngx-bs-icon>
               <span class="visually-hidden" i18n>Delete note</span>

src-ui/src/app/components/document-notes/document-notes.component.scss

@@ -5,3 +5,45 @@
 .card:hover .fade {
     opacity: 1;
 }
+
+.note-preview {
+  min-height: calc(1.5em * 3 + 0.5rem + var(--bs-border-width) * 2); // textfield height with 3 rows
+}
+
+.note-markdown ::ng-deep {
+  h1, h2, h3, h4, h5, h6 {
+    font-size: 1em;
+    font-weight: bold;
+  }
+
+  h1 { font-size: 1.25em; }
+  h2 { font-size: 1.15em; }
+  h3 { font-size: 1.05em; }
+
+  table {
+    margin-bottom: 1rem;
+    display: block;
+    overflow-x: auto;
+  }
+
+  th, td {
+    padding: 0.15rem 0.4rem;
+    border: 1px solid var(--bs-border-color);
+  }
+
+  pre {
+    padding: 0.5rem;
+    background-color: var(--bs-tertiary-bg);
+    border-radius: var(--bs-border-radius);
+  }
+
+  blockquote {
+    padding-left: 0.75rem;
+    border-left: 0.25rem solid var(--bs-border-color);
+    color: var(--bs-secondary-color);
+  }
+
+  > :last-child {
+    margin-bottom: 0;
+  }
+}

src-ui/src/app/components/document-notes/document-notes.component.spec.ts

@@ -5,7 +5,7 @@ import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { By } from '@angular/platform-browser'
 import { of, throwError } from 'rxjs'
-import { DocumentNote } from 'src/app/data/document-note'
+import { DocumentNote, NoteFormat } from 'src/app/data/document-note'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
 import { PermissionsService } from 'src/app/services/permissions.service'
@@ -129,6 +129,66 @@ describe('DocumentNotesComponent', () => {
     expect(fixture.debugElement.nativeElement.textContent).toContain('user3')
   })
 
+  it('should render notes according to their format', () => {
+    component.notes.set([
+      { id: 31, note: '**x**', format: NoteFormat.Markdown },
+      {
+        id: 32,
+        note: '<script>alert(1)</script>',
+        format: NoteFormat.Markdown,
+      },
+      { id: 33, note: '**x**', format: NoteFormat.Plain },
+    ])
+    fixture.detectChanges()
+
+    const noteCards = fixture.debugElement.queryAll(By.css('.card-text'))
+    expect(noteCards[0].query(By.css('strong')).nativeElement.textContent).toBe(
+      'x'
+    )
+    expect(noteCards[1].query(By.css('script'))).toBeNull()
+    expect(noteCards[2].query(By.css('strong'))).toBeNull()
+    expect(noteCards[2].nativeElement.textContent).toBe('**x**')
+  })
+
+  it('should toggle between edit and preview', () => {
+    const radios = fixture.debugElement.queryAll(
+      By.css('.btn-group input[type="radio"]')
+    )
+    radios[1].triggerEventHandler('change')
+    fixture.detectChanges()
+    expect(
+      fixture.debugElement.query(By.css('.note-preview')).nativeElement
+        .textContent
+    ).toContain('Nothing to preview')
+
+    component.noteForm.get('newNote').setValue('**bold**')
+    fixture.detectChanges()
+    expect(
+      fixture.debugElement.query(By.css('.note-preview strong'))
+    ).not.toBeNull()
+    expect(
+      fixture.debugElement.query(By.css('textarea')).nativeElement.classList
+    ).toContain('d-none')
+
+    radios[0].triggerEventHandler('change')
+    fixture.detectChanges()
+    expect(fixture.debugElement.query(By.css('.note-preview'))).toBeNull()
+    expect(
+      fixture.debugElement.query(By.css('textarea')).nativeElement.classList
+    ).not.toContain('d-none')
+  })
+
+  it('should return to edit mode after saving', () => {
+    component.documentId.set(12)
+    component.noteForm.get('newNote').setValue('Preview note')
+    fixture.debugElement
+      .queryAll(By.css('.btn-group input[type="radio"]'))[1]
+      .triggerEventHandler('change')
+    jest.spyOn(notesService, 'addNote').mockReturnValueOnce(of(notes))
+    component.addNote()
+    expect(component.noteView()).toBe('edit')
+  })
+
   it('should handle note user display in all situations', () => {
     expect(
       component.displayName({
@@ -161,7 +221,7 @@ describe('DocumentNotesComponent', () => {
     const addSpy = jest.spyOn(notesService, 'addNote')
     addSpy.mockReturnValueOnce(throwError(() => new Error('error saving note')))
     const toastsSpy = jest.spyOn(toastService, 'showError')
-    const addButton = fixture.debugElement.query(By.css('button'))
+    const addButton = fixture.debugElement.query(By.css('.btn-primary'))
     addButton.triggerEventHandler('click')
     expect(addSpy).toHaveBeenCalledWith(12, note)
     expect(toastsSpy).toHaveBeenCalled()
@@ -190,7 +250,9 @@ describe('DocumentNotesComponent', () => {
     component.documentId.set(12)
     component.notes.set(notes)
     fixture.detectChanges()
-    const deleteButton = fixture.debugElement.queryAll(By.css('button'))[1] // 0 is add button
+    const deleteButton = fixture.debugElement.query(
+      By.css('.card-footer button')
+    )
     const deleteSpy = jest.spyOn(notesService, 'deleteNote')
     const toastsSpy = jest.spyOn(toastService, 'showError')
     deleteSpy.mockReturnValueOnce(

