Feature: Allow configuring the compression type and compression levels during export

Building on the zip export improvements, this now allows users to further configure the
zip to fit their needs.  A simple stored zip for speed, or a high compression zstd for
the smallest archive.  Full validation of the method and levels at the command line

docs/administration.md

@@ -299,6 +299,8 @@ optional arguments:
 -sm, --split-manifest
 -z,  --zip
 -zn, --zip-name
+--zip-compression
+--zip-compression-level
 --data-only
 --no-progress-bar
 --passphrase
@@ -361,6 +363,19 @@ If `-z` or `--zip` is provided, the export will be a zip file
 in the target directory, named according to the current local date or the
 value set in `-zn` or `--zip-name`.
 
+The compression method for the zip can be set with `--zip-compression`
+(`stored`, `deflated` (default), `bzip2`, `lzma`, or `zstd`) and tuned with
+`--zip-compression-level` (deflated: 0–9, bzip2: 1–9, zstd: -22–22; ignored
+for `stored` and `lzma`). Both options require `--zip`.
+
+!!! warning
+
+    `zstd` compression requires Python 3.14 or newer on **both** the machine
+    creating the export and any machine importing it. An archive compressed with
+    `zstd` (or `lzma`/`bzip2` where those modules are unavailable) cannot be
+    imported on a runtime that lacks the codec; the importer will refuse it with
+    a clear error. The default `deflated` is universally readable.
+
 If `--data-only` is provided, only the database will be exported. This option is intended
 to facilitate database upgrades without needing to clean documents and thumbnails from the media directory.
 

docs/usage.md

@@ -576,9 +576,7 @@ The following workflow action types are available:
 - Tags, correspondent, document type and storage path
 - Document owner
 - View and / or edit permissions to users or groups
-- Custom fields, optionally with a value. If no value is set, the field is only added to the
+- Custom fields. Note that no value for the field will be set
-  document and any value it may already have is left untouched. If a value is set, it will
-  overwrite an existing value of that field on the document.
 
 ##### Removal {#workflow-action-removal}
 

src-ui/package.json

@@ -66,5 +66,5 @@
     "ts-node": "~10.9.1",
     "typescript": "^6.0.3"
   },
-  "packageManager": "pnpm@11.15.1"
+  "packageManager": "pnpm@10.26.0"
 }

src-ui/pnpm-workspace.yaml

@@ -5,7 +5,6 @@ trustPolicy: no-downgrade
 trustPolicyExclude:
   - "chokidar@4.0.3"
   - "semver@6.3.1 || 5.7.2"
-blockExoticSubdeps: true
 allowBuilds:
   "@parcel/watcher": true
   canvas: true

src-ui/src/app/components/common/input/custom-fields-values/custom-fields-values.component.spec.ts

@@ -52,10 +52,10 @@ describe('CustomFieldsValuesComponent', () => {
   })
 
   it('should set selectedFields and map values correctly', () => {
-    component.value = { 1: 'value1', 3: 0, 4: false }
+    component.value = { 1: 'value1' }
-    component.selectedFields = [1, 2, 3, 4]
+    component.selectedFields = [1, 2]
-    expect(component.selectedFields).toEqual([1, 2, 3, 4])
+    expect(component.selectedFields).toEqual([1, 2])
-    expect(component.value).toEqual({ 1: 'value1', 2: null, 3: 0, 4: false })
+    expect(component.value).toEqual({ 1: 'value1', 2: null })
   })
 
   it('should return the correct custom field by id', () => {

src-ui/src/app/components/common/input/custom-fields-values/custom-fields-values.component.ts

@@ -77,7 +77,7 @@ export class CustomFieldsValuesComponent extends AbstractInputComponent<Object>
     this._selectedFields = newFields
     // map the selected fields to an object with field_id as key and value as value
     this.value = newFields.reduce((acc, fieldId) => {
-      acc[fieldId] = this.value?.[fieldId] ?? null
+      acc[fieldId] = this.value?.[fieldId] || null
       return acc
     }, {})
     this.onChange(this.value)

