Auto translate strings

* Fix (beta): batch document user_can_change checks to avoid per-row N+1

DocumentSerializer.get_user_can_change() built a fresh
ObjectPermissionChecker and issued a guardian permission-table query for
every document row not owned by the requesting user -- correct, but O(N)
per page load for any non-superuser viewing documents owned by others.

BulkPermissionMixin already batches this exact lookup (2 queries total,
regardless of page size) for Correspondent/Tag/DocumentType/CustomField,
but was gated behind the rarely-used `full_perms` flag and DocumentViewSet
didn't inherit it at all. Changed the gate to "any list action" (cheap:
just two extra queries per page) and added BulkPermissionMixin to
DocumentViewSet, then updated get_user_can_change to consult that batched
context before falling back to a fresh guardian check.

Preserves guardian's own superuser shortcut explicitly (has_perm() special-
cases is_superuser without a query; the batched-context path doesn't, so it
needed its own check) -- covered by a new regression test, since no
existing test exercised a superuser viewing an other-owned document.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Fix (beta): don't batch permissions for tantivy search results

UnifiedSearchViewSet.list() returns SearchHit/dict-like objects for
text/title/query/more_like_id search requests, not Document ORM instances.
Adding BulkPermissionMixin to DocumentViewSet (previous commit) meant its
get_serializer_context() ran for search responses too, and its
_get_object_perms() -- which expects real model instances with .pk --
crashed on the dict-like hits with AttributeError, turning every search
request into a 400.

Skip the batching specifically for search requests (existing
_is_search_request() check) by calling past BulkPermissionMixin in the
MRO; non-search list() calls (which return a real Document queryset) are
unaffected and still get the batching.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

src-ui/messages.xlf

@@ -11515,21 +11515,21 @@
         <source>Successfully completed one-time migratration of settings to the database!</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">636</context>
+          <context context-type="linenumber">635</context>
         </context-group>
       </trans-unit>
       <trans-unit id="5558341108007064934" datatype="html">
         <source>Unable to migrate settings to the database, please try saving manually.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">637</context>
+          <context context-type="linenumber">636</context>
         </context-group>
       </trans-unit>
       <trans-unit id="1168781785897678748" datatype="html">
         <source>You can restart the tour from the settings page.</source>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/services/settings.service.ts</context>
-          <context context-type="linenumber">709</context>
+          <context context-type="linenumber">708</context>
         </context-group>
       </trans-unit>
       <trans-unit id="3852289441366561594" datatype="html">

src-ui/src/app/components/chat/chat/chat.component.html

@@ -16,7 +16,7 @@
               @if (message.role === 'assistant' && message.references?.length) {
                 <div class="chat-references list-group mt-3">
                   @for (reference of message.references; track reference.id) {
-                    <a class="list-group-item list-group-item-action text-primary" [routerLink]="['/documents', reference.id]">
+                    <a class="list-group-item list-group-item-action d-flex text-primary text-break" [routerLink]="['/documents', reference.id]">
                       <i-bs width="0.9em" height="0.9em" name="file-text" class="me-1"></i-bs><span>{{ reference.title }}</span>
                     </a>
                   }

src-ui/src/app/services/settings.service.ts

@@ -17,7 +17,7 @@ import {
   estimateBrightnessForColor,
   hexToHsl,
 } from 'src/app/utils/color'
-import { environment } from 'src/environments/environment'
+import { DEFAULT_APP_TITLE, environment } from 'src/environments/environment'
 import { DEFAULT_DISPLAY_FIELDS, DisplayField } from '../data/document'
 import { SavedView } from '../data/saved-view'
 import {
@@ -359,9 +359,8 @@ export class SettingsService {
       }),
       tap((uisettings) => {
         this.assignSafeSettings(uisettings.settings)
-        if (this.get(SETTINGS_KEYS.APP_TITLE)?.length) {
-          environment.appTitle = this.get(SETTINGS_KEYS.APP_TITLE)
-        }
+        environment.appTitle =
+          this.get(SETTINGS_KEYS.APP_TITLE) || DEFAULT_APP_TITLE
         this.maybeMigrateSettings()
         // to update lang cookie
         if (this.settings['language']?.length)

src-ui/src/environments/environment.prod.ts

@@ -1,10 +1,12 @@
 const base_url = new URL(document.baseURI)
 
+export const DEFAULT_APP_TITLE = 'Paperless-ngx'
+
 export const environment = {
   production: true,
   apiBaseUrl: document.baseURI + 'api/',
   apiVersion: '10', // match src/paperless/settings.py
-  appTitle: 'Paperless-ngx',
+  appTitle: DEFAULT_APP_TITLE,
   tag: 'prod',
   version: '3.0.0',
   webSocketHost: window.location.host,

src-ui/src/environments/environment.ts

@@ -2,11 +2,13 @@
 // `ng build --configuration production` replaces `environment.ts` with `environment.prod.ts`.
 // The list of file replacements can be found in `angular.json`.
 