src-ui/src/app/components/document-notes/document-notes.component.ts

@@ -14,15 +14,21 @@ import {
   ReactiveFormsModule,
 } from '@angular/forms'
 import { BootstrapIconComponent } from 'src/app/components/common/bootstrap-icon/bootstrap-icon.component'
-import { DocumentNote } from 'src/app/data/document-note'
+import { DocumentNote, NoteFormat } from 'src/app/data/document-note'
 import { User } from 'src/app/data/user'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe'
+import { MarkdownPipe } from 'src/app/pipes/markdown.pipe'
 import { DocumentNotesService } from 'src/app/services/rest/document-notes.service'
 import { UserService } from 'src/app/services/rest/user.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { ComponentWithPermissions } from '../with-permissions/with-permissions.component'
 
+enum NoteViewMode {
+  Edit = 'edit',
+  Preview = 'preview',
+}
+
 @Component({
   selector: 'pngx-document-notes',
   templateUrl: './document-notes.component.html',
@@ -30,6 +36,7 @@ import { ComponentWithPermissions } from '../with-permissions/with-permissions.c
   imports: [
     IfPermissionsDirective,
     CustomDatePipe,
+    MarkdownPipe,
     FormsModule,
     ReactiveFormsModule,
     BootstrapIconComponent,
@@ -43,6 +50,9 @@ export class DocumentNotesComponent extends ComponentWithPermissions {
   readonly notes = model<DocumentNote[]>([])
   readonly addDisabled = input(false)
   readonly networkActive = signal(false)
+  protected readonly NoteViewMode = NoteViewMode
+  protected readonly NoteFormat = NoteFormat
+  protected readonly noteView = signal<NoteViewMode>(NoteViewMode.Edit)
 
   noteForm: FormGroup = new FormGroup({
     newNote: new FormControl(''),
@@ -75,6 +85,7 @@ export class DocumentNotesComponent extends ComponentWithPermissions {
       next: (result) => {
         this.notes.set(result)
         this.noteForm.get('newNote').reset()
+        this.noteView.set(NoteViewMode.Edit)
         this.networkActive.set(false)
         this.updated.emit(this.notes())
       },

src-ui/src/app/data/document-note.ts

@@ -1,8 +1,14 @@
 import { ObjectWithId } from './object-with-id'
 import { User } from './user'
 
+export enum NoteFormat {
+  Plain = 'plain',
+  Markdown = 'markdown',
+}
+
 export interface DocumentNote extends ObjectWithId {
   created?: Date
   note?: string
   user?: User
+  format?: NoteFormat
 }

src-ui/src/app/data/workflow-trigger.ts

@@ -12,6 +12,7 @@ export enum WorkflowTriggerType {
   DocumentAdded = 2,
   DocumentUpdated = 3,
   Scheduled = 4,
+  Manual = 5,
 }
 
 export enum ScheduleDateField {

src-ui/src/app/services/rest/document-notes.service.spec.ts

@@ -1,6 +1,7 @@
 import { HttpTestingController } from '@angular/common/http/testing'
 import { TestBed } from '@angular/core/testing'
 import { Subscription } from 'rxjs'
+import { NoteFormat } from 'src/app/data/document-note'
 import { environment } from 'src/environments/environment'
 import { commonAbstractPaperlessServiceTests } from './abstract-paperless-service.spec'
 import { DocumentNotesService } from './document-notes.service'
@@ -50,6 +51,7 @@ describe(`Additional service tests for DocumentNotesService`, () => {
     expect(req.request.method).toEqual('POST')
     expect(req.request.body).toEqual({
       note: content,
+      format: NoteFormat.Markdown,
     })
   })
 

src-ui/src/app/services/rest/document-notes.service.ts

@@ -1,7 +1,7 @@
 import { HttpParams } from '@angular/common/http'
 import { Injectable } from '@angular/core'
 import { Observable } from 'rxjs'
-import { DocumentNote } from 'src/app/data/document-note'
+import { DocumentNote, NoteFormat } from 'src/app/data/document-note'
 import { AbstractPaperlessService } from './abstract-paperless-service'
 