src/documents/export/compression.py

@@ -0,0 +1,108 @@
+from __future__ import annotations
+
+import importlib
+import zipfile
+
+# ZIP_ZSTANDARD exists only on Python 3.14+ (PEP 784). None elsewhere.
+ZSTD: int | None = getattr(zipfile, "ZIP_ZSTANDARD", None)
+
+# CLI choices are fixed across runtimes so argparse never hides zstd; runtime
+# availability is enforced separately in compression_available().
+COMPRESSION_CHOICES: tuple[str, ...] = (
+    "stored",
+    "deflated",
+    "bzip2",
+    "lzma",
+    "zstd",
+)
+
+# Method name -> zipfile compression constant (zstd only when supported).
+COMPRESSION_METHODS: dict[str, int] = {
+    "stored": zipfile.ZIP_STORED,
+    "deflated": zipfile.ZIP_DEFLATED,
+    "bzip2": zipfile.ZIP_BZIP2,
+    "lzma": zipfile.ZIP_LZMA,
+}
+if ZSTD is not None:
+    COMPRESSION_METHODS["zstd"] = ZSTD
+
+# Inclusive (min, max) level bounds per method; None => level not applicable.
+# Verified on CPython 3.14.3.
+#
+# zstd's raw library bounds are (-131072, 22)
+# (compression.zstd.CompressionParameter.compression_level.bounds()) — the
+# minimum is an internal implementation constant (-ZSTD_TARGETLENGTH_MAX),
+# not a meaningful distinct "level"; deeper negative values than -22 buy
+# nothing over -22 in practice. We expose the conventional zstd CLI range
+# instead of the raw library bounds.
+LEVEL_BOUNDS: dict[str, tuple[int, int] | None] = {
+    "stored": None,
+    "deflated": (0, 9),
+    "bzip2": (1, 9),
+    "lzma": None,
+    "zstd": (-22, 22),
+}
+
+# zipfile compress_type id -> method name. 93 = current zstd id, 20 = legacy
+# zstd id that zipfile can still read.
+_COMPRESS_TYPE_TO_METHOD: dict[int, str] = {
+    zipfile.ZIP_STORED: "stored",
+    zipfile.ZIP_DEFLATED: "deflated",
+    zipfile.ZIP_BZIP2: "bzip2",
+    zipfile.ZIP_LZMA: "lzma",
+    93: "zstd",
+    20: "zstd",
+}
+
+
+def compression_available(method: str) -> bool:
+    """Whether the running interpreter can actually use the given method."""
+    if method in ("stored", "deflated"):
+        # zlib is a hard CPython dependency; stored needs nothing.
+        return True
+    if method == "bzip2":
+        return _module_importable("bz2")
+    if method == "lzma":
+        return _module_importable("lzma")
+    if method == "zstd":
+        return ZSTD is not None and _module_importable("compression.zstd")
+    return False
+
+
+def _module_importable(name: str) -> bool:
+    try:
+        importlib.import_module(name)
+    except ImportError:
+        return False
+    return True
+
+
+def level_error(method: str, level: int | None) -> str | None:
+    """Return a human message if (method, level) is invalid, else None."""
+    if level is None:
+        return None
+    bounds = LEVEL_BOUNDS[method]
+    if bounds is None:
+        return f"--zip-compression-level has no effect for '{method}'"
+    low, high = bounds
+    if not (low <= level <= high):
+        return (
+            f"--zip-compression-level for '{method}' must be between {low} and {high}"
+        )
+    return None
+
+
+def compress_type_readable(compress_type: int) -> bool:
+    """Whether this interpreter can decompress an entry of the given type."""
+    method = _COMPRESS_TYPE_TO_METHOD.get(compress_type)
+    if method is None:
+        return False
+    return compression_available(method)
+
+
+def unreadable_method_names(compress_types: set[int]) -> set[str]:
+    """Map a set of compress_type ids to human method names for error messages."""
+    names: set[str] = set()
+    for ct in compress_types:
+        names.add(_COMPRESS_TYPE_TO_METHOD.get(ct, f"method {ct}"))
+    return names

src/documents/export/sinks.py

@@ -243,11 +243,21 @@ class ZipExportSink(ExportSink):
     added as an entry at finalize (a zip entry cannot be interleaved with others).
     """
 
-    def __init__(self, target: Path, zip_name: str, *, delete: bool = False) -> None:
+    def __init__(
+        self,
+        target: Path,
+        zip_name: str,
+        *,
+        delete: bool = False,
+        compression: int = zipfile.ZIP_DEFLATED,
+        compresslevel: int | None = None,
+    ) -> None:
         self._target = target.resolve()
         self._zip_path = (self._target / zip_name).with_suffix(".zip")
         self._tmp_path = self._zip_path.with_name(self._zip_path.name + ".tmp")
         self._delete = delete
+        self._compression = compression
+        self._compresslevel = compresslevel
         self._zip: zipfile.ZipFile | None = None
         self._dirs: set[str] = set()
         self._pending_manifest: tuple[Path, str] | None = None
@@ -258,7 +268,8 @@ class ZipExportSink(ExportSink):
         self._zip = zipfile.ZipFile(
             self._tmp_path,
             "w",
-            compression=zipfile.ZIP_DEFLATED,
+            compression=self._compression,
+            compresslevel=self._compresslevel,
             allowZip64=True,
         )
 

src/documents/filters.py

@@ -1047,12 +1047,6 @@ class PermittedObjectsFilter(BaseFilterBackend):
     perm_codename: str | None = None
 
     def filter_queryset(self, request, queryset, view):
-        # Before the superuser and owner-only paths, neither of which consults
-        # permitted_object_ids. Scoped to authenticated users so anonymous
-        # access (AnonymousUser.is_active is False) keeps its existing
-        # unowned-only behaviour.
-        if request.user.is_authenticated and not request.user.is_active:
-            return queryset.none()
         if request.user.is_superuser:
             return queryset
         if not self.include_granted:

src/documents/management/commands/document_exporter.py

@@ -29,6 +29,11 @@ if TYPE_CHECKING:
 if settings.AUDIT_LOG_ENABLED:
     from auditlog.models import LogEntry
 
+from documents.export.compression import COMPRESSION_CHOICES
+from documents.export.compression import COMPRESSION_METHODS
+from documents.export.compression import ZSTD
+from documents.export.compression import compression_available
+from documents.export.compression import level_error
 from documents.export.sinks import DirectoryExportSink
 from documents.export.sinks import ExportSink
 from documents.export.sinks import StreamingManifestWriter
@@ -192,6 +197,28 @@ class Command(CryptMixin, PaperlessCommand):
             help="Sets the export zip file name",
         )
 
+        parser.add_argument(
+            "--zip-compression",
+            choices=COMPRESSION_CHOICES,
+            default=None,
+            help=(
+                "Compression method for the export zip (requires --zip). "
+                "Default: deflated. 'zstd' requires Python 3.14+ on both the "
+                "exporting and importing machine."
+            ),
+        )
+
+        parser.add_argument(
+            "--zip-compression-level",
+            type=int,
+            default=None,
+            help=(
+                "Compression level for the export zip (requires --zip). "
+                "deflated: 0-9, bzip2: 1-9, zstd: -22..22; ignored for "
+                "stored/lzma."
+            ),
+        )
+
         parser.add_argument(
             "--data-only",
             default=False,
@@ -247,12 +274,39 @@ class Command(CryptMixin, PaperlessCommand):
         if not os.access(self.target, os.W_OK):
             raise CommandError("That path doesn't appear to be writable")
 
