Merge branch 'beta' into beta-sec-autocomplete-perms

To help readability, use NameTuple for the returns, so we know what list of pks is what
Fix: enforce current permissions in autocomplete
2026-07-22 11:54:55 +00:00 · 2026-07-21 16:42:15 -07:00 · 2026-07-21 16:16:15 -07:00 · 2026-07-21 16:03:22 -07:00 · 2026-07-21 16:50:28 +00:00 · 2026-07-21 07:31:58 -07:00
21 changed files with 375 additions and 347 deletions
@@ -1,6 +1,5 @@
 import { expect, test } from '@playwright/test'
 import path from 'node:path'
-import { mockFilterSelectionData } from '../mock-filter-selection-data'

 const REQUESTS_HAR = path.join(__dirname, 'requests/api-settings.har')

@@ -8,7 +7,6 @@ test('should activate / deactivate save button when settings change', async ({
  page,
 }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/settings')
  await expect(page.getByRole('button', { name: 'Save' })).toBeDisabled()
  await page.getByLabel('Use system setting').click()
@@ -18,7 +16,6 @@ test('should activate / deactivate save button when settings change', async ({

 test('should warn on unsaved changes', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/settings')
  await page.getByLabel('Use system setting').click()
  await page.getByRole('link', { name: 'Dashboard' }).click()
@@ -31,7 +28,6 @@ test('should warn on unsaved changes', async ({ page }) => {

 test('should apply appearance changes when set', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/settings')
  await expect(page.locator('html')).toHaveAttribute('data-bs-theme', /auto/)
  await page.getByLabel('Use system setting').click()
@@ -1,6 +1,5 @@
 import { expect, test } from '@playwright/test'
 import path from 'node:path'
-import { mockFilterSelectionData } from '../mock-filter-selection-data'

 const REQUESTS_HAR1 = path.join(__dirname, 'requests/api-dashboard1.har')
 const REQUESTS_HAR2 = path.join(__dirname, 'requests/api-dashboard2.har')
@@ -9,7 +8,6 @@ const REQUESTS_HAR4 = path.join(__dirname, 'requests/api-dashboard4.har')

 test('dashboard inbox link', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR1, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await page.getByRole('link', { name: 'Documents in inbox' }).click()
  await expect(page).toHaveURL(/tags__id__in=9/)
@@ -18,7 +16,6 @@ test('dashboard inbox link', async ({ page }) => {

 test('dashboard total documents link', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR2, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await page.getByRole('link').filter({ hasText: 'Total documents' }).click()
  await expect(page).toHaveURL(/documents/)
@@ -28,7 +25,6 @@ test('dashboard total documents link', async ({ page }) => {

 test('dashboard saved view show all', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR3, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await page
    .locator('pngx-widget-frame')
@@ -42,7 +38,6 @@ test('dashboard saved view show all', async ({ page }) => {

 test('dashboard saved view document links', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR4, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await page
    .locator('pngx-widget-frame')
@@ -56,7 +51,6 @@ test('dashboard saved view document links', async ({ page }) => {

 test('test slim sidebar', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR1, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await page.locator('.sidebar-slim-toggler').click()
  await expect(
@@ -1,6 +1,5 @@
 import { expect, test } from '@playwright/test'
 import path from 'node:path'
-import { mockFilterSelectionData } from '../mock-filter-selection-data'

 const REQUESTS_HAR = path.join(__dirname, 'requests/api-document-detail.har')
 const REQUESTS_HAR2 = path.join(__dirname, 'requests/api-document-detail2.har')
@@ -9,7 +8,6 @@ test('should activate / deactivate save button when changes are saved', async ({
  page,
 }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents/175/')
  await page.waitForSelector('pngx-document-detail pngx-input-text:first-child')
  await expect(page.getByTitle('Storage path', { exact: true })).toHaveText(
@@ -22,7 +20,6 @@ test('should activate / deactivate save button when changes are saved', async ({

 test('should warn on unsaved changes', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents/175/')
  await expect(page.getByTitle('Correspondent', { exact: true })).toHaveText(
    /\w+/
@@ -42,7 +39,6 @@ test('should warn on unsaved changes', async ({ page }) => {

 test('should support tab direct navigation', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents/175/details')
  await expect(page.getByRole('tab', { name: 'Details' })).toHaveAttribute(
    'aria-selected',
@@ -72,7 +68,6 @@ test('should support tab direct navigation', async ({ page }) => {

 test('should show a mobile preview', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents/175/')
  await page.setViewportSize({ width: 400, height: 1000 })
  await expect(page.getByRole('tab', { name: 'Preview' })).toBeVisible()
@@ -82,7 +77,6 @@ test('should show a mobile preview', async ({ page }) => {

 test('should show a list of notes', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents/175/notes')
  await expect(page.locator('pngx-document-notes')).toBeVisible()
  await expect(
@@ -95,7 +89,6 @@ test('should show a list of notes', async ({ page }) => {

 test('should support quick filters', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR2, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents/175/details')
  await page
    .getByRole('button', { name: 'Filter documents with these Tags' })
@@ -1,6 +1,5 @@
 import { expect, test } from '@playwright/test'
 import path from 'node:path'
-import { mockFilterSelectionData } from '../mock-filter-selection-data'

 const REQUESTS_HAR1 = path.join(__dirname, 'requests/api-document-list1.har')
 const REQUESTS_HAR2 = path.join(__dirname, 'requests/api-document-list2.har')
@@ -11,7 +10,6 @@ const REQUESTS_HAR6 = path.join(__dirname, 'requests/api-document-list6.har')

 test('basic filtering', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR1, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents')
  await page.getByRole('button', { name: 'Tags' }).click()
  await page.getByRole('menuitem', { name: 'Inbox' }).click()
@@ -47,7 +45,6 @@ test('basic filtering', async ({ page }) => {

 test('text filtering', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR2, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents')
  await page.getByRole('main').getByRole('combobox').click()
  await page.getByRole('main').getByRole('combobox').fill('test')
@@ -84,7 +81,6 @@ test('text filtering', async ({ page }) => {

 test('date filtering', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR3, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents')
  await page.getByRole('button', { name: 'Dates' }).click()
  await page.locator('.ng-arrow-wrapper').first().click()
@@ -107,7 +103,6 @@ test('date filtering', async ({ page }) => {

 test('sorting', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR4, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents')
  await page.getByRole('button', { name: 'Sort' }).click()
  await page.getByRole('button', { name: 'ASN' }).click()
@@ -146,7 +141,6 @@ test('sorting', async ({ page }) => {

 test('change views', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR5, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents')
  await page.locator('.btn-group > label').first().click()
  await expect(page.locator('pngx-document-list table')).toBeVisible()
@@ -158,7 +152,6 @@ test('change views', async ({ page }) => {

 test('bulk edit', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR6, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/documents')

  await page.locator('pngx-document-card-small').nth(0).click()
@@ -1,35 +0,0 @@
-import { Page } from '@playwright/test'
-
-const EMPTY_SELECTION_DATA = {
-  selected_correspondents: [],
-  selected_tags: [],
-  selected_document_types: [],
-  selected_storage_paths: [],
-  selected_custom_fields: [],
-}
-
-/**
- * The document list now fires a GET to filter_selection_data on every
- * non-search reload(), independent of and concurrent with the main list
- * request. It's not present in any of the recorded HAR fixtures, so with
- * `notFound: 'fallback'` it would otherwise fall through to the real
- * network (nothing listens there in e2e, since only the frontend dev
- * server is started) and fail every test that reloads the list.
- *
- * Playwright checks routes in reverse-registration order, so this must be
- * registered before a test's own page.routeFromHAR() call for the HAR
- * route's `notFound: 'fallback'` to defer back to this one.
- */
-export async function mockFilterSelectionData(page: Page) {
-  await page.route('**/api/documents/filter_selection_data/**', (route) =>
-    route.fulfill({
-      json: EMPTY_SELECTION_DATA,
-      // The app calls the (cross-origin, from the e2e app's perspective)
-      // backend at http://localhost:8000 while served from :4200, so a
-      // fulfilled response needs the same CORS header the real backend
-      // sends (and that recorded HAR responses already carry) or the
-      // browser rejects it as a cross-origin failure.
-      headers: { 'Access-Control-Allow-Origin': 'http://localhost:4200' },
-    })
-  )
-}
@@ -1,12 +1,10 @@
 import { expect, test } from '@playwright/test'
 import path from 'node:path'
-import { mockFilterSelectionData } from '../mock-filter-selection-data'

