Merge branch 'dev'

Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>

docs/configuration.md

@@ -8,6 +8,12 @@ common [OCR](#ocr) related settings and some frontend settings. If set, these wi
 preference over the settings via environment variables. If not set, the environment setting
 or applicable default will be utilized instead.
 
+!!! warning
+
+    Changing configuration from the UI requires the `AppConfig` permission, which applies
+    instance-wide and should be treated as an admin-level permission. See
+    [global permissions](usage.md#global-permissions).
+
 - If you run paperless on docker, `paperless.conf` is not used.
   Rather, configure paperless by copying necessary options to
   `docker-compose.env`.
@@ -1125,6 +1131,10 @@ they use underscores instead of dashes.
         so specifying invalid options may prevent paperless from consuming
         any documents.  Use with caution!
 
+        These arguments are passed directly to OCRmyPDF, so this setting should only
+        be changed by trusted users. This applies to the `AppConfig` permission as well,
+        which allows setting these arguments from the UI.
+
     Specify arguments as a JSON dictionary. Keep note of lower case
     booleans and double quoted parameter names and strings. Examples:
 

docs/usage.md

@@ -427,27 +427,27 @@ Global permissions define what areas of the app and API endpoints users can acce
 determine if a user can create, edit, delete or view _any_ documents, but individual documents themselves
 still have "object-level" permissions.
 
-| Type             | Details                                                                                                                                                                                                                         |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| AppConfig        | _Change_ or higher permissions grants access to the "Application Configuration" area.                                                                                                                                           |
-| Correspondent    | Add, edit, delete or view Correspondents.                                                                                                                                                                                       |
-| CustomField      | Add, edit, delete or view Custom Fields.                                                                                                                                                                                        |
-| Document         | Add, edit, delete or view Documents.                                                                                                                                                                                            |
-| DocumentType     | Add, edit, delete or view Document Types.                                                                                                                                                                                       |
-| Group            | Add, edit, delete or view Groups.                                                                                                                                                                                               |
-| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents.                                                                                                                           |
-| MailAccount      | Add, edit, delete or view Mail Accounts.                                                                                                                                                                                        |
-| MailRule         | Add, edit, delete or view Mail Rules.                                                                                                                                                                                           |
-| Note             | Add, edit, delete or view Notes.                                                                                                                                                                                                |
-| PaperlessTask    | View or dismiss (_Change_) File Tasks.                                                                                                                                                                                          |
-| SavedView        | Add, edit, delete or view Saved Views.                                                                                                                                                                                          |
-| ShareLink        | Add, delete or view Share Links.                                                                                                                                                                                                |
-| StoragePath      | Add, edit, delete or view Storage Paths.                                                                                                                                                                                        |
-| SystemMonitoring | View the system status dialog, tasks summary and their API endpoints. Admin users also retain system status access.                                                                                                             |
-| Tag              | Add, edit, delete or view Tags.                                                                                                                                                                                                 |
-| UISettings       | Add, edit, delete or view the UI settings that are used by the web app.<br/>:warning: **Users that will access the web UI must be granted at least _View_ permissions.**                                                        |
-| User             | Add, edit, delete or view other user accounts via Settings > Users & Groups and `/api/users/`. These permissions are not needed for users to edit their own profile via "My Profile" or `/api/profile/`.                        |
-| Workflow         | Add, edit, delete or view Workflows.<br/>Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions). |
+| Type             | Details                                                                                                                                                                                                                                                                                              |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| AppConfig        | _Change_ or higher permissions grants access to the "Application Configuration" area.<br/>:warning: **This is a trusted, admin-level permission.** Application configuration applies instance-wide and some settings, such as OCR arguments, are passed directly to the underlying processing tools. |
+| Correspondent    | Add, edit, delete or view Correspondents.                                                                                                                                                                                                                                                            |
+| CustomField      | Add, edit, delete or view Custom Fields.                                                                                                                                                                                                                                                             |
+| Document         | Add, edit, delete or view Documents.                                                                                                                                                                                                                                                                 |
+| DocumentType     | Add, edit, delete or view Document Types.                                                                                                                                                                                                                                                            |
+| Group            | Add, edit, delete or view Groups.                                                                                                                                                                                                                                                                    |
+| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents.                                                                                                                                                                                                |
+| MailAccount      | Add, edit, delete or view Mail Accounts.                                                                                                                                                                                                                                                             |
+| MailRule         | Add, edit, delete or view Mail Rules.                                                                                                                                                                                                                                                                |
+| Note             | Add, edit, delete or view Notes.                                                                                                                                                                                                                                                                     |
+| PaperlessTask    | View or dismiss (_Change_) File Tasks.                                                                                                                                                                                                                                                               |
+| SavedView        | Add, edit, delete or view Saved Views.                                                                                                                                                                                                                                                               |
+| ShareLink        | Add, delete or view Share Links.                                                                                                                                                                                                                                                                     |
+| StoragePath      | Add, edit, delete or view Storage Paths.                                                                                                                                                                                                                                                             |
+| SystemMonitoring | View the system status dialog, tasks summary and their API endpoints. Admin users also retain system status access.                                                                                                                                                                                  |
+| Tag              | Add, edit, delete or view Tags.                                                                                                                                                                                                                                                                      |
+| UISettings       | Add, edit, delete or view the UI settings that are used by the web app.<br/>:warning: **Users that will access the web UI must be granted at least _View_ permissions.**                                                                                                                             |
+| User             | Add, edit, delete or view other user accounts via Settings > Users & Groups and `/api/users/`. These permissions are not needed for users to edit their own profile via "My Profile" or `/api/profile/`.                                                                                             |
+| Workflow         | Add, edit, delete or view Workflows.<br/>Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions).                                                                      |
 