+        zip_compression: str | None = options["zip_compression"]
+        zip_compression_level: int | None = options["zip_compression_level"]
+
+        if not self.zip_export and (
+            zip_compression is not None or zip_compression_level is not None
+        ):
+            raise CommandError(
+                "--zip-compression and --zip-compression-level require --zip",
+            )
+
+        compression_method = zip_compression or "deflated"
+        if self.zip_export:
+            if not compression_available(compression_method):
+                if compression_method == "zstd" and ZSTD is None:
+                    raise CommandError(
+                        "zstd compression requires Python 3.14 or newer",
+                    )
+                raise CommandError(
+                    f"Compression method '{compression_method}' is not "
+                    f"available on this Python runtime",
+                )
+            level_msg = level_error(compression_method, zip_compression_level)
+            if level_msg is not None:
+                raise CommandError(level_msg)
+
         sink: ExportSink
         if self.zip_export:
             sink = ZipExportSink(
                 self.target,
                 options["zip_name"],
                 delete=self.delete,
+                compression=COMPRESSION_METHODS[compression_method],
+                compresslevel=zip_compression_level,
             )
         else:
             sink = DirectoryExportSink(

src/documents/management/commands/document_importer.py

@@ -32,6 +32,8 @@ from django.db.models.signals import post_save
 from filelock import FileLock
 from guardian.shortcuts import clear_ct_cache
 
+from documents.export.compression import compress_type_readable
+from documents.export.compression import unreadable_method_names
 from documents.file_handling import create_source_path_directory
 from documents.management.commands.base import PaperlessCommand
 from documents.management.commands.mixins import CryptMixin
@@ -460,6 +462,20 @@ class Command(CryptMixin, PaperlessCommand):
         with tempfile.TemporaryDirectory() as tmp_dir:
             if is_zipfile(self.source):
                 with ZipFile(self.source) as zf:
+                    unsupported = {
+                        info.compress_type
+                        for info in zf.infolist()
+                        if not compress_type_readable(info.compress_type)
+                    }
+                    if unsupported:
+                        names = sorted(unreadable_method_names(unsupported))
+                        message = (
+                            f"This archive uses compression this Python cannot "
+                            f"read ({', '.join(names)})."
+                        )
+                        if "zstd" in names:
+                            message += " zstd archives require Python 3.14+."
+                        raise CommandError(message)
                     zf.extractall(tmp_dir)
                 self.source = Path(tmp_dir)
             self._run_import()

src/documents/permissions.py

@@ -54,15 +54,11 @@ class PaperlessObjectPermissions(DjangoObjectPermissions):
 
 class PaperlessAdminPermissions(BasePermission):
     def has_permission(self, request, view):
-        return request.user.is_active and request.user.is_staff
+        return request.user.is_staff
 
 
 def has_global_statistics_permission(user: User | None) -> bool:
-    if (
+    if user is None or not getattr(user, "is_authenticated", False):
-        user is None
-        or not getattr(user, "is_active", False)
-        or not getattr(user, "is_authenticated", False)
-    ):
         return False
 
     return getattr(user, "is_superuser", False) or user.has_perm(
@@ -71,11 +67,7 @@ def has_global_statistics_permission(user: User | None) -> bool:
 
 
 def has_system_status_permission(user: User | None) -> bool:
-    if (
+    if user is None or not getattr(user, "is_authenticated", False):
-        user is None
-        or not getattr(user, "is_active", False)
-        or not getattr(user, "is_authenticated", False)
-    ):
         return False
 
     return (
@@ -196,13 +188,6 @@ def permitted_object_ids(
     if user is None or not getattr(user, "is_authenticated", False):
         return base_qs.filter(owner__isnull=True).values_list("id", flat=True)
 
-    # Deactivated users get nothing, deactivated superusers included, so this
-    # has to come before the superuser shortcut. guardian's
-    # ObjectPermissionChecker denies inactive users, but get_objects_for_user
-    # (the pattern this replaces) does not, so it would not be inherited.
-    if not getattr(user, "is_active", False):
-        return base_qs.none().values_list("id", flat=True)
-
     if getattr(user, "is_superuser", False):
         return base_qs.values_list("id", flat=True)
 

src/documents/serialisers.py

@@ -3213,13 +3213,6 @@ class WorkflowActionSerializer(serializers.ModelSerializer[WorkflowAction]):
                         {"assign_title": f'Invalid f-string detected: "{e.args[0]}"'},
                     )
 
-        if attrs.get("assign_custom_fields_values"):
-            # Empty strings treated as None to avoid unexpected behavior
-            attrs["assign_custom_fields_values"] = {
-                field_id: (None if value == "" else value)
-                for field_id, value in attrs["assign_custom_fields_values"].items()
-            }
-
         if (
             "type" in attrs
             and attrs["type"] == WorkflowAction.WorkflowActionType.EMAIL