 const REQUESTS_HAR = path.join(__dirname, 'requests/api-global-permissions.har')

 test('should not allow user to edit settings', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await expect(page.getByRole('link', { name: 'Settings' })).not.toBeAttached()
  await page.goto('/settings')
@@ -17,7 +15,6 @@ test('should not allow user to edit settings', async ({ page }) => {

 test('should not allow user to view documents', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await expect(
    page.locator('nav').getByRole('link', { name: 'Documents' })
@@ -34,7 +31,6 @@ test('should not allow user to view documents', async ({ page }) => {

 test('should not allow user to view correspondents', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
@@ -47,7 +43,6 @@ test('should not allow user to view correspondents', async ({ page }) => {

 test('should not allow user to view tags', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
@@ -60,7 +55,6 @@ test('should not allow user to view tags', async ({ page }) => {

 test('should not allow user to view document types', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
@@ -73,7 +67,6 @@ test('should not allow user to view document types', async ({ page }) => {

 test('should not allow user to view storage paths', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await expect(
    page.getByRole('link', { name: 'Attributes' })
@@ -86,7 +79,6 @@ test('should not allow user to view storage paths', async ({ page }) => {

 test('should not allow user to view logs', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await expect(page.getByRole('link', { name: 'Logs' })).not.toBeAttached()
  await page.goto('/logs')
@@ -97,7 +89,6 @@ test('should not allow user to view logs', async ({ page }) => {

 test('should not allow user to view tasks', async ({ page }) => {
  await page.routeFromHAR(REQUESTS_HAR, { notFound: 'fallback' })
-  await mockFilterSelectionData(page)
  await page.goto('/dashboard')
  await expect(page.getByRole('link', { name: 'Tasks' })).not.toBeAttached()
  await page.goto('/tasks')
@@ -191,14 +191,6 @@ describe('BulkEditorComponent', () => {
  })

  afterEach(async () => {
-    // A filter_selection_data request now fires concurrently with every
-    // non-search reload(), independent of whether a given test flushes or
-    // even inspects the primary list response. Drain any left unclaimed.
-    httpTestingController.match(
-      (request) =>
-        request.url ===
-        `${environment.apiBaseUrl}documents/filter_selection_data/`
-    )
    httpTestingController.verify()
  })

@@ -394,7 +386,7 @@ describe('BulkEditorComponent', () => {
      parameters: { add_tags: [101], remove_tags: [] },
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -440,7 +432,7 @@ describe('BulkEditorComponent', () => {
      parameters: { add_tags: [101], remove_tags: [] },
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
  })

@@ -469,7 +461,7 @@ describe('BulkEditorComponent', () => {
      .expectOne(`${environment.apiBaseUrl}documents/bulk_edit/`)
      .flush(true)
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -560,7 +552,7 @@ describe('BulkEditorComponent', () => {
      parameters: { correspondent: 101 },
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -592,7 +584,7 @@ describe('BulkEditorComponent', () => {
      .expectOne(`${environment.apiBaseUrl}documents/bulk_edit/`)
      .flush(true)
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -658,7 +650,7 @@ describe('BulkEditorComponent', () => {
      parameters: { document_type: 101 },
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -690,7 +682,7 @@ describe('BulkEditorComponent', () => {
      .expectOne(`${environment.apiBaseUrl}documents/bulk_edit/`)
      .flush(true)
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -756,7 +748,7 @@ describe('BulkEditorComponent', () => {
      parameters: { storage_path: 101 },
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -788,7 +780,7 @@ describe('BulkEditorComponent', () => {
      .expectOne(`${environment.apiBaseUrl}documents/bulk_edit/`)
      .flush(true)
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -854,7 +846,7 @@ describe('BulkEditorComponent', () => {
      parameters: { add_custom_fields: [101], remove_custom_fields: [102] },
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -886,7 +878,7 @@ describe('BulkEditorComponent', () => {
      .expectOne(`${environment.apiBaseUrl}documents/bulk_edit/`)
      .flush(true)
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -995,7 +987,7 @@ describe('BulkEditorComponent', () => {
      documents: [3, 4],
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -1088,7 +1080,7 @@ describe('BulkEditorComponent', () => {
      documents: [3, 4],
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -1123,7 +1115,7 @@ describe('BulkEditorComponent', () => {
      source_mode: 'latest_version',
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -1164,7 +1156,7 @@ describe('BulkEditorComponent', () => {
      metadata_document_id: 3,
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -1183,7 +1175,7 @@ describe('BulkEditorComponent', () => {
      delete_originals: true,
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -1204,7 +1196,7 @@ describe('BulkEditorComponent', () => {
      archive_fallback: true,
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -1307,7 +1299,7 @@ describe('BulkEditorComponent', () => {
      },
    })
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -1615,7 +1607,7 @@ describe('BulkEditorComponent', () => {
    expect(toastServiceShowInfoSpy).toHaveBeenCalled()
    expect(listReloadSpy).toHaveBeenCalled()
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    ) // list reload
    httpTestingController.match(
      `${environment.apiBaseUrl}documents/?page=1&page_size=100000&fields=id`
@@ -84,28 +84,6 @@ const view: SavedView = {
  filter_rules: filterRules,
 }

-const emptySelectionData = {
-  selected_correspondents: [],
-  selected_tags: [],
-  selected_document_types: [],
-  selected_storage_paths: [],
-  selected_custom_fields: [],
-}
-
-// A successful (non-search) list response now triggers a separate,
-// non-blocking request for filter dropdown counts. Tests that flush a
-// successful list response need to also flush this follow-up request.
-function flushSelectionDataRequest(
-  httpTestingController: HttpTestingController,
-  querySuffix: string = ''
-) {
-  const req = httpTestingController.expectOne(
-    `${environment.apiBaseUrl}documents/filter_selection_data/${querySuffix}`
-  )
-  expect(req.request.method).toEqual('GET')
-  req.flush(emptySelectionData)
-}
-
 describe('DocumentListViewService', () => {
  let httpTestingController: HttpTestingController
  let documentListViewService: DocumentListViewService
@@ -127,7 +105,6 @@ describe('DocumentListViewService', () => {
    })

    sessionStorage.clear()
-    localStorage.clear()
    httpTestingController = TestBed.inject(HttpTestingController)
    documentListViewService = TestBed.inject(DocumentListViewService)
    settingsService = TestBed.inject(SettingsService)
@@ -137,19 +114,8 @@ describe('DocumentListViewService', () => {

  afterEach(() => {
    documentListViewService.cancelPending()
-    // A filter_selection_data request now fires concurrently with every
-    // non-search reload(), independent of whether the test cares about or
-    // flushes the primary list response. Drain any that a test didn't
-    // explicitly claim via flushSelectionDataRequest, so unrelated tests
-    // don't have to know about this follow-up request to pass verify().
-    httpTestingController.match(
-      (request) =>
-        request.url ===
-        `${environment.apiBaseUrl}documents/filter_selection_data/`
-    )
    httpTestingController.verify()
    sessionStorage.clear()
-    localStorage.clear()
  })

  afterAll(() => {
@@ -162,11 +128,10 @@ describe('DocumentListViewService', () => {
    expect(documentListViewService.currentPage).toEqual(1)
    documentListViewService.reload()
    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    req.flush(full_results)
-    flushSelectionDataRequest(httpTestingController)
    expect(req.request.method).toEqual('GET')
    expect(documentListViewService.isReloading).toBeFalsy()
    expect(documentListViewService.activeSavedViewId).toBeNull()
@@ -178,12 +143,12 @@ describe('DocumentListViewService', () => {
  it('should handle error on page request out of range', () => {
    documentListViewService.currentPage = 50
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=50&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=50&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    req.flush([], { status: 404, statusText: 'Unexpected error' })
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    expect(documentListViewService.currentPage).toEqual(1)
@@ -200,20 +165,21 @@ describe('DocumentListViewService', () => {
    ]
    documentListViewService.setFilterRules(filterRulesAny)
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false&tags__id__in=${tags__id__in}`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true&tags__id__in=${tags__id__in}`
    )
    expect(req.request.method).toEqual('GET')
    req.flush(
      { archive_serial_number: 'hello' },
      { status: 404, statusText: 'Unexpected error' }
    )
-    // the error is a plain field error (not a page-out-of-range or deleted
-    // custom-field-sort case), so no automatic retry request is sent here
-    expect(documentListViewService.error).toBeTruthy()
+    req = httpTestingController.expectOne(
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
+    )
+    expect(req.request.method).toEqual('GET')
    // reset the list
    documentListViewService.setFilterRules([])
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
  })