 #### Detailed Explanation of Object Permissions {#object-permissions}
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.0.5"
+version = "3.1.0"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.11"

src-ui/messages.xlf

@@ -4639,7 +4639,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
-          <context context-type="linenumber">53</context>
+          <context context-type="linenumber">58</context>
         </context-group>
       </trans-unit>
       <trans-unit id="5324147361912094446" datatype="html">
@@ -6488,7 +6488,7 @@
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
-          <context context-type="linenumber">71</context>
+          <context context-type="linenumber">76</context>
         </context-group>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/components/common/input/tags/tags.component.html</context>
@@ -6614,6 +6614,13 @@
         </context-group>
         <note priority="1" from="description">Used for both types, correspondents, storage paths</note>
       </trans-unit>
+      <trans-unit id="6945988051184690124" datatype="html">
+        <source>Remove item</source>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
+          <context context-type="linenumber">41</context>
+        </context-group>
+      </trans-unit>
       <trans-unit id="3686284950598311784" datatype="html">
         <source>Private</source>
         <context-group purpose="location">

src-ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperless-ngx-ui",
-  "version": "3.0.5",
+  "version": "3.1.0",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "ng": "ng",

src-ui/src/app/components/admin/config/config.component.html

@@ -6,7 +6,7 @@
     infoLink="configuration">
 </pngx-page-header>
 
-<form [formGroup]="configForm" (ngSubmit)="saveConfig()" class="pb-4">
+<form [formGroup]="configForm" (ngSubmit)="saveConfig()" class="pb-4" autocomplete="off">
 