src/documents/tests/export/test_compression.py

@@ -0,0 +1,190 @@
+import sys
+import zipfile
+
+import pytest
+
+from documents.export import compression
+
+
+class TestCompressionMethods:
+    def test_choices_always_include_zstd(self) -> None:
+        """
+        GIVEN:
+            - The compression policy module's CLI choices list
+        WHEN:
+            - Read on any runtime
+        THEN:
+            - zstd is always present; availability is checked separately so
+              argparse never hides it based on the current Python version
+        """
+        assert compression.COMPRESSION_CHOICES == (
+            "stored",
+            "deflated",
+            "bzip2",
+            "lzma",
+            "zstd",
+        )
+
+    @pytest.mark.parametrize(
+        ("name", "constant"),
+        [
+            ("stored", zipfile.ZIP_STORED),
+            ("deflated", zipfile.ZIP_DEFLATED),
+            ("bzip2", zipfile.ZIP_BZIP2),
+            ("lzma", zipfile.ZIP_LZMA),
+        ],
+    )
+    def test_method_maps_to_zipfile_constant(self, name: str, constant: int) -> None:
+        """
+        GIVEN:
+            - A compression method name
+        WHEN:
+            - Looked up in COMPRESSION_METHODS
+        THEN:
+            - It maps to the matching zipfile compression constant
+        """
+        assert compression.COMPRESSION_METHODS[name] == constant
+
+    def test_stored_and_deflated_always_available(self) -> None:
+        """
+        GIVEN:
+            - The stored and deflated compression methods
+        WHEN:
+            - Checked with compression_available()
+        THEN:
+            - Both are always available (zlib is a hard CPython dependency)
+        """
+        assert compression.compression_available("stored")
+        assert compression.compression_available("deflated")
+
+    def test_zstd_availability_tracks_runtime(self) -> None:
+        """
+        GIVEN:
+            - The zstd compression method
+        WHEN:
+            - Checked with compression_available() on this runtime
+        THEN:
+            - Availability matches whether Python is 3.14+
+        """
+        expected: bool = sys.version_info >= (3, 14)
+        assert compression.compression_available("zstd") == expected
+
+
+class TestLevelError:
+    @pytest.mark.parametrize(
+        ("method", "level"),
+        [
+            ("deflated", 0),
+            ("deflated", 9),
+            ("bzip2", 1),
+            ("bzip2", 9),
+            ("zstd", -22),
+            ("zstd", 22),
+            ("deflated", None),
+            ("stored", None),
+        ],
+    )
+    def test_valid_levels_return_none(self, method: str, level: int | None) -> None:
+        """
+        GIVEN:
+            - A method and a level within its valid bounds (or no level)
+        WHEN:
+            - Checked with level_error()
+        THEN:
+            - No error message is returned
+        """
+        assert compression.level_error(method, level) is None
+
+    @pytest.mark.parametrize(
+        ("method", "level"),
+        [
+            ("deflated", 10),
+            ("deflated", -1),
+            ("bzip2", 0),
+            ("bzip2", 10),
+            ("zstd", -23),
+            ("zstd", 23),
+        ],
+    )
+    def test_out_of_range_levels_return_message(
+        self,
+        method: str,
+        level: int,
+    ) -> None:
+        """
+        GIVEN:
+            - A method and a level outside its valid bounds
+        WHEN:
+            - Checked with level_error()
+        THEN:
+            - An error message naming the valid range is returned
+        """
+        msg: str | None = compression.level_error(method, level)
+        assert msg is not None
+        assert "between" in msg
+
+    @pytest.mark.parametrize("method", ["stored", "lzma"])
+    def test_level_on_levelless_method_is_rejected(self, method: str) -> None:
+        """
+        GIVEN:
+            - A method that ignores compression level (stored, lzma)
+        WHEN:
+            - A level is passed to level_error() anyway
+        THEN:
+            - An error message noting the level has no effect is returned
+        """
+        msg: str | None = compression.level_error(method, 5)
+        assert msg is not None
+        assert "no effect" in msg
+
+
+class TestCompressTypeReadable:
+    @pytest.mark.parametrize("ct", [zipfile.ZIP_STORED, zipfile.ZIP_DEFLATED])
+    def test_stored_and_deflated_always_readable(self, ct: int) -> None:
+        """
+        GIVEN:
+            - A stored or deflated compress_type id
+        WHEN:
+            - Checked with compress_type_readable()
+        THEN:
+            - It is always readable
+        """
+        assert compression.compress_type_readable(ct)
+
+    def test_zstd_compress_type_readability_tracks_runtime(self) -> None:
+        """
+        GIVEN:
+            - The current (93) and legacy (20) zstd compress_type ids
+        WHEN:
+            - Checked with compress_type_readable() on this runtime
+        THEN:
+            - Readability matches whether Python is 3.14+
+        """
+        # 93 = ZIP_ZSTANDARD; 20 = legacy zstd method id (read-only)
+        expected: bool = sys.version_info >= (3, 14)
+        assert compression.compress_type_readable(93) == expected
+        assert compression.compress_type_readable(20) == expected
+
+    def test_unknown_compress_type_is_unreadable(self) -> None:
+        """
+        GIVEN:
+            - An unrecognized compress_type id
+        WHEN:
+            - Checked with compress_type_readable()
+        THEN:
+            - It is reported as unreadable
+        """
+        assert not compression.compress_type_readable(9999)
+
+    def test_unreadable_method_names_lists_methods(self) -> None:
+        """
+        GIVEN:
+            - A set containing an unknown compress_type id
+        WHEN:
+            - Passed to unreadable_method_names()
+        THEN:
+            - It is reported generically as "method <id>"
+        """
+        # An unknown method id maps to no name and is reported generically.
+        names: set[str] = compression.unreadable_method_names({9999})
+        assert names == {"method 9999"}

src/documents/tests/export/test_sinks.py

@@ -5,6 +5,7 @@ import zipfile
 from pathlib import Path
 
 import pytest
+import pytest_mock
 from pytest_django.fixtures import SettingsWrapper
 
 from documents.export.sinks import DirectoryExportSink
@@ -305,6 +306,48 @@ class TestZipExportSink:
         assert not (target / "export.zip").exists()
 