@@ -221,7 +187,7 @@ describe('DocumentListViewService', () => {
    documentListViewService.currentPage = 1
    documentListViewService.sortField = 'custom_field_999'
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-custom_field_999&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-custom_field_999&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    req.flush(
@@ -230,7 +196,7 @@ describe('DocumentListViewService', () => {
    )
    // resets itself
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
  })

@@ -245,7 +211,7 @@ describe('DocumentListViewService', () => {
    ]
    documentListViewService.setFilterRules(filterRulesAny)
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false&tags__id__in=${tags__id__in}`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true&tags__id__in=${tags__id__in}`
    )
    expect(req.request.method).toEqual('GET')
    req.flush('Generic error', { status: 404, statusText: 'Unexpected error' })
@@ -253,7 +219,7 @@ describe('DocumentListViewService', () => {
    // reset the list
    documentListViewService.setFilterRules([])
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
  })

@@ -262,7 +228,7 @@ describe('DocumentListViewService', () => {
    expect(documentListViewService.sortReverse).toBeTruthy()
    documentListViewService.setSort('added', false)
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=added&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=added&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    expect(documentListViewService.sortField).toEqual('added')
@@ -270,12 +236,12 @@ describe('DocumentListViewService', () => {

    documentListViewService.sortField = 'created'
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=created&truncate_content=true&include_selection_data=true`
    )
    expect(documentListViewService.sortField).toEqual('created')
    documentListViewService.sortReverse = true
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    expect(documentListViewService.sortReverse).toBeTruthy()
@@ -318,7 +284,7 @@ describe('DocumentListViewService', () => {
    const req = httpTestingController.expectOne(
      `${environment.apiBaseUrl}documents/?page=${page}&page_size=${
        documentListViewService.pageSize
-      }&ordering=${reverse ? '-' : ''}${sort}&truncate_content=true&include_selection_data=false`
+      }&ordering=${reverse ? '-' : ''}${sort}&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    expect(documentListViewService.currentPage).toEqual(page)
@@ -335,7 +301,7 @@ describe('DocumentListViewService', () => {
    }
    documentListViewService.loadFromQueryParams(convertToParamMap(params))
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=${documentListViewService.currentPage}&page_size=${documentListViewService.pageSize}&ordering=-added&truncate_content=true&include_selection_data=false&tags__id__all=${tags__id__all}`
+      `${environment.apiBaseUrl}documents/?page=${documentListViewService.currentPage}&page_size=${documentListViewService.pageSize}&ordering=-added&truncate_content=true&include_selection_data=true&tags__id__all=${tags__id__all}`
    )
    expect(req.request.method).toEqual('GET')
    expect(documentListViewService.filterRules).toEqual([
@@ -345,16 +311,12 @@ describe('DocumentListViewService', () => {
      },
    ])
    req.flush(full_results)
-    flushSelectionDataRequest(
-      httpTestingController,
-      `?tags__id__all=${tags__id__all}`
-    )
  })

  it('should use filter rules to update query params', () => {
    documentListViewService.setFilterRules(filterRules)
    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=${documentListViewService.currentPage}&page_size=${documentListViewService.pageSize}&ordering=-created&truncate_content=true&include_selection_data=false&tags__id__all=${tags__id__all}`
+      `${environment.apiBaseUrl}documents/?page=${documentListViewService.currentPage}&page_size=${documentListViewService.pageSize}&ordering=-created&truncate_content=true&include_selection_data=true&tags__id__all=${tags__id__all}`
    )
    expect(req.request.method).toEqual('GET')
  })
@@ -363,31 +325,26 @@ describe('DocumentListViewService', () => {
    documentListViewService.currentPage = 2
    let req = httpTestingController.expectOne((request) =>
      request.urlWithParams.startsWith(
-        `${environment.apiBaseUrl}documents/?page=2&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+        `${environment.apiBaseUrl}documents/?page=2&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
      )
    )
    expect(req.request.method).toEqual('GET')
    req.flush(full_results)
-    flushSelectionDataRequest(httpTestingController)

    documentListViewService.setFilterRules(filterRules, true)

    const filteredReqs = httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false&tags__id__all=${tags__id__all}`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true&tags__id__all=${tags__id__all}`
    )
    expect(filteredReqs).toHaveLength(1)
    filteredReqs[0].flush(full_results)
-    flushSelectionDataRequest(
-      httpTestingController,
-      `?tags__id__all=${tags__id__all}`
-    )
    expect(documentListViewService.currentPage).toEqual(1)
  })

  it('should support quick filter', () => {
    documentListViewService.quickFilter(filterRules)
    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=${documentListViewService.currentPage}&page_size=${documentListViewService.pageSize}&ordering=-created&truncate_content=true&include_selection_data=false&tags__id__all=${tags__id__all}`
+      `${environment.apiBaseUrl}documents/?page=${documentListViewService.currentPage}&page_size=${documentListViewService.pageSize}&ordering=-created&truncate_content=true&include_selection_data=true&tags__id__all=${tags__id__all}`
    )
    expect(req.request.method).toEqual('GET')
  })
@@ -410,21 +367,21 @@ describe('DocumentListViewService', () => {
      convertToParamMap(params)
    )
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=${page}&page_size=${documentListViewService.pageSize}&ordering=-added&truncate_content=true&include_selection_data=false&tags__id__all=${tags__id__all}`
+      `${environment.apiBaseUrl}documents/?page=${page}&page_size=${documentListViewService.pageSize}&ordering=-added&truncate_content=true&include_selection_data=true&tags__id__all=${tags__id__all}`
    )
    expect(req.request.method).toEqual('GET')
    // reset the list
    documentListViewService.currentPage = 1
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-added&truncate_content=true&include_selection_data=false&tags__id__all=9`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-added&truncate_content=true&include_selection_data=true&tags__id__all=9`
    )
    documentListViewService.setFilterRules([])
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-added&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-added&truncate_content=true&include_selection_data=true`
    )
    documentListViewService.sortField = 'created'
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    documentListViewService.activateSavedView(null)
  })
@@ -432,22 +389,18 @@ describe('DocumentListViewService', () => {
  it('should support navigating next / previous', () => {
    documentListViewService.setFilterRules([])
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(documentListViewService.currentPage).toEqual(1)
    documentListViewService.pageSize = 3
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=3&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=3&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    req.flush({
      count: 3,
      results: documents.slice(0, 3),
    })
-    // two reload()s ran above (setFilterRules, then pageSize), each firing
-    // its own concurrent filter_selection_data request with an identical
-    // (unfiltered) URL; this test doesn't assert on selectionData, so let
-    // afterEach's drain step clean both up rather than disambiguating here.
    expect(documentListViewService.hasNext(documents[0].id)).toBeTruthy()
    expect(documentListViewService.hasPrevious(documents[0].id)).toBeFalsy()
    documentListViewService.getNext(documents[0].id).subscribe((docId) => {
@@ -494,7 +447,7 @@ describe('DocumentListViewService', () => {
    expect(documentListViewService.currentPage).toEqual(1)
    documentListViewService.pageSize = 3
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=3&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=3&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    jest
      .spyOn(documentListViewService, 'getLastPage')
@@ -509,7 +462,7 @@ describe('DocumentListViewService', () => {
    expect(reloadSpy).toHaveBeenCalled()
    expect(documentListViewService.currentPage).toEqual(2)
    const reqs = httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=2&page_size=3&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=2&page_size=3&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(reqs.length).toBeGreaterThan(0)
  })
@@ -544,11 +497,11 @@ describe('DocumentListViewService', () => {
      .mockReturnValue(documents)
    documentListViewService.currentPage = 2
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=2&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=2&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    documentListViewService.pageSize = 3
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=2&page_size=3&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=2&page_size=3&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    const reloadSpy = jest.spyOn(documentListViewService, 'reload')
    documentListViewService.getPrevious(1).subscribe({
@@ -558,7 +511,7 @@ describe('DocumentListViewService', () => {
    expect(reloadSpy).toHaveBeenCalled()
    expect(documentListViewService.currentPage).toEqual(1)
    const reqs = httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=3&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=3&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(reqs.length).toBeGreaterThan(0)
  })
@@ -571,11 +524,10 @@ describe('DocumentListViewService', () => {
  it('should support select a document', () => {
    documentListViewService.reload()
    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    req.flush(full_results)
-    flushSelectionDataRequest(httpTestingController)
    documentListViewService.toggleSelected(documents[0])
    expect(documentListViewService.isSelected(documents[0])).toBeTruthy()
    documentListViewService.toggleSelected(documents[0])
@@ -585,11 +537,10 @@ describe('DocumentListViewService', () => {
  it('should support select all', () => {
    documentListViewService.reload()
    const reloadReq = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(reloadReq.request.method).toEqual('GET')
    reloadReq.flush(full_results)
-    flushSelectionDataRequest(httpTestingController)