+export const DEFAULT_APP_TITLE = 'Paperless-ngx'
+
 export const environment = {
   production: false,
   apiBaseUrl: 'http://localhost:8000/api/',
   apiVersion: '10',
-  appTitle: 'Paperless-ngx',
+  appTitle: DEFAULT_APP_TITLE,
   tag: 'dev',
   version: 'DEVELOPMENT',
   webSocketHost: 'localhost:8000',

src/documents/filters.py

@@ -161,9 +161,7 @@ class ObjectFilter(Filter):
 class InboxFilter(Filter):
     def filter(self, qs, value):
         if value == "true":
-            # A document can have more than one tag flagged as an inbox tag
-            # (nothing enforces uniqueness), so this join can multiply rows.
-            return qs.filter(tags__is_inbox_tag=True).distinct()
+            return qs.filter(tags__is_inbox_tag=True)
         elif value == "false":
             return qs.exclude(tags__is_inbox_tag=True)
         else:
@@ -270,10 +268,6 @@ class CustomFieldsFilter(Filter):
                     for _, option in enumerate(options):
                         if option.get("label").lower().find(value.lower()) != -1:
                             option_ids.extend([option.get("id")])
-            # A document with multiple custom field instances can match more
-            # than one of these OR-ed branches (or the same branch via
-            # different fields), each via its own join to custom_fields --
-            # dedupe explicitly rather than relying on the caller to.
             return (
                 qs.filter(custom_fields__field__name__icontains=value)
                 | qs.filter(custom_fields__value_text__icontains=value)
@@ -286,7 +280,7 @@ class CustomFieldsFilter(Filter):
                 | qs.filter(custom_fields__value_document_ids__icontains=value)
                 | qs.filter(custom_fields__value_select__in=option_ids)
                 | qs.filter(custom_fields__value_long_text__icontains=value)
-            ).distinct()
+            )
         else:
             return qs
 

src/documents/serialisers.py

@@ -392,15 +392,34 @@ class OwnedObjectSerializer(
         }
 
     def get_user_can_change(self, obj) -> bool:
-        checker = ObjectPermissionChecker(self.user) if self.user is not None else None
-        return (
-            obj.owner is None
-            or obj.owner == self.user
-            or (
-                self.user is not None
-                and checker.has_perm(f"change_{obj.__class__.__name__.lower()}", obj)
+        if obj.owner is None or obj.owner == self.user:
+            return True
+        if self.user is None:
+            return False
+        if self.user.is_active and self.user.is_superuser:
+            # Mirrors guardian's own ObjectPermissionChecker.has_perm() shortcut --
+            # superusers aren't necessarily granted explicit object permissions,
+            # so the batched context below would otherwise incorrectly say no.
+            return True
+
+        # Prefer the page-level batch computed by BulkPermissionMixin
+        # (get_serializer_context) over a fresh per-object guardian check,
+        # which would otherwise query the permission tables once per row.
+        users_change_perms = self.context.get("users_change_perms")
+        groups_change_perms = self.context.get("groups_change_perms")
+        if users_change_perms is not None and groups_change_perms is not None:
+            if self.user.pk in users_change_perms.get(obj.pk, []):
+                return True
+            user_group_ids = getattr(self, "_user_group_ids", None)
+            if user_group_ids is None:
+                user_group_ids = set(self.user.groups.values_list("id", flat=True))
+                self._user_group_ids = user_group_ids
+            return bool(
+                user_group_ids.intersection(groups_change_perms.get(obj.pk, [])),
             )
-        )
+
+        checker = ObjectPermissionChecker(self.user)
+        return checker.has_perm(f"change_{obj.__class__.__name__.lower()}", obj)
 
     @staticmethod
     def get_shared_object_pks(objects: Iterable):

src/documents/tests/test_api_documents.py

@@ -883,62 +883,6 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
         results = response.data["results"]
         self.assertEqual(len(results), 3)
 