 
+class TestZipExportSinkCompression:
+    @pytest.mark.parametrize(
+        ("method", "constant"),
+        [
+            ("stored", zipfile.ZIP_STORED),
+            ("deflated", zipfile.ZIP_DEFLATED),
+            ("bzip2", zipfile.ZIP_BZIP2),
+            ("lzma", zipfile.ZIP_LZMA),
+        ],
+    )
+    def test_compression_and_level_forwarded_to_zipfile(
+        self,
+        mocker: pytest_mock.MockerFixture,
+        tmp_path: Path,
+        method: str,
+        constant: int,
+    ) -> None:
+        """
+        GIVEN:
+            - A ZipExportSink constructed with a compression method and level
+        WHEN:
+            - The sink is opened
+        THEN:
+            - zipfile.ZipFile is constructed with those values forwarded
+              unchanged (whether ZipFile actually compresses is Python's own
+              contract, not ours, so this checks the call args, not a real
+              archive)
+        """
+        target: Path = tmp_path / "out"
+        target.mkdir()
+        zip_cls = mocker.patch("documents.export.sinks.zipfile.ZipFile")
+        sink = ZipExportSink(target, "export", compression=constant, compresslevel=5)
+        sink._open()
+        zip_cls.assert_called_once_with(
+            mocker.ANY,
+            "w",
+            compression=constant,
+            compresslevel=5,
+            allowZip64=True,
+        )
+
+
 class TestStreamContract:
     @pytest.fixture(params=["dir", "zip"])
     def sink(self, request: pytest.FixtureRequest, tmp_path: Path) -> ExportSink:

src/documents/tests/test_api_workflows.py

@@ -422,11 +422,6 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
             json.dumps(
                 {
                     "assign_title": "",
-                    "assign_custom_fields": [self.cf1.id, self.cf2.id],
-                    "assign_custom_fields_values": {
-                        str(self.cf1.id): "",
-                        str(self.cf2.id): 0,
-                    },
                 },
             ),
             content_type="application/json",
@@ -434,10 +429,6 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
         action = WorkflowAction.objects.get(id=response.data["id"])
         self.assertIsNone(action.assign_title)
-        self.assertEqual(
-            action.assign_custom_fields_values,
-            {str(self.cf1.id): None, str(self.cf2.id): 0},
-        )
 
         response = self.client.post(
             self.ENDPOINT_TRIGGERS,

src/documents/tests/test_management_exporter.py

@@ -6,6 +6,8 @@ from datetime import timedelta
 from io import StringIO
 from pathlib import Path
 from unittest import mock
+from zipfile import ZIP_DEFLATED
+from zipfile import ZIP_LZMA
 from zipfile import ZipFile
 
 import pytest
@@ -1078,6 +1080,186 @@ class TestExportImport(
                         skip_checks=True,
                     )
 
+    def test_compression_flags_require_zip(self) -> None:
+        """
+        GIVEN:
+            - A request to export without --zip
+        WHEN:
+            - --zip-compression or --zip-compression-level is passed anyway
+        THEN:
+            - A CommandError is raised (the flags are meaningless without --zip)
+        """
+        for args in (
+            ["--zip-compression", "lzma"],
+            ["--zip-compression-level", "5"],
+        ):
+            with self.assertRaises(CommandError):
+                call_command(
+                    "document_exporter",
+                    self.target,
+                    *args,
+                    skip_checks=True,
+                )
+
+    def test_zip_compression_level_out_of_range_raises(self) -> None:
+        """
+        GIVEN:
+            - A request to export to a zip file
+        WHEN:
+            - --zip-compression-level is outside the chosen method's valid range
+        THEN:
+            - A CommandError is raised
+        """
+        with self.assertRaises(CommandError):
+            call_command(
+                "document_exporter",
+                self.target,
+                "--zip",
+                "--zip-compression",
+                "deflated",
+                "--zip-compression-level",
+                "99",
+                skip_checks=True,
+            )
+
+    def test_zip_compression_level_rejected_for_stored(self) -> None:
+        """
+        GIVEN:
+            - A request to export to a zip file with --zip-compression stored
+        WHEN:
+            - --zip-compression-level is also passed
+        THEN:
+            - A CommandError is raised (stored ignores level entirely)
+        """
+        with self.assertRaises(CommandError):
+            call_command(
+                "document_exporter",
+                self.target,
+                "--zip",
+                "--zip-compression",
+                "stored",
+                "--zip-compression-level",
+                "5",
+                skip_checks=True,
+            )
+
+    def test_zip_compression_level_rejected_for_lzma(self) -> None:
+        """
+        GIVEN:
+            - A request to export to a zip file with --zip-compression lzma
+        WHEN:
+            - --zip-compression-level is also passed
+        THEN:
+            - A CommandError is raised (lzma ignores level entirely)
+        """
+        with self.assertRaises(CommandError):
+            call_command(
+                "document_exporter",
+                self.target,
+                "--zip",
+                "--zip-compression",
+                "lzma",
+                "--zip-compression-level",
+                "5",
+                skip_checks=True,
+            )
+
+    def test_zstd_unavailable_raises_friendly_error(self) -> None:
+        """
+        GIVEN:
+            - A Python runtime without zstd support (< 3.14)
+        WHEN:
+            - --zip-compression zstd is requested
+        THEN:
+            - A CommandError naming the Python version requirement is raised
+
+        zstd availability is mocked rather than relying on the actual
+        runtime: on a Python 3.14+ CI leg, ZSTD is not None, so without the
+        mock this check is skipped and the command falls through into the
+        real export, which fails on missing document files instead of
+        raising the expected CommandError.
+        """
+        with (
+            mock.patch(
+                "documents.management.commands.document_exporter.ZSTD",
+                None,
+            ),
+            mock.patch(
+                "documents.management.commands.document_exporter.compression_available",
+                return_value=False,
+            ),
+            self.assertRaises(CommandError) as e,
+        ):
+            call_command(
+                "document_exporter",
+                self.target,
+                "--zip",
+                "--zip-compression",
+                "zstd",
+                skip_checks=True,
+            )
+        self.assertIn("3.14", str(e.exception))
+
+    def test_zip_compression_flag_resolves_to_sink_constant(self) -> None:
+        """
+        GIVEN:
+            - A request to export to a zip file with --zip-compression lzma
+        WHEN:
+            - The export runs
+        THEN:
+            - ZipExportSink is constructed with the resolved ZIP_LZMA constant
+              (whether zipfile actually compresses with the chosen method is
+              Python's own contract, and ZipExportSink's own tests already
+              cover the forwarding; what this command owns is resolving the
+              CLI string to the right constant, so assert that resolution
+              directly)
+        """
+        with mock.patch(
+            "documents.management.commands.document_exporter.ZipExportSink",
+        ) as sink_cls:
+            call_command(
+                "document_exporter",
+                self.target,
+                "--zip",
+                "--zip-compression",
+                "lzma",
+                skip_checks=True,
+            )
+        sink_cls.assert_called_once_with(
+            mock.ANY,
+            mock.ANY,
+            delete=False,
+            compression=ZIP_LZMA,
+            compresslevel=None,
+        )
+
+    def test_default_zip_compression_resolves_to_deflate(self) -> None:
+        """
+        GIVEN:
+            - A request to export to a zip file with no --zip-compression flag
+        WHEN:
+            - The export runs
+        THEN:
+            - ZipExportSink is constructed with the default ZIP_DEFLATED
+              constant and compresslevel=None, matching pre-existing behavior
+        """
+        with mock.patch(
+            "documents.management.commands.document_exporter.ZipExportSink",
+        ) as sink_cls:
+            call_command(
+                "document_exporter",
+                self.target,
+                "--zip",
+                skip_checks=True,
+            )
+        sink_cls.assert_called_once_with(
+            mock.ANY,
+            mock.ANY,
+            delete=False,
+            compression=ZIP_DEFLATED,
+            compresslevel=None,
+        )
+
 