 @Injectable({
@@ -22,6 +22,7 @@ export class DocumentNotesService extends AbstractPaperlessService<DocumentNote>
   addNote(id: number, note: string): Observable<DocumentNote[]> {
     return this.http.post<DocumentNote[]>(this.getResourceUrl(id, 'notes'), {
       note: note,
+      format: NoteFormat.Markdown,
     })
   }
 

src-ui/src/app/services/rest/document.service.ts

@@ -39,6 +39,7 @@ export type DocumentBulkEditMethod =
   | 'modify_tags'
   | 'modify_custom_fields'
   | 'set_permissions'
+  | 'run_workflow'
 
 export interface MergeDocumentsRequest {
   metadata_document_id?: number

src/documents/bulk_edit.py

@@ -42,6 +42,7 @@ from documents.plugins.helpers import DocumentsStatusManager
 from documents.tasks import bulk_update_documents
 from documents.tasks import consume_file
 from documents.tasks import remove_document_from_index
+from documents.tasks import run_workflows_for_documents
 from documents.tasks import update_document_content_maybe_archive_file
 from documents.versioning import get_latest_version_for_root
 from documents.versioning import get_root_document
@@ -464,6 +465,25 @@ def reprocess(doc_ids: list[int], *, remote_ocr: bool = False) -> Literal["OK"]:
     return "OK"
 
 
+def run_workflow(
+    doc_ids: list[int],
+    workflow: int,
+    *,
+    filter_documents: bool = True,
+) -> Literal["OK"]:
+    """
+    Manually run a single workflow against the given documents.
+
+    Done asynchronously via a Celery task.
+    """
+    run_workflows_for_documents.delay(
+        document_ids=doc_ids,
+        workflow_id=workflow,
+        filter_documents=filter_documents,
+    )
+    return "OK"
+
+
 def set_permissions(
     doc_ids: list[int],
     set_permissions: PermissionsSpec,

src/documents/filters.py

@@ -35,6 +35,7 @@ from django_filters.rest_framework import DateTimeFilter
 from django_filters.rest_framework import Filter
 from django_filters.rest_framework import FilterSet
 from django_filters.rest_framework import MultipleChoiceFilter
+from django_filters.rest_framework import NumberFilter
 from drf_spectacular.utils import extend_schema_field
 from guardian.utils import get_group_obj_perms_model
 from guardian.utils import get_user_obj_perms_model
@@ -52,6 +53,7 @@ from documents.models import ShareLink
 from documents.models import ShareLinkBundle
 from documents.models import StoragePath
 from documents.models import Tag
+from documents.models import Workflow
 from documents.permissions import annotate_authorizing_fields
 from documents.permissions import permitted_document_ids
 from documents.permissions import permitted_object_ids
@@ -249,6 +251,17 @@ class CustomFieldFilterSet(FilterSet):
         }
 
 
+class WorkflowFilterSet(FilterSet):
+    trigger_type = NumberFilter(field_name="triggers__type", distinct=True)
+
+    class Meta:
+        model = Workflow
+        fields = {
+            "id": ID_KWARGS,
+            "enabled": ["exact"],
+        }
+
+
 @extend_schema_field(serializers.CharField)
 class CustomFieldsFilter(Filter):
     def filter(self, qs, value):

src/documents/matching.py

@@ -684,6 +684,7 @@ def document_matches_workflow(
                 trigger_type == WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED
                 or trigger_type == WorkflowTrigger.WorkflowTriggerType.DOCUMENT_UPDATED
                 or trigger_type == WorkflowTrigger.WorkflowTriggerType.SCHEDULED
+                or trigger_type == WorkflowTrigger.WorkflowTriggerType.MANUAL
             ):
                 trigger_matched, reason = existing_document_matches_workflow(
                     document,

src/documents/migrations/0029_alter_workflowrun_type_alter_workflowtrigger_type.py

@@ -0,0 +1,43 @@
+# Generated by Django 5.2.18 on 2026-11-06 17:12
+
+from django.db import migrations
+from django.db import models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("documents", "0028_replace_tag_tree_fields"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="workflowrun",
+            name="type",
+            field=models.PositiveSmallIntegerField(
+                choices=[
+                    (1, "Consumption Started"),
+                    (2, "Document Added"),
+                    (3, "Document Updated"),
+                    (4, "Scheduled"),
+                    (5, "Manual"),
+                ],
+                null=True,
+                verbose_name="workflow trigger type",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="workflowtrigger",
+            name="type",
+            field=models.PositiveSmallIntegerField(
+                choices=[
+                    (1, "Consumption Started"),
+                    (2, "Document Added"),
+                    (3, "Document Updated"),
+                    (4, "Scheduled"),
+                    (5, "Manual"),
+                ],
+                default=1,
+                verbose_name="Workflow Trigger Type",
+            ),
+        ),
+    ]

src/documents/migrations/0030_note_format.py

@@ -0,0 +1,23 @@
+# Generated by Django 5.2.17 on 2026-11-03 05:57
+
+from django.db import migrations
+from django.db import models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("documents", "0029_alter_workflowrun_type_alter_workflowtrigger_type"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="note",
+            name="format",
+            field=models.CharField(
+                choices=[("plain", "Plain"), ("markdown", "Markdown")],
+                default="plain",
+                max_length=16,
+                verbose_name="format",
+            ),
+        ),
+    ]

src/documents/models.py

@@ -1006,12 +1006,23 @@ class PaperlessTask(ModelWithOwner):
 
 
 class Note(SoftDeleteModel):
+    class Format(models.TextChoices):
+        PLAIN = ("plain", _("Plain"))
+        MARKDOWN = ("markdown", _("Markdown"))
+
     note = models.TextField(
         _("content"),
         blank=True,
         help_text=_("Note for the document"),
     )
 