-    def test_is_in_inbox_filter_no_duplicates_with_multiple_inbox_tags(self) -> None:
-        """
-        GIVEN:
-            - A document tagged with two different inbox tags
-        WHEN:
-            - The document list is filtered by is_in_inbox=true
-        THEN:
-            - The document appears exactly once, not once per matching tag
-        """
-        doc = Document.objects.create(title="doc", checksum="c1")
-        inbox_1 = Tag.objects.create(name="inbox1", is_inbox_tag=True)
-        inbox_2 = Tag.objects.create(name="inbox2", is_inbox_tag=True)
-        doc.tags.add(inbox_1, inbox_2)
-
-        response = self.client.get("/api/documents/?is_in_inbox=true")
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        results = response.data["results"]
-        self.assertEqual(len(results), 1)
-        self.assertEqual(results[0]["id"], doc.id)
-
-    def test_custom_fields_icontains_filter_no_duplicates(self) -> None:
-        """
-        GIVEN:
-            - A document with two custom field instances that both match the
-              same custom_fields__icontains search term
-        WHEN:
-            - The document list is filtered by custom_fields__icontains
-        THEN:
-            - The document appears exactly once, not once per matching field
-        """
-        doc = Document.objects.create(title="doc", checksum="c1")
-        field_1 = CustomField.objects.create(
-            name="apple",
-            data_type=CustomField.FieldDataType.STRING,
-        )
-        field_2 = CustomField.objects.create(
-            name="apricot",
-            data_type=CustomField.FieldDataType.STRING,
-        )
-        CustomFieldInstance.objects.create(
-            document=doc,
-            field=field_1,
-            value_text="something",
-        )
-        CustomFieldInstance.objects.create(
-            document=doc,
-            field=field_2,
-            value_text="something else",
-        )
-
-        response = self.client.get("/api/documents/?custom_fields__icontains=ap")
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        results = response.data["results"]
-        self.assertEqual(len(results), 1)
-        self.assertEqual(results[0]["id"], doc.id)
-
     def test_custom_field_select_filter(self) -> None:
         """
         GIVEN:

src/documents/tests/test_api_permissions.py

@@ -568,6 +568,30 @@ class TestApiAuth(DirectoriesMixin, APITestCase):
         self.assertNotIn("user_can_change", results[0])
         self.assertNotIn("is_shared_by_requester", results[0])
 
+    def test_superuser_user_can_change_without_explicit_grant(self) -> None:
+        """
+        A superuser has implicit change access to every document, even one
+        owned by someone else with no explicit guardian grant -- mirrors
+        guardian's own ObjectPermissionChecker.has_perm() superuser shortcut.
+        """
+        superuser = User.objects.create_superuser(username="admin")
+        other_user = User.objects.create_user(username="user2")
+        Document.objects.create(
+            title="Test",
+            content="content",
+            checksum="1",
+            owner=other_user,
+        )
+
+        self.client.force_authenticate(superuser)
+
+        response = self.client.get("/api/documents/", format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        results = response.json()["results"]
+        self.assertEqual(len(results), 1)
+        self.assertTrue(results[0]["user_can_change"])
+
     @mock.patch("allauth.mfa.adapter.DefaultMFAAdapter.is_mfa_enabled")
     def test_basic_auth_mfa_enabled(self, mock_is_mfa_enabled) -> None:
         """

src/documents/views.py

@@ -431,14 +431,12 @@ class BulkPermissionMixin:
         This avoid fetching permissions object by object in database.
         """
         context = super().get_serializer_context()
-        try:
-            full_perms = get_boolean(
-                str(self.request.query_params.get("full_perms", "false")),
-            )
-        except ValueError:
-            full_perms = False
 
-        if not full_perms:
+        if getattr(self, "action", None) != "list":
+            # Batching only pays off across a page of objects; for single-object
+            # actions (retrieve, update, ...) the per-object fallback in
+            # get_user_can_change()/_get_perms() is cheap and avoids scanning
+            # the whole queryset here.
             return context
 
         # Check which objects are being paginated
@@ -943,6 +941,7 @@ class EmailDocumentDetailSchema(EmailSerializer):
     ),
 )
 class DocumentViewSet(
+    BulkPermissionMixin,
     PassUserMixin,
     RetrieveModelMixin,
     UpdateModelMixin,
@@ -1051,16 +1050,9 @@ class DocumentViewSet(
             .values("count"),
             output_field=IntegerField(),
         )
-        # No .distinct() here: nothing in this base queryset can produce
-        # duplicate document rows (select_related below is all FK-to-PK;
-        # permission filtering is a boolean id__in predicate, not a join).
-        # M2M-based filters that *do* introduce a join (e.g. tags__id__in)
-        # already call .distinct() themselves where they need it -- see
-        # ObjectFilter.filter(). A blanket .distinct() here forces the
-        # database to fully sort and dedupe every visible document before
-        # it can apply LIMIT, which is disastrous at scale.
         return (
             Document.objects.filter(root_document__isnull=True)
+            .distinct()
             .order_by("-created", "-id")
             .annotate(effective_content=Coalesce(latest_version_content, F("content")))
             .annotate(num_notes=Coalesce(note_count, 0))
@@ -2298,6 +2290,15 @@ class UnifiedSearchViewSet(DocumentViewSet):
             return SearchResultSerializer
         return DocumentSerializer
 