 @pytest.mark.management
 class TestCryptExportImport(

src/documents/tests/test_management_importer.py

@@ -525,6 +525,35 @@ class TestCommandImport(
         self.assertEqual(doc.tags.count(), 1)
         self.assertEqual(doc.tags.first().name, "batch-flush-tag")
 
+    def test_import_rejects_unreadable_compression(self) -> None:
+        """
+        GIVEN:
+            - A zip archive with an entry whose compression this Python can't read
+        WHEN:
+            - Import is attempted
+        THEN:
+            - A CommandError naming the issue is raised, before extraction
+        """
+        import zipfile
+        from unittest import mock
+
+        archive = Path(self.dirs.scratch_dir) / "export.zip"
+        with zipfile.ZipFile(archive, "w") as zf:
+            zf.writestr("manifest.json", "[]")
+
+        with mock.patch(
+            "documents.management.commands.document_importer.compress_type_readable",
+            return_value=False,
+        ):
+            with self.assertRaises(CommandError) as e:
+                call_command(
+                    "document_importer",
+                    str(archive),
+                    "--no-progress-bar",
+                    skip_checks=True,
+                )
+        self.assertIn("compression", str(e.exception))
+
 
 @pytest.mark.management
 @pytest.mark.django_db

src/documents/tests/test_permission_filtering_security.py

@@ -496,28 +496,6 @@ class TestPermittedObjectIdsGenericModels:
             expected_hidden=[strangers.pk],
         )
 
-    @pytest.mark.parametrize("is_superuser", [False, True])
-    def test_inactive_user_sees_nothing(self, model, factory, perm, is_superuser):
-        suffix = f"{model.__name__}_{is_superuser}"
-        user = User.objects.create_user(
-            username=f"inactive_{suffix}",
-            is_active=False,
-            is_superuser=is_superuser,
-        )
-        other = User.objects.create_user(username=f"other_{suffix}")
-        granted = factory(owner=other)
-        assign_perm(perm, user, granted)
-
-        assert_visible_document_ids(
-            permitted_object_ids(user, model, perm),
-            expected_visible=[],
-            expected_hidden=[
-                factory(owner=None).pk,
-                factory(owner=user).pk,
-                granted.pk,
-            ],
-        )
-
     def test_unowned_object_visible_to_everyone(self, model, factory, perm):
         user = User.objects.create_user(username=f"user_{model.__name__}")
         unowned = factory(owner=None)