    documentListViewService.selectAll()
    expect(documentListViewService.allSelected).toBeTruthy()
@@ -602,14 +553,13 @@ describe('DocumentListViewService', () => {
  it('should support select page', () => {
    documentListViewService.pageSize = 3
    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=3&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=3&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    req.flush({
      count: 3,
      results: documents.slice(0, 3),
    })
-    flushSelectionDataRequest(httpTestingController)
    documentListViewService.selectPage()
    expect(documentListViewService.selected.size).toEqual(3)
    expect(documentListViewService.isSelected(documents[5])).toBeFalsy()
@@ -618,11 +568,10 @@ describe('DocumentListViewService', () => {
  it('should support select range', () => {
    documentListViewService.reload()
    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    req.flush(full_results)
-    flushSelectionDataRequest(httpTestingController)
    documentListViewService.toggleSelected(documents[0])
    expect(documentListViewService.isSelected(documents[0])).toBeTruthy()
    documentListViewService.selectRangeTo(documents[2])
@@ -634,10 +583,9 @@ describe('DocumentListViewService', () => {
  it('should clear all-selected mode when toggling a single document', () => {
    documentListViewService.reload()
    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    req.flush(full_results)
-    flushSelectionDataRequest(httpTestingController)

    documentListViewService.selectAll()
    expect(documentListViewService.allSelected).toBeTruthy()
@@ -651,10 +599,9 @@ describe('DocumentListViewService', () => {
  it('should clear all-selected mode when selecting a range', () => {
    documentListViewService.reload()
    const req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    req.flush(full_results)
-    flushSelectionDataRequest(httpTestingController)

    documentListViewService.selectAll()
    documentListViewService.toggleSelected(documents[1])
@@ -672,24 +619,22 @@ describe('DocumentListViewService', () => {
  it('should support selection range reduction', () => {
    documentListViewService.reload()
    let req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(req.request.method).toEqual('GET')
    req.flush(full_results)
-    flushSelectionDataRequest(httpTestingController)

    documentListViewService.selectAll()
    expect(documentListViewService.selected.size).toEqual(6)

    documentListViewService.setFilterRules(filterRules)
    req = httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false&tags__id__all=9`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true&tags__id__all=9`
    )
    req.flush({
      count: 3,
      results: documents.slice(0, 3),
    })
-    flushSelectionDataRequest(httpTestingController, '?tags__id__all=9')
    expect(documentListViewService.allSelected).toBeTruthy()
    expect(documentListViewService.selected.size).toEqual(3)
  })
@@ -698,7 +643,7 @@ describe('DocumentListViewService', () => {
    const cancelSpy = jest.spyOn(documentListViewService, 'cancelPending')
    documentListViewService.reload()
    httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true&tags__id__all=9`
    )
    expect(cancelSpy).toHaveBeenCalled()
  })
@@ -717,7 +662,7 @@ describe('DocumentListViewService', () => {
    documentListViewService.setFilterRules([])
    expect(documentListViewService.sortField).toEqual('created')
    httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
  })

@@ -744,11 +689,11 @@ describe('DocumentListViewService', () => {
    expect(localStorageSpy).toHaveBeenCalled()
    // reload triggered
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    documentListViewService.displayFields = null
    httpTestingController.match(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    expect(documentListViewService.displayFields).toEqual(
      DEFAULT_DISPLAY_FIELDS.filter((f) => f.id !== DisplayField.ADDED).map(
@@ -793,7 +738,7 @@ describe('DocumentListViewService', () => {
  it('should generate quick filter URL preserving default state', () => {
    documentListViewService.reload()
    httpTestingController.expectOne(
-      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=false`
+      `${environment.apiBaseUrl}documents/?page=1&page_size=50&ordering=-created&truncate_content=true&include_selection_data=true`
    )
    const urlTree = documentListViewService.getQuickFilterUrl(filterRules)
    expect(urlTree).toBeDefined()
@@ -314,39 +314,12 @@ export class DocumentListViewService {
    }
  }

-  private loadFilterSelectionData(filterRules: FilterRule[]) {
-    this.documentService
-      .getFilterSelectionData(filterRules)
-      .pipe(takeUntil(this.unsubscribeNotifier))
-      .subscribe({
-        next: (selectionData) => {
-          this.selectionData = selectionData
-          this.markChanged()
-        },
-        error: () => {
-          this.selectionData = null
-          this.markChanged()
-        },
-      })
-  }
-
  reload(onFinish?, updateQueryParams: boolean = true) {
    this.cancelPending()
    this.isReloading = true
    this.error = null
    this.markChanged()
    let activeListViewState = this.activeListViewState
-    // Full-text search results are already narrowed by the search backend, so
-    // computing selection data inline there is cheap. A plain (unfiltered or
-    // ORM-filtered) browse can span the entire document set, so its selection
-    // data is fetched separately -- concurrently with the list itself, rather
-    // than blocking or waiting on it.
-    const isFullTextSearch = isFullTextFilterRule(
-      activeListViewState.filterRules
-    )
-    if (!isFullTextSearch) {
-      this.loadFilterSelectionData(activeListViewState.filterRules)
-    }
    this.documentService
      .listFiltered(
        activeListViewState.currentPage,
@@ -354,22 +327,17 @@ export class DocumentListViewService {
        activeListViewState.sortField,
        activeListViewState.sortReverse,
        activeListViewState.filterRules,
-        {
-          truncate_content: true,
-          include_selection_data: isFullTextSearch,
-        }
+        { truncate_content: true, include_selection_data: true }
      )
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe({
        next: (result) => {
+          const resultWithSelectionData = result as DocumentResults
          this.initialized = true
          this.isReloading = false
          activeListViewState.collectionSize = result.count
          activeListViewState.documents = result.results
-          if (isFullTextSearch) {
-            this.selectionData =
-              (result as DocumentResults).selection_data ?? null
-          }
+          this.selectionData = resultWithSelectionData.selection_data ?? null
          this.syncSelectedToCurrentPage()
          this.markChanged()