+    format = models.CharField(
+        max_length=16,
+        choices=Format,
+        default=Format.PLAIN,
+        verbose_name=_("format"),
+    )
+
     created = models.DateTimeField(
         _("created"),
         default=timezone.now,
@@ -1532,6 +1543,7 @@ class WorkflowTrigger(models.Model):
         DOCUMENT_ADDED = 2, _("Document Added")
         DOCUMENT_UPDATED = 3, _("Document Updated")
         SCHEDULED = 4, _("Scheduled")
+        MANUAL = 5, _("Manual")
 
     class DocumentSourceChoices(models.IntegerChoices):
         CONSUME_FOLDER = DocumentSource.ConsumeFolder.value, _("Consume Folder")

src/documents/permissions.py

@@ -789,6 +789,7 @@ def has_document_operation_permissions(
                 bulk_edit.edit_pdf,
                 bulk_edit.merge_as_versions,
                 bulk_edit.remove_password,
+                bulk_edit.run_workflow,
             ]
         )
         or (

src/documents/serialisers.py

@@ -971,10 +971,19 @@ class NotesSerializer(serializers.ModelSerializer[Note]):
 
     class Meta:
         model = Note
-        fields = ["id", "note", "created", "user"]
+        fields = ["id", "note", "format", "created", "user"]
         ordering = ["-created"]
 
 
+class NoteCreateSerializer(serializers.Serializer[dict[str, Any]]):
+    note = serializers.CharField()
+    format = serializers.ChoiceField(
+        choices=Note.Format.choices,
+        default=Note.Format.PLAIN,
+        required=False,
+    )
+
+
 def _get_viewable_duplicates(
     document: Document,
     user: User | None,
@@ -1829,6 +1838,7 @@ class BulkEditSerializer(
             "modify_tags",
             "modify_custom_fields",
             "set_permissions",
+            "run_workflow",
             *LEGACY_DOCUMENT_ACTION_METHODS,
         ],
         label="Method",
@@ -1918,6 +1928,8 @@ class BulkEditSerializer(
             return bulk_edit.reprocess
         elif method == "set_permissions":
             return bulk_edit.set_permissions
+        elif method == "run_workflow":
+            return bulk_edit.run_workflow
         elif method == "rotate":
             return bulk_edit.rotate
         elif method == "merge":
@@ -2157,6 +2169,35 @@ class BulkEditSerializer(
         else:
             parameters["remote_ocr"] = False
 
+    def _validate_parameters_run_workflow(self, parameters) -> None:
+        if "workflow" not in parameters:
+            raise serializers.ValidationError("workflow not specified")
+        try:
+            workflow = Workflow.objects.get(id=parameters["workflow"])
+        except (Workflow.DoesNotExist, ValueError, TypeError):
+            raise serializers.ValidationError("Workflow does not exist")
+        request = self.context.get("request")
+        user = getattr(request, "user", None)
+        if user is not None and not user.has_perm("documents.view_workflow"):
+            raise PermissionDenied(
+                "Insufficient permissions to run this workflow",
+            )
+        if not workflow.enabled:
+            raise serializers.ValidationError("Workflow is not enabled")
+        if not workflow.triggers.filter(
+            type=WorkflowTrigger.WorkflowTriggerType.MANUAL,
+        ).exists():
+            raise serializers.ValidationError(
+                "Workflow does not have a manual trigger",
+            )
+        if "filter_documents" in parameters:
+            if not isinstance(parameters["filter_documents"], bool):
+                raise serializers.ValidationError(
+                    "filter_documents must be a boolean",
+                )
+        else:
+            parameters["filter_documents"] = True
+
     def validate_parameters_remove_password(self, parameters):
         if "password" not in parameters:
             raise serializers.ValidationError("password not specified")
@@ -2223,6 +2264,8 @@ class BulkEditSerializer(
             self.validate_parameters_remove_password(parameters)
         elif method == bulk_edit.reprocess:
             self._validate_parameters_reprocess(parameters)
+        elif method == bulk_edit.run_workflow:
+            self._validate_parameters_run_workflow(parameters)
 
         return attrs
 

src/documents/signals/handlers.py

@@ -864,6 +864,8 @@ def run_workflows(
     logging_group: uuid.UUID | None = None,
     overrides: DocumentMetadataOverrides | None = None,
     original_file: Path | None = None,
+    *,
+    skip_matching: bool = False,
 ) -> tuple[DocumentMetadataOverrides, str] | None:
     """
     Execute workflows matching a document for the given trigger. When `overrides` is provided
@@ -874,6 +876,10 @@ def run_workflows(
     `document.source_path` (Document) or `document.original_file` (ConsumableDocument).
 