src/documents/tests/test_permitted_objects_filter.py

@@ -68,44 +68,3 @@ class TestPermittedObjectsFilter:
         visible_ids = set(result.values_list("id", flat=True))
         assert visible_ids == {owned.pk}
         assert granted.pk not in visible_ids
-
-    @pytest.mark.parametrize(
-        ("username", "is_superuser"),
-        [("inactive", False), ("inactive_super", True)],
-    )
-    def test_inactive_user_sees_nothing(self, username: str, *, is_superuser: bool):
-        user = User.objects.create_user(
-            username=username,
-            is_active=False,
-            is_superuser=is_superuser,
-        )
-        TagFactory(owner=None)
-        TagFactory(owner=user)
-        granted = TagFactory(owner=User.objects.create_user(username=f"o_{username}"))
-        assign_perm("view_tag", user, granted)
-        request = APIRequestFactory().get("/")
-        request.user = user
-
-        result = PermittedObjectsFilter().filter_queryset(
-            request,
-            Tag.objects.all(),
-            _DummyView(),
-        )
-        assert result.count() == 0
-
-    def test_inactive_user_sees_nothing_with_include_granted_false(self):
-        user = User.objects.create_user(username="inactive_owner", is_active=False)
-        TagFactory(owner=user)
-        TagFactory(owner=None)
-        request = APIRequestFactory().get("/")
-        request.user = user
-
-        class _OwnerOnlyFilter(PermittedObjectsFilter):
-            include_granted = False
-
-        result = _OwnerOnlyFilter().filter_queryset(
-            request,
-            Tag.objects.all(),
-            _DummyView(),
-        )
-        assert result.count() == 0

src/documents/tests/test_workflows.py

@@ -2000,55 +2000,6 @@ class TestWorkflows(
                 r"Doc added in \w{3,}",
             )  # Match any 3-letter month name
 
-    def test_document_updated_workflow_existing_custom_field_empty_value(self) -> None:
-        """
-        GIVEN:
-            - Existing workflow with UPDATED trigger and action that assigns a custom field
-              with an empty value
-        WHEN:
-            - Document is updated that already contains the field with a value
-        THEN:
-            - The existing value is left untouched, see GH #13627
-        """
-        trigger = WorkflowTrigger.objects.create(
-            type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_UPDATED,
-            filter_has_document_type=self.dt,
-        )
-        action = WorkflowAction.objects.create()
-        action.assign_custom_fields.add(self.cf1)
-        action.assign_custom_fields_values = {self.cf1.pk: ""}
-        action.save()
-        w = Workflow.objects.create(
-            name="Workflow 1",
-            order=0,
-        )
-        w.triggers.add(trigger)
-        w.actions.add(action)
-        w.save()
-
-        doc = Document.objects.create(
-            title="sample test",
-            correspondent=self.c,
-            original_filename="sample.pdf",
-        )
-        CustomFieldInstance.objects.create(
-            document=doc,
-            field=self.cf1,
-            value_text="existing value",
-        )
-
-        superuser = User.objects.create_superuser("superuser")
-        self.client.force_authenticate(user=superuser)
-
-        self.client.patch(
-            f"/api/documents/{doc.id}/",
-            {"document_type": self.dt.id},
-            format="json",
-        )
-
-        doc.refresh_from_db()
-        self.assertEqual(doc.custom_fields.get(field=self.cf1).value, "existing value")
-
     def test_document_updated_workflow_existing_custom_field(self) -> None:
         """
         GIVEN:

src/documents/workflows/mutations.py

@@ -105,8 +105,7 @@ def apply_assignment_to_document(
                 field=field,
                 document=document,
             ).first()
-            # empty string is indistinguishable from no value in the UI
+            if instance and args[value_field_name] is not None:
-            if instance and args[value_field_name] not in (None, ""):
                 setattr(instance, value_field_name, args[value_field_name])
                 instance.save()
             elif not instance:

src/locale/en_US/LC_MESSAGES/django.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-08-10 02:25+0000\n"
+"POT-Creation-Date: 2026-08-08 14:28+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -53,7 +53,7 @@ msgstr ""
 msgid "Maximum nesting depth exceeded."
 msgstr ""
 
-#: documents/filters.py:1079
+#: documents/filters.py:1073
 msgid "Custom field not found"
 msgstr ""
 

src/paperless/auth.py

@@ -19,10 +19,7 @@ class AutoLoginMiddleware(MiddlewareMixin):
         if request.path.startswith("/api/token/") and request.method == "POST":
             return None
         try:
-            request.user = User.objects.get(
+            request.user = User.objects.get(username=settings.AUTO_LOGIN_USERNAME)
-                username=settings.AUTO_LOGIN_USERNAME,
-                is_active=True,
-            )
             auth.login(
                 request=request,
                 user=request.user,

src/paperless/tests/test_auth_middleware.py

@@ -1,53 +0,0 @@
-from django.contrib.auth.models import AnonymousUser
-from django.contrib.auth.models import User
-from django.test import RequestFactory
-from django.test import TestCase
-from django.test import override_settings
-
-from paperless.auth import AutoLoginMiddleware
-
-
-@override_settings(AUTO_LOGIN_USERNAME="autologin")
-class TestAutoLoginMiddleware(TestCase):
-    def setUp(self) -> None:
-        super().setUp()
-        self.factory = RequestFactory()
-        self.middleware = AutoLoginMiddleware(lambda request: None)
-
-    def _process(self, request):
-        # login() needs a session to write to
-        request.session = self.client.session
-        self.middleware.process_request(request)
-        return request
-
-    def test_active_user_is_logged_in(self) -> None:
-        """
-        GIVEN:
-            - AUTO_LOGIN_USERNAME names an active user
-        WHEN:
-            - A request is processed by the middleware
-        THEN:
-            - That user is attached to the request
-        """
-        user = User.objects.create_user(username="autologin")
-
-        request = self._process(self.factory.get("/"))
-
-        self.assertEqual(request.user, user)
-
-    def test_deactivated_user_is_not_logged_in(self) -> None:
-        """
-        GIVEN:
-            - AUTO_LOGIN_USERNAME names a user who has been deactivated
-        WHEN:
-            - A request is processed by the middleware
-        THEN:
-            - The request is left anonymous rather than authenticated as them
-        """
-        User.objects.create_user(username="autologin", is_active=False)
-
-        request = self.factory.get("/")
-        request.user = AnonymousUser()
-        self._process(request)
-
-        self.assertFalse(request.user.is_authenticated)