     <ul ngbNav #nav="ngbNav" class="nav-tabs">
         @for (category of optionCategories; track category) {
@@ -44,7 +44,7 @@
                                                         @case (ConfigOptionType.String) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
                                                         @case (ConfigOptionType.JSON) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
                                                         @case (ConfigOptionType.File) { <pngx-input-file [formControlName]="option.key" (upload)="uploadFile($event, option.key)" [error]="errors[option.key]"></pngx-input-file> }
-                                                        @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-password> }
+                                                        @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]" autocomplete="new-password"></pngx-input-password> }
                                                     }
                                                 </div>
                                                 @if (option.note) {

src-ui/src/app/components/app-frame/app-frame.component.html

@@ -37,7 +37,7 @@
     }
     <pngx-toasts-dropdown></pngx-toasts-dropdown>
     <li ngbDropdown class="nav-item dropdown">
-      <button class="btn navbar-action border-0" id="userDropdown" ngbDropdownToggle aria-label="User menu" i18n-aria-label>
+      <button class="btn navbar-action border-0 me-1 me-md-2" id="userDropdown" ngbDropdownToggle aria-label="User menu" i18n-aria-label>
         <i-bs width="1.3em" height="1.3em" name="person-circle"></i-bs>
         <span class="small ms-2 d-none d-sm-inline">
           {{this.settingsService.displayName}}

src-ui/src/app/components/app-frame/app-frame.component.scss

@@ -436,6 +436,18 @@ main {
   padding-right: .5rem;
 }
 
+// true center the search with equal flex widths
+@media (min-width: 768px) {
+  .navbar-brand,
+  .navbar > ul {
+    flex: 1 1 0;
+  }
+
+  .navbar > ul {
+    justify-content: flex-end;
+  }
+}
+
 :host ::ng-deep .navbar-action {
   display: inline-flex;
   align-items: center;

src-ui/src/app/components/common/input/password/password.component.spec.ts

@@ -40,6 +40,10 @@ describe('PasswordComponent', () => {
     // expect(component.value).toEqual('foo')
   })
 
+  it('should not offer itself to browser autofill by default', () => {
+    expect(input.getAttribute('autocomplete')).toEqual('off')
+  })
+
   it('should support toggling field visibility', () => {
     expect(input.type).toEqual('password')
     component.showReveal = true

src-ui/src/app/components/common/input/password/password.component.ts

@@ -25,7 +25,7 @@ export class PasswordComponent extends AbstractInputComponent<string> {
   showReveal: boolean = false
 
   @Input()
-  autocomplete: string
+  autocomplete: string = 'off'
 
   public textVisible: boolean = false
 

src-ui/src/app/components/common/input/select/select.component.html

@@ -36,11 +36,16 @@
           (focus)="clearLastSearchTerm()"
           (clear)="clearLastSearchTerm()"
           (blur)="onBlur()">
-          <ng-template ng-label-tmp let-item="item">
-            @if (iconField && item[iconField]) {
-              <i-bs class="me-2" [name]="item[iconField]"></i-bs>
+          <ng-template ng-label-tmp let-item="item" let-clear="clear">
+            @if (multiple && !disabled) {
+              <span class="ng-value-icon left" role="button" tabindex="0" (click)="clear(item)" (keydown.enter)="clear(item)" aria-label="Remove item" i18n-aria-label>×</span>
             }
-            <span [title]="item[bindLabel]">{{item[bindLabel]}}</span>
+            <span class="ng-value-label" [title]="item[bindLabel]">
+              @if (iconField && item[iconField]) {
+                <i-bs class="me-2" [name]="item[iconField]"></i-bs>
+              }
+              {{item[bindLabel]}}
+            </span>
           </ng-template>
           <ng-template ng-option-tmp let-item="item">
               @if (iconField && item[iconField]) {

src-ui/src/app/components/common/input/text/text.component.spec.ts

@@ -24,6 +24,12 @@ describe('TextComponent', () => {
     input = component.inputField.nativeElement
   })
 
