Chore: add a null guard for sidebar hidden items

docs/configuration.md

@@ -501,20 +501,20 @@ See the [Django project documentation on the settings](https://docs.djangoprojec
 
 #### [`PAPERLESS_ALLOWED_HOSTS=<comma-separated-list>`](#PAPERLESS_ALLOWED_HOSTS) {#PAPERLESS_ALLOWED_HOSTS}
 
-: If you expose Paperless to the internet, set `PAPERLESS_URL` to its public URL
-or list its public hostname in `PAPERLESS_ALLOWED_HOSTS` to help protect against
-HTTP Host header attacks.
+: If you're planning on putting Paperless on the open internet, then
+you really should set this value to the domain name you're using.
+Failing to do so leaves you open to HTTP host header attacks.
 You can read more about this in [the Django project's documentation](https://docs.djangoproject.com/en/4.1/topics/security/#host-header-validation)
 
-    Separate multiple hostnames with commas, as in `example.com,www.example.com`.
+    Just remember that this is a comma-separated list, so
+    "example.com" is fine, as is "example.com,www.example.com", but
+    NOT " example.com" or "example.com,"
 
-    - With neither setting configured, Paperless accepts any host.
-    - With only `PAPERLESS_URL` set, Paperless accepts the hostname from that URL
-      and `localhost` (used by the Docker health check).
-    - `PAPERLESS_ALLOWED_HOSTS` adds hosts to `localhost` and the hostname from
-      `PAPERLESS_URL`, if set. A blank list adds no hosts.
-    - With `PAPERLESS_ALLOWED_HOSTS=*`, Paperless accepts any host, even when
-      `PAPERLESS_URL` is set.
+    Can also be set using PAPERLESS_URL (see above).
+
+    "localhost" is always allowed for docker healthcheck
+
+    Defaults to "\*", which is all hosts.
 
 #### [`PAPERLESS_CORS_ALLOWED_HOSTS=<comma-separated-list>`](#PAPERLESS_CORS_ALLOWED_HOSTS) {#PAPERLESS_CORS_ALLOWED_HOSTS}
 

src-ui/messages.xlf

@@ -4030,21 +4030,14 @@
         <source>Sources</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/chat/chat/chat.component.html</context>
-          <context context-type="linenumber">47,48</context>
-        </context-group>
-      </trans-unit>
-      <trans-unit id="6025275430560167531" datatype="html">
-        <source>+<x id="INTERPOLATION" equiv-text="{{ hiddenReferenceCount(message) }}"/> more</source>
-        <context-group purpose="location">
-          <context context-type="sourcefile">src/app/components/chat/chat/chat.component.html</context>
-          <context context-type="linenumber">49,50</context>
+          <context context-type="linenumber">46,47</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8066608938393600549" datatype="html">
         <source>Message</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/chat/chat/chat.component.html</context>
-          <context context-type="linenumber">66,67</context>
+          <context context-type="linenumber">61,62</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/email-document-dialog/email-document-dialog.component.html</context>
@@ -4055,22 +4048,22 @@
         <source>Stop</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/chat/chat/chat.component.html</context>
-          <context context-type="linenumber">79</context>
+          <context context-type="linenumber">74</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/chat/chat/chat.component.html</context>
-          <context context-type="linenumber">79</context>
+          <context context-type="linenumber">74</context>
         </context-group>
       </trans-unit>
       <trans-unit id="6490688569532630280" datatype="html">
         <source>Send</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/chat/chat/chat.component.html</context>
-          <context context-type="linenumber">83</context>
+          <context context-type="linenumber">78</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/chat/chat/chat.component.html</context>
-          <context context-type="linenumber">83</context>
+          <context context-type="linenumber">78</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/document-detail/document-detail.component.html</context>
@@ -4097,14 +4090,14 @@
         <source>Ask a question about this document...</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/chat/chat/chat.component.ts</context>
-          <context context-type="linenumber">83</context>
+          <context context-type="linenumber">61</context>
         </context-group>
       </trans-unit>
       <trans-unit id="224049052163028286" datatype="html">
         <source>Ask a question about a document...</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/chat/chat/chat.component.ts</context>
-          <context context-type="linenumber">84</context>
+          <context context-type="linenumber">62</context>
         </context-group>
       </trans-unit>
       <trans-unit id="8700121026680200191" datatype="html">