@@ -408,9 +376,6 @@ export class DocumentListViewService {
            // e.g. field was deleted
            this.sortField = 'created'
          } else {
-            // cancel the concurrently-fired selection-data request too, so it
-            // can't resolve afterward and clobber this reset with stale data
-            this.cancelPending()
            this.selectionData = null
            let errorMessage
            if (
@@ -41,24 +41,6 @@ export abstract class AbstractPaperlessService<T extends ObjectWithId> {
    }
  }

-  /**
-   * Merges a plain params object into an HttpParams instance, skipping
-   * null/undefined values so they aren't serialized as literal "null" /
-   * "undefined" query string entries.
-   */
-  protected withParams(
-    params,
-    base: HttpParams = new HttpParams()
-  ): HttpParams {
-    let httpParams = base
-    for (let key in params) {
-      if (params[key] != null) {
-        httpParams = httpParams.set(key, params[key])
-      }
-    }
-    return httpParams
-  }
-
  list(
    page?: number,
    pageSize?: number,
@@ -78,7 +60,11 @@ export abstract class AbstractPaperlessService<T extends ObjectWithId> {
    if (ordering) {
      httpParams = httpParams.set('ordering', ordering)
    }
-    httpParams = this.withParams(extraParams, httpParams)
+    for (let extraParamKey in extraParams) {
+      if (extraParams[extraParamKey] != null) {
+        httpParams = httpParams.set(extraParamKey, extraParams[extraParamKey])
+      }
+    }
    return this.http
      .get<Results<T>>(this.getResourceUrl(), {
        params: httpParams,
@@ -127,7 +113,11 @@ export abstract class AbstractPaperlessService<T extends ObjectWithId> {
    httpParams = httpParams.set('id__in', ids.join(','))
    httpParams = httpParams.set('ordering', '-id')
    httpParams = httpParams.set('page_size', 1000)
-    httpParams = this.withParams(extraParams, httpParams)
+    for (let extraParamKey in extraParams) {
+      if (extraParams[extraParamKey] != null) {
+        httpParams = httpParams.set(extraParamKey, extraParams[extraParamKey])
+      }
+    }
    return this.http
      .get<Results<T>>(this.getResourceUrl(), {
        params: httpParams,
@@ -398,13 +398,6 @@ export class DocumentService extends AbstractPaperlessService<Document> {
    )
  }

-  getFilterSelectionData(filterRules: FilterRule[]): Observable<SelectionData> {
-    return this.http.get<SelectionData>(
-      this.getResourceUrl(null, 'filter_selection_data'),
-      { params: this.withParams(queryParamsFromFilterRules(filterRules)) }
-    )
-  }
-
  getSuggestions(id: number): Observable<DocumentSuggestions> {
    return this.http.get<DocumentSuggestions>(
      this.getResourceUrl(id, 'suggestions')
@@ -1024,6 +1024,8 @@ class ObjectOwnedOrGrantedPermissionsFilter(ObjectPermissionsFilter):
    """

    def filter_queryset(self, request, queryset, view):
+        if request.user.is_superuser:
+            return queryset
        objects_with_perms = super().filter_queryset(request, queryset, view)
        objects_owned = queryset.filter(owner=request.user)
        objects_unowned = queryset.filter(owner__isnull=True)
@@ -11,6 +11,7 @@ from enum import StrEnum
 from itertools import islice
 from typing import TYPE_CHECKING
 from typing import Final
+from typing import NamedTuple
 from typing import Self
 from typing import TypedDict
 from typing import TypeVar
@@ -21,6 +22,7 @@ import tantivy
 from django.conf import settings
 from django.contrib.contenttypes.models import ContentType
 from django.utils.timezone import get_current_timezone
+from guardian.shortcuts import get_groups_with_perms
 from guardian.shortcuts import get_users_with_perms

 from documents.search._query import build_permission_filter
@@ -45,6 +47,8 @@ if TYPE_CHECKING:
    from pathlib import Path

    from django.contrib.auth.models import AbstractUser
+    from django.contrib.auth.models import Group
+    from django.contrib.auth.models import User
    from django.db.models import QuerySet

    from documents.models import Document
@@ -59,6 +63,18 @@ _LOCK_BACKOFF_CAP: Final[float] = 10.0  # seconds
 T = TypeVar("T")


+class ViewerGrant(NamedTuple):
+    """Direct user and group view grants for a single document.
+
+    Named fields (rather than a bare 2-tuple) so ``viewer_ids`` and
+    ``viewer_group_ids`` can't be silently transposed at a call site — both
+    are ``list[int]``, so a positional swap would type-check cleanly.
+    """
+
+    viewer_ids: list[int]
+    viewer_group_ids: list[int]
+
+
 class SearchMode(StrEnum):
    QUERY = "query"
    TEXT = "text"
@@ -367,7 +383,7 @@ class TantivyBackend:
    ) -> tantivy.Query:
        """Wrap a query with a permission filter if the user is not a superuser."""
        if user is not None:
-            permission_filter = build_permission_filter(self._schema, user)
+            permission_filter = self._build_permission_filter(user)
            return tantivy.Query.boolean_query(
                [
                    (tantivy.Occur.Must, query),
@@ -376,11 +392,21 @@ class TantivyBackend:
            )
        return query

+    def _build_permission_filter(self, user: AbstractUser) -> tantivy.Query:
+        """Build a filter using the user's current group memberships."""
+        group_ids = user.groups.values_list("pk", flat=True)
+        return build_permission_filter(
+            self._schema,
+            user,
+            viewer_group_ids=group_ids,
+        )
+
    def _build_tantivy_doc(
        self,
        document: Document,
        effective_content: str | None = None,
        viewer_ids: list[int] | None = None,
+        viewer_group_ids: list[int] | None = None,
    ) -> tantivy.Document:
        """Build a tantivy Document from a Django Document instance.

@@ -497,10 +523,26 @@ class TantivyBackend:
            users_with_perms = get_users_with_perms(
                document,
                only_with_perms_in=["view_document"],
+                with_group_users=False,
+            )
+            viewer_ids = list(
+                cast("QuerySet[User]", users_with_perms).values_list("id", flat=True),
            )
-            viewer_ids = [int(u.id) for u in users_with_perms]
        for viewer_id in viewer_ids:
            doc.add_unsigned("viewer_id", viewer_id)
+        if viewer_group_ids is None:
+            groups_with_perms = get_groups_with_perms(
+                document,
+                only_with_perms_in=["view_document"],
+            )
+            viewer_group_ids = list(
+                cast("QuerySet[Group]", groups_with_perms).values_list(
+                    "id",
+                    flat=True,
+                ),
+            )
+        for viewer_group_id in viewer_group_ids:
+            doc.add_unsigned("viewer_group_id", viewer_group_id)

        # Autocomplete words
        text_sources = [document.title, content]
@@ -813,7 +855,7 @@ class TantivyBackend:
        # Intersect with permission filter so autocomplete words from
        # invisible documents don't leak to other users.
        if user is not None and not user.is_superuser:
-            permission_query = build_permission_filter(self._schema, user)
+            permission_query = self._build_permission_filter(user)

        matches = searcher.terms_with_prefix(
            "autocomplete_word",
@@ -915,7 +957,7 @@ class TantivyBackend:
    def rebuild(
        self,
        documents: QuerySet[Document],
-        iter_wrapper: IterWrapper[tuple[Document, list[int]]] = identity,
+        iter_wrapper: IterWrapper[tuple[Document, ViewerGrant]] = identity,
        writer_heap_bytes: int = 512_000_000,
    ) -> None:
        """
@@ -928,8 +970,8 @@ class TantivyBackend:
            documents: QuerySet of Document instances to index
            iter_wrapper: Optional wrapper function for progress tracking
                (e.g., progress bar). Wraps an iterable of
-                ``(document, viewer_ids)`` pairs and should yield each pair
-                unchanged, advancing one step per document.
+                ``(document, (viewer_ids, viewer_group_ids))`` pairs and should yield
+                each unchanged, advancing one step per document.
            writer_heap_bytes: Tantivy writer memory budget (split across the
                writer's threads). Larger values buffer more docs in RAM before
                flushing a segment, deferring merge work; they do not avoid it.
@@ -953,11 +995,14 @@ class TantivyBackend:
        documents_stream = _DocumentViewerStream(documents, chunk_size=1000)
        try:
            writer = new_index.writer(heap_size=writer_heap_bytes)
-            for document, viewer_ids in iter_wrapper(documents_stream):
+            for document, (viewer_ids, viewer_group_ids) in iter_wrapper(
+                documents_stream,
+            ):
                doc = self._build_tantivy_doc(
                    document,
                    document.get_effective_content(),
                    viewer_ids=viewer_ids,
+                    viewer_group_ids=viewer_group_ids,
                )
                writer.add_document(doc)
            writer.commit()
@@ -978,19 +1023,26 @@ def chunked(iterable, size):
        yield chunk