+  it('should not offer itself to browser autofill by default', () => {
+    expect(
+      component.inputField.nativeElement.getAttribute('autocomplete')
+    ).toEqual('off')
+  })
+
   it('should support use of input field', () => {
     expect(component.value).toBeUndefined()
     input.value = 'foo'

src-ui/src/app/components/common/input/text/text.component.ts

@@ -28,7 +28,7 @@ import { AbstractInputComponent } from '../abstract-input'
 })
 export class TextComponent extends AbstractInputComponent<string> {
   @Input()
-  autocomplete: string
+  autocomplete: string = 'off'
 
   @Input()
   placeholder: string = ''

src-ui/src/app/utils/text-search.spec.ts

@@ -15,6 +15,35 @@ describe('text search utilities', () => {
     expect(matchesSearchText('taxes 2026', 'tax receipt')).toBeFalsy()
   })
 
+  it('does not let two terms match the same word', () => {
+    expect(matchesSearchText('Another Tag', 'another tag th')).toBeFalsy()
+    expect(matchesSearchText('Another Tag', 'another tag ag')).toBeFalsy()
+    expect(matchesSearchText('Another Tag', 'another tag e')).toBeFalsy()
+    expect(matchesSearchText('Another Tag', 'another tag')).toBeTruthy()
+    expect(matchesSearchText('Another Tag', 'tag another')).toBeTruthy()
+  })
+
+  it('matches a single term anywhere in the value', () => {
+    expect(matchesSearchText('Another Tag', 'anoth')).toBeTruthy()
+    expect(matchesSearchText('Another Tag', 'th')).toBeTruthy()
+  })
+
+  it('treats punctuation as a separator on both sides', () => {
+    expect(matchesSearchText('medical-history', 'medical history')).toBeTruthy()
+    expect(matchesSearchText('medical history', 'medical-history')).toBeTruthy()
+    expect(matchesSearchText('medical-history', 'medical dental')).toBeFalsy()
+  })
+
+  it('matches longer terms first so they cannot be starved', () => {
+    expect(matchesSearchText('tagger tag', 'tag tagger')).toBeTruthy()
+  })
+
+  it('handles a query with no usable terms', () => {
+    expect(matchesSearchText('Another Tag', '')).toBeTruthy()
+    // Still filters, so the dropdown can offer to create a tag named "---"
+    expect(matchesSearchText('Another Tag', '---')).toBeFalsy()
+  })
+
   it('matches a large set of tag names without blocking input', () => {
     const tagNames = Array.from(
       { length: 1280 },

src-ui/src/app/utils/text-search.ts

@@ -3,13 +3,18 @@ import { diacritics } from 'normalize-diacritics/diacritics'
 export type SearchTextValue =
   string | number | boolean | bigint | null | undefined
 
+const NON_ASCII = /[^\x00-\x7F]/
+const SEPARATORS = /[^\p{L}\p{N}]+/u
+
 export function normalizeSearchText(value: SearchTextValue): string {
-  const normalized = diacritics.reduce(
-    (text, replacement) => {
-      return text.replace(replacement.diacritics, replacement.letter)
-    },
-    String(value ?? '')
-  )
+  const text = String(value ?? '')
+
+  // Nothing in the table matches ASCII, so skip normaliation
+  if (!NON_ASCII.test(text)) return text.toLocaleLowerCase()
+
+  const normalized = diacritics.reduce((text, replacement) => {
+    return text.replace(replacement.diacritics, replacement.letter)
+  }, text)
 
   return normalized.toLocaleLowerCase()
 }
@@ -18,8 +23,28 @@ export function matchesSearchText(
   value: SearchTextValue,
   searchText: SearchTextValue
 ): boolean {
-  const normalizedValue = normalizeSearchText(value)
-  const searchTerms = normalizeSearchText(searchText).trim().split(/\s+/)
+  const query = normalizeSearchText(searchText)
+  const terms = query.split(SEPARATORS).filter(Boolean)
 