+    def get_serializer_context(self):
+        if self._is_search_request():
+            # BulkPermissionMixin.get_serializer_context() (inherited via
+            # DocumentViewSet) assumes it's batching permissions for a page of
+            # real Document instances. Tantivy search results are SearchHit/
+            # dict-like objects instead, so skip straight past it here.
+            return super(BulkPermissionMixin, self).get_serializer_context()
+        return super().get_serializer_context()
+
     def _get_active_search_params(self, request: Request | None = None) -> list[str]:
         request = request or self.request
         return [

src/locale/en_US/LC_MESSAGES/django.po

@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: paperless-ngx\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-22 15:44+0000\n"
+"POT-Creation-Date: 2026-07-23 04:03+0000\n"
 "PO-Revision-Date: 2022-02-17 04:17\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
@@ -1351,49 +1351,49 @@ msgstr ""
 msgid "workflow runs"
 msgstr ""
 
-#: documents/serialisers.py:503 documents/serialisers.py:855
-#: documents/serialisers.py:2744 documents/views.py:297 documents/views.py:2500
+#: documents/serialisers.py:522 documents/serialisers.py:874
+#: documents/serialisers.py:2763 documents/views.py:297 documents/views.py:2508
 #: paperless_mail/serialisers.py:155
 msgid "Insufficient permissions."
 msgstr ""
 
-#: documents/serialisers.py:691
+#: documents/serialisers.py:710
 msgid "Invalid color."
 msgstr ""
 
-#: documents/serialisers.py:2216
+#: documents/serialisers.py:2235
 #, python-format
 msgid "File type %(type)s not supported"
 msgstr ""
 
-#: documents/serialisers.py:2260
+#: documents/serialisers.py:2279
 #, python-format
 msgid "Custom field id must be an integer: %(id)s"
 msgstr ""
 
-#: documents/serialisers.py:2267
+#: documents/serialisers.py:2286
 #, python-format
 msgid "Custom field with id %(id)s does not exist"
 msgstr ""
 
-#: documents/serialisers.py:2284 documents/serialisers.py:2294
+#: documents/serialisers.py:2303 documents/serialisers.py:2313
 msgid ""
 "Custom fields must be a list of integers or an object mapping ids to values."
 msgstr ""
 
-#: documents/serialisers.py:2289
+#: documents/serialisers.py:2308
 msgid "Some custom fields don't exist or were specified twice."
 msgstr ""
 
-#: documents/serialisers.py:2436
+#: documents/serialisers.py:2455
 msgid "Invalid variable detected."
 msgstr ""
 
-#: documents/serialisers.py:2800
+#: documents/serialisers.py:2819
 msgid "Duplicate document identifiers are not allowed."
 msgstr ""
 
-#: documents/serialisers.py:2830 documents/views.py:4459
+#: documents/serialisers.py:2849 documents/views.py:4467
 #, python-format
 msgid "Documents not found: %(ids)s"
 msgstr ""
@@ -1661,36 +1661,36 @@ msgstr ""
 msgid "Unable to parse URI {value}"
 msgstr ""
 
-#: documents/views.py:290 documents/views.py:2497
+#: documents/views.py:290 documents/views.py:2505
 msgid "Invalid more_like_id"
 msgstr ""
 
-#: documents/views.py:1524
+#: documents/views.py:1523
 msgid "Invalid AI configuration."
 msgstr ""
 
-#: documents/views.py:1533
+#: documents/views.py:1532
 msgid "AI backend request timed out."
 msgstr ""
 
-#: documents/views.py:2322 documents/views.py:2643
+#: documents/views.py:2330 documents/views.py:2651
 msgid "Specify only one of text, title_search, query, or more_like_id."
 msgstr ""
 
-#: documents/views.py:4471
+#: documents/views.py:4479
 #, python-format
 msgid "Insufficient permissions to share document %(id)s."
 msgstr ""
 
-#: documents/views.py:4517
+#: documents/views.py:4525
 msgid "Bundle is already being processed."
 msgstr ""
 
-#: documents/views.py:4578
+#: documents/views.py:4586
 msgid "The share link bundle is still being prepared. Please try again later."
 msgstr ""
 
-#: documents/views.py:4588
+#: documents/views.py:4596
 msgid "The share link bundle is unavailable."
 msgstr ""