-class _DocumentViewerStream:
-    """Yield (document, viewer_ids) pairs while batch-loading viewer ids.
+_EMPTY_VIEWER_GRANT: Final[ViewerGrant] = ViewerGrant(
+    viewer_ids=[],
+    viewer_group_ids=[],
+)

-    Viewer permissions are fetched one SQL query per chunk (see
-    ``_bulk_get_viewer_ids``), but documents are yielded individually so a
+
+class _DocumentViewerStream:
+    """Yield document permission data while batch-loading grants.
+
+    Viewer permissions are fetched in batches (see
+    ``_bulk_get_viewer_permissions``), but documents are yielded individually so a
    progress bar wrapped around this stream advances per document rather than
    jumping a whole chunk at a time. ``__len__`` lets the progress helper still
    discover the total (it inspects ``QuerySet``/``Sized``).

-    The viewer ids travel with each document in the yielded pair rather than
-    through a separate mutable attribute, so the pairing survives regardless
-    of how ``iter_wrapper`` consumes the stream (buffering, batching, etc.) —
-    there is no reliance on the caller advancing this generator in lock-step.
+    The viewer and group ids travel with each document in the yielded pair
+    rather than through a separate mutable attribute, so the pairing survives
+    regardless of how ``iter_wrapper`` consumes the stream (buffering,
+    batching, etc.) — there is no reliance on the caller advancing this
+    generator in lock-step.
    """

    def __init__(self, documents: QuerySet[Document], *, chunk_size: int) -> None:
@@ -1000,25 +1052,25 @@ class _DocumentViewerStream:
    def __len__(self) -> int:
        return self._documents.count()

-    def __iter__(self) -> Iterator[tuple[Document, list[int]]]:
+    def __iter__(self) -> Iterator[tuple[Document, ViewerGrant]]:
        # iterator(chunk_size=…) streams from a server-side cursor instead of
        # materialising the whole queryset in memory; since Django 4.1 it still
        # honours prefetch_related, running the prefetches one batch at a time.
        documents = self._documents.iterator(chunk_size=self._chunk_size)
        for chunk in chunked(documents, self._chunk_size):
-            viewer_ids_by_pk = _bulk_get_viewer_ids([doc.pk for doc in chunk])
+            grants_by_pk = _bulk_get_viewer_permissions([doc.pk for doc in chunk])
            for doc in chunk:
-                yield doc, viewer_ids_by_pk.get(doc.pk, [])
+                yield doc, grants_by_pk.get(doc.pk, _EMPTY_VIEWER_GRANT)


-def _bulk_get_viewer_ids(doc_pks: Sequence[int]) -> dict[int, list[int]]:
-    """Fetch all view_document permissions for a batch of documents in one query.
+def _bulk_get_viewer_permissions(
+    doc_pks: Sequence[int],
+) -> dict[int, ViewerGrant]:
+    """Fetch direct user and group view grants for a batch of documents, keyed by pk.

-    Mirrors get_users_with_perms(doc, only_with_perms_in=["view_document"])
-    (with_group_users defaults to True there): a user counts as a viewer if
-    they hold the permission directly, OR via membership in a group that
-    holds the permission. Missing the group case would silently drop search
-    access for group-only viewers.
+    Group grants remain group IDs in the index so permission checks use the
+    requesting user's current memberships. Expanding groups to user IDs here
+    would leave stale access behind after a user is removed from a group.
    """
    from collections import defaultdict

@@ -1032,6 +1084,7 @@ def _bulk_get_viewer_ids(doc_pks: Sequence[int]) -> dict[int, list[int]]:
    str_pks = [str(pk) for pk in doc_pks]

    viewer_map: dict[int, set[int]] = defaultdict(set)
+    viewer_group_map: dict[int, set[int]] = defaultdict(set)

    # Fold the permission lookup into the query via a join on codename instead
    # of a separate Permission.objects.get(), which would otherwise run once per
@@ -1045,22 +1098,22 @@ def _bulk_get_viewer_ids(doc_pks: Sequence[int]) -> dict[int, list[int]]:
    for object_pk, user_id in user_qs:
        viewer_map[int(object_pk)].add(user_id)

-    # User.groups has related_query_name="user", so group__user__id joins
-    # through the group membership m2m to the member users' ids in the same
-    # single-query fashion as user_qs above (values_list compiles to one SQL
-    # JOIN; no per-row Python-side lookups follow, so select_related /
-    # prefetch_related do not apply here).
    group_qs = GroupObjectPermission.objects.filter(
        content_type=ct,
        permission__content_type=ct,
        permission__codename="view_document",
        object_pk__in=str_pks,
-    ).values_list("object_pk", "group__user__id")
-    for object_pk, user_id in group_qs:
-        if user_id is not None:
-            viewer_map[int(object_pk)].add(user_id)
+    ).values_list("object_pk", "group_id")
+    for object_pk, group_id in group_qs:
+        viewer_group_map[int(object_pk)].add(group_id)

-    return {object_pk: list(user_ids) for object_pk, user_ids in viewer_map.items()}
+    return {
+        object_pk: ViewerGrant(
+            viewer_ids=list(viewer_map.get(object_pk, ())),
+            viewer_group_ids=list(viewer_group_map.get(object_pk, ())),
+        )
+        for object_pk in viewer_map.keys() | viewer_group_map.keys()
+    }


 # Module-level singleton with proper thread safety
@@ -20,6 +20,7 @@ from documents.search._translate import SearchQueryError
 from documents.search._translate import translate_query

 if TYPE_CHECKING:
+    from collections.abc import Iterable
    from datetime import tzinfo

    from django.contrib.auth.base_user import AbstractBaseUser
@@ -114,6 +115,7 @@ def normalize_query(query: str) -> str:
 def build_permission_filter(
    schema: tantivy.Schema,
    user: AbstractBaseUser,
+    viewer_group_ids: Iterable[int] = (),
 ) -> tantivy.Query:
    """
    Build a query filter for user document permissions.
@@ -123,10 +125,12 @@ def build_permission_filter(
    - Public documents (no owner) are visible to all users
    - Private documents are visible to their owner
    - Documents explicitly shared with the user are visible
+    - Documents shared with one of the user's current groups are visible

    Args:
        schema: Tantivy schema for field validation
        user: User to check permissions for
+        viewer_group_ids: Current group memberships for the user

    Returns:
        Tantivy query that filters results to visible documents
@@ -140,7 +144,13 @@ def build_permission_filter(
    )
    owned = tantivy.Query.term_query(schema, "owner_id", user.pk)
    shared = tantivy.Query.term_query(schema, "viewer_id", user.pk)
-    return tantivy.Query.disjunction_max_query([no_owner, owned, shared])
+    group_shared = [
+        tantivy.Query.term_query(schema, "viewer_group_id", group_id)
+        for group_id in viewer_group_ids
+    ]
+    return tantivy.Query.disjunction_max_query(
+        [no_owner, owned, shared, *group_shared],
+    )