     Passing `workflow_to_run` skips the workflow query (currently only used by scheduled runs).
+
+    Passing `skip_matching` runs the workflow's actions without evaluating its trigger
+    filters against the document. It is only meaningful together with `workflow_to_run`
+    (e.g. a manual run the user has explicitly forced onto the selected documents).
     """
 
     use_overrides = overrides is not None
@@ -923,7 +929,11 @@ def run_workflows(
                 )
                 break
 
-        if matching.document_matches_workflow(document, workflow, trigger_type):
+        if skip_matching or matching.document_matches_workflow(
+            document,
+            workflow,
+            trigger_type,
+        ):
             action: WorkflowAction
             has_move_to_trash_action = False
             for action in workflow.actions.order_by("order", "pk"):

src/documents/tasks.py

@@ -53,6 +53,7 @@ from documents.models import ShareLink
 from documents.models import ShareLinkBundle
 from documents.models import StoragePath
 from documents.models import Tag
+from documents.models import Workflow
 from documents.models import WorkflowRun
 from documents.models import WorkflowTrigger
 from documents.plugins.base import ConsumeTaskPlugin
@@ -691,6 +692,51 @@ def check_scheduled_workflows() -> None:
                         )
 
 
+@shared_task
+def run_workflows_for_documents(
+    document_ids: list[int],
+    workflow_id: int,
+    *,
+    filter_documents: bool = True,
+) -> None:
+    """
+    Run a single workflow manually against the given documents.
+
+    ``filter_documents`` controls whether the workflow's trigger filters are applied.
+    When True, only documents matching the existing filters will have the workflow run.
+    When False, the workflow will be run on all specified documents regardless of the filters.
+    ``
+    """
+    try:
+        workflow = Workflow.objects.get(id=workflow_id)
+    except Workflow.DoesNotExist:
+        logger.warning(
+            f"Manual workflow run requested for missing workflow {workflow_id}",
+        )
+        return
+
+    for document in Document.objects.filter(
+        id__in=document_ids,
+        root_document__isnull=True,
+    ):
+        try:
+            run_workflows(
+                trigger_type=WorkflowTrigger.WorkflowTriggerType.MANUAL,
+                document=document,
+                workflow_to_run=workflow,
+                skip_matching=not filter_documents,
+            )
+            # Manual runs dont send document_updated signal, so ws here to ensure clients are refreshed
+            send_websocket_document_updated(
+                sender=None,
+                document=document,
+            )
+        except Exception:
+            logger.exception(
+                f"Error running workflow {workflow} on document {document.pk}",
+            )
+
+
 def update_document_parent_tags(tag: Tag, new_parent: Tag) -> None:
     """
     When a tag's parent changes, ensure all documents containing the tag also have

src/documents/tests/test_api_bulk_edit.py

@@ -15,7 +15,11 @@ from documents.models import Document
 from documents.models import DocumentType
 from documents.models import StoragePath
 from documents.models import Tag
+from documents.models import Workflow
+from documents.models import WorkflowAction
+from documents.models import WorkflowTrigger
 from paperless_testing.dirs import DirectoriesMixin
+from paperless_testing.factories import DocumentFactory
 from paperless_testing.factories import UserFactory
 from paperless_testing.permissions import grant_all_global
 from paperless_testing.permissions import grant_global
@@ -622,6 +626,112 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
         self.assertEqual(args[0], [self.doc1.id])
         self.assertEqual(kwargs, {"remote_ocr": True})
 
+    def _make_manual_workflow(self) -> Workflow:
+        trigger = WorkflowTrigger.objects.create(
+            type=WorkflowTrigger.WorkflowTriggerType.MANUAL,
+        )
+        action = WorkflowAction.objects.create()
+        workflow = Workflow.objects.create(name="Manual workflow", order=0)
+        workflow.triggers.add(trigger)
+        workflow.actions.add(action)
+        return workflow
+
+    def _run_workflow(self, parameters, documents=None):
+        return self.client.post(
+            "/api/documents/bulk_edit/",
+            json.dumps(
+                {
+                    "documents": documents or [self.doc1.id],
+                    "method": "run_workflow",
+                    "parameters": parameters,
+                },
+            ),
+            content_type="application/json",
+        )
+
+    @mock.patch("documents.views.bulk_edit.run_workflow")
+    def test_run_workflow(self, m) -> None:
+        """A valid run_workflow call passes the docs, workflow id and filter flag through."""
+        self.setup_mock(m, "run_workflow")
+        workflow = self._make_manual_workflow()
+
+        response = self._run_workflow({"workflow": workflow.id})
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        args, kwargs = m.call_args
+        self.assertEqual(args[0], [self.doc1.id])
+        self.assertEqual(kwargs, {"workflow": workflow.id, "filter_documents": True})
+
+        self._run_workflow({"workflow": workflow.id, "filter_documents": False})
+        self.assertFalse(m.call_args.kwargs["filter_documents"])
+
+    @mock.patch("documents.views.bulk_edit.run_workflow")
+    def test_run_workflow_invalid_parameters(self, m) -> None:
+        """Invalid run_workflow parameters are rejected before dispatch."""
+        self.setup_mock(m, "run_workflow")
+        manual = self._make_manual_workflow()
+        non_manual = Workflow.objects.create(name="Non-manual", order=0)
+        non_manual.triggers.add(
+            WorkflowTrigger.objects.create(
+                type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
+            ),
+        )
+        disabled = Workflow.objects.create(
+            name="Disabled manual",
+            order=0,
+            enabled=False,
+        )
+        disabled.triggers.add(
+            WorkflowTrigger.objects.create(
+                type=WorkflowTrigger.WorkflowTriggerType.MANUAL,
+            ),
+        )
+        for label, parameters in (
+            ("missing workflow", {}),
+            ("nonexistent workflow", {"workflow": 9999}),
+            ("no manual trigger", {"workflow": non_manual.id}),
+            ("disabled workflow", {"workflow": disabled.id}),
+            ("non-bool filter", {"workflow": manual.id, "filter_documents": "nope"}),
+        ):
+            with self.subTest(label):
+                response = self._run_workflow(parameters)
+                self.assertEqual(
+                    response.status_code,
+                    status.HTTP_400_BAD_REQUEST,
+                )
+        m.assert_not_called()
+
+    @mock.patch("documents.views.bulk_edit.run_workflow")
+    def test_run_workflow_requires_ownership(self, m) -> None:
+        """A non-owner with change permission cannot run mutating workflow actions."""
+        self.setup_mock(m, "run_workflow")
+        user = UserFactory(username="non_owner")
+        grant_all_global(user)
+        doc = DocumentFactory(owner=UserFactory(username="other"))
+        grant_object(user, doc, "change_document")
+        workflow = self._make_manual_workflow()
+        self.client.force_authenticate(user=user)
+
+        response = self._run_workflow({"workflow": workflow.id}, documents=[doc.id])
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        m.assert_not_called()
+
+    @mock.patch("documents.views.bulk_edit.run_workflow")
+    def test_run_workflow_requires_workflow_permission(self, m) -> None:
+        """Owning the documents is not enough without view_workflow permission."""
+        self.setup_mock(m, "run_workflow")
+        user = UserFactory(username="no_wf_perms")
+        grant_global(user, "change_document")
+        doc = DocumentFactory(owner=user)
+        workflow = self._make_manual_workflow()
+        self.client.force_authenticate(user=user)
+
+        response = self._run_workflow({"workflow": workflow.id}, documents=[doc.id])
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        m.assert_not_called()
+
     @mock.patch("documents.serialisers.bulk_edit.set_storage_path")
     def test_api_set_storage_path(self, m) -> None:
         """