-  return searchTerms.every((term) => normalizedValue.includes(term))
+  // Empty or punctuation-only query, nothing to split into terms
+  if (terms.length === 0) {
+    return normalizeSearchText(value).includes(query.trim())
+  }
+
+  const words = normalizeSearchText(value).split(SEPARATORS).filter(Boolean)
+  const claimed = new Array<boolean>(words.length).fill(false)
+
+  // Each term takes a word of its own, longest first, so that "another tag th"
+  // doesn't match "Another Tag" by finding the "th" inside "another"
+  return terms
+    .sort((a, b) => b.length - a.length)
+    .every((term) => {
+      for (let i = 0; i < words.length; i++) {
+        if (!claimed[i] && words[i].includes(term)) {
+          claimed[i] = true
+          return true
+        }
+      }
+      return false
+    })
 }

src-ui/src/environments/environment.prod.ts

@@ -8,7 +8,7 @@ export const environment = {
   apiVersion: '10', // match src/paperless/settings.py
   appTitle: DEFAULT_APP_TITLE,
   tag: 'prod',
-  version: '3.0.5',
+  version: '3.1.0',
   webSocketHost: window.location.host,
   webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
   webSocketBaseUrl: base_url.pathname + 'ws/',

src/documents/tests/test_workflows.py

@@ -5573,6 +5573,41 @@ class TestApplyAISuggestionsWorkflowAction(
         self.doc.refresh_from_db()
         return changed
 
+    def test_fields_persist_when_tags_are_applied_in_the_same_run(self) -> None:
+        """
+        GIVEN:
+            - A document that already has a filename, as any consumed document does
+            - Suggestions carrying both a document type and tags
+        WHEN:
+            - The suggestions are applied
+        THEN:
+            - The document type is still set after the tags are added
+
+        Adding tags fires m2m_changed, and update_filename_and_move_files
+        refreshes the document from the database. Assigning fields and then
+        adding tags before saving loses those assignments, and only for
+        documents with a filename, so it does not reproduce on a bare
+        Document.objects.create().
+        """
+        self.doc.filename = "originals/original.pdf"
+        self.doc.save(update_fields=["filename"])
+
+        action = self.make_action(ai_create_missing=True)
+        changed = self.apply(action)
+
+        self.assertIn("document_type", changed)
+        self.assertIn("tags", changed)
+        self.assertIsNotNone(
+            self.doc.document_type,
+            "document_type was reported as applied but did not persist",
+        )
+        self.assertEqual(self.doc.document_type.name, "Suggested Document Type")
+        self.assertEqual(self.doc.correspondent.name, "Existing Correspondent")
+        self.assertCountEqual(
+            [t.name for t in self.doc.tags.all()],
+            ["Existing Tag", "Suggested Tag"],
+        )
+
     def test_document_added_trigger_queues_task(self) -> None:
         """
         GIVEN:

src/documents/workflows/ai.py

@@ -226,20 +226,20 @@ def apply_ai_suggestions_to_document(
             document.created = created
             updated_fields.append("created")
 
+    tags_to_add: list[Tag] = []
     if AISuggestionField.TAGS in selected:
         choice = suggestions["tags"]
         names = choice["new_names"]
-        tags = resolve_tags(
+        tags_to_add = resolve_tags(
             names,
             resolve_tag_ids(choice["existing_ids"], owner)
             + match_tags_by_name(names, owner),
             create_missing=create_missing,
             owner=owner,
         )
-        if tags:
+        if tags_to_add:
             # Suggested tags are always added, so overwrite_existing
             # does not really apply here
-            document.add_nested_tags(tags)
             updated_fields.append("tags")
 
     if updated_fields:
@@ -249,6 +249,10 @@ def apply_ai_suggestions_to_document(
         ]
         document.save(update_fields=[*direct_updated_fields, "modified"])
 
+    # Tags at the end so m2m_changed doesn't trigger db and overwrite other changes
+    if tags_to_add:
+        document.add_nested_tags(tags_to_add)
+
     logger.info(
         "Applied AI suggestions %s to document %s",
         updated_fields or "(none)",