 DEFAULT_SEARCH_FIELDS = [
@@ -102,6 +102,7 @@ def build_schema() -> tantivy.Schema:
        "tag_id",
        "owner_id",
        "viewer_id",
+        "viewer_group_id",
    ):
        sb.add_unsigned_field(field, stored=False, indexed=True, fast=True)

@@ -1419,6 +1419,30 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        m.assert_called_once()

+    @mock.patch("documents.views.bulk_edit.merge")
+    def test_merge_and_delete_requires_change_permission(self, m) -> None:
+        self.setup_mock(m, "merge")
+        user = User.objects.create_user(username="no-change")
+        user.user_permissions.add(
+            Permission.objects.get(codename="add_document"),
+            Permission.objects.get(codename="delete_document"),
+        )
+        self.client.force_authenticate(user=user)
+
+        response = self.client.post(
+            "/api/documents/merge/",
+            json.dumps(
+                {
+                    "documents": [self.doc2.id, self.doc3.id],
+                    "delete_originals": True,
+                },
+            ),
+            content_type="application/json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        m.assert_not_called()
+
    @mock.patch("documents.views.bulk_edit.merge")
    def test_merge_invalid_parameters(self, m) -> None:
        self.setup_mock(m, "merge")
@@ -1668,6 +1692,74 @@ class TestBulkEditAPI(DirectoriesMixin, APITestCase):
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        m.assert_called_once()

+    @mock.patch("documents.views.bulk_edit.edit_pdf")
+    def test_edit_pdf_update_requires_change_permission(self, m) -> None:
+        self.setup_mock(m, "edit_pdf")
+        user = User.objects.create_user(username="no-change")
+        self.client.force_authenticate(user=user)
+
+        response = self.client.post(
+            "/api/documents/edit_pdf/",
+            json.dumps(
+                {
+                    "documents": [self.doc2.id],
+                    "operations": [{"page": 1}],
+                    "update_document": True,
+                },
+            ),
+            content_type="application/json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        m.assert_not_called()
+
+    @mock.patch("documents.views.bulk_edit.remove_password")
+    @mock.patch("documents.views.bulk_edit.edit_pdf")
+    def test_delete_original_requires_delete_permission(
+        self,
+        edit_pdf_mock,
+        remove_password_mock,
+    ) -> None:
+        self.setup_mock(edit_pdf_mock, "edit_pdf")
+        self.setup_mock(remove_password_mock, "remove_password")
+        user = User.objects.create_user(username="no-delete")
+        user.user_permissions.add(
+            Permission.objects.get(codename="add_document"),
+            Permission.objects.get(codename="change_document"),
+        )
+        self.client.force_authenticate(user=user)
+
+        cases = [
+            (
+                "/api/documents/edit_pdf/",
+                {
+                    "documents": [self.doc2.id],
+                    "operations": [{"page": 1}],
+                    "delete_original": True,
+                },
+                edit_pdf_mock,
+            ),
+            (
+                "/api/documents/remove_password/",
+                {
+                    "documents": [self.doc2.id],
+                    "password": "secret",
+                    "delete_original": True,
+                },
+                remove_password_mock,
+            ),
+        ]
+        for endpoint, payload, operation_mock in cases:
+            with self.subTest(endpoint=endpoint):
+                response = self.client.post(
+                    endpoint,
+                    json.dumps(payload),
+                    content_type="application/json",
+                )
+
+                self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+                operation_mock.assert_not_called()
+
    @mock.patch("documents.views.bulk_edit.remove_password")
    def test_remove_password(self, m) -> None:
        self.setup_mock(m, "remove_password")
@@ -669,6 +669,26 @@ class TestDocumentVersioningApi(DirectoriesMixin, APITestCase):

        self.assertEqual(resp.status_code, status.HTTP_403_FORBIDDEN)

+    def test_update_version_requires_global_change_permission(self) -> None:
+        user = User.objects.create_user(username="add-only")
+        user.user_permissions.add(Permission.objects.get(codename="add_document"))
+        root = Document.objects.create(
+            title="root",
+            checksum="root",
+            mime_type="application/pdf",
+        )
+        self.client.force_authenticate(user=user)
+
+        with mock.patch("documents.views.consume_file") as consume_mock:
+            resp = self.client.post(
+                f"/api/documents/{root.id}/update_version/",
+                {"document": self._make_pdf_upload()},
+                format="multipart",
+            )
+
+        self.assertEqual(resp.status_code, status.HTTP_403_FORBIDDEN)
+        consume_mock.apply_async.assert_not_called()
+
    def test_update_version_returns_404_for_missing_document(self) -> None:
        resp = self.client.post(
            "/api/documents/9999/update_version/",
@@ -1241,7 +1241,7 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
            ],
        )

-    def test_selection_data_endpoint(self) -> None:
+    def test_list_with_include_selection_data(self) -> None:
        correspondent = Correspondent.objects.create(name="c1")
        doc_type = DocumentType.objects.create(name="dt1")
        storage_path = StoragePath.objects.create(name="sp1")
@@ -1259,28 +1259,30 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
        non_matching_doc.tags.add(Tag.objects.create(name="other"))

        response = self.client.get(
-            f"/api/documents/filter_selection_data/?tags__id__in={tag.id}",
+            f"/api/documents/?tags__id__in={tag.id}&include_selection_data=true",
        )

        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertNotIn("results", response.data)
+        self.assertIn("selection_data", response.data)

        selected_correspondent = next(
            item
-            for item in response.data["selected_correspondents"]
+            for item in response.data["selection_data"]["selected_correspondents"]
            if item["id"] == correspondent.id
        )
        selected_tag = next(
-            item for item in response.data["selected_tags"] if item["id"] == tag.id
+            item
+            for item in response.data["selection_data"]["selected_tags"]
+            if item["id"] == tag.id
        )
        selected_type = next(
            item
-            for item in response.data["selected_document_types"]
+            for item in response.data["selection_data"]["selected_document_types"]
            if item["id"] == doc_type.id
        )
        selected_storage_path = next(
            item
-            for item in response.data["selected_storage_paths"]
+            for item in response.data["selection_data"]["selected_storage_paths"]
            if item["id"] == storage_path.id
        )

@@ -1289,17 +1291,6 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
        self.assertEqual(selected_type["document_count"], 1)
        self.assertEqual(selected_storage_path["document_count"], 1)

-    def test_list_no_longer_supports_include_selection_data(self) -> None:
-        """
-        include_selection_data was never part of a stable release (beta-only,
-        introduced and removed within the 3.0.0-beta cycle) -- the plain list
-        endpoint should just ignore the param now rather than compute it inline.
-        """
-        response = self.client.get("/api/documents/?include_selection_data=true")
-
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertNotIn("selection_data", response.data)
-
    def test_statistics(self) -> None:
        doc1 = Document.objects.create(
            title="none1",
@@ -131,6 +131,10 @@ class TestApiAuth(DirectoriesMixin, APITestCase):
            self.client.get("/api/saved_views/").status_code,
            status.HTTP_403_FORBIDDEN,
        )
+        self.assertEqual(
+            self.client.get("/api/search/autocomplete/?term=test").status_code,
+            status.HTTP_403_FORBIDDEN,
+        )

    def test_api_sufficient_permissions(self) -> None:
        user = User.objects.create_user(username="test")
@@ -832,6 +832,7 @@ class TestDocumentSearchApi(DirectoriesMixin, APITestCase):
        """
        u1 = User.objects.create_user("user1")
        u2 = User.objects.create_user("user2")
+        u1.user_permissions.add(Permission.objects.get(codename="view_document"))

        self.client.force_authenticate(user=u1)

@@ -878,6 +879,30 @@ class TestDocumentSearchApi(DirectoriesMixin, APITestCase):
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        self.assertEqual(response.data, ["applebaum", "apples", "appletini"])