src/documents/tests/test_api_documents.py

@@ -3689,6 +3689,7 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
             {
                 "id": note.id,
                 "note": note.note,
+                "format": Note.Format.PLAIN,
                 "user": {
                     "id": note.user.id,
                     "username": note.user.username,
@@ -3737,11 +3738,64 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
         resp_data = resp_data[0]
 
         self.assertEqual(resp_data["note"], "this is a posted note")
+        self.assertEqual(resp_data["format"], Note.Format.PLAIN)
 
         doc = Document.objects.get(pk=doc.pk)
         # modified was updated to today
         self.assertEqual(doc.modified.day, timezone.now().day)
 
+    def test_create_markdown_note(self) -> None:
+        doc = DocumentFactory(
+            title="test",
+            content="this is a document which will have a markdown note",
+        )
+
+        response = self.client.post(
+            f"/api/documents/{doc.pk}/notes/",
+            data={"note": "**markdown**", "format": Note.Format.MARKDOWN},
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        note = Note.objects.get(document=doc)
+        self.assertEqual(note.format, Note.Format.MARKDOWN)
+
+        response = self.client.get(f"/api/documents/{doc.pk}/notes/", format="json")
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.json()[0]["format"], Note.Format.MARKDOWN)
+
+    def test_create_note_rejects_unsupported_format(self) -> None:
+        doc = DocumentFactory(
+            title="test",
+            content="this is a document which will have a note",
+        )
+
+        response = self.client.post(
+            f"/api/documents/{doc.pk}/notes/",
+            data={"note": "unsupported", "format": "html"},
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("format", response.json())
+        self.assertFalse(Note.objects.filter(document=doc).exists())
+
+    def test_create_note_requires_note(self) -> None:
+        doc = DocumentFactory(
+            title="test",
+            content="this is a document which will have a note",
+        )
+
+        response = self.client.post(
+            f"/api/documents/{doc.pk}/notes/",
+            data={"format": Note.Format.MARKDOWN},
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("note", response.json())
+        self.assertFalse(Note.objects.filter(document=doc).exists())
+
     def test_create_note_only_saves_document_modified_field(self) -> None:
         """
         GIVEN:

src/documents/tests/test_api_workflows.py

@@ -100,6 +100,47 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
             self.action.assign_correspondent.pk,
         )
 
+    def test_api_get_workflows_filter_trigger_type(self) -> None:
+        """
+        GIVEN:
+            - A consumption workflow and a manual workflow
+        WHEN:
+            - Workflows are requested filtered by trigger_type
+        THEN:
+            - Only workflows with a matching trigger are returned
+        """
+        manual_trigger = WorkflowTrigger.objects.create(
+            type=WorkflowTrigger.WorkflowTriggerType.MANUAL,
+        )
+        manual_workflow = Workflow.objects.create(name="Manual", order=1)
+        manual_workflow.triggers.add(manual_trigger)
+
+        response = self.client.get(
+            f"{self.ENDPOINT}?trigger_type={WorkflowTrigger.WorkflowTriggerType.MANUAL}",
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["count"], 1)
+        self.assertEqual(response.data["results"][0]["id"], manual_workflow.id)
+
+    def test_api_get_workflows_filter_enabled(self) -> None:
+        """
+        GIVEN:
+            - An enabled workflow and a disabled workflow
+        WHEN:
+            - Workflows are requested filtered by enabled
+        THEN:
+            - Only enabled workflows are returned
+        """
+        Workflow.objects.create(name="Disabled", order=1, enabled=False)
+
+        response = self.client.get(f"{self.ENDPOINT}?enabled=true", format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["count"], 1)
+        self.assertEqual(response.data["results"][0]["id"], self.workflow.id)
+
     def test_api_get_workflow_actions_ordered(self) -> None:
         """
         GIVEN:

src/documents/tests/test_workflows.py

@@ -2288,6 +2288,83 @@ class TestWorkflows(
         doc.refresh_from_db()
         self.assertEqual(doc.owner, self.user2)
 
+    def _make_manual_workflow(self, *, require_tag: Tag | None = None) -> Workflow:
+        trigger = WorkflowTrigger.objects.create(
+            type=WorkflowTrigger.WorkflowTriggerType.MANUAL,
+        )
+        if require_tag is not None:
+            trigger.filter_has_all_tags.add(require_tag)
+        action = WorkflowAction.objects.create(assign_owner=self.user2)
+        workflow = Workflow.objects.create(name="Manual workflow", order=0)
+        workflow.triggers.add(trigger)
+        workflow.actions.add(action)
+        return workflow
+
+    @mock.patch("documents.tasks.send_websocket_document_updated")
+    def test_manual_workflow_run_applies_and_notifies(self, mock_ws) -> None:
+        """A manual run applies the workflow's actions and pushes a websocket update."""
+        workflow = self._make_manual_workflow()
+        doc = DocumentFactory()
+
+        tasks.run_workflows_for_documents([doc.pk], workflow.pk)
+
+        doc.refresh_from_db()
+        self.assertEqual(doc.owner, self.user2)
+        self.assertEqual(mock_ws.call_args.kwargs["document"].pk, doc.pk)
+
+    def test_manual_workflow_run_respects_filters(self) -> None:
+        """With filter_documents=True, a document failing the trigger filters is skipped."""
+        workflow = self._make_manual_workflow(require_tag=self.t1)
+        doc = DocumentFactory()
+
+        tasks.run_workflows_for_documents([doc.pk], workflow.pk, filter_documents=True)
+
+        doc.refresh_from_db()
+        self.assertIsNone(doc.owner)
+
+    def test_manual_workflow_run_force_ignores_filters(self) -> None:
+        """With filter_documents=False, actions run regardless of the trigger filters."""
+        workflow = self._make_manual_workflow(require_tag=self.t1)
+        doc = DocumentFactory()
+
+        tasks.run_workflows_for_documents([doc.pk], workflow.pk, filter_documents=False)
+
+        doc.refresh_from_db()
+        self.assertEqual(doc.owner, self.user2)
+
+    def test_manual_workflow_run_missing_workflow(self) -> None:
+        """A missing workflow id logs a warning rather than raising."""
+        doc = DocumentFactory()
+        with self.assertLogs("paperless.tasks", level="WARNING"):
+            tasks.run_workflows_for_documents([doc.pk], 9999)
+
+    @mock.patch("documents.tasks.send_websocket_document_updated")
+    @mock.patch("documents.tasks.run_workflows")
+    def test_manual_workflow_run_continues_after_error(
+        self,
+        mock_run_workflows,
+        mock_ws,
+    ) -> None:
+        """A failure on one document does not abort the run for the others."""
+        workflow = self._make_manual_workflow()
+        doc1 = DocumentFactory()
+        doc2 = DocumentFactory()
+
+        def side_effect(*args, document, **kwargs):
+            if document.pk == doc1.pk:
+                raise Exception("boom")
+
+        mock_run_workflows.side_effect = side_effect
+
+        with self.assertLogs("paperless.tasks", level="ERROR"):
+            tasks.run_workflows_for_documents([doc1.pk, doc2.pk], workflow.pk)
+
+        # Both documents were attempted; the websocket update only fired for the
+        # one that did not raise.
+        self.assertEqual(mock_run_workflows.call_count, 2)
+        ws_doc_ids = [c.kwargs["document"].pk for c in mock_ws.call_args_list]
+        self.assertEqual(ws_doc_ids, [doc2.pk])
+
     @mock.patch("documents.tasks.send_websocket_document_updated")
     def test_workflow_scheduled_trigger_sends_websocket_update(
         self,