uv.lock

@@ -1298,16 +1298,16 @@ wheels = [
 
 [[package]]
 name = "fpdf2"
-version = "2.8.8"
+version = "2.8.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "defusedxml", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "fonttools", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "pillow", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1e/bc/8fd4321aed40cadadddc8f311c65b6082346b252bca048f7b476d8f35d72/fpdf2-2.8.8.tar.gz", hash = "sha256:9e94e155e85e8053329a9a1fce8b566fd7a7c5bb79e98a1a3952d379b947c5b9", size = 374689, upload-time = "2026-08-09T23:32:45.334Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/27/f2/72feae0b2827ed38013e4307b14f95bf0b3d124adfef4d38a7d57533f7be/fpdf2-2.8.7.tar.gz", hash = "sha256:7060ccee5a9c7ab0a271fb765a36a23639f83ef8996c34e3d46af0a17ede57f9", size = 362351, upload-time = "2026-02-28T05:39:16.456Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f5/be/af012eda9507494f28b99b077423806c43a11573eb6225dd46f19ae2d263/fpdf2-2.8.8-py3-none-any.whl", hash = "sha256:3557a478fc577a929c94aace9666aed4dcc432b5ab6764232e6a59f1ccd75f17", size = 337000, upload-time = "2026-08-09T23:32:43.728Z" },
+    { url = "https://files.pythonhosted.org/packages/66/0a/cf50ecffa1e3747ed9380a3adfc829259f1f86b3fdbd9e505af789003141/fpdf2-2.8.7-py3-none-any.whl", hash = "sha256:d391fc508a3ce02fc43a577c830cda4fe6f37646f2d143d489839940932fbc19", size = 327056, upload-time = "2026-02-28T05:39:14.619Z" },
 ]
 
 [[package]]
@@ -2927,8 +2927,8 @@ dependencies = [
     { name = "sqlite-vec", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "tantivy", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "tika-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
-    { name = "torch", version = "2.13.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "torch", version = "2.13.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
-    { name = "torch", version = "2.13.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "torch", version = "2.13.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'linux'" },
     { name = "watchfiles", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "whitenoise", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "zxing-cpp", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
@@ -4511,8 +4511,8 @@ dependencies = [
     { name = "numpy", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "scikit-learn", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "scipy", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
-    { name = "torch", version = "2.13.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "torch", version = "2.13.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
-    { name = "torch", version = "2.13.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "torch", version = "2.13.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'linux'" },
     { name = "tqdm", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "transformers", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "typing-extensions", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
@@ -4957,17 +4957,18 @@ name = "torch"
 version = "2.13.0"
 source = { registry = "https://download.pytorch.org/whl/cpu" }
 resolution-markers = [
+    "python_full_version >= '3.15' and sys_platform == 'darwin'",
     "python_full_version >= '3.12' and python_full_version < '3.15' and sys_platform == 'darwin'",
     "python_full_version < '3.12' and sys_platform == 'darwin'",
 ]
 dependencies = [
-    { name = "filelock", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "filelock", marker = "sys_platform == 'darwin'" },
-    { name = "fsspec", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "fsspec", marker = "sys_platform == 'darwin'" },
-    { name = "jinja2", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "jinja2", marker = "sys_platform == 'darwin'" },
-    { name = "networkx", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "networkx", marker = "sys_platform == 'darwin'" },
-    { name = "setuptools", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "setuptools", marker = "sys_platform == 'darwin'" },
-    { name = "sympy", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "sympy", marker = "sys_platform == 'darwin'" },
-    { name = "typing-extensions", marker = "python_full_version < '3.15' and sys_platform == 'darwin'" },
+    { name = "typing-extensions", marker = "sys_platform == 'darwin'" },
 ]
 wheels = [
     { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.13.0-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:e76f9bcecc52b8ff711239a2f7547d5353df95878ab232f0773c1d95928b92f8", upload-time = "2026-07-08T12:26:13Z" },
@@ -4982,7 +4983,6 @@ name = "torch"
 version = "2.13.0+cpu"
 source = { registry = "https://download.pytorch.org/whl/cpu" }
 resolution-markers = [
-    "python_full_version >= '3.15' and sys_platform == 'darwin'",
     "python_full_version == '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux'",
     "python_full_version == '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux'",
     "python_full_version >= '3.15' and sys_platform == 'linux'",
@@ -4990,13 +4990,13 @@ resolution-markers = [
     "python_full_version < '3.12' and sys_platform == 'linux'",
 ]
 dependencies = [
-    { name = "filelock", marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "filelock", marker = "sys_platform == 'linux'" },
-    { name = "fsspec", marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "fsspec", marker = "sys_platform == 'linux'" },
-    { name = "jinja2", marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "jinja2", marker = "sys_platform == 'linux'" },
-    { name = "networkx", marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "networkx", marker = "sys_platform == 'linux'" },
-    { name = "setuptools", marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "setuptools", marker = "sys_platform == 'linux'" },
-    { name = "sympy", marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "sympy", marker = "sys_platform == 'linux'" },
-    { name = "typing-extensions", marker = "(python_full_version >= '3.15' and sys_platform == 'darwin') or sys_platform == 'linux'" },
+    { name = "typing-extensions", marker = "sys_platform == 'linux'" },
 ]
 wheels = [
     { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.13.0%2Bcpu-cp311-cp311-linux_s390x.whl", hash = "sha256:6e9817dbdf5ea76789babd46e457eac5bf14ff566cf85f8addbfdff2d56601ce", upload-time = "2026-07-08T19:27:52Z" },