+    def test_search_autocomplete_group_revocation_is_immediate(self) -> None:
+        user = User.objects.create_user("group-user")
+        owner = User.objects.create_user("document-owner")
+        group = Group.objects.create(name="temporary-viewers")
+        user.user_permissions.add(Permission.objects.get(codename="view_document"))
+        user.groups.add(group)
+
+        document = Document.objects.create(
+            title="private",
+            content="canarysecretautocomplete",
+            checksum="group-revocation",
+            owner=owner,
+        )
+        assign_perm("view_document", group, document)
+        get_backend().add_or_update(document)
+        self.client.force_authenticate(user=user)
+
+        response = self.client.get("/api/search/autocomplete/?term=canarysecret")
+        self.assertEqual(response.data, ["canarysecretautocomplete"])
+
+        user.groups.remove(group)
+        response = self.client.get("/api/search/autocomplete/?term=canarysecret")
+        self.assertEqual(response.data, [])
+
    def test_search_autocomplete_field_name_match(self) -> None:
        """
        GIVEN:
@@ -1034,27 +1034,29 @@ class DocumentViewSet(
            ],
        }

-    def _base_document_queryset(self):
-        # Root documents only, with the annotations that filter_backends rely
-        # on (effective_content for SearchFilter, num_notes for ordering) --
-        # but no select_related/prefetch_related, since those only matter for
-        # serializing documents, not for filtering, ordering, or aggregating.
+    def get_queryset(self):
        latest_version_content = Subquery(
            Document.objects.filter(root_document=OuterRef("pk"))
            .order_by("-id")
            .values("content")[:1],
        )
+        # A correlated subquery avoids the LEFT JOIN + Count() this used to
+        # be, which forced a GROUP BY aggregate over every matching document
+        # before the query could even be sorted or limited.
+        note_count = Subquery(
+            Note.objects.filter(document=OuterRef("pk"))
+            .order_by()
+            .values("document")
+            .annotate(count=Count("pk"))
+            .values("count"),
+            output_field=IntegerField(),
+        )
        return (
            Document.objects.filter(root_document__isnull=True)
            .distinct()
            .order_by("-created", "-id")
            .annotate(effective_content=Coalesce(latest_version_content, F("content")))
-            .annotate(num_notes=Count("notes"))
-        )
-
-    def get_queryset(self):
-        return (
-            self._base_document_queryset()
+            .annotate(num_notes=Coalesce(note_count, 0))
            .select_related("correspondent", "storage_path", "document_type", "owner")
            .prefetch_related(
                Prefetch(
@@ -1193,21 +1195,24 @@ class DocumentViewSet(

        return response

-    @extend_schema(
-        operation_id="documents_filter_selection_data",
-        description=(
-            "Returns per-tag/correspondent/document-type/storage-path/custom-field "
-            "document counts for the current filter, without paginating or "
-            "serializing the matching documents themselves. Split out from the "
-            "plain document list so that browsing the (potentially huge) unfiltered "
-            "document list doesn't pay for this aggregation on every request."
-        ),
-        responses={200: inline_serializer(name="SelectionData", fields={})},
-    )
-    @action(detail=False, methods=["get"], url_path="filter_selection_data")
-    def filter_selection_data(self, request, *args, **kwargs):
-        queryset = self.filter_queryset(self._base_document_queryset())
-        return Response(self._get_selection_data_for_queryset(queryset))
+    def list(self, request, *args, **kwargs):
+        if not get_boolean(
+            str(request.query_params.get("include_selection_data", "false")),
+        ):
+            return super().list(request, *args, **kwargs)
+
+        queryset = self.filter_queryset(self.get_queryset())
+        selection_data = self._get_selection_data_for_queryset(queryset)
+
+        page = self.paginate_queryset(queryset)
+        if page is not None:
+            serializer = self.get_serializer(page, many=True)
+            response = self.get_paginated_response(serializer.data)
+            response.data["selection_data"] = selection_data
+            return response
+
+        serializer = self.get_serializer(queryset, many=True)
+        return Response({"results": serializer.data, "selection_data": selection_data})

    def destroy(self, request, *args, **kwargs):
        from documents.search import get_backend
@@ -1942,10 +1947,13 @@ class DocumentViewSet(
                "root_document",
            ).get(pk=pk)
            root_doc = get_root_document(request_doc)
-            if request.user is not None and not has_perms_owner_aware(
-                request.user,
-                "change_document",
-                root_doc,
+            if request.user is not None and (
+                not request.user.has_perm("documents.change_document")
+                or not has_perms_owner_aware(
+                    request.user,
+                    "change_document",
+                    root_doc,
+                )
            ):
                return HttpResponseForbidden("Insufficient permissions")
        except Document.DoesNotExist:
@@ -2751,7 +2759,7 @@ class DocumentOperationPermissionMixin(PassUserMixin, DocumentSelectionMixin):
            )
            or (method == bulk_edit.edit_pdf and parameters.get("update_document"))
        ):
-            has_perms = user_is_owner_of_all_documents
+            has_perms = has_perms and user_is_owner_of_all_documents

        # check global add permissions for methods that create documents
        if (
@@ -2776,6 +2784,11 @@ class DocumentOperationPermissionMixin(PassUserMixin, DocumentSelectionMixin):
                    method in [bulk_edit.merge, bulk_edit.split]
                    and parameters.get("delete_originals")
                )
+                or (
+                    method in [bulk_edit.edit_pdf, bulk_edit.remove_password]
+                    and parameters.get("delete_original")
+                    and not parameters.get("update_document")
+                )
            )
            and not user.has_perm("documents.delete_document")
        ):
@@ -3376,7 +3389,7 @@ class SelectionDataView(GenericAPIView[Any]):
    ),
 )
 class SearchAutoCompleteView(GenericAPIView[Any]):
-    permission_classes = (IsAuthenticated,)
+    permission_classes = (IsAuthenticated, ViewDocumentsPermissions)

    def get(self, request, format=None):
        user = self.request.user if hasattr(self.request, "user") else None
Author	SHA1	Message	Date
shamoonandGitHub	591e78cef4	Merge branch 'beta' into beta-sec-autocomplete-perms	2026-07-21 16:42:15 -07:00
stumpylog	708391976f	To help readability, use NameTuple for the returns, so we know what list of pks is what	2026-07-21 16:16:15 -07:00
shamoon	7bfaa86c7c	Fix: enforce current permissions in autocomplete	2026-07-21 16:03:22 -07:00
shamoonandGitHub	8aab34ea73	Security (beta): two small permission check fixes (#13186 )	2026-07-21 16:50:28 +00:00
Trenton H GitHub Claude Sonnet 5	8404198ec8	Fix (beta): short-circuit ObjectOwnedOrGrantedPermissionsFilter for superusers (#13183 ) Mirrors the existing short-circuit already present in its sibling class, ObjectOwnedPermissionsFilter, which this one lacked. Benchmarked as a superuser against a 100k-document corpus: no measurable difference. django-guardian's own get_objects_for_user() (called via super().filter_queryset()) already returns the queryset unrestricted for superusers before this change, so the guardian permission tables were never actually queried for superusers either way. This change only skips building a redundant 3-way OR of conditions that are all subsets of the already-unrestricted queryset -- worth keeping for clarity/consistency with the sibling filter, not as a performance claim. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-21 07:31:58 -07:00
Trenton H GitHub Claude Sonnet 5	d8d8872414	Fix (beta): compute num_notes via a subquery instead of Count()+distinct() (#13182 ) DocumentViewSet.get_queryset() annotated num_notes via a LEFT JOIN to documents_note plus Count(), which requires the database to aggregate every matching document's note count before it can even sort or paginate the result -- on every list request, not just filtered ones. Switched to the same correlated-subquery pattern already used two lines above for effective_content (Subquery + OuterRef), which Django compiles to portable SQL across sqlite/postgresql/mariadb rather than a join-based aggregate. Benchmarked against a 100k synthetic document corpus (Postgres): the plain document list request dropped from ~2.2-2.4s to ~0.9-1.0s. Note that a separate, larger cost remains in the same queryset's plain .distinct() call, which still forces a full sort over every matching row regardless of this fix -- tracked separately, not addressed here. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 13:59:44 -07:00