src-ui/src/app/components/chat/chat/chat.component.html

@@ -42,16 +42,11 @@
               <span class="text-break">{{ message.content }}</span>
             }
             @if (message.role === 'assistant' && !message.isStreaming && message.references?.length) {
-              <div class="chat-references mt-2 pt-2 border-top">
-                <div class="d-flex align-items-center text-muted mb-1">
-                  <span i18n>Sources</span>
-                  @if (hiddenReferenceCount(message) > 0 && !expandedReferences().has(message)) {
-                    <button type="button" class="badge rounded-pill bg-body-secondary text-body-secondary fw-normal border-0 ms-2" (click)="expandReferences(message)" i18n>+{{ hiddenReferenceCount(message) }} more</button>
-                  }
-                </div>
-                @for (reference of visibleReferences(message); track reference.id) {
-                  <a class="reference-link d-flex align-items-center lh-sm text-primary text-decoration-none py-1" [routerLink]="['/documents', reference.id]" [title]="reference.title">
-                    <pngx-bs-icon width="0.8em" height="0.8em" name="file-text" class="me-2 flex-shrink-0"></pngx-bs-icon><span class="text-truncate">{{ reference.title }}</span>
+              <div class="chat-references list-group mt-3">
+                <div class="list-group-item text-muted small py-1" i18n>Sources</div>
+                @for (reference of message.references; track reference.id) {
+                  <a class="list-group-item list-group-item-action d-flex align-items-center text-primary" [routerLink]="['/documents', reference.id]" [title]="reference.title">
+                    <pngx-bs-icon width="0.9em" height="0.9em" name="file-text" class="me-2 flex-shrink-0"></pngx-bs-icon><span class="text-truncate">{{ reference.title }}</span>
                   </a>
                 }
               </div>

src-ui/src/app/components/chat/chat/chat.component.scss

@@ -12,10 +12,6 @@
   display: none;
 }
 
-.message .flex-grow-1 {
-  min-width: 0;
-}
-
 .dropdown-item {
   white-space: initial;
 }

src-ui/src/app/components/chat/chat/chat.component.ts

@@ -14,7 +14,6 @@ import { BootstrapIconComponent } from 'src/app/components/common/bootstrap-icon
 import { MarkdownPipe } from 'src/app/pipes/markdown.pipe'
 import {
   ChatMessage,
-  ChatReference,
   ChatService,
   parseChatResponse,
 } from 'src/app/services/chat.service'
@@ -41,29 +40,8 @@ export class ChatComponent implements OnInit {
   readonly input = signal('')
   readonly documentId = signal<number>(undefined)
   readonly slowResponse = signal(false)
-  readonly expandedReferences = signal<Set<ChatMessage>>(new Set())
   public popperOptions = pngxPopperOptions
 
-  static readonly COLLAPSED_REFERENCE_COUNT = 2
-
-  public visibleReferences(message: ChatMessage): ChatReference[] {
-    if (this.expandedReferences().has(message)) {
-      return message.references
-    }
-    return message.references.slice(0, ChatComponent.COLLAPSED_REFERENCE_COUNT)
-  }
-
-  public hiddenReferenceCount(message: ChatMessage): number {
-    return Math.max(
-      0,
-      message.references.length - ChatComponent.COLLAPSED_REFERENCE_COUNT
-    )
-  }
-
-  public expandReferences(message: ChatMessage): void {
-    this.expandedReferences.update((expanded) => new Set(expanded).add(message))
-  }
-
   private chatService: ChatService = inject(ChatService)
   private router: Router = inject(Router)
 

src-ui/src/app/services/settings.service.spec.ts

@@ -260,6 +260,18 @@ describe('SettingsService', () => {
     ).toBe(false)
   })
 
+  it('handles null values for sidebar hidden items', () => {
+    httpTestingController
+      .expectOne(`${environment.apiBaseUrl}ui_settings/`)
+      .flush(ui_settings)
+
+    settingsService.set(SETTINGS_KEYS.SIDEBAR_HIDDEN_ITEMS, null)
+
+    expect(
+      settingsService.sidebarItemIsHidden(HideableSidebarItemID.Workflows)
+    ).toBe(false)
+  })
+
   it('updates setting signals when settings are reinitialized', () => {
     let req = httpTestingController.expectOne(
       `${environment.apiBaseUrl}ui_settings/`

src-ui/src/app/services/settings.service.ts

@@ -765,7 +765,9 @@ export class SettingsService {
 
   sidebarItemIsHidden(item: HideableSidebarItemID): boolean {
     return (
-      this.sidebarHiddenItemsEditing() ?? this.hiddenSidebarItems()
+      this.sidebarHiddenItemsEditing() ??
+      this.hiddenSidebarItems() ??
+      []
     ).includes(item)
   }
 
@@ -774,7 +776,7 @@ export class SettingsService {
     visible: boolean
   ): void {
     const hiddenItems = new Set(
-      this.sidebarHiddenItemsEditing() ?? this.hiddenSidebarItems()
+      this.sidebarHiddenItemsEditing() ?? this.hiddenSidebarItems() ?? []
     )
     if (visible) {
       hiddenItems.delete(item)

src/paperless/settings/__init__.py

@@ -450,10 +450,7 @@ CORS_EXPOSE_HEADERS = [
     "Content-Disposition",
 ]
 