src/documents/views.py

@@ -146,6 +146,7 @@ from documents.filters import ShareLinkFilterSet
 from documents.filters import StoragePathFilterSet
 from documents.filters import TagFilterSet
 from documents.filters import TitleContentFilter
+from documents.filters import WorkflowFilterSet
 from documents.mail import EmailAttachment
 from documents.mail import send_email
 from documents.matching import match_correspondents
@@ -206,6 +207,7 @@ from documents.serialisers import EditPdfDocumentsSerializer
 from documents.serialisers import EmailSerializer
 from documents.serialisers import MergeDocumentsAsVersionsSerializer
 from documents.serialisers import MergeDocumentsSerializer
+from documents.serialisers import NoteCreateSerializer
 from documents.serialisers import NotesSerializer
 from documents.serialisers import PostDocumentSerializer
 from documents.serialisers import RemovePasswordDocumentsSerializer
@@ -832,12 +834,7 @@ class EmailDocumentDetailSchema(EmailSerializer):
     notes=extend_schema(
         description="View, add, or delete notes for the document",
         methods=["GET", "POST", "DELETE"],
-        request=inline_serializer(
+        request=NoteCreateSerializer,
-            name="NoteCreateRequest",
-            fields={
-                "note": serializers.CharField(),
-            },
-        ),
         parameters=[
             OpenApiParameter(
                 name="id",
@@ -1895,7 +1892,6 @@ class DocumentViewSet(
                     {"error": "Error retrieving notes, check logs for more detail."},
                 )
         elif request.method == "POST":
-            try:
             if currentUser is not None and not has_perms_owner_aware(
                 currentUser,
                 "change_document",
@@ -1905,9 +1901,14 @@ class DocumentViewSet(
                     "Insufficient permissions to create notes",
                 )
 
+            note_serializer = NoteCreateSerializer(data=request.data)
+            note_serializer.is_valid(raise_exception=True)
+
+            try:
                 c = Note.objects.create(
                     document=doc,
-                    note=request.data["note"],
+                    note=note_serializer.validated_data["note"],
+                    format=note_serializer.validated_data["format"],
                     user=currentUser,
                 )
                 # If audit log is enabled make an entry in the log
@@ -3008,6 +3009,100 @@ class DocumentOperationPermissionMixin(PassUserMixin, DocumentSelectionMixin):
         )
         return Response({"result": "OK", "task_id": task.id})
 
+    def _has_document_permissions(
+        self,
+        *,
+        user: User,
+        documents: list[int],
+        method,
+        parameters: dict[str, Any],
+    ) -> bool:
+        if user.is_superuser:
+            return True
+
+        root_docs = {
+            get_root_document(doc)
+            for doc in Document.objects.select_related(
+                "owner",
+                "root_document__owner",
+            ).filter(pk__in=documents)
+        }
+        user_is_owner_of_all_documents = all(
+            (doc.owner == user or doc.owner is None) for doc in root_docs
+        )
+
+        # check global and object permissions for all documents
+        has_perms = (
+            user.has_perm(
+                "documents.change_document",
+            )
+            and not Document.global_objects.filter(pk__in=documents)
+            .exclude(pk__in=permitted_document_ids(user, perm="change_document"))
+            .exists()
+        )
+
+        # check ownership for methods that change original document
+        if (
+            (
+                has_perms
+                and method
+                in [
+                    bulk_edit.set_permissions,
+                    bulk_edit.delete,
+                    bulk_edit.rotate,
+                    bulk_edit.delete_pages,
+                    bulk_edit.edit_pdf,
+                    bulk_edit.merge_as_versions,
+                    bulk_edit.remove_password,
+                    bulk_edit.run_workflow,
+                ]
+            )
+            or (
+                method in [bulk_edit.merge, bulk_edit.split]
+                and parameters.get("delete_originals")
+            )
+            or (method == bulk_edit.edit_pdf and parameters.get("update_document"))
+        ):
+            has_perms = has_perms and user_is_owner_of_all_documents
+
+        # check global add permissions for methods that create documents
+        if (
+            has_perms
+            and (
+                method in [bulk_edit.split, bulk_edit.merge]
+                or (
+                    method in [bulk_edit.edit_pdf, bulk_edit.remove_password]
+                    and not parameters.get("update_document")
+                )
+            )
+            and not user.has_perm("documents.add_document")
+        ):
+            has_perms = False
+
+        # check global delete permissions for methods that delete documents
+        if (
+            has_perms
+            and (
+                method == bulk_edit.delete
+                # Sources stop being documents of their own, and removing one
+                # again afterwards needs delete_document
+                or method == bulk_edit.merge_as_versions
+                or (
+                    method in [bulk_edit.merge, bulk_edit.split]
+                    and parameters.get("delete_originals")
+                )
+                or (
+                    method in [bulk_edit.edit_pdf, bulk_edit.remove_password]
+                    and parameters.get("delete_original")
+                    and not parameters.get("update_document")
+                )
+            )
+            and not user.has_perm("documents.delete_document")
+        ):
+            has_perms = False
+
+        return has_perms
+
     def _execute_document_action(
         self,
         *,
@@ -3084,6 +3179,7 @@ class BulkEditView(DocumentOperationPermissionMixin):
     LEGACY_MODIFIED_FIELDS = {
         "delete": "deleted_at",
         "reprocess": "checksum",
+        "remove_password": None,
     }
 
     serializer_class = BulkEditSerializer
@@ -5089,6 +5185,8 @@ class WorkflowViewSet(ModelViewSet[Workflow]):
 
     serializer_class = WorkflowSerializer
     pagination_class = StandardPagination
+    filter_backends = (DjangoFilterBackend,)
+    filterset_class = WorkflowFilterSet
 
     model = Workflow