-if "PAPERLESS_ALLOWED_HOSTS" in os.environ or os.getenv("PAPERLESS_URL"):
-    ALLOWED_HOSTS = get_list_from_env("PAPERLESS_ALLOWED_HOSTS")
-else:
-    ALLOWED_HOSTS = ["*"]
+ALLOWED_HOSTS = get_list_from_env("PAPERLESS_ALLOWED_HOSTS", default=["*"])
 if ALLOWED_HOSTS != ["*"]:
     # always allow localhost. Necessary e.g. for healthcheck in docker.
     ALLOWED_HOSTS.append("localhost")
@@ -463,15 +460,13 @@ def _parse_paperless_url():
     global CSRF_TRUSTED_ORIGINS, CORS_ALLOWED_ORIGINS, ALLOWED_HOSTS
     url = os.getenv("PAPERLESS_URL")
     if url:
-        hostname = (urlparse(url).hostname or "").removesuffix(".")
-        if not hostname or hostname == "*" or hostname.startswith("."):
+        hostname = urlparse(url).hostname
+        if not hostname:
             raise ImproperlyConfigured(
-                f"PAPERLESS_URL {url!r} has no valid hostname, expected a URL like https://example.com",
+                f"PAPERLESS_URL {url!r} has no hostname, expected a URL like https://example.com",
             )
         CSRF_TRUSTED_ORIGINS.append(url)
         CORS_ALLOWED_ORIGINS.append(url)
-        if ":" in hostname and not hostname.startswith("["):
-            hostname = f"[{hostname}]"  # Add brackets around IPv6 addresses
         ALLOWED_HOSTS.append(hostname)
 
     return url

src/paperless/tests/settings/test_settings.py

@@ -1,8 +1,4 @@
-import json
 import os
-import subprocess
-import sys
-from pathlib import Path
 from unittest import TestCase
 from unittest import mock
 
@@ -172,66 +168,8 @@ class TestPaperlessURLSettings(TestCase):
             self.assertIn(url, settings.CORS_ALLOWED_ORIGINS)
 
 
-@pytest.mark.parametrize(
-    ("url", "allowed_hosts", "expected"),
-    [
-        (None, None, ["*"]),
-        (None, "", ["localhost"]),
-        ("https://example.com:8443", None, ["localhost", "example.com"]),
-        ("https://example.com.", "", ["localhost", "example.com"]),
-        ("http://[::1]:8000", None, ["localhost", "[::1]"]),
-        ("https://example.com", "*", ["*", "example.com"]),
-        (
-            "https://example.com",
-            "lan.example.com",
-            ["lan.example.com", "localhost", "example.com"],
-        ),
-    ],
-)
-def test_allowed_hosts_at_startup(
-    tmp_path: Path,
-    url: str | None,
-    allowed_hosts: str | None,
-    expected: list[str],
-) -> None:
-    config = tmp_path / "paperless.conf"
-    config.touch()
-    env = {
-        **os.environ,
-        "PAPERLESS_CONFIGURATION_PATH": str(config),
-        "PAPERLESS_LOGGING_DIR": str(tmp_path),
-    }
-    for name, value in (
-        ("PAPERLESS_URL", url),
-        ("PAPERLESS_ALLOWED_HOSTS", allowed_hosts),
-    ):
-        if value is None:
-            env.pop(name, None)
-        else:
-            env[name] = value
-
-    result = subprocess.run(
-        [
-            sys.executable,
-            "-c",
-            "import json; from paperless.settings import ALLOWED_HOSTS; print(json.dumps(ALLOWED_HOSTS))",
-        ],
-        cwd=Path(__file__).resolve().parents[3],
-        env=env,
-        capture_output=True,
-        text=True,
-        timeout=30,
-        check=False,
-    )
-    assert result.returncode == 0, result.stderr
-    assert json.loads(result.stdout) == expected
-
-
-@pytest.mark.parametrize(
-    "url",
-    ["example.com", "https://", "/just/a/path", "https://*", "https://.example.com"],
-)
-def test_paperless_url_without_valid_hostname_is_rejected(
+@pytest.mark.parametrize("url", ["example.com", "https://", "/just/a/path"])
+def test_paperless_url_without_hostname_is_rejected(
     monkeypatch: pytest.MonkeyPatch,
     url: str,
 ) -> None:
@@ -241,9 +179,9 @@ def test_paperless_url_without_valid_hostname_is_rejected(
     WHEN:
         - The URL is parsed
     THEN:
-        - A configuration error is raised for missing or wildcard hostnames
+        - A configuration error is raised instead of adding None to ALLOWED_HOSTS
     """
     monkeypatch.setenv("PAPERLESS_URL", url)
 
-    with pytest.raises(ImproperlyConfigured, match="no valid hostname"):
+    with pytest.raises(ImproperlyConfigured, match="no hostname"):
         _parse_paperless_url()

src/paperless_ai/chat.py

@@ -22,8 +22,8 @@ logger = logging.getLogger("paperless_ai.chat")
 CHAT_METADATA_DELIMITER = "\n\n__PAPERLESS_CHAT_METADATA__"
 CHAT_ERROR_MESSAGE = "Sorry, something went wrong while generating a response."
 CHAT_NO_CONTENT_MESSAGE = "Sorry, I couldn't find any content to answer your question."
+MAX_CHAT_REFERENCES = 3
 CHAT_RETRIEVER_TOP_K = 5
-MAX_CHAT_REFERENCES = CHAT_RETRIEVER_TOP_K
 
 
 def _build_chat_prompt(output_language: str | None) -> str: