Not bad catches from Copilot, if a little extra secure

feature: add Tantivy full-text fallback adapter for taxonomy candidates
This brings users without an embedding backend configured to closer parity with those who do. Reuse the search backend to locate similar documents and use them to provide the LLM with the better suggestion pool to draw from
2026-08-27 21:23:20 +00:00 · 2026-08-27 11:37:07 -07:00 · 2026-08-27 09:42:08 -07:00 · 2026-08-27 00:28:39 -07:00 · 2026-08-27 00:21:03 -07:00 · 2026-08-27 00:21:03 -07:00
159 changed files with 164375 additions and 93800 deletions
@@ -59,10 +59,13 @@ The following are not generally considered vulnerabilities unless accompanied by
 - large uploads or resource usage that do not bypass documented limits or privileges
 - IDOR / access control claims regarding the ability to attach an un-viewable object to a document. This is expected behavior.
 - claims based solely on the presence of a library, framework feature or code pattern without a working exploit
- reports that rely on admin-level access, workflow-editing privileges, shell access, or other high-trust roles unless they demonstrate an unintended privilege boundary bypass
+- pickle deserialization of internal data from trusted components such as the Redis-compatible broker or Paperless-ngx data directory
 - users with permission to edit users granting themselves additional privileges; this is expected behavior for that trusted permission
 - reports that rely on admin-level access, application-configuration access, workflow-editing privileges, shell access, or other high-trust roles unless they demonstrate an unintended privilege boundary bypass
 - optional webhook, mail, AI, OCR, or integration behavior described without a product-level vulnerability
 - missing limits or hardening settings presented without concrete impact
 - generic AI or static-analysis output that is not confirmed against the current codebase and a real deployment scenario
 - metadata names visible in a document's custom storage path, even when the user cannot access the underlying metadata object; this is expected behavior
 - the ability to attach objects that a user cannot access to a document by ID is an intentional design choice, and not considered a vulnerability
 ## Transparency
@@ -1,5 +1,220 @@
 # Changelog
 ## paperless-ngx 3.1.0
 ### Features / Enhancements
 - Enhancement: Apply AI suggestions workflow action [@shamoon](https://github.com/shamoon) ([#13639](https://github.com/paperless-ngx/paperless-ngx/pull/13639))
 - Enhancement: welcome widget visual tweaks [@shamoon](https://github.com/shamoon) ([#13794](https://github.com/paperless-ngx/paperless-ngx/pull/13794))
 - Enhancement: support using remote OCR engines selectively [@shamoon](https://github.com/shamoon) ([#13633](https://github.com/paperless-ngx/paperless-ngx/pull/13633))
 - Enhancement: websocket heartbeat [@oktupol](https://github.com/oktupol) ([#13739](https://github.com/paperless-ngx/paperless-ngx/pull/13739))
 - Enhancement: more v3 ui tweaks [@shamoon](https://github.com/shamoon) ([#13774](https://github.com/paperless-ngx/paperless-ngx/pull/13774))
 - Tweak: better support long list of views in documents list [@shamoon](https://github.com/shamoon) ([#13769](https://github.com/paperless-ngx/paperless-ngx/pull/13769))
 - QoL: add count badge to versions dropdown [@shamoon](https://github.com/shamoon) ([#13753](https://github.com/paperless-ngx/paperless-ngx/pull/13753))
 - Tweakhancement: add jitter to IMAP polling schedule [@shamoon](https://github.com/shamoon) ([#13734](https://github.com/paperless-ngx/paperless-ngx/pull/13734))
 - Enhancement: sync OIDC groups to superuser and staff roles [@BeSovereign](https://github.com/BeSovereign) ([#13060](https://github.com/paperless-ngx/paperless-ngx/pull/13060))
 - Enhancement: merge documents as versions [@shamoon](https://github.com/shamoon) ([#13515](https://github.com/paperless-ngx/paperless-ngx/pull/13515))
 - Tweak: adjust modal proportions for small screens [@shamoon](https://github.com/shamoon) ([#13728](https://github.com/paperless-ngx/paperless-ngx/pull/13728))
 - Refactor: render paperless\_ai prompts via Jinja2 templates instead of f-strings [@stumpylog](https://github.com/stumpylog) ([#13698](https://github.com/paperless-ngx/paperless-ngx/pull/13698))
 - Tweak: small visual tweaks / improvements \& fixes [@shamoon](https://github.com/shamoon) ([#13700](https://github.com/paperless-ngx/paperless-ngx/pull/13700))
 - Enhancement: prefer existing tags, types, correspondents, and storage paths in AI suggestions [@stumpylog](https://github.com/stumpylog) ([#13676](https://github.com/paperless-ngx/paperless-ngx/pull/13676))
 - Tweak: tweak permissions menu labels for shared user-dependent views [@shamoon](https://github.com/shamoon) ([#13685](https://github.com/paperless-ngx/paperless-ngx/pull/13685))
 - Feature: Allow selection of compression type and and level during export [@stumpylog](https://github.com/stumpylog) ([#13661](https://github.com/paperless-ngx/paperless-ngx/pull/13661))
 - Enhancement: customizable icons for saved views [@shamoon](https://github.com/shamoon) ([#13388](https://github.com/paperless-ngx/paperless-ngx/pull/13388))
 - Enhancement: Add --url argument to document\_fuzzy\_match to improve output [@lukyjay](https://github.com/lukyjay) ([#13123](https://github.com/paperless-ngx/paperless-ngx/pull/13123))
 - Feature: Updates remote OCR parser to respect the OCR mode setting [@stumpylog](https://github.com/stumpylog) ([#13408](https://github.com/paperless-ngx/paperless-ngx/pull/13408))
 - Tweak: improve no ML suggestions UX [@shamoon](https://github.com/shamoon) ([#13621](https://github.com/paperless-ngx/paperless-ngx/pull/13621))
 - Performance: reduce memory and I/O overhead of the document exporter during zip exports [@stumpylog](https://github.com/stumpylog) ([#13490](https://github.com/paperless-ngx/paperless-ngx/pull/13490))
 - QoL: make name button text on attribute pages selectable [@shamoon](https://github.com/shamoon) ([#13592](https://github.com/paperless-ngx/paperless-ngx/pull/13592))
 - Performance: More efficient mail fetching [@stumpylog](https://github.com/stumpylog) ([#13432](https://github.com/paperless-ngx/paperless-ngx/pull/13432))
 ### Bug Fixes
 - Fix: prevent config autocomplete craziness [@shamoon](https://github.com/shamoon) ([#13808](https://github.com/paperless-ngx/paperless-ngx/pull/13808))
 - Fix/performance: prevent token reuse in dropdown filtering, also a perf thing [@shamoon](https://github.com/shamoon) ([#13804](https://github.com/paperless-ngx/paperless-ngx/pull/13804))
 - Fix: exclude version documents from bulk edit "all" [@shamoon](https://github.com/shamoon) ([#13791](https://github.com/paperless-ngx/paperless-ngx/pull/13791))
 - Fix: fix bottom mobile nav buttons on Android [@shamoon](https://github.com/shamoon) ([#13780](https://github.com/paperless-ngx/paperless-ngx/pull/13780))
 - Fix: lazy import guardian modules to fix search language setting [@shamoon](https://github.com/shamoon) ([#13768](https://github.com/paperless-ngx/paperless-ngx/pull/13768))
 - Fix: version indexing fixes [@shamoon](https://github.com/shamoon) ([#13737](https://github.com/paperless-ngx/paperless-ngx/pull/13737))
 - Fix: append charset to file response for text files [@shamoon](https://github.com/shamoon) ([#13759](https://github.com/paperless-ngx/paperless-ngx/pull/13759))
 - Chore: pin Apache Tika images to 3.3.1 [@shamoon](https://github.com/shamoon) ([#13758](https://github.com/paperless-ngx/paperless-ngx/pull/13758))
 - Fix: align bulk edit object perms with document model [@shamoon](https://github.com/shamoon) ([#13757](https://github.com/paperless-ngx/paperless-ngx/pull/13757))
 - Fix: use selected version for doc detail emailing [@shamoon](https://github.com/shamoon) ([#13738](https://github.com/paperless-ngx/paperless-ngx/pull/13738))
 - Fix: hide version delete button without global perms [@shamoon](https://github.com/shamoon) ([#13735](https://github.com/paperless-ngx/paperless-ngx/pull/13735))
 - Fix: dont re-render path template when checking collisions [@shamoon](https://github.com/shamoon) ([#13718](https://github.com/paperless-ngx/paperless-ngx/pull/13718))
 - Fix: DocumentClassifierSchema bounds [@shamoon](https://github.com/shamoon) ([#13707](https://github.com/paperless-ngx/paperless-ngx/pull/13707))
 - Fix: remove shadow around attribute pages [@shamoon](https://github.com/shamoon) ([#13696](https://github.com/paperless-ngx/paperless-ngx/pull/13696))
 - Zen: correct dropdown corner radius visual defect [@shamoon](https://github.com/shamoon) ([#13695](https://github.com/paperless-ngx/paperless-ngx/pull/13695))
 - Fix: handle Android keyboard popper overlay [@shamoon](https://github.com/shamoon) ([#13694](https://github.com/paperless-ngx/paperless-ngx/pull/13694))
 - Fix: only show create when there is text, hide set values if no fields in cf bulk edit dropdown [@shamoon](https://github.com/shamoon) ([#13688](https://github.com/paperless-ngx/paperless-ngx/pull/13688))
 - Fix: reopen a fresh Tantivy index per write to prevent orphaned segment files [@stumpylog](https://github.com/stumpylog) ([#13682](https://github.com/paperless-ngx/paperless-ngx/pull/13682))
 - Fix: fix validation of workflow title assignment [@maxtruxa](https://github.com/maxtruxa) ([#13659](https://github.com/paperless-ngx/paperless-ngx/pull/13659))
 - Fix: dont clip search dropdown on mobile [@shamoon](https://github.com/shamoon) ([#13675](https://github.com/paperless-ngx/paperless-ngx/pull/13675))
 - Fix: include sharelink bundle perms in WebUI [@shamoon](https://github.com/shamoon) ([#13664](https://github.com/paperless-ngx/paperless-ngx/pull/13664))
 - Fix: add pagination to saved views management page [@shamoon](https://github.com/shamoon) ([#13646](https://github.com/paperless-ngx/paperless-ngx/pull/13646))
 - Fix: fixes for workflow assign custom field values [@shamoon](https://github.com/shamoon) ([#13630](https://github.com/paperless-ngx/paperless-ngx/pull/13630))
 - Fix: deny deactivated users in permission filtering and auto-login [@stumpylog](https://github.com/stumpylog) ([#13623](https://github.com/paperless-ngx/paperless-ngx/pull/13623))
 - Fix: check bulk mail delete permissions for the whole batch up front [@stumpylog](https://github.com/stumpylog) ([#13620](https://github.com/paperless-ngx/paperless-ngx/pull/13620))
 - Fix: Allow DRF to validate the maximum API key length [@stumpylog](https://github.com/stumpylog) ([#13614](https://github.com/paperless-ngx/paperless-ngx/pull/13614))
 - Fix: render PDF form values in annotation layer [@shamoon](https://github.com/shamoon) ([#13607](https://github.com/paperless-ngx/paperless-ngx/pull/13607))
 - QoL: disable name button without perms [@shamoon](https://github.com/shamoon) ([#13606](https://github.com/paperless-ngx/paperless-ngx/pull/13606))
 - Fix: prevent debounce overwrites in advanced search field, also improve Esc behavior [@shamoon](https://github.com/shamoon) ([#13602](https://github.com/paperless-ngx/paperless-ngx/pull/13602))
 - Fix: raise ParseError on remote OCR failure instead of silently continuing [@stumpylog](https://github.com/stumpylog) ([#13574](https://github.com/paperless-ngx/paperless-ngx/pull/13574))
 - Fix: use selected version when creating share links [@shamoon](https://github.com/shamoon) ([#13571](https://github.com/paperless-ngx/paperless-ngx/pull/13571))
 - Fix: reject bulk edit permissions requests without the correct key [@shamoon](https://github.com/shamoon) ([#13563](https://github.com/paperless-ngx/paperless-ngx/pull/13563))
 - Fix: correctly serve app logo specified in env [@shamoon](https://github.com/shamoon) ([#13561](https://github.com/paperless-ngx/paperless-ngx/pull/13561))
 - Fix: prevent workflow passwords field type error [@shamoon](https://github.com/shamoon) ([#13552](https://github.com/paperless-ngx/paperless-ngx/pull/13552))
 - Fix: correct Firefox print regression [@shamoon](https://github.com/shamoon) ([#13543](https://github.com/paperless-ngx/paperless-ngx/pull/13543))
 - Fix: hide some saved view operations on management page without permissions [@shamoon](https://github.com/shamoon) ([#13542](https://github.com/paperless-ngx/paperless-ngx/pull/13542))
 - Fix: disable pdfjs selection rendering [@shamoon](https://github.com/shamoon) ([#13538](https://github.com/paperless-ngx/paperless-ngx/pull/13538))
 - Fix: hide sidebar drag grips with insufficient permissions [@shamoon](https://github.com/shamoon) ([#13536](https://github.com/paperless-ngx/paperless-ngx/pull/13536))
 - Fix: don't re-queue a consume-folder file that is already queued and awaiting consumption [@stumpylog](https://github.com/stumpylog) ([#13526](https://github.com/paperless-ngx/paperless-ngx/pull/13526))
 - Fix: correct multi-search non-adjacent queries [@shamoon](https://github.com/shamoon) ([#13504](https://github.com/paperless-ngx/paperless-ngx/pull/13504))
 - Fix: Content-Disposition filename normalization [@shamoon](https://github.com/shamoon) ([#13514](https://github.com/paperless-ngx/paperless-ngx/pull/13514))
 - Fix: prevent duplicated text query with multiple date queries [@shamoon](https://github.com/shamoon) ([#13522](https://github.com/paperless-ngx/paperless-ngx/pull/13522))
 - Fix: crash filtering document link custom fields with an unset or unrelated field present [@ggouzi](https://github.com/ggouzi) ([#13518](https://github.com/paperless-ngx/paperless-ngx/pull/13518))
 - Fix: parse unpadded yyyy-mm-dd date input regardless of locale [@Se1foo](https://github.com/Se1foo) ([#13501](https://github.com/paperless-ngx/paperless-ngx/pull/13501))
 ### Documentation
 - Documentation: clarify default OCR mode changes in v3 [@shamoon](https://github.com/shamoon) ([#13666](https://github.com/paperless-ngx/paperless-ngx/pull/13666))
 - Fix: fixes for workflow assign custom field values [@shamoon](https://github.com/shamoon) ([#13630](https://github.com/paperless-ngx/paperless-ngx/pull/13630))
 - Documentation: add wiki links for AI stuff and parser plugins [@shamoon](https://github.com/shamoon) ([#13626](https://github.com/paperless-ngx/paperless-ngx/pull/13626))
 ### Maintenance
 - Chore(deps): Bump the actions group across 1 directory with 20 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13481](https://github.com/paperless-ngx/paperless-ngx/pull/13481))
 ### Dependencies
 <details>
 <summary>23 changes</summary>
 - Chore: Upgrade Docker image to Python 3.14 [@stumpylog](https://github.com/stumpylog) ([#13721](https://github.com/paperless-ngx/paperless-ngx/pull/13721))
 - Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13709](https://github.com/paperless-ngx/paperless-ngx/pull/13709))
 - Chore: update, reorg some npm deps [@shamoon](https://github.com/shamoon) ([#13716](https://github.com/paperless-ngx/paperless-ngx/pull/13716))
 - Chore: update fpdf2 to 2.8.8 [@shamoon](https://github.com/shamoon) ([#13629](https://github.com/paperless-ngx/paperless-ngx/pull/13629))
 - Chore: update pnpm, add blockExoticSubdeps [@shamoon](https://github.com/shamoon) ([#13628](https://github.com/paperless-ngx/paperless-ngx/pull/13628))
 - Chore(deps): Bump h2 from 4.3.0 to 4.4.1 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13593](https://github.com/paperless-ngx/paperless-ngx/pull/13593))
 - Chore(deps): Bump pdfjs-dist from 6.1.200 to 6.2.108 in /src-ui in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13594](https://github.com/paperless-ngx/paperless-ngx/pull/13594))
 - Chore(deps): Bump cryptography from 48.0.1 to 50.0.0 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13588](https://github.com/paperless-ngx/paperless-ngx/pull/13588))
 - Chore(deps): Bump the utilities-patch group across 1 directory with 6 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13539](https://github.com/paperless-ngx/paperless-ngx/pull/13539))
 - Chore(deps): Bump the utilities-minor group across 1 directory with 20 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13535](https://github.com/paperless-ngx/paperless-ngx/pull/13535))
 - Chore(deps): Bump aiohttp from 3.14.1 to 3.14.3 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13537](https://github.com/paperless-ngx/paperless-ngx/pull/13537))
 - Chore(deps-dev): Bump zensical from 0.0.47 to 0.0.51 in the development group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13533](https://github.com/paperless-ngx/paperless-ngx/pull/13533))
 - Chore(deps-dev): Bump postcss from 8.5.22 to 8.5.25 in /src/paperless\_mail/templates in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13534](https://github.com/paperless-ngx/paperless-ngx/pull/13534))
 - Chore(deps): Bump the pre-commit-dependencies group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13532](https://github.com/paperless-ngx/paperless-ngx/pull/13532))
 - Chore: ruff 0.16 upgrade [@stumpylog](https://github.com/stumpylog) ([#13531](https://github.com/paperless-ngx/paperless-ngx/pull/13531))
 - Chore(deps): Bump the actions group across 1 directory with 20 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13481](https://github.com/paperless-ngx/paperless-ngx/pull/13481))
 - docker(deps): bump astral-sh/uv from 0.11.28-python3.12-trixie-slim to 0.11.32-python3.12-trixie-slim @[dependabot[bot]](https://github.com/apps/dependabot) ([#13472](https://github.com/paperless-ngx/paperless-ngx/pull/13472))
 - docker-compose(deps): bump nginx from 1.31.2-alpine to 1.31.3-alpine in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#13470](https://github.com/paperless-ngx/paperless-ngx/pull/13470))
 - docker-compose(deps): Bump greenmail/standalone from 2.1.9 to 2.1.11 in /docker/compose @[dependabot[bot]](https://github.com/apps/dependabot) ([#13469](https://github.com/paperless-ngx/paperless-ngx/pull/13469))
 - Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 18 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13476](https://github.com/paperless-ngx/paperless-ngx/pull/13476))
 - Chore(deps-dev): Bump @playwright/test from 1.61.1 to 1.62.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#13480](https://github.com/paperless-ngx/paperless-ngx/pull/13480))
 - Chore(deps-dev): Bump the frontend-eslint-dependencies group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13477](https://github.com/paperless-ngx/paperless-ngx/pull/13477))
 - Chore(deps-dev): Bump @types/node from 26.1.0 to 26.1.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#13479](https://github.com/paperless-ngx/paperless-ngx/pull/13479))
 </details>
 ### All App Changes
 <details>
 <summary>91 changes</summary>
 - Fix: prevent config autocomplete craziness [@shamoon](https://github.com/shamoon) ([#13808](https://github.com/paperless-ngx/paperless-ngx/pull/13808))
 - Fix/performance: prevent token reuse in dropdown filtering, also a perf thing [@shamoon](https://github.com/shamoon) ([#13804](https://github.com/paperless-ngx/paperless-ngx/pull/13804))
 - Enhancement: Apply AI suggestions workflow action [@shamoon](https://github.com/shamoon) ([#13639](https://github.com/paperless-ngx/paperless-ngx/pull/13639))
 - Fix: exclude version documents from bulk edit "all" [@shamoon](https://github.com/shamoon) ([#13791](https://github.com/paperless-ngx/paperless-ngx/pull/13791))
 - Enhancement: welcome widget visual tweaks [@shamoon](https://github.com/shamoon) ([#13794](https://github.com/paperless-ngx/paperless-ngx/pull/13794))
 - Performance: fetch note authors with prefetch instead of one query each [@shamoon](https://github.com/shamoon) ([#13790](https://github.com/paperless-ngx/paperless-ngx/pull/13790))
 - Tweak: more misc UI tweaks [@shamoon](https://github.com/shamoon) ([#13783](https://github.com/paperless-ngx/paperless-ngx/pull/13783))
 - Enhancement: support using remote OCR engines selectively [@shamoon](https://github.com/shamoon) ([#13633](https://github.com/paperless-ngx/paperless-ngx/pull/13633))
 - Fix: fix bottom mobile nav buttons on Android [@shamoon](https://github.com/shamoon) ([#13780](https://github.com/paperless-ngx/paperless-ngx/pull/13780))
 - Enhancement: websocket heartbeat [@oktupol](https://github.com/oktupol) ([#13739](https://github.com/paperless-ngx/paperless-ngx/pull/13739))
 - Fix: lazy import guardian modules to fix search language setting [@shamoon](https://github.com/shamoon) ([#13768](https://github.com/paperless-ngx/paperless-ngx/pull/13768))
 - Enhancement: more v3 ui tweaks [@shamoon](https://github.com/shamoon) ([#13774](https://github.com/paperless-ngx/paperless-ngx/pull/13774))
 - Chore: add some missing UI accessibility labels [@shamoon](https://github.com/shamoon) ([#13772](https://github.com/paperless-ngx/paperless-ngx/pull/13772))
 - Chore: refactor permission checkbox live changes [@shamoon](https://github.com/shamoon) ([#13771](https://github.com/paperless-ngx/paperless-ngx/pull/13771))
 - Tweak: better support long list of views in documents list [@shamoon](https://github.com/shamoon) ([#13769](https://github.com/paperless-ngx/paperless-ngx/pull/13769))
 - Fix: version indexing fixes [@shamoon](https://github.com/shamoon) ([#13737](https://github.com/paperless-ngx/paperless-ngx/pull/13737))
 - Fix: append charset to file response for text files [@shamoon](https://github.com/shamoon) ([#13759](https://github.com/paperless-ngx/paperless-ngx/pull/13759))
 - Fix: align bulk edit object perms with document model [@shamoon](https://github.com/shamoon) ([#13757](https://github.com/paperless-ngx/paperless-ngx/pull/13757))
 - QoL: add count badge to versions dropdown [@shamoon](https://github.com/shamoon) ([#13753](https://github.com/paperless-ngx/paperless-ngx/pull/13753))
 - Tweakhancement: add jitter to IMAP polling schedule [@shamoon](https://github.com/shamoon) ([#13734](https://github.com/paperless-ngx/paperless-ngx/pull/13734))
 - Fix: use selected version for doc detail emailing [@shamoon](https://github.com/shamoon) ([#13738](https://github.com/paperless-ngx/paperless-ngx/pull/13738))
 - Fix: hide version delete button without global perms [@shamoon](https://github.com/shamoon) ([#13735](https://github.com/paperless-ngx/paperless-ngx/pull/13735))
 - Enhancement: sync OIDC groups to superuser and staff roles [@BeSovereign](https://github.com/BeSovereign) ([#13060](https://github.com/paperless-ngx/paperless-ngx/pull/13060))
 - Enhancement: merge documents as versions [@shamoon](https://github.com/shamoon) ([#13515](https://github.com/paperless-ngx/paperless-ngx/pull/13515))
 - Tweak: adjust modal proportions for small screens [@shamoon](https://github.com/shamoon) ([#13728](https://github.com/paperless-ngx/paperless-ngx/pull/13728))
 - Refactor: render paperless\_ai prompts via Jinja2 templates instead of f-strings [@stumpylog](https://github.com/stumpylog) ([#13698](https://github.com/paperless-ngx/paperless-ngx/pull/13698))
 - Chore(deps): Bump the uv group across 1 directory with 2 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13709](https://github.com/paperless-ngx/paperless-ngx/pull/13709))
 - Fix: dont re-render path template when checking collisions [@shamoon](https://github.com/shamoon) ([#13718](https://github.com/paperless-ngx/paperless-ngx/pull/13718))
 - Chore: update, reorg some npm deps [@shamoon](https://github.com/shamoon) ([#13716](https://github.com/paperless-ngx/paperless-ngx/pull/13716))
 - Fix: DocumentClassifierSchema bounds [@shamoon](https://github.com/shamoon) ([#13707](https://github.com/paperless-ngx/paperless-ngx/pull/13707))
 - Tweak: small visual tweaks / improvements \& fixes [@shamoon](https://github.com/shamoon) ([#13700](https://github.com/paperless-ngx/paperless-ngx/pull/13700))
 - Fix: remove shadow around attribute pages [@shamoon](https://github.com/shamoon) ([#13696](https://github.com/paperless-ngx/paperless-ngx/pull/13696))
 - Zen: correct dropdown corner radius visual defect [@shamoon](https://github.com/shamoon) ([#13695](https://github.com/paperless-ngx/paperless-ngx/pull/13695))
 - Fix: handle Android keyboard popper overlay [@shamoon](https://github.com/shamoon) ([#13694](https://github.com/paperless-ngx/paperless-ngx/pull/13694))
 - Enhancement: prefer existing tags, types, correspondents, and storage paths in AI suggestions [@stumpylog](https://github.com/stumpylog) ([#13676](https://github.com/paperless-ngx/paperless-ngx/pull/13676))
 - Fix: only show create when there is text, hide set values if no fields in cf bulk edit dropdown [@shamoon](https://github.com/shamoon) ([#13688](https://github.com/paperless-ngx/paperless-ngx/pull/13688))
 - Fix: reopen a fresh Tantivy index per write to prevent orphaned segment files [@stumpylog](https://github.com/stumpylog) ([#13682](https://github.com/paperless-ngx/paperless-ngx/pull/13682))
 - Tweak: tweak permissions menu labels for shared user-dependent views [@shamoon](https://github.com/shamoon) ([#13685](https://github.com/paperless-ngx/paperless-ngx/pull/13685))
 - Fix: fix validation of workflow title assignment [@maxtruxa](https://github.com/maxtruxa) ([#13659](https://github.com/paperless-ngx/paperless-ngx/pull/13659))
 - Feature: Allow selection of compression type and and level during export [@stumpylog](https://github.com/stumpylog) ([#13661](https://github.com/paperless-ngx/paperless-ngx/pull/13661))
 - Fix: dont clip search dropdown on mobile [@shamoon](https://github.com/shamoon) ([#13675](https://github.com/paperless-ngx/paperless-ngx/pull/13675))
 - Fix: include sharelink bundle perms in WebUI [@shamoon](https://github.com/shamoon) ([#13664](https://github.com/paperless-ngx/paperless-ngx/pull/13664))
 - Enhancement: customizable icons for saved views [@shamoon](https://github.com/shamoon) ([#13388](https://github.com/paperless-ngx/paperless-ngx/pull/13388))
 - Enhancement: Add --url argument to document\_fuzzy\_match to improve output [@lukyjay](https://github.com/lukyjay) ([#13123](https://github.com/paperless-ngx/paperless-ngx/pull/13123))
 - Feature: Updates remote OCR parser to respect the OCR mode setting [@stumpylog](https://github.com/stumpylog) ([#13408](https://github.com/paperless-ngx/paperless-ngx/pull/13408))
 - Performance: pass document chat queries as a QuerySet instead of a materialized.list [@stumpylog](https://github.com/stumpylog) ([#13638](https://github.com/paperless-ngx/paperless-ngx/pull/13638))
 - Fix: add pagination to saved views management page [@shamoon](https://github.com/shamoon) ([#13646](https://github.com/paperless-ngx/paperless-ngx/pull/13646))
 - Fix: fixes for workflow assign custom field values [@shamoon](https://github.com/shamoon) ([#13630](https://github.com/paperless-ngx/paperless-ngx/pull/13630))
 - Fix: deny deactivated users in permission filtering and auto-login [@stumpylog](https://github.com/stumpylog) ([#13623](https://github.com/paperless-ngx/paperless-ngx/pull/13623))
 - Chore: update fpdf2 to 2.8.8 [@shamoon](https://github.com/shamoon) ([#13629](https://github.com/paperless-ngx/paperless-ngx/pull/13629))
 - Chore: update pnpm, add blockExoticSubdeps [@shamoon](https://github.com/shamoon) ([#13628](https://github.com/paperless-ngx/paperless-ngx/pull/13628))
 - Fix: check bulk mail delete permissions for the whole batch up front [@stumpylog](https://github.com/stumpylog) ([#13620](https://github.com/paperless-ngx/paperless-ngx/pull/13620))
 - Tweak: improve no ML suggestions UX [@shamoon](https://github.com/shamoon) ([#13621](https://github.com/paperless-ngx/paperless-ngx/pull/13621))
 - Fix: Allow DRF to validate the maximum API key length [@stumpylog](https://github.com/stumpylog) ([#13614](https://github.com/paperless-ngx/paperless-ngx/pull/13614))
 - Performance: unify permission-filtering backends, fixes Correspondent/Tag list slowness [@stumpylog](https://github.com/stumpylog) ([#13601](https://github.com/paperless-ngx/paperless-ngx/pull/13601))
 - Performance: generalize permitted\_document\_ids into permitted\_object\_ids for any model [@stumpylog](https://github.com/stumpylog) ([#13578](https://github.com/paperless-ngx/paperless-ngx/pull/13578))
 - Fix: render PDF form values in annotation layer [@shamoon](https://github.com/shamoon) ([#13607](https://github.com/paperless-ngx/paperless-ngx/pull/13607))
 - QoL: disable name button without perms [@shamoon](https://github.com/shamoon) ([#13606](https://github.com/paperless-ngx/paperless-ngx/pull/13606))
 - Fix: prevent debounce overwrites in advanced search field, also improve Esc behavior [@shamoon](https://github.com/shamoon) ([#13602](https://github.com/paperless-ngx/paperless-ngx/pull/13602))
 - Performance: reduce memory and I/O overhead of the document exporter during zip exports [@stumpylog](https://github.com/stumpylog) ([#13490](https://github.com/paperless-ngx/paperless-ngx/pull/13490))
 - Chore(deps): Bump h2 from 4.3.0 to 4.4.1 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13593](https://github.com/paperless-ngx/paperless-ngx/pull/13593))
 - Chore(deps): Bump pdfjs-dist from 6.1.200 to 6.2.108 in /src-ui in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13594](https://github.com/paperless-ngx/paperless-ngx/pull/13594))
 - QoL: make name button text on attribute pages selectable [@shamoon](https://github.com/shamoon) ([#13592](https://github.com/paperless-ngx/paperless-ngx/pull/13592))
 - Fix: raise ParseError on remote OCR failure instead of silently continuing [@stumpylog](https://github.com/stumpylog) ([#13574](https://github.com/paperless-ngx/paperless-ngx/pull/13574))
 - Fix: use selected version when creating share links [@shamoon](https://github.com/shamoon) ([#13571](https://github.com/paperless-ngx/paperless-ngx/pull/13571))
 - Chore: specify AI chat refine template [@shamoon](https://github.com/shamoon) ([#13564](https://github.com/paperless-ngx/paperless-ngx/pull/13564))
 - Fix: reject bulk edit permissions requests without the correct key [@shamoon](https://github.com/shamoon) ([#13563](https://github.com/paperless-ngx/paperless-ngx/pull/13563))
 - Fix: correctly serve app logo specified in env [@shamoon](https://github.com/shamoon) ([#13561](https://github.com/paperless-ngx/paperless-ngx/pull/13561))
 - Fix: prevent workflow passwords field type error [@shamoon](https://github.com/shamoon) ([#13552](https://github.com/paperless-ngx/paperless-ngx/pull/13552))
 - Chore(deps): Bump the utilities-patch group across 1 directory with 6 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13539](https://github.com/paperless-ngx/paperless-ngx/pull/13539))
 - Chore(deps): Bump the utilities-minor group across 1 directory with 20 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13535](https://github.com/paperless-ngx/paperless-ngx/pull/13535))
 - Performance: More efficient mail fetching [@stumpylog](https://github.com/stumpylog) ([#13432](https://github.com/paperless-ngx/paperless-ngx/pull/13432))
 - Performance: eliminate per-document guardian permission-check causing high CPU on document lists [@stumpylog](https://github.com/stumpylog) ([#13505](https://github.com/paperless-ngx/paperless-ngx/pull/13505))
 - Fix: correct Firefox print regression [@shamoon](https://github.com/shamoon) ([#13543](https://github.com/paperless-ngx/paperless-ngx/pull/13543))
 - Fix: hide some saved view operations on management page without permissions [@shamoon](https://github.com/shamoon) ([#13542](https://github.com/paperless-ngx/paperless-ngx/pull/13542))
 - Chore(deps): Bump aiohttp from 3.14.1 to 3.14.3 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13537](https://github.com/paperless-ngx/paperless-ngx/pull/13537))
 - Chore(deps-dev): Bump zensical from 0.0.47 to 0.0.51 in the development group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13533](https://github.com/paperless-ngx/paperless-ngx/pull/13533))
 - Fix: disable pdfjs selection rendering [@shamoon](https://github.com/shamoon) ([#13538](https://github.com/paperless-ngx/paperless-ngx/pull/13538))
 - Fix: hide sidebar drag grips with insufficient permissions [@shamoon](https://github.com/shamoon) ([#13536](https://github.com/paperless-ngx/paperless-ngx/pull/13536))
 - Chore(deps-dev): Bump postcss from 8.5.22 to 8.5.25 in /src/paperless\_mail/templates in the npm\_and\_yarn group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13534](https://github.com/paperless-ngx/paperless-ngx/pull/13534))
 - Chore: ruff 0.16 upgrade [@stumpylog](https://github.com/stumpylog) ([#13531](https://github.com/paperless-ngx/paperless-ngx/pull/13531))
 - Fix: don't re-queue a consume-folder file that is already queued and awaiting consumption [@stumpylog](https://github.com/stumpylog) ([#13526](https://github.com/paperless-ngx/paperless-ngx/pull/13526))
 - Fix: correct multi-search non-adjacent queries [@shamoon](https://github.com/shamoon) ([#13504](https://github.com/paperless-ngx/paperless-ngx/pull/13504))
 - Fix: Content-Disposition filename normalization [@shamoon](https://github.com/shamoon) ([#13514](https://github.com/paperless-ngx/paperless-ngx/pull/13514))
 - Fix: prevent duplicated text query with multiple date queries [@shamoon](https://github.com/shamoon) ([#13522](https://github.com/paperless-ngx/paperless-ngx/pull/13522))
 - Fix: crash filtering document link custom fields with an unset or unrelated field present [@ggouzi](https://github.com/ggouzi) ([#13518](https://github.com/paperless-ngx/paperless-ngx/pull/13518))
 - Fix: parse unpadded yyyy-mm-dd date input regardless of locale [@Se1foo](https://github.com/Se1foo) ([#13501](https://github.com/paperless-ngx/paperless-ngx/pull/13501))
 - Chore(deps): Bump the frontend-angular-dependencies group across 1 directory with 18 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13476](https://github.com/paperless-ngx/paperless-ngx/pull/13476))
 - Chore(deps-dev): Bump @playwright/test from 1.61.1 to 1.62.0 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#13480](https://github.com/paperless-ngx/paperless-ngx/pull/13480))
 - Chore(deps-dev): Bump the frontend-eslint-dependencies group across 1 directory with 4 updates @[dependabot[bot]](https://github.com/apps/dependabot) ([#13477](https://github.com/paperless-ngx/paperless-ngx/pull/13477))
 - Chore(deps-dev): Bump @types/node from 26.1.0 to 26.1.1 in /src-ui @[dependabot[bot]](https://github.com/apps/dependabot) ([#13479](https://github.com/paperless-ngx/paperless-ngx/pull/13479))
 </details>
 ## paperless-ngx 3.0.5
 ### Bug Fixes
@@ -8,6 +8,12 @@ common [OCR](#ocr) related settings and some frontend settings. If set, these wi
 preference over the settings via environment variables. If not set, the environment setting
 or applicable default will be utilized instead.
 !!! warning
    Changing configuration from the UI requires the `AppConfig` permission, which applies
    instance-wide and should be treated as an admin-level permission. See
    [global permissions](usage.md#global-permissions).
 - If you run paperless on docker, `paperless.conf` is not used.
  Rather, configure paperless by copying necessary options to
  `docker-compose.env`.
@@ -1125,6 +1131,10 @@ they use underscores instead of dashes.
        so specifying invalid options may prevent paperless from consuming
        any documents.  Use with caution!
        These arguments are passed directly to OCRmyPDF, so this setting should only
        be changed by trusted users. This applies to the `AppConfig` permission as well,
        which allows setting these arguments from the UI.
    Specify arguments as a JSON dictionary. Keep note of lower case
    booleans and double quoted parameter names and strings. Examples:
@@ -427,27 +427,27 @@ Global permissions define what areas of the app and API endpoints users can acce
 determine if a user can create, edit, delete or view _any_ documents, but individual documents themselves
 still have "object-level" permissions.
-| Type             | Details                                                                                                                                                                                                                         |
+| Type             | Details                                                                                                                                                                                                                                                                                              |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| AppConfig        | _Change_ or higher permissions grants access to the "Application Configuration" area.                                                                                                                                           |
+| AppConfig        | _Change_ or higher permissions grants access to the "Application Configuration" area.<br/>:warning: **This is a trusted, admin-level permission.** Application configuration applies instance-wide and some settings, such as OCR arguments, are passed directly to the underlying processing tools. |
-| Correspondent    | Add, edit, delete or view Correspondents.                                                                                                                                                                                       |
+| Correspondent    | Add, edit, delete or view Correspondents.                                                                                                                                                                                                                                                            |
-| CustomField      | Add, edit, delete or view Custom Fields.                                                                                                                                                                                        |
+| CustomField      | Add, edit, delete or view Custom Fields.                                                                                                                                                                                                                                                             |
-| Document         | Add, edit, delete or view Documents.                                                                                                                                                                                            |
+| Document         | Add, edit, delete or view Documents.                                                                                                                                                                                                                                                                 |
-| DocumentType     | Add, edit, delete or view Document Types.                                                                                                                                                                                       |
+| DocumentType     | Add, edit, delete or view Document Types.                                                                                                                                                                                                                                                            |
-| Group            | Add, edit, delete or view Groups.                                                                                                                                                                                               |
+| Group            | Add, edit, delete or view Groups.                                                                                                                                                                                                                                                                    |
-| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents.                                                                                                                           |
+| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents.                                                                                                                                                                                                |
-| MailAccount      | Add, edit, delete or view Mail Accounts.                                                                                                                                                                                        |
+| MailAccount      | Add, edit, delete or view Mail Accounts.                                                                                                                                                                                                                                                             |
-| MailRule         | Add, edit, delete or view Mail Rules.                                                                                                                                                                                           |
+| MailRule         | Add, edit, delete or view Mail Rules.                                                                                                                                                                                                                                                                |
-| Note             | Add, edit, delete or view Notes.                                                                                                                                                                                                |
+| Note             | Add, edit, delete or view Notes.                                                                                                                                                                                                                                                                     |
-| PaperlessTask    | View or dismiss (_Change_) File Tasks.                                                                                                                                                                                          |
+| PaperlessTask    | View or dismiss (_Change_) File Tasks.                                                                                                                                                                                                                                                               |
-| SavedView        | Add, edit, delete or view Saved Views.                                                                                                                                                                                          |
+| SavedView        | Add, edit, delete or view Saved Views.                                                                                                                                                                                                                                                               |
-| ShareLink        | Add, delete or view Share Links.                                                                                                                                                                                                |
+| ShareLink        | Add, delete or view Share Links.                                                                                                                                                                                                                                                                     |
-| StoragePath      | Add, edit, delete or view Storage Paths.                                                                                                                                                                                        |
+| StoragePath      | Add, edit, delete or view Storage Paths.                                                                                                                                                                                                                                                             |
-| SystemMonitoring | View the system status dialog, tasks summary and their API endpoints. Admin users also retain system status access.                                                                                                             |
+| SystemMonitoring | View the system status dialog, tasks summary and their API endpoints. Admin users also retain system status access.                                                                                                                                                                                  |
-| Tag              | Add, edit, delete or view Tags.                                                                                                                                                                                                 |
+| Tag              | Add, edit, delete or view Tags.                                                                                                                                                                                                                                                                      |
-| UISettings       | Add, edit, delete or view the UI settings that are used by the web app.<br/>:warning: **Users that will access the web UI must be granted at least _View_ permissions.**                                                        |
+| UISettings       | Add, edit, delete or view the UI settings that are used by the web app.<br/>:warning: **Users that will access the web UI must be granted at least _View_ permissions.**                                                                                                                             |
-| User             | Add, edit, delete or view other user accounts via Settings > Users & Groups and `/api/users/`. These permissions are not needed for users to edit their own profile via "My Profile" or `/api/profile/`.                        |
+| User             | Add, edit, delete or view other user accounts via Settings > Users & Groups and `/api/users/`. These permissions are not needed for users to edit their own profile via "My Profile" or `/api/profile/`.                                                                                             |
-| Workflow         | Add, edit, delete or view Workflows.<br/>Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions). |
+| Workflow         | Add, edit, delete or view Workflows.<br/>Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions).                                                                      |
 #### Detailed Explanation of Object Permissions {#object-permissions}
@@ -667,6 +667,35 @@ The action takes no options, its presence is what enables remote OCR for a match
 If the remote engine is not configured, or does not support the document's file type, the document is
 processed locally instead and a warning is written to the log.
 ##### Apply AI Suggestions {#workflow-action-apply-ai-suggestions}
 "Apply AI Suggestions" actions ask the configured AI service for title and metadata suggestions,
 the same as the AI suggestions shown on the document detail page, except applied automatically and in bulk.
 It requires [AI features](configuration.md#ai) to be enabled. You can specify:
 - Which suggestions to apply: title, tags, correspondent, document type, storage path and / or created
  date. Suggestions for fields you did not select are discarded.
 - Whether to create missing items. By default only tags, correspondents and document types that
  already exist are assigned and any other suggestion is dropped. With this enabled, suggested items
  that do not exist are created. Storage paths are never created.
 - Whether to overwrite existing values. By default a field is only filled in if it is currently empty.
  Note that documents almost always already have a title and created date, so if you select those you
  will usually want to enable this too. Tags are an exception: suggested tags are always added and
  never replace the document's existing tags.
 The action works with every trigger **except Consumption Started**, because suggestions are made from
 the document's text, which does not exist until after the document has been processed.
 Because the query to the AI service is slow, the action is queued and runs in the background rather
 than as part of the workflow run itself. The document is updated once the suggestions come back.
 !!! warning
    Every matching document results in a query to the AI service, which may incur costs and have privacy
    implications. Queries can be slow, so a workflow matching a large number of documents can occupy the
    task queue, and delay consumption of new documents, etc. Consider narrowing the trigger filters,
    running in small batches and / or increasing workers.
 #### Workflow placeholders
 Titles and webhook payloads can be generated by workflows using [Jinja templates](https://jinja.palletsprojects.com/en/3.1.x/templates/).
@@ -1,6 +1,6 @@
 [project]
 name = "paperless-ngx"
-version = "3.0.5"
+version = "3.1.0"
 description = "A community-supported supercharged document management system: scan, index and archive all your physical documents"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -40,6 +40,7 @@ dependencies = [
  "djangorestframework~=3.16",
  "drf-spectacular~=0.30",
  "drf-spectacular-sidecar~=2026.7.1",
  "drf-writable-nested~=0.7.1",
  "filelock~=3.32.0",
  "flower~=2.0.1",
  "gotenberg-client~=0.14.0",
@@ -296,11 +296,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">93</context>
+          <context context-type="linenumber">91</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">95</context>
+          <context context-type="linenumber">93</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/dashboard.component.html</context>
@@ -323,11 +323,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">102</context>
+          <context context-type="linenumber">100</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">104</context>
+          <context context-type="linenumber">102</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/share-link-bundle-dialog/share-link-bundle-dialog.component.html</context>
@@ -374,16 +374,16 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">60</context>
+          <context context-type="linenumber">58</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
          <context context-type="linenumber">282</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
          <context context-type="linenumber">284</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
          <context context-type="linenumber">286</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5890330709052835856" datatype="html">
        <source>The dashboard can be used to show saved views, such as an &apos;Inbox&apos;. Views are found under Manage &gt; Saved Views once you have created some.</source>
@@ -727,11 +727,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">320</context>
+          <context context-type="linenumber">318</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">322</context>
+          <context context-type="linenumber">320</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2272120016352772836" datatype="html">
@@ -1142,11 +1142,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">244</context>
+          <context context-type="linenumber">242</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">246</context>
+          <context context-type="linenumber">244</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/saved-views/saved-views.component.html</context>
@@ -1620,6 +1620,10 @@
          <context context-type="sourcefile">src/app/components/admin/settings/settings.component.ts</context>
          <context context-type="linenumber">99</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
          <context context-type="linenumber">173</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-detail/document-detail.component.html</context>
          <context context-type="linenumber">174</context>
@@ -1651,6 +1655,10 @@
          <context context-type="sourcefile">src/app/components/admin/settings/settings.component.ts</context>
          <context context-type="linenumber">100</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
          <context context-type="linenumber">177</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-detail/document-detail.component.html</context>
          <context context-type="linenumber">178</context>
@@ -1682,6 +1690,10 @@
          <context context-type="sourcefile">src/app/components/admin/settings/settings.component.ts</context>
          <context context-type="linenumber">101</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
          <context context-type="linenumber">181</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-detail/document-detail.component.html</context>
          <context context-type="linenumber">182</context>
@@ -1711,7 +1723,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">215</context>
+          <context context-type="linenumber">213</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
          <context context-type="linenumber">169</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/tags/tags.component.ts</context>
@@ -1801,15 +1817,15 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.ts</context>
-          <context context-type="linenumber">162</context>
+          <context context-type="linenumber">164</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.ts</context>
-          <context context-type="linenumber">274</context>
+          <context context-type="linenumber">276</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.ts</context>
-          <context context-type="linenumber">304</context>
+          <context context-type="linenumber">306</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6904866445262015585" datatype="html">
@@ -1820,11 +1836,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">307</context>
+          <context context-type="linenumber">305</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">309</context>
+          <context context-type="linenumber">307</context>
        </context-group>
      </trans-unit>
      <trans-unit id="8492095365580052820" datatype="html">
@@ -2087,7 +2103,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">95</context>
+          <context context-type="linenumber">96</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/share-link-bundle-manage-dialog/share-link-bundle-manage-dialog.component.html</context>
@@ -2402,7 +2418,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">80</context>
+          <context context-type="linenumber">81</context>
        </context-group>
      </trans-unit>
      <trans-unit id="228975554646076615" datatype="html">
@@ -2462,7 +2478,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">122</context>
+          <context context-type="linenumber">123</context>
        </context-group>
      </trans-unit>
      <trans-unit id="235571817610183244" datatype="html">
@@ -2473,7 +2489,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">84</context>
+          <context context-type="linenumber">85</context>
        </context-group>
      </trans-unit>
      <trans-unit id="526966086395145275" datatype="html">
@@ -2484,7 +2500,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">76</context>
+          <context context-type="linenumber">77</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6520092939021340973" datatype="html">
@@ -2601,11 +2617,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">268</context>
+          <context context-type="linenumber">266</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">270</context>
+          <context context-type="linenumber">268</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3818027200170621545" datatype="html">
@@ -2962,11 +2978,11 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">298</context>
+          <context context-type="linenumber">296</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">300</context>
+          <context context-type="linenumber">298</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4569276013106377105" datatype="html">
@@ -3275,104 +3291,104 @@
        <source>by Paperless-ngx</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">27,28</context>
+          <context context-type="linenumber">24,25</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7228136119811576789" datatype="html">
        <source>User menu</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">44</context>
+          <context context-type="linenumber">42</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2448391510242468907" datatype="html">
        <source>Logged in as <x id="INTERPOLATION" equiv-text="{{this.settingsService.displayName}}"/></source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">52,53</context>
+          <context context-type="linenumber">50,51</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2127032578120864096" datatype="html">
        <source>My Profile</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">56</context>
+          <context context-type="linenumber">54</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3797778920049399855" datatype="html">
        <source>Logout</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">63</context>
+          <context context-type="linenumber">61</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4895326106573044490" datatype="html">
        <source>Documentation</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">68</context>
+          <context context-type="linenumber">66</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">328,329</context>
+          <context context-type="linenumber">326,327</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">331</context>
+          <context context-type="linenumber">329</context>
        </context-group>
      </trans-unit>
      <trans-unit id="472206565520537964" datatype="html">
        <source>Saved views</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">112,113</context>
+          <context context-type="linenumber">110,111</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">142,143</context>
+          <context context-type="linenumber">140,141</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6988090220128974198" datatype="html">
        <source>Open documents</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">151,152</context>
+          <context context-type="linenumber">149,150</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5687256342387781369" datatype="html">
        <source>Close all</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">173</context>
+          <context context-type="linenumber">171</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">175</context>
+          <context context-type="linenumber">173</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3897348120591552265" datatype="html">
        <source>Manage</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">184,185</context>
+          <context context-type="linenumber">182,183</context>
        </context-group>
      </trans-unit>
      <trans-unit id="8008131619909556709" datatype="html">
        <source>Attributes</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">192</context>
+          <context context-type="linenumber">190</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">194</context>
+          <context context-type="linenumber">192</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7437910965833684826" datatype="html">
        <source>Correspondents</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">220</context>
+          <context context-type="linenumber">218</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/suggestions-dropdown/suggestions-dropdown.component.html</context>
@@ -3391,7 +3407,7 @@
        <source>Document types</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">225</context>
+          <context context-type="linenumber">223</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/document-attributes/document-attributes.component.ts</context>
@@ -3402,7 +3418,7 @@
        <source>Storage paths</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">230</context>
+          <context context-type="linenumber">228</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/document-attributes/document-attributes.component.ts</context>
@@ -3413,7 +3429,7 @@
        <source>Custom fields</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">235</context>
+          <context context-type="linenumber">233</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/bulk-editor/bulk-editor.component.html</context>
@@ -3432,11 +3448,11 @@
        <source>Workflows</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">253</context>
+          <context context-type="linenumber">251</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">255</context>
+          <context context-type="linenumber">253</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/manage/workflows/workflows.component.html</context>
@@ -3447,99 +3463,99 @@
        <source>Mail</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">261</context>
+          <context context-type="linenumber">259</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">263</context>
+          <context context-type="linenumber">261</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7844706011418789951" datatype="html">
        <source>Administration</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">278,279</context>
+          <context context-type="linenumber">276,277</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3008420115644088420" datatype="html">
        <source>Configuration</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">291</context>
+          <context context-type="linenumber">289</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">293</context>
+          <context context-type="linenumber">291</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1534029177398918729" datatype="html">
        <source>GitHub</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">338</context>
+          <context context-type="linenumber">336</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4112664765954374539" datatype="html">
        <source>is available.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">348</context>
+          <context context-type="linenumber">346</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1175891574282637937" datatype="html">
        <source>Click to view.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">348</context>
+          <context context-type="linenumber">346</context>
        </context-group>
      </trans-unit>
      <trans-unit id="9811291095862612" datatype="html">
        <source>Paperless-ngx can automatically check for updates</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">352</context>
+          <context context-type="linenumber">350</context>
        </context-group>
      </trans-unit>
      <trans-unit id="894819944961861800" datatype="html">
        <source> How does this work? </source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">360</context>
+          <context context-type="linenumber">358</context>
        </context-group>
      </trans-unit>
      <trans-unit id="509090351011426949" datatype="html">
        <source>Update available</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">372</context>
+          <context context-type="linenumber">370</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1329827712962827905" datatype="html">
        <source>Configure update checking</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.html</context>
-          <context context-type="linenumber">377</context>
+          <context context-type="linenumber">375</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1542489069631984294" datatype="html">
        <source>Sidebar views updated</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.ts</context>
-          <context context-type="linenumber">425</context>
+          <context context-type="linenumber">427</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3547923076537026828" datatype="html">
        <source>Error updating sidebar views</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.ts</context>
-          <context context-type="linenumber">428</context>
+          <context context-type="linenumber">430</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2526035785704676448" datatype="html">
        <source>An error occurred while saving update checking settings.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/app-frame/app-frame.component.ts</context>
-          <context context-type="linenumber">449</context>
+          <context context-type="linenumber">451</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4580988005648117665" datatype="html">
@@ -4332,7 +4348,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">91</context>
+          <context context-type="linenumber">92</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
@@ -4623,7 +4639,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
-          <context context-type="linenumber">53</context>
+          <context context-type="linenumber">58</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5324147361912094446" datatype="html">
@@ -5322,7 +5338,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">137</context>
+          <context context-type="linenumber">138</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html</context>
@@ -5954,18 +5970,67 @@
          <context context-type="linenumber">461,462</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4231754882471903566" datatype="html">
        <source>The document will be sent to the configured AI service for suggestions. Consider costs and privacy.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html</context>
          <context context-type="linenumber">468,469</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3473589590476379802" datatype="html">
        <source>Apply suggestions for</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html</context>
          <context context-type="linenumber">471,472</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6859826074028847234" datatype="html">
        <source>Suggestions for fields that are not selected are discarded.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html</context>
          <context context-type="linenumber">476,477</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1137167921211640884" datatype="html">
        <source>Create missing items</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html</context>
          <context context-type="linenumber">486,487</context>
        </context-group>
      </trans-unit>
      <trans-unit id="449779688394460071" datatype="html">
        <source>Create suggested tags, correspondents and document types that do not exist yet.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html</context>
          <context context-type="linenumber">488,489</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5192325026233872238" datatype="html">
        <source>Overwrite existing values</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html</context>
          <context context-type="linenumber">496,497</context>
        </context-group>
      </trans-unit>
      <trans-unit id="9010697250406492150" datatype="html">
        <source>Apply suggestions even if the document already has a value. Tags are always added, never replaced.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html</context>
          <context context-type="linenumber">498,499</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4626030417479279989" datatype="html">
        <source>Consume Folder</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">72</context>
+          <context context-type="linenumber">73</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3553216189604488439" datatype="html">
        <source>Modified</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">99</context>
+          <context context-type="linenumber">100</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
@@ -5976,63 +6041,63 @@
        <source>Custom Field</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">103</context>
+          <context context-type="linenumber">104</context>
        </context-group>
      </trans-unit>
      <trans-unit id="8696908693776094667" datatype="html">
        <source>Consumption Started</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">110</context>
+          <context context-type="linenumber">111</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7858311467093621703" datatype="html">
        <source>Document Added</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">114</context>
+          <context context-type="linenumber">115</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7955486237346046731" datatype="html">
        <source>Document Updated</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">118</context>
+          <context context-type="linenumber">119</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5502398334173581061" datatype="html">
        <source>Assignment</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">129</context>
+          <context context-type="linenumber">130</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6234812824772766804" datatype="html">
        <source>Removal</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">133</context>
+          <context context-type="linenumber">134</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4206419737792796794" datatype="html">
        <source>Webhook</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">141</context>
+          <context context-type="linenumber">142</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4824906895380506720" datatype="html">
        <source>Password removal</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">145</context>
+          <context context-type="linenumber">146</context>
        </context-group>
      </trans-unit>
      <trans-unit id="2048798344356757326" datatype="html">
        <source>Move to trash</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">149</context>
+          <context context-type="linenumber">150</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-detail/document-detail.component.ts</context>
@@ -6047,116 +6112,157 @@
        <source>Remote OCR</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">153</context>
+          <context context-type="linenumber">154</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/paperless-config.ts</context>
          <context context-type="linenumber">58</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4101630920511881483" datatype="html">
        <source>Apply AI suggestions</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
          <context context-type="linenumber">158</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5701618810648052610" datatype="html">
        <source>Title</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
          <context context-type="linenumber">165</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-detail/document-detail.component.html</context>
          <context context-type="linenumber">167</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
          <context context-type="linenumber">218,219</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/filter-editor/filter-editor.component.ts</context>
          <context context-type="linenumber">197</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
          <context context-type="linenumber">30</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
          <context context-type="linenumber">90</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5224451373257709572" datatype="html">
        <source>Created date</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
          <context context-type="linenumber">185</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4522609911791833187" datatype="html">
        <source>Has any of these tags</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">222</context>
+          <context context-type="linenumber">254</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4166903555074156852" datatype="html">
        <source>Has all of these tags</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">229</context>
+          <context context-type="linenumber">261</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6624363795312783141" datatype="html">
        <source>Does not have these tags</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">236</context>
+          <context context-type="linenumber">268</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7168528512669831184" datatype="html">
        <source>Has any of these correspondents</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">243</context>
+          <context context-type="linenumber">275</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5281365940563983618" datatype="html">
        <source>Has correspondent</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">251</context>
+          <context context-type="linenumber">283</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6884498632428600393" datatype="html">
        <source>Does not have correspondents</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">259</context>
+          <context context-type="linenumber">291</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4806713133917046341" datatype="html">
        <source>Has document type</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">267</context>
+          <context context-type="linenumber">299</context>
        </context-group>
      </trans-unit>
      <trans-unit id="8801397520369995032" datatype="html">
        <source>Has any of these document types</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">275</context>
+          <context context-type="linenumber">307</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1507843981661822403" datatype="html">
        <source>Does not have document types</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">283</context>
+          <context context-type="linenumber">315</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4277260190522078330" datatype="html">
        <source>Has storage path</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">291</context>
+          <context context-type="linenumber">323</context>
        </context-group>
      </trans-unit>
      <trans-unit id="8858580062214623097" datatype="html">
        <source>Has any of these storage paths</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">299</context>
+          <context context-type="linenumber">331</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6070943364927280151" datatype="html">
        <source>Does not have storage paths</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">307</context>
+          <context context-type="linenumber">339</context>
        </context-group>
      </trans-unit>
      <trans-unit id="6250799006816371860" datatype="html">
        <source>Matches custom field query</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">315</context>
+          <context context-type="linenumber">347</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3138206142174978019" datatype="html">
        <source>Create new workflow</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">524</context>
+          <context context-type="linenumber">556</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5996779210524133604" datatype="html">
        <source>Edit workflow</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts</context>
-          <context context-type="linenumber">528</context>
+          <context context-type="linenumber">560</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5457837313196342910" datatype="html">
@@ -6382,7 +6488,7 @@
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
-          <context context-type="linenumber">71</context>
+          <context context-type="linenumber">76</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/tags/tags.component.html</context>
@@ -6508,6 +6614,13 @@
        </context-group>
        <note priority="1" from="description">Used for both types, correspondents, storage paths</note>
      </trans-unit>
      <trans-unit id="6945988051184690124" datatype="html">
        <source>Remove item</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/common/input/select/select.component.html</context>
          <context context-type="linenumber">41</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3686284950598311784" datatype="html">
        <source>Private</source>
        <context-group purpose="location">
@@ -8021,35 +8134,35 @@
        <source>Paperless-ngx is running!</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/widgets/welcome-widget/welcome-widget.component.html</context>
-          <context context-type="linenumber">2</context>
+          <context context-type="linenumber">6</context>
        </context-group>
      </trans-unit>
      <trans-unit id="3326049540711826572" datatype="html">
        <source>You&apos;re ready to start uploading documents! Explore the various features of this web app on your own, or start a quick tour using the button below.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/widgets/welcome-widget/welcome-widget.component.html</context>
-          <context context-type="linenumber">3,4</context>
+          <context context-type="linenumber">8,9</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4474647174688421179" datatype="html">
        <source>More detail on how to use and configure Paperless-ngx is always available in the <x id="START_LINK" ctype="x-a" equiv-text="&lt;a href=&quot;https://docs.paperless-ngx.com&quot; target=&quot;_blank&quot;&gt;"/>documentation<x id="CLOSE_LINK" ctype="x-a" equiv-text="&lt;/a&gt;"/>.</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/widgets/welcome-widget/welcome-widget.component.html</context>
-          <context context-type="linenumber">4,6</context>
+          <context context-type="linenumber">9,10</context>
        </context-group>
      </trans-unit>
      <trans-unit id="4294899532887357745" datatype="html">
        <source>Thanks for being a part of the Paperless-ngx community!</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/widgets/welcome-widget/welcome-widget.component.html</context>
-          <context context-type="linenumber">7,8</context>
+          <context context-type="linenumber">13,14</context>
        </context-group>
      </trans-unit>
      <trans-unit id="1415832194529539652" datatype="html">
        <source>Start the tour</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/dashboard/widgets/welcome-widget/welcome-widget.component.html</context>
-          <context context-type="linenumber">8</context>
+          <context context-type="linenumber">14</context>
        </context-group>
      </trans-unit>
      <trans-unit id="7822640317427130239" datatype="html">
@@ -8208,29 +8321,6 @@
          <context context-type="linenumber">164,165</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5701618810648052610" datatype="html">
        <source>Title</source>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-detail/document-detail.component.html</context>
          <context context-type="linenumber">167</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/document-list.component.html</context>
          <context context-type="linenumber">218,219</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/components/document-list/filter-editor/filter-editor.component.ts</context>
          <context context-type="linenumber">197</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
          <context context-type="linenumber">30</context>
        </context-group>
        <context-group purpose="location">
          <context context-type="sourcefile">src/app/data/document.ts</context>
          <context context-type="linenumber">90</context>
        </context-group>
      </trans-unit>
      <trans-unit id="5114742157723900905" datatype="html">
        <source>Date created</source>
        <context-group purpose="location">
@@ -1,6 +1,6 @@
 {
  "name": "paperless-ngx-ui",
-  "version": "3.0.5",
+  "version": "3.1.0",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
    "ng": "ng",
@@ -6,7 +6,7 @@
    infoLink="configuration">
 </pngx-page-header>
-<form [formGroup]="configForm" (ngSubmit)="saveConfig()" class="pb-4">
+<form [formGroup]="configForm" (ngSubmit)="saveConfig()" class="pb-4" autocomplete="off">
    <ul ngbNav #nav="ngbNav" class="nav-tabs">
        @for (category of optionCategories; track category) {
@@ -44,7 +44,7 @@
                                                        @case (ConfigOptionType.String) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
                                                        @case (ConfigOptionType.JSON) { <pngx-input-text [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-text> }
                                                        @case (ConfigOptionType.File) { <pngx-input-file [formControlName]="option.key" (upload)="uploadFile($event, option.key)" [error]="errors[option.key]"></pngx-input-file> }
-                                                        @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]"></pngx-input-password> }
+                                                        @case (ConfigOptionType.Password) { <pngx-input-password [formControlName]="option.key" [error]="errors[option.key]" autocomplete="new-password"></pngx-input-password> }
                                                    }
                                                </div>
                                                @if (option.note) {
@@ -4,31 +4,29 @@
    (click)="closeMobileSearch(); toggleMenuCollapsed()">
    <i-bs width="1.5em" height="1.5em" name="list"></i-bs>
  </button>
-  <a class="navbar-brand d-flex align-items-center me-0 ps-md-3 py-0 order-sm-0"
+  <div class="navbar-brand-container order-sm-0">
    <a class="navbar-brand d-flex align-items-center me-0 ps-md-3 py-0"
    [ngClass]="{ 'slim': slimSidebarEnabled, '' : !slimSidebarEnabled }"
    routerLink="/dashboard"
    tourAnchor="tour.intro">
-    @if (!hasCustomBranding) {
+      @if (!hasCustomBranding) {
-      <pngx-logo extra_classes="navbar-official-logo px-1" height="2.4rem"></pngx-logo>
+        <pngx-logo extra_classes="navbar-official-logo px-1" height="2.4rem"></pngx-logo>
-      <svg class="brand-mark brand-mark-slim d-none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 1000" width="1.5em" height="1.5em" fill="currentColor">
+        <pngx-brand-mark class="brand-mark brand-mark-slim d-none"></pngx-brand-mark>
        <path d="M341,949.1c-6.9-20.3-20.7-61.2-21.9-61-199.6-88.9-182.5-229.8-134.3-347.5,30,137.2,268.8,148.9,146.2,336-.9,2.2,10,27.8,19.5,51.3,22.7-51.9,58.6-115.5,55.8-120.8C178,398.7,724.9,299,807.1,18.5c83,251.5,53.1,659.8-377.4,814.9-2,1.4-63.5,148.6-66.9,150.2-.2-2.1-33.2,2.9-30.1-8.7,1.6-7,4.8-16.2,8.2-25.6h0v-.2h.1ZM323.1,846.2c48.3-71.9-12.7-120.8-56.9-152.2,81.2,107.4,66.4,120.8,56.9,152.2h0Z"/>
      </svg>
    } @else {
      @if (customAppLogo) {
        <img class="brand-logo" [src]="customAppLogo" alt="" />
      } @else {
-        <svg class="brand-mark" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 1000" width="1.5em" height="1.5em" fill="currentColor">
+        @if (customAppLogo) {
-          <path d="M341,949.1c-6.9-20.3-20.7-61.2-21.9-61-199.6-88.9-182.5-229.8-134.3-347.5,30,137.2,268.8,148.9,146.2,336-.9,2.2,10,27.8,19.5,51.3,22.7-51.9,58.6-115.5,55.8-120.8C178,398.7,724.9,299,807.1,18.5c83,251.5,53.1,659.8-377.4,814.9-2,1.4-63.5,148.6-66.9,150.2-.2-2.1-33.2,2.9-30.1-8.7,1.6-7,4.8-16.2,8.2-25.6h0v-.2h.1ZM323.1,846.2c48.3-71.9-12.7-120.8-56.9-152.2,81.2,107.4,66.4,120.8,56.9,152.2h0Z"/>
+          <img class="brand-logo" [src]="customAppLogo" alt="" />
-        </svg>
+        } @else {
-      }
+          <pngx-brand-mark class="brand-mark"></pngx-brand-mark>
      <div class="brand-copy ms-2 text-truncate" [class.d-md-none]="slimSidebarEnabled">
        <span class="brand-title text-truncate">{{ appTitle }}</span>
        @if (customAppTitle) {
          <span class="byline text-uppercase font-monospace" i18n>by Paperless-ngx</span>
        }
-      </div>
+        <div class="brand-copy ms-2 text-truncate" [class.d-md-none]="slimSidebarEnabled">
-    }
+          <span class="brand-title text-truncate">{{ appTitle }}</span>
-  </a>
+          @if (customAppTitle) {
            <span class="byline text-uppercase font-monospace" i18n>by Paperless-ngx</span>
          }
        </div>
      }
    </a>
  </div>
  <div class="search-container flex-grow-1 py-2 pb-3 pb-sm-2 me-sm-auto order-3 order-sm-1"
    [class.mobile-hidden]="mobileSearchHidden()">
    <div class="col-12 header-search mx-auto">
@@ -41,7 +39,7 @@
    }
    <pngx-toasts-dropdown></pngx-toasts-dropdown>
    <li ngbDropdown class="nav-item dropdown">
-      <button class="btn navbar-action border-0" id="userDropdown" ngbDropdownToggle aria-label="User menu" i18n-aria-label>
+      <button class="btn navbar-action border-0 me-1 me-md-2" id="userDropdown" ngbDropdownToggle aria-label="User menu" i18n-aria-label>
        <i-bs width="1.3em" height="1.3em" name="person-circle"></i-bs>
        <span class="small ms-2 d-none d-sm-inline">
          {{this.settingsService.displayName}}
@@ -362,6 +362,7 @@ main {
  }
  ::ng-deep .navbar-official-logo {
    will-change: filter; // Safari repaints the whole navbar on filter change without this
    filter: drop-shadow(0 1px 2px rgba(var(--pngx-navbar-brand-shadow-rgb), .3));
    transition: filter .15s ease-in-out;
@@ -417,7 +418,7 @@ main {
 :host ::ng-deep .navbar-official-logo {
  .leaf {
-    fill: color-mix(in srgb, var(--pngx-primary-text-contrast) 70%, var(--bs-primary)) !important;
+    fill: color-mix(in srgb, var(--pngx-primary-text-contrast) 85%, var(--bs-primary)) !important;
  }
  .text {
@@ -436,6 +437,19 @@ main {
  padding-right: .5rem;
 }
 // true center the search with equal flex widths
@media (min-width: 768px) {
  .navbar-brand-container,
  .navbar > ul {
    display: flex; // so the brand link stays as wide as its contents
    flex: 1 1 0;
  }
  .navbar > ul {
    justify-content: flex-end;
  }
 }
 :host ::ng-deep .navbar-action {
  display: inline-flex;
  align-items: center;
@@ -476,6 +490,7 @@ main {
    text-align: left;
  }
  .navbar-brand-container,
  .navbar-brand {
    grid-area: brand;
    min-width: 0;
@@ -45,6 +45,7 @@ import { TasksService } from 'src/app/services/tasks.service'
 import { ToastService } from 'src/app/services/toast.service'
 import { environment } from 'src/environments/environment'
 import { ChatComponent } from '../chat/chat/chat.component'
 import { BrandMarkComponent } from '../common/logo/brand-mark/brand-mark.component'
 import { LogoComponent } from '../common/logo/logo.component'
 import { ProfileEditDialogComponent } from '../common/profile-edit-dialog/profile-edit-dialog.component'
 import { DocumentDetailComponent } from '../document-detail/document-detail.component'
@@ -61,6 +62,7 @@ const SCROLL_THRESHOLD = 16
  imports: [
    GlobalSearchComponent,
    LogoComponent,
    BrandMarkComponent,
    DocumentTitlePipe,
    IfPermissionsDirective,
    ToastsDropdownComponent,
@@ -462,6 +462,45 @@
          </div>
        </div>
      }
      @case (WorkflowActionType.ApplyAiSuggestions) {
        <div class="row">
          <div class="col">
            <p class="text-muted small" i18n>The document will be sent to the configured AI service for suggestions. Consider costs and privacy.</p>
            <pngx-input-select
              i18n-title
              title="Apply suggestions for"
              [items]="aiSuggestionFieldOptions"
              [multiple]="true"
              formControlName="ai_suggestion_fields"
              [error]="error?.actions?.[i]?.ai_suggestion_fields"
              hint="Suggestions for fields that are not selected are discarded."
              i18n-hint
            ></pngx-input-select>
          </div>
        </div>
        <div class="row">
          <div class="col-md-6">
            <pngx-input-switch
              [horizontal]="true"
              i18n-title
              title="Create missing items"
              formControlName="ai_create_missing"
              hint="Create suggested tags, correspondents and document types that do not exist yet."
              i18n-hint
            ></pngx-input-switch>
          </div>
          <div class="col-md-6">
            <pngx-input-switch
              [horizontal]="true"
              i18n-title
              title="Overwrite existing values"
              formControlName="ai_overwrite_existing"
              hint="Apply suggestions even if the document already has a value. Tags are always added, never replaced."
              i18n-hint
            ></pngx-input-switch>
          </div>
        </div>
      }
    }
  </div>
 </ng-template>
@@ -22,6 +22,7 @@ import {
 } from 'src/app/data/matching-model'
 import { Workflow } from 'src/app/data/workflow'
 import {
  AISuggestionField,
  WorkflowAction,
  WorkflowActionType,
 } from 'src/app/data/workflow-action'
@@ -49,6 +50,7 @@ import { TagsComponent } from '../../input/tags/tags.component'
 import { TextComponent } from '../../input/text/text.component'
 import { EditDialogMode } from '../edit-dialog.component'
 import {
  AI_SUGGESTION_FIELD_OPTIONS,
  DOCUMENT_SOURCE_OPTIONS,
  SCHEDULE_DATE_FIELD_OPTIONS,
  TriggerFilterType,
@@ -239,14 +241,15 @@ describe('WorkflowEditDialogComponent', () => {
      SCHEDULE_DATE_FIELD_OPTIONS
    )
-    // Email disabled
+    // Email, remote OCR and AI all disabled
    jest.spyOn(settingsService, 'get').mockReturnValue(false)
    component.ngOnInit()
    expect(component.actionTypeOptions).toEqual(
      WORKFLOW_ACTION_OPTIONS.filter(
        (a) =>
          a.id !== WorkflowActionType.Email &&
-          a.id !== WorkflowActionType.RemoteOcr
+          a.id !== WorkflowActionType.RemoteOcr &&
          a.id !== WorkflowActionType.ApplyAiSuggestions
      )
    )
  })
@@ -344,6 +347,125 @@ describe('WorkflowEditDialogComponent', () => {
    )
  })
  it('should offer apply AI suggestions unless every trigger is consumption', () => {
    jest.spyOn(settingsService, 'get').mockReturnValue(true)
    // Consumption runs before the document has been parsed, so there would be
    // no content to make suggestions from
    component.object = {
      name: 'Workflow 1',
      order: 0,
      enabled: true,
      triggers: [{ type: WorkflowTriggerType.Consumption }],
      actions: [],
    } as Workflow
    component.ngOnInit()
    expect(component.actionTypeOptions.map((a) => a.id)).not.toContain(
      WorkflowActionType.ApplyAiSuggestions
    )
    // A second, usable trigger is enough
    component.object = {
      name: 'Workflow 2',
      order: 0,
      enabled: true,
      triggers: [
        { type: WorkflowTriggerType.Consumption },
        { type: WorkflowTriggerType.DocumentAdded },
      ],
      actions: [],
    } as Workflow
    component.ngOnInit()
    expect(component.actionTypeOptions.map((a) => a.id)).toContain(
      WorkflowActionType.ApplyAiSuggestions
    )
  })
  it('should keep apply AI suggestions listed when an action already uses it', () => {
    jest.spyOn(settingsService, 'get').mockReturnValue(true)
    // Otherwise changing the trigger would silently blank the selection
    component.object = {
      name: 'Workflow 1',
      order: 0,
      enabled: true,
      triggers: [{ type: WorkflowTriggerType.Consumption }],
      actions: [{ type: WorkflowActionType.ApplyAiSuggestions }],
    } as Workflow
    component.ngOnInit()
    expect(component.actionTypeOptions.map((a) => a.id)).toContain(
      WorkflowActionType.ApplyAiSuggestions
    )
  })
  it('should not offer apply AI suggestions when AI is disabled', () => {
    jest
      .spyOn(settingsService, 'get')
      .mockImplementation((key) => key !== SETTINGS_KEYS.AI_ENABLED)
    component.object = {
      name: 'Workflow 1',
      order: 0,
      enabled: true,
      triggers: [{ type: WorkflowTriggerType.DocumentAdded }],
      actions: [],
    } as Workflow
    component.ngOnInit()
    expect(component.actionTypeOptions.map((a) => a.id)).not.toContain(
      WorkflowActionType.ApplyAiSuggestions
    )
  })
  it('should create form fields for apply AI suggestions options', () => {
    component.object = {
      name: 'Workflow 1',
      order: 0,
      enabled: true,
      triggers: [{ type: WorkflowTriggerType.DocumentAdded }],
      actions: [
        {
          type: WorkflowActionType.ApplyAiSuggestions,
          ai_suggestion_fields: [
            AISuggestionField.Title,
            AISuggestionField.Tags,
          ],
          ai_create_missing: true,
          ai_overwrite_existing: true,
        },
      ],
    } as Workflow
    component.ngOnInit()
    const action = component.actionFields.at(0)
    expect(action.get('ai_suggestion_fields').value).toEqual([
      AISuggestionField.Title,
      AISuggestionField.Tags,
    ])
    expect(action.get('ai_create_missing').value).toBeTruthy()
    expect(action.get('ai_overwrite_existing').value).toBeTruthy()
    expect(component.aiSuggestionFieldOptions).toEqual(
      AI_SUGGESTION_FIELD_OPTIONS
    )
  })
  it('should default apply AI suggestions options on a new action', () => {
    component.object = {
      name: 'Workflow 1',
      order: 0,
      enabled: true,
      triggers: [{ type: WorkflowTriggerType.DocumentAdded }],
      actions: [],
    } as Workflow
    component.addAction()
    const action = component.actionFields.at(component.actionFields.length - 1)
    expect(action.get('ai_suggestion_fields').value).toEqual([])
    expect(action.get('ai_create_missing').value).toBeFalsy()
    expect(action.get('ai_overwrite_existing').value).toBeFalsy()
  })
  it('should support add and remove triggers and actions', () => {
    component.object = workflow
    component.addTrigger()
@@ -30,6 +30,7 @@ import { StoragePath } from 'src/app/data/storage-path'
 import { SETTINGS_KEYS } from 'src/app/data/ui-settings'
 import { Workflow } from 'src/app/data/workflow'
 import {
  AISuggestionField,
  WorkflowAction,
  WorkflowActionType,
 } from 'src/app/data/workflow-action'
@@ -152,6 +153,37 @@ export const WORKFLOW_ACTION_OPTIONS = [
    id: WorkflowActionType.RemoteOcr,
    name: $localize`Remote OCR`,
  },
  {
    id: WorkflowActionType.ApplyAiSuggestions,
    name: $localize`Apply AI suggestions`,
  },
 ]
 export const AI_SUGGESTION_FIELD_OPTIONS = [
  {
    id: AISuggestionField.Title,
    name: $localize`Title`,
  },
  {
    id: AISuggestionField.Tags,
    name: $localize`Tags`,
  },
  {
    id: AISuggestionField.Correspondent,
    name: $localize`Correspondent`,
  },
  {
    id: AISuggestionField.DocumentType,
    name: $localize`Document type`,
  },
  {
    id: AISuggestionField.StoragePath,
    name: $localize`Storage path`,
  },
  {
    id: AISuggestionField.Created,
    name: $localize`Created date`,
  },
 ]
 export enum TriggerFilterType {
@@ -576,6 +608,24 @@ export class WorkflowEditDialogComponent
      allowed = allowed.filter((a) => a.id !== WorkflowActionType.RemoteOcr)
    }
    // Only available after consumption. Unlike remote OCR this is hidden only
    // once every trigger is consumption, so it stays offered on a workflow
    // that has no triggers yet.
    const aiSuggestionsUsable =
      this.settingsService.get(SETTINGS_KEYS.AI_ENABLED) &&
      (!formWorkflow?.triggers?.length ||
        formWorkflow.triggers.some(
          (trigger) => trigger.type !== WorkflowTriggerType.Consumption
        ) ||
        formWorkflow.actions?.some(
          (action) => action.type === WorkflowActionType.ApplyAiSuggestions
        ))
    if (!aiSuggestionsUsable) {
      allowed = allowed.filter(
        (a) => a.id !== WorkflowActionType.ApplyAiSuggestions
      )
    }
    if (
      this.allowedActionTypes?.length === allowed.length &&
      this.allowedActionTypes.every((a, i) => a.id === allowed[i].id)
@@ -1227,6 +1277,11 @@ export class WorkflowEditDialogComponent
        passwords: new FormControl(
          this.formatPasswords(action.passwords ?? [])
        ),
        ai_suggestion_fields: new FormControl(
          action.ai_suggestion_fields ?? []
        ),
        ai_create_missing: new FormControl(!!action.ai_create_missing),
        ai_overwrite_existing: new FormControl(!!action.ai_overwrite_existing),
      }),
      { emitEvent }
    )
@@ -1316,6 +1371,10 @@ export class WorkflowEditDialogComponent
    return this.actionTypeOptions.find((t) => t.id === type)?.name ?? ''
  }
  get aiSuggestionFieldOptions() {
    return AI_SUGGESTION_FIELD_OPTIONS
  }
  addAction() {
    if (!this.object) {
      this.object = Object.assign({}, this.objectForm.value)
@@ -1369,6 +1428,9 @@ export class WorkflowEditDialogComponent
        include_document: false,
      },
      passwords: [],
      ai_suggestion_fields: [],
      ai_create_missing: false,
      ai_overwrite_existing: false,
    }
    this.object.actions.push(action)
    this.createActionField(action)
@@ -40,6 +40,10 @@ describe('PasswordComponent', () => {
    // expect(component.value).toEqual('foo')
  })
  it('should not offer itself to browser autofill by default', () => {
    expect(input.getAttribute('autocomplete')).toEqual('off')
  })
  it('should support toggling field visibility', () => {
    expect(input.type).toEqual('password')
    component.showReveal = true
@@ -25,7 +25,7 @@ export class PasswordComponent extends AbstractInputComponent<string> {
  showReveal: boolean = false
  @Input()
-  autocomplete: string
+  autocomplete: string = 'off'
  public textVisible: boolean = false
@@ -36,11 +36,16 @@
          (focus)="clearLastSearchTerm()"
          (clear)="clearLastSearchTerm()"
          (blur)="onBlur()">
-          <ng-template ng-label-tmp let-item="item">
+          <ng-template ng-label-tmp let-item="item" let-clear="clear">
-            @if (iconField && item[iconField]) {
+            @if (multiple && !disabled) {
-              <i-bs class="me-2" [name]="item[iconField]"></i-bs>
+              <span class="ng-value-icon left" role="button" tabindex="0" (click)="clear(item)" (keydown.enter)="clear(item)" aria-label="Remove item" i18n-aria-label>×</span>
            }
-            <span [title]="item[bindLabel]">{{item[bindLabel]}}</span>
+            <span class="ng-value-label" [title]="item[bindLabel]">
              @if (iconField && item[iconField]) {
                <i-bs class="me-2" [name]="item[iconField]"></i-bs>
              }
              {{item[bindLabel]}}
            </span>
          </ng-template>
          <ng-template ng-option-tmp let-item="item">
              @if (iconField && item[iconField]) {
@@ -24,6 +24,12 @@ describe('TextComponent', () => {
    input = component.inputField.nativeElement
  })
  it('should not offer itself to browser autofill by default', () => {
    expect(
      component.inputField.nativeElement.getAttribute('autocomplete')
    ).toEqual('off')
  })
  it('should support use of input field', () => {
    expect(component.value).toBeUndefined()
    input.value = 'foo'
@@ -28,7 +28,7 @@ import { AbstractInputComponent } from '../abstract-input'
 })
 export class TextComponent extends AbstractInputComponent<string> {
  @Input()
-  autocomplete: string
+  autocomplete: string = 'off'
  @Input()
  placeholder: string = ''
@@ -0,0 +1,3 @@
 <svg class="w-100 h-100 d-block" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 1000" fill="currentColor" aria-hidden="true">
  <path d="M341,949.1c-6.9-20.3-20.7-61.2-21.9-61-199.6-88.9-182.5-229.8-134.3-347.5,30,137.2,268.8,148.9,146.2,336-.9,2.2,10,27.8,19.5,51.3,22.7-51.9,58.6-115.5,55.8-120.8C178,398.7,724.9,299,807.1,18.5c83,251.5,53.1,659.8-377.4,814.9-2,1.4-63.5,148.6-66.9,150.2-.2-2.1-33.2,2.9-30.1-8.7,1.6-7,4.8-16.2,8.2-25.6h0v-.2h.1ZM323.1,846.2c48.3-71.9-12.7-120.8-56.9-152.2,81.2,107.4,66.4,120.8,56.9,152.2h0Z"/>
 </svg>
@@ -0,0 +1,14 @@
 import { Component, input } from '@angular/core'
@Component({
  selector: 'pngx-brand-mark',
  templateUrl: './brand-mark.component.html',
  host: {
    '[style.width]': 'width()',
    '[style.height]': 'height()',
  },
 })
 export class BrandMarkComponent {
  readonly width = input<string>(null)
  readonly height = input<string>(null)
 }
@@ -1,10 +1,18 @@
-<ngb-alert class="pe-3" type="primary" [dismissible]="true" (closed)="dismiss.emit(true)">
+<ngb-alert class="welcome-widget bg-light shadow-sm pe-3 position-relative overflow-hidden" type="primary" [dismissible]="true" (closed)="dismiss.emit(true)">
-  <h4 class="alert-heading"><ng-container i18n>Paperless-ngx is running!</ng-container> 🎉</h4>
+  <pngx-brand-mark class="welcome-watermark d-none d-md-block position-absolute top-50 translate-middle-y text-primary pe-none" width="26rem" height="26rem"></pngx-brand-mark>
-  <p i18n>You're ready to start uploading documents! Explore the various features of this web app on your own, or start a quick tour using the button below.</p>
+  <div class="d-flex align-items-start gap-3 gap-md-4 position-relative">
-  <p i18n>More detail on how to use and configure Paperless-ngx is always available in the <a href="https://docs.paperless-ngx.com" target="_blank">documentation</a>.</p>
+    <pngx-brand-mark class="d-none d-sm-block flex-shrink-0 text-primary" width="3rem" height="3rem"></pngx-brand-mark>
-  <hr>
+    <div class="flex-grow-1">
-  <div class="d-flex align-items-end">
+      <h4 class="alert-heading text-primary fw-semibold"><ng-container i18n>Paperless-ngx is running!</ng-container> 🎉</h4>
-    <p class="lead fs-6 m-0"><em i18n>Thanks for being a part of the Paperless-ngx community!</em></p>
+      <div class="welcome-copy text-dark">
-    <button class="btn btn-primary ms-auto flex-shrink-0" (click)="tourService.start()"><ng-container i18n>Start the tour</ng-container> &rarr;</button>
+        <p i18n>You're ready to start uploading documents! Explore the various features of this web app on your own, or start a quick tour using the button below.</p>
        <p class="mb-0" i18n>More detail on how to use and configure Paperless-ngx is always available in the <a href="https://docs.paperless-ngx.com" target="_blank">documentation</a>.</p>
      </div>
      <hr class="opacity-100">
      <div class="d-flex flex-column flex-sm-row align-items-sm-center gap-3">
        <p class="m-0 text-secondary"><em i18n>Thanks for being a part of the Paperless-ngx community!</em></p>
        <button class="btn btn-primary ms-sm-auto flex-shrink-0 align-self-start align-self-sm-auto" (click)="tourService.start()"><ng-container i18n>Start the tour</ng-container> &rarr;</button>
      </div>
    </div>
  </div>
 </ngb-alert>
@@ -0,0 +1,16 @@
 .welcome-widget {
  border-color: color-mix(in srgb, var(--bs-primary) 50%, transparent);
  hr {
    border-top-color: color-mix(in srgb, var(--bs-primary) 25%, transparent);
  }
 }
 .welcome-copy {
  max-width: 68ch;
 }
 .welcome-watermark {
  right: -6rem;
  opacity: .07;
 }
@@ -1,12 +1,13 @@
 import { Component, EventEmitter, Output, inject } from '@angular/core'
 import { NgbAlertModule } from '@ng-bootstrap/ng-bootstrap'
 import { TourService } from 'ngx-ui-tour-ng-bootstrap'
 import { BrandMarkComponent } from '../../../common/logo/brand-mark/brand-mark.component'
@Component({
  selector: 'pngx-welcome-widget',
  templateUrl: './welcome-widget.component.html',
  styleUrls: ['./welcome-widget.component.scss'],
-  imports: [NgbAlertModule],
+  imports: [NgbAlertModule, BrandMarkComponent],
 })
 export class WelcomeWidgetComponent {
  readonly tourService = inject(TourService)
@@ -8,6 +8,17 @@ export enum WorkflowActionType {
  PasswordRemoval = 5,
  MoveToTrash = 6,
  RemoteOcr = 7,
  ApplyAiSuggestions = 8,
 }
 // see src/documents/models.py AISuggestionField
 export enum AISuggestionField {
  Title = 'title',
  Tags = 'tags',
  Correspondent = 'correspondent',
  DocumentType = 'document_type',
  StoragePath = 'storage_path',
  Created = 'created',
 }
 export interface WorkflowActionEmail extends ObjectWithId {
@@ -102,4 +113,10 @@ export interface WorkflowAction extends ObjectWithId {
  webhook?: WorkflowActionWebhook
  passwords?: string[]
  ai_suggestion_fields?: AISuggestionField[]
  ai_create_missing?: boolean
  ai_overwrite_existing?: boolean
 }
@@ -15,6 +15,35 @@ describe('text search utilities', () => {
    expect(matchesSearchText('taxes 2026', 'tax receipt')).toBeFalsy()
  })
  it('does not let two terms match the same word', () => {
    expect(matchesSearchText('Another Tag', 'another tag th')).toBeFalsy()
    expect(matchesSearchText('Another Tag', 'another tag ag')).toBeFalsy()
    expect(matchesSearchText('Another Tag', 'another tag e')).toBeFalsy()
    expect(matchesSearchText('Another Tag', 'another tag')).toBeTruthy()
    expect(matchesSearchText('Another Tag', 'tag another')).toBeTruthy()
  })
  it('matches a single term anywhere in the value', () => {
    expect(matchesSearchText('Another Tag', 'anoth')).toBeTruthy()
    expect(matchesSearchText('Another Tag', 'th')).toBeTruthy()
  })
  it('treats punctuation as a separator on both sides', () => {
    expect(matchesSearchText('medical-history', 'medical history')).toBeTruthy()
    expect(matchesSearchText('medical history', 'medical-history')).toBeTruthy()
    expect(matchesSearchText('medical-history', 'medical dental')).toBeFalsy()
  })
  it('matches longer terms first so they cannot be starved', () => {
    expect(matchesSearchText('tagger tag', 'tag tagger')).toBeTruthy()
  })
  it('handles a query with no usable terms', () => {
    expect(matchesSearchText('Another Tag', '')).toBeTruthy()
    // Still filters, so the dropdown can offer to create a tag named "---"
    expect(matchesSearchText('Another Tag', '---')).toBeFalsy()
  })
  it('matches a large set of tag names without blocking input', () => {
    const tagNames = Array.from(
      { length: 1280 },
@@ -3,13 +3,18 @@ import { diacritics } from 'normalize-diacritics/diacritics'
 export type SearchTextValue =
  string | number | boolean | bigint | null | undefined
 const NON_ASCII = /[^\x00-\x7F]/
 const SEPARATORS = /[^\p{L}\p{N}]+/u
 export function normalizeSearchText(value: SearchTextValue): string {
-  const normalized = diacritics.reduce(
+  const text = String(value ?? '')
-    (text, replacement) => {
+
-      return text.replace(replacement.diacritics, replacement.letter)
+  // Nothing in the table matches ASCII, so skip normaliation
-    },
+  if (!NON_ASCII.test(text)) return text.toLocaleLowerCase()
-    String(value ?? '')
+
-  )
+  const normalized = diacritics.reduce((text, replacement) => {
    return text.replace(replacement.diacritics, replacement.letter)
  }, text)
  return normalized.toLocaleLowerCase()
 }
@@ -18,8 +23,28 @@ export function matchesSearchText(
  value: SearchTextValue,
  searchText: SearchTextValue
 ): boolean {
-  const normalizedValue = normalizeSearchText(value)
+  const query = normalizeSearchText(searchText)
-  const searchTerms = normalizeSearchText(searchText).trim().split(/\s+/)
+  const terms = query.split(SEPARATORS).filter(Boolean)
-  return searchTerms.every((term) => normalizedValue.includes(term))
+  // Empty or punctuation-only query, nothing to split into terms
  if (terms.length === 0) {
    return normalizeSearchText(value).includes(query.trim())
  }
  const words = normalizeSearchText(value).split(SEPARATORS).filter(Boolean)
  const claimed = new Array<boolean>(words.length).fill(false)
  // Each term takes a word of its own, longest first, so that "another tag th"
  // doesn't match "Another Tag" by finding the "th" inside "another"
  return terms
    .sort((a, b) => b.length - a.length)
    .every((term) => {
      for (let i = 0; i < words.length; i++) {
        if (!claimed[i] && words[i].includes(term)) {
          claimed[i] = true
          return true
        }
      }
      return false
    })
 }
@@ -8,7 +8,7 @@ export const environment = {
  apiVersion: '10', // match src/paperless/settings.py
  appTitle: DEFAULT_APP_TITLE,
  tag: 'prod',
-  version: '3.0.5',
+  version: '3.1.0',
  webSocketHost: window.location.host,
  webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:',
  webSocketBaseUrl: base_url.pathname + 'ws/',
@@ -27,7 +27,7 @@ from documents.models import DocumentType
 from documents.models import PaperlessTask
 from documents.models import StoragePath
 from documents.models import Tag
-from documents.permissions import set_permissions_for_objects
+from documents.permissions import set_permissions_for_object
 from documents.plugins.helpers import DocumentsStatusManager
 from documents.tasks import bulk_update_documents
 from documents.tasks import consume_file
@@ -305,49 +305,33 @@ def modify_custom_fields(
        else [(field, None) for field in add_custom_fields]
    )
-    custom_fields_by_id: dict[int, CustomField] = {
+    custom_fields = CustomField.objects.filter(
-        cf.id: cf
+        id__in=[int(field) for field, _ in add_custom_fields],
-        for cf in CustomField.objects.filter(
+    ).distinct()
            id__in=[int(field) for field, _ in add_custom_fields],
        )
    }
    # Deferred, not `.only()`: these objects get cached onto the FK
    # descriptor of newly-created CustomFieldInstance rows below, and
    # downstream post_save receivers (e.g. the filename-generation signal)
    # touch other Document fields -- `.only("pk")` would just turn that into
    # a deferred-field reload per document, trading one N+1 for another.
    # `content` is the one field guaranteed to be both large (full OCR text)
    # and unused by anything this function or its receivers touch.
    docs_by_id: dict[int, Document] = {
        doc.id: doc
        for doc in Document.objects.filter(id__in=affected_docs).defer("content")
    }
    for field_id, value in add_custom_fields:
        custom_field = custom_fields_by_id[field_id]
        value_field = CustomFieldInstance.TYPE_TO_DATA_STORE_NAME_MAP[
            custom_field.data_type
        ]
        for doc_id in affected_docs:
-            defaults = {value_field: value}
+            defaults = {}
-            if (
+            custom_field = custom_fields.get(id=field_id)
-                custom_field.data_type == CustomField.FieldDataType.DOCUMENTLINK
+            if custom_field:
-                and value
+                value_field = CustomFieldInstance.TYPE_TO_DATA_STORE_NAME_MAP[
-                and doc_id in value
+                    custom_field.data_type
-            ):
+                ]
-                # Prevent self-linking
+                defaults[value_field] = value
-                continue
+                if (
-            # Pass the already-resolved objects, not bare ids: this caches
+                    custom_field.data_type == CustomField.FieldDataType.DOCUMENTLINK
-            # them on the FK descriptor of any newly-created instance, so a
+                    and value
-            # later `.field`/`.document` access (e.g. auditlog's post_save
+                    and doc_id in value
-            # receiver calling `str(instance)`, which touches `.field.name`)
+                ):
-            # doesn't trigger its own per-instance re-fetch.
+                    # Prevent self-linking
                    continue
            CustomFieldInstance.objects.update_or_create(
-                document=docs_by_id[doc_id],
+                document_id=doc_id,
-                field=custom_field,
+                field_id=field_id,
                defaults=defaults,
            )
            if custom_field.data_type == CustomField.FieldDataType.DOCUMENTLINK:
-                reflect_doclinks(docs_by_id[doc_id], custom_field, value)
+                doc = Document.objects.get(id=doc_id)
                reflect_doclinks(doc, custom_field, value)
    # For doc link fields that are being removed, remove symmetrical links
    for doclink_being_removed_instance in CustomFieldInstance.objects.filter(
@@ -355,10 +339,12 @@ def modify_custom_fields(
        field__id__in=remove_custom_fields,
        field__data_type=CustomField.FieldDataType.DOCUMENTLINK,
        value_document_ids__isnull=False,
-    ).select_related("field"):
+    ):
        for target_doc_id in doclink_being_removed_instance.value:
            remove_doclink(
-                document=docs_by_id[doclink_being_removed_instance.document_id],
+                document=Document.objects.get(
                    id=doclink_being_removed_instance.document.id,
                ),
                field=doclink_being_removed_instance.field,
                target_doc_id=target_doc_id,
            )
@@ -444,13 +430,10 @@ def set_permissions(
    else:
        qs.update(owner=owner)
    for doc in qs:
        set_permissions_for_object(permissions=set_permissions, object=doc, merge=merge)
    affected_docs = list(qs.values_list("pk", flat=True))
    set_permissions_for_objects(
        permissions=set_permissions,
        model=Document,
        pks=affected_docs,
        merge=merge,
    )
    bulk_update_documents.apply_async(
        kwargs={"document_ids": affected_docs},
@@ -129,7 +129,7 @@ class DocumentMetadataOverrides:
        )
        overrides.custom_fields = {
            custom_field.field.id: custom_field.value
-            for custom_field in doc.custom_fields.select_related("field").all()
+            for custom_field in doc.custom_fields.all()
        }
        groups_with_perms = get_groups_with_perms(
@@ -0,0 +1,84 @@
 # Generated by Django 5.2.16 on 2026-08-10 18:26
 from django.db import migrations
 from django.db import models
 class Migration(migrations.Migration):
    dependencies = [
        ("documents", "0024_alter_workflowaction_type"),
    ]
    operations = [
        migrations.AddField(
            model_name="workflowaction",
            name="ai_create_missing",
            field=models.BooleanField(
                default=False,
                help_text="Create suggested tags, correspondents, document types and storage paths that do not already exist instead of skipping them.",
                verbose_name="create missing objects",
            ),
        ),
        migrations.AddField(
            model_name="workflowaction",
            name="ai_overwrite_existing",
            field=models.BooleanField(
                default=False,
                help_text="Apply suggestions even if the document already has a value for that field. Tags are always added to, never replaced.",
                verbose_name="overwrite existing values",
            ),
        ),
        migrations.AddField(
            model_name="workflowaction",
            name="ai_suggestion_fields",
            field=models.JSONField(
                blank=True,
                help_text="Which of the AI-suggested fields to apply to the document.",
                null=True,
                verbose_name="AI suggestion fields",
            ),
        ),
        migrations.AlterField(
            model_name="workflowaction",
            name="type",
            field=models.PositiveSmallIntegerField(
                choices=[
                    (1, "Assignment"),
                    (2, "Removal"),
                    (3, "Email"),
                    (4, "Webhook"),
                    (5, "Password removal"),
                    (6, "Move to trash"),
                    (7, "Remote OCR"),
                    (8, "Apply AI suggestions"),
                ],
                default=1,
                verbose_name="Workflow Action Type",
            ),
        ),
        migrations.AlterField(
            model_name="paperlesstask",
            name="task_type",
            field=models.CharField(
                choices=[
                    ("consume_file", "Consume File"),
                    ("train_classifier", "Train Classifier"),
                    ("sanity_check", "Sanity Check"),
                    ("index_optimize", "Index Optimize"),
                    ("mail_fetch", "Mail Fetch"),
                    ("llm_index", "LLM Index"),
                    ("empty_trash", "Empty Trash"),
                    ("check_workflows", "Check Workflows"),
                    ("bulk_update", "Bulk Update"),
                    ("reprocess_document", "Reprocess Document"),
                    ("build_share_link", "Build Share Link"),
                    ("bulk_delete", "Bulk Delete"),
                    ("apply_ai_suggestions", "Apply AI Suggestions"),
                ],
                db_index=True,
                help_text="The kind of work being performed",
                max_length=50,
                verbose_name="Task Type",
            ),
        ),
    ]
@@ -766,6 +766,7 @@ class PaperlessTask(ModelWithOwner):
        REPROCESS_DOCUMENT = "reprocess_document", _("Reprocess Document")
        BUILD_SHARE_LINK = "build_share_link", _("Build Share Link")
        BULK_DELETE = "bulk_delete", _("Bulk Delete")
        APPLY_AI_SUGGESTIONS = "apply_ai_suggestions", _("Apply AI Suggestions")
    COMPLETE_STATUSES = (
        Status.SUCCESS,
@@ -1674,6 +1675,18 @@ class WorkflowAction(models.Model):
            7,
            _("Remote OCR"),
        )
        APPLY_AI_SUGGESTIONS = (
            8,
            _("Apply AI suggestions"),
        )
    class AISuggestionField(models.TextChoices):
        TITLE = ("title", _("Title"))
        TAGS = ("tags", _("Tags"))
        CORRESPONDENT = ("correspondent", _("Correspondent"))
        DOCUMENT_TYPE = ("document_type", _("Document type"))
        STORAGE_PATH = ("storage_path", _("Storage path"))
        CREATED = ("created", _("Created date"))
    type = models.PositiveSmallIntegerField(
        _("Workflow Action Type"),
@@ -1912,6 +1925,33 @@ class WorkflowAction(models.Model):
        ),
    )
    ai_suggestion_fields = models.JSONField(
        _("AI suggestion fields"),
        null=True,
        blank=True,
        help_text=_(
            "Which of the AI-suggested fields to apply to the document.",
        ),
    )
    ai_create_missing = models.BooleanField(
        _("create missing objects"),
        default=False,
        help_text=_(
            "Create suggested tags, correspondents, document types and storage "
            "paths that do not already exist instead of skipping them.",
        ),
    )
    ai_overwrite_existing = models.BooleanField(
        _("overwrite existing values"),
        default=False,
        help_text=_(
            "Apply suggestions even if the document already has a value for that "
            "field. Tags are always added to, never replaced.",
        ),
    )
    class Meta:
        verbose_name = _("workflow action")
        verbose_name_plural = _("workflow actions")
@@ -173,182 +173,6 @@ def set_permissions_for_object(
                        )
 def _resolve_permissions(codenames: set[str], ctype: ContentType) -> list[Permission]:
    """
    Resolves `codenames` to Permission rows, raising like the single-object
    assign_perm() this bulk path replaces does (via a `.get()` internally)
    if any codename doesn't exist -- e.g. a client-supplied action name that
    was never validated (BulkEditObjectsSerializer._validate_permissions
    calls validate_set_permissions() only for its side-effecting id checks
    and discards the filtered dict it returns, so an unrecognized action key
    reaches this function as-is). A plain `.filter()` with no existence
    check would otherwise silently build zero rows and no-op instead of
    reporting the bad input.
    """
    permission_objs = list(
        Permission.objects.filter(content_type=ctype, codename__in=codenames),
    )
    missing = codenames - {p.codename for p in permission_objs}
    if missing:
        raise Permission.DoesNotExist(
            f"Permission matching query does not exist for codename(s): "
            f"{', '.join(sorted(missing))}",
        )
    return permission_objs
 # Target number of permission rows to build in Python before handing them to
 # bulk_create -- keeps peak memory bounded for a large "apply to all" call,
 # independent of bulk_create's own batch_size (which only caps the size of
 # each INSERT statement, not how many row objects exist in memory at once).
 _PERMISSION_ROW_CHUNK_SIZE = 5000
 def _apply_bulk_permission_entry(
    *,
    perm_model: type[UserObjectPermission] | type[GroupObjectPermission],
    identity_model: type[User] | type[Group],
    identity_field: str,
    ids: list[int],
    codename: str,
    permission_objs: list[Permission],
    ctype: ContentType,
    object_pks: list[str],
    merge: bool,
 ) -> None:
    # Only the ids are needed to build permission rows (via `<field>_id=`),
    # so avoid fetching full User/Group rows for identities that may not
    # even end up being granted anything new.
    add_ids = set(
        identity_model.objects.filter(id__in=ids).values_list("id", flat=True),
    )
    if not merge:
        existing_ids = set(
            perm_model.objects.filter(
                content_type=ctype,
                object_pk__in=object_pks,
                permission__codename=codename,
            ).values_list(f"{identity_field}_id", flat=True),
        )
        remove_ids = existing_ids - add_ids
        if remove_ids:
            perm_model.objects.filter(
                content_type=ctype,
                object_pk__in=object_pks,
                permission__codename=codename,
                **{f"{identity_field}_id__in": remove_ids},
            ).delete()
    if not add_ids:
        return
    rows_per_pk = len(permission_objs) * len(add_ids)
    pks_per_chunk = max(1, _PERMISSION_ROW_CHUNK_SIZE // rows_per_pk)
    for start in range(0, len(object_pks), pks_per_chunk):
        pk_chunk = object_pks[start : start + pks_per_chunk]
        rows = [
            perm_model(
                content_type=ctype,
                object_pk=pk,
                permission=permission_obj,
                **{f"{identity_field}_id": identity_id},
            )
            for permission_obj in permission_objs
            for pk in pk_chunk
            for identity_id in add_ids
        ]
        # ignore_conflicts skips only rows that already exist as an exact
        # (identity, permission, object) match -- the same de-dup the
        # underlying (user|group, permission, object_pk) unique constraint
        # already enforces for the single-object assign_perm() this
        # replaces, so it doesn't change what counts as "already granted".
        # batch_size caps how many rows go into a single INSERT so a huge
        # chunk doesn't build one enormous statement.
        perm_model.objects.bulk_create(rows, ignore_conflicts=True, batch_size=1000)
 def set_permissions_for_objects(
    permissions: dict,
    model: type[Model],
    pks: QuerySet | list,
    *,
    merge: bool = False,
 ) -> None:
    """
    Bulk equivalent of set_permissions_for_object: applies the same
    permission changes to every object identified by `pks` at once.
    Takes a model + pks (rather than model instances) deliberately -- the
    permission rows built below only ever need `pk`, `content_type`, and
    identity ids, so callers shouldn't have to fetch full rows (with every
    other field) just to hand them to this function.
    Deliberately does not use guardian's queryset/list-aware assign_perm:
    passing a list as the object routes to bulk_assign_perm, which skips
    creating a direct permission row for anyone who already has the
    permission via ANY group membership (it checks
    ObjectPermissionChecker.has_perm, which is group-inheritance-aware) --
    unlike the single-object assign_perm this replaces, which always
    ensures a direct row via get_or_create regardless of group-derived
    access. Losing that guarantee would mean a later revocation of the
    group's grant silently strips access an admin explicitly asked to be
    direct. Bulk-creating rows straight against the permission models
    instead (see _apply_bulk_permission_entry) preserves the original
    always-create-a-direct-row semantics while still batching every object
    and every identity into one query per action, rather than one query per
    (object, user) pair.
    """
    object_pks = [str(pk) for pk in pks]
    if not object_pks:
        return
    model_name = model.__name__.lower()
    ctype = ContentType.objects.get_for_model(model)
    for action, entry in permissions.items():
        codename = f"{action}_{model_name}"
        implied_codenames = {codename}
        if action == "change":
            # change gives view too
            implied_codenames.add(f"view_{model_name}")
        # Resolved once per action (not once per users/groups branch) and
        # shared between both below -- also where an unrecognized action
        # name (see _resolve_permissions) is caught.
        permission_objs = (
            _resolve_permissions(implied_codenames, ctype)
            if "users" in entry or "groups" in entry
            else []
        )
        if "users" in entry:
            _apply_bulk_permission_entry(
                perm_model=UserObjectPermission,
                identity_model=User,
                identity_field="user",
                ids=entry["users"],
                codename=codename,
                permission_objs=permission_objs,
                ctype=ctype,
                object_pks=object_pks,
                merge=merge,
            )
        if "groups" in entry:
            _apply_bulk_permission_entry(
                perm_model=GroupObjectPermission,
                identity_model=Group,
                identity_field="group",
                ids=entry["groups"],
                codename=codename,
                permission_objs=permission_objs,
                ctype=ctype,
                object_pks=object_pks,
                merge=merge,
            )
 def permitted_object_ids(
    user: User | None,
    model: type[Model],
@@ -1,10 +1,8 @@
 from __future__ import annotations
 import contextlib
 import logging
 import math
 import re
 from collections.abc import Iterable
 from datetime import datetime
 from datetime import timedelta
 from decimal import Decimal
@@ -26,7 +24,6 @@ from django.core.validators import MaxValueValidator
 from django.core.validators import MinValueValidator
 from django.core.validators import RegexValidator
 from django.core.validators import integer_validator
 from django.db import DataError
 from django.db.models import Count
 from django.db.models import Q
 from django.db.models.functions import Lower
@@ -40,12 +37,12 @@ from django.utils.timezone import make_aware
 from django.utils.translation import gettext as _
 from drf_spectacular.utils import extend_schema_field
 from drf_spectacular.utils import extend_schema_serializer
 from drf_writable_nested.serializers import NestedUpdateMixin
 from guardian.core import ObjectPermissionChecker
 from guardian.shortcuts import get_users_with_perms
 from guardian.utils import get_group_obj_perms_model
 from guardian.utils import get_user_obj_perms_model
 from rest_framework import fields
 from rest_framework import relations
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.fields import SerializerMethodField
@@ -745,100 +742,22 @@ class TagSerializer(MatchingModelSerializer, OwnedObjectSerializer):
        return super().validate(attrs)
-class _BatchingManyRelatedField(serializers.ManyRelatedField):
+class CorrespondentField(serializers.PrimaryKeyRelatedField[Correspondent]):
    """
    `ManyRelatedField.to_internal_value` resolves each id in the submitted
    list with its own `child_relation.to_internal_value()` call -- one query
    per item on every PATCH/PUT that sets a `many=True` relation field.
    Batch-resolve them instead, falling back to the child relation's normal
    (query-per-item) validation for anything that isn't a plausible int pk,
    so bad input still gets the usual DRF validation error rather than being
    silently dropped.
    """
    @staticmethod
    def _normalize_pk(item) -> int | None:
        # Excludes bool: DRF's own PrimaryKeyRelatedField rejects it too
        # (True == 1 would otherwise silently match pk 1).
        if isinstance(item, bool):
            return None
        try:
            return int(item)
        except (TypeError, ValueError):
            return None
    def to_internal_value(self, data):
        if isinstance(data, str) or not hasattr(data, "__iter__"):
            self.fail("not_a_list", input_type=type(data).__name__)
        if not self.allow_empty and len(data) == 0:
            self.fail("empty")
        item_pks = [(item, self._normalize_pk(item)) for item in data]
        candidate_pks = {pk for _, pk in item_pks if pk is not None}
        # Django's IntegerFieldOverflow guard (-> EmptyResultSet, i.e. no
        # match) only covers exact/gt/gte/lt/lte lookups, not `in` -- an
        # out-of-range int in `pk__in=` reaches the DB driver as-is and
        # raises OverflowError (SQLite) / DataError (Postgres) instead of
        # cleanly matching nothing. The per-item `exact`-lookup fallback
        # below IS covered, so on that failure just skip the batch and let
        # every item resolve individually -- each still costs one query,
        # but reports the normal validation error instead of a raw 500.
        try:
            resolved_by_pk = {
                obj.pk: obj
                for obj in self.child_relation.get_queryset().filter(
                    pk__in=candidate_pks,
                )
            }
        except (OverflowError, DataError):
            resolved_by_pk = {}
        result = []
        for item, pk in item_pks:
            obj = resolved_by_pk.get(pk) if pk is not None else None
            result.append(
                obj if obj is not None else self.child_relation.to_internal_value(item),
            )
        return result
 class BatchResolvingPrimaryKeyRelatedField(serializers.PrimaryKeyRelatedField):
    """
    A PrimaryKeyRelatedField whose `many=True` form (a DRF ManyRelatedField)
    resolves all submitted ids with one batched query instead of one query
    per id. Subclasses only need to implement `get_queryset()` as usual --
    only `TagsField` is used with `many=True` today, but this is the base
    for all four so the fix isn't tag-specific: if a future PR puts
    `many=True` on correspondent/document_type/storage_path, it inherits the
    same batching instead of reintroducing this as a new bug to rediscover.
    """
    @classmethod
    def many_init(cls, *args, **kwargs):
        list_kwargs = {"child_relation": cls(*args, **kwargs)}
        for key, value in kwargs.items():
            if key in relations.MANY_RELATION_KWARGS:
                list_kwargs[key] = value
        return _BatchingManyRelatedField(**list_kwargs)
 class CorrespondentField(BatchResolvingPrimaryKeyRelatedField[Correspondent]):
    def get_queryset(self):
        return Correspondent.objects.all()
-class TagsField(BatchResolvingPrimaryKeyRelatedField[Tag]):
+class TagsField(serializers.PrimaryKeyRelatedField[Tag]):
    def get_queryset(self):
        return Tag.objects.all()
-class DocumentTypeField(BatchResolvingPrimaryKeyRelatedField[DocumentType]):
+class DocumentTypeField(serializers.PrimaryKeyRelatedField[DocumentType]):
    def get_queryset(self):
        return DocumentType.objects.all()
-class StoragePathField(BatchResolvingPrimaryKeyRelatedField[StoragePath]):
+class StoragePathField(serializers.PrimaryKeyRelatedField[StoragePath]):
    def get_queryset(self):
        return StoragePath.objects.all()
@@ -957,106 +876,8 @@ def validate_documentlink_targets(user, doc_ids):
        )
 # A CustomField lookup cache scoped to a single field/serializer instance
 # only helps within that one instance's own validation pass. Several call
 # sites, though, build more than one CustomFieldInstanceSerializer (or its
 # CustomFieldInstanceListSerializer/field) for the same request and pass
 # each of them `context=self.context` -- the *same* dict object, not a
 # copy -- e.g. bulk-edit's _validate_custom_field_values() constructing a
 # fresh CustomFieldInstanceSerializer per submitted field. That context
 # dict is already request-scoped (DRF builds it fresh per request via
 # get_serializer_context()), so stashing the resolved CustomField objects
 # there -- rather than in some new global/thread-local cache -- lets every
 # one of those separately-instantiated serializers reuse them for free
 # while staying entirely within DRF's existing, already-request-scoped
 # machinery.
 _CUSTOM_FIELD_CONTEXT_CACHE_KEY = "_custom_field_lookup_cache"
 class _CachingCustomFieldPrimaryKeyField(serializers.PrimaryKeyRelatedField):
    """
    Resolves CustomField ids with as few queries as possible: a per-instance
    cache for repeat lookups on this exact field instance, backed by a
    shared cache on the serializer context (see _CUSTOM_FIELD_CONTEXT_CACHE_KEY
    above) so later, separately-instantiated fields for the same request
    reuse what was already resolved instead of re-querying.
    """
    def __init__(self, **kwargs: Any) -> None:
        super().__init__(**kwargs)
        self._cache: dict[int, CustomField] = {}
    def _shared_cache(self) -> dict[int, CustomField]:
        return self.context.setdefault(_CUSTOM_FIELD_CONTEXT_CACHE_KEY, {})
    @staticmethod
    def _normalize_pk(data: Any) -> int | None:
        """
        Returns `data` coerced to the int a valid CustomField pk would be,
        or None if `data` isn't a plausible pk (wrong type, unhashable,
        non-numeric, or a bool -- DRF itself rejects bools as pks since
        `True == 1` would otherwise silently match). None tells callers to
        leave `data` alone and let `super().to_internal_value()` report the
        normal validation error instead of touching the cache/queryset with
        it directly.
        """
        if isinstance(data, bool):
            return None
        try:
            return int(data)
        except (TypeError, ValueError):
            return None
    def prefetch(self, ids: Iterable[Any]) -> None:
        shared_cache = self._shared_cache()
        candidates = {pk for i in ids if (pk := self._normalize_pk(i)) is not None}
        missing = {
            i for i in candidates if i not in self._cache and i not in shared_cache
        }
        if missing:
            for obj in self.get_queryset().filter(pk__in=missing):
                shared_cache[obj.pk] = obj
        for i in candidates:
            obj = shared_cache.get(i)
            if obj is not None:
                self._cache[i] = obj
    def to_internal_value(self, data: Any) -> CustomField:
        pk = self._normalize_pk(data)
        if pk is None:
            return super().to_internal_value(data)
        if pk in self._cache:
            return self._cache[pk]
        shared_cache = self._shared_cache()
        if pk in shared_cache:
            obj = shared_cache[pk]
            self._cache[pk] = obj
            return obj
        obj: CustomField = super().to_internal_value(data)
        self._cache[obj.pk] = obj
        shared_cache[obj.pk] = obj
        return obj
 class CustomFieldInstanceListSerializer(serializers.ListSerializer):
    def to_internal_value(self, data: Any) -> list[Any]:
        if isinstance(data, list):
            field_ids = []
            for item in data:
                if not isinstance(item, dict) or "field" not in item:
                    continue
                try:
                    hash(item["field"])
                except TypeError:
                    continue
                field_ids.append(item["field"])
            if field_ids:
                self.child.fields["field"].prefetch(field_ids)
        return super().to_internal_value(data)
 class CustomFieldInstanceSerializer(serializers.ModelSerializer[CustomFieldInstance]):
-    field = _CachingCustomFieldPrimaryKeyField(queryset=CustomField.objects.all())
+    field = serializers.PrimaryKeyRelatedField(queryset=CustomField.objects.all())
    value = ReadWriteSerializerMethodField(allow_null=True)
    def create(self, validated_data):
@@ -1157,7 +978,6 @@ class CustomFieldInstanceSerializer(serializers.ModelSerializer[CustomFieldInsta
    class Meta:
        model = CustomFieldInstance
        list_serializer_class = CustomFieldInstanceListSerializer
        fields = [
            "value",
            "field",
@@ -1223,6 +1043,7 @@ class DocumentVersionInfoSerializer(serializers.Serializer[_DocumentVersionInfo]
 )
 class DocumentSerializer(
    OwnedObjectSerializer,
    NestedUpdateMixin,
    DocumentUpdateFieldsModelSerializer,
 ):
    correspondent = CorrespondentField(allow_null=True)
@@ -1437,60 +1258,16 @@ class DocumentSerializer(
                    if tag not in inbox_tags_not_being_added
                ]
-        custom_fields_data = validated_data.pop("custom_fields", None)
+        if settings.AUDIT_LOG_ENABLED:
-
+            with set_actor(self.user):
-        actor_context = (
+                super().update(instance, validated_data)
-            set_actor(self.user)
+        else:
            if settings.AUDIT_LOG_ENABLED
            else contextlib.nullcontext()
        )
        with actor_context:
            super().update(instance, validated_data)
            if custom_fields_data is not None:
                self._sync_custom_fields(instance, custom_fields_data)
        # hard delete custom field instances that were soft deleted
        CustomFieldInstance.deleted_objects.filter(document=instance).delete()
        return instance
    def _sync_custom_fields(
        self,
        instance: Document,
        custom_fields_data: list[dict],
    ) -> None:
        """
        Create/update a CustomFieldInstance for every (field, value) pair in
        custom_fields_data, then hard-delete any of the document's existing
        instances whose field wasn't included.
        Replaces drf-writable-nested's generic
        update_or_create_reverse_relations()/delete_reverse_relations_if_need():
        that machinery always matched submitted items by an instance "id"
        this client payload never sends, so its own pk-matching never did
        anything for this field -- the real upsert semantics were always
        CustomFieldInstanceSerializer.create()'s update_or_create() below.
        On a partial (PATCH) update, DRF skips the "value" field's required
        check on the first validation pass because it's absent entirely from
        the payload item, not merely null. drf-writable-nested happened to
        re-enforce that check itself, by re-validating each item against a
        freshly built, non-partial child serializer before saving. Reproduce
        that specific guarantee explicitly here, since CustomFieldInstance's
        "value" is not optional.
        """
        for item in custom_fields_data:
            if "value" not in item:
                raise serializers.ValidationError(
                    {"custom_fields": [{"value": ["This field is required."]}]},
                )
        kept_field_ids: set[int] = set()
        serializer = CustomFieldInstanceSerializer()
        for item in custom_fields_data:
            kept_field_ids.add(item["field"].pk)
            serializer.create({**item, "document": instance})
        CustomFieldInstance.objects.filter(document=instance).exclude(
            field_id__in=kept_field_ids,
        ).hard_delete()
    def __init__(self, *args, **kwargs) -> None:
        self.truncate_content = kwargs.pop("truncate_content", False)
@@ -3458,6 +3235,9 @@ class WorkflowActionSerializer(serializers.ModelSerializer[WorkflowAction]):
            "email",
            "webhook",
            "passwords",
            "ai_suggestion_fields",
            "ai_create_missing",
            "ai_overwrite_existing",
        ]
    def validate(self, attrs):
@@ -3515,6 +3295,23 @@ class WorkflowActionSerializer(serializers.ModelSerializer[WorkflowAction]):
                    "Passwords are required for password removal actions",
                )
        if (
            "type" in attrs
            and attrs["type"] == WorkflowAction.WorkflowActionType.APPLY_AI_SUGGESTIONS
        ):
            fields = attrs.get("ai_suggestion_fields")
            valid_fields = set(WorkflowAction.AISuggestionField.values)
            if (
                fields is None
                or not isinstance(fields, list)
                or len(fields) == 0
                or any(field not in valid_fields for field in fields)
            ):
                raise serializers.ValidationError(
                    "At least one valid field is required for apply AI "
                    f"suggestions actions, options are: {sorted(valid_fields)}",
                )
        return attrs
@@ -3543,24 +3340,43 @@ class WorkflowSerializer(serializers.ModelSerializer[Workflow]):
                action.get("type") == WorkflowAction.WorkflowActionType.REMOTE_OCR
                for action in attrs["actions"]
            )
            has_ai_suggestions_action = any(
                action.get("type")
                == WorkflowAction.WorkflowActionType.APPLY_AI_SUGGESTIONS
                for action in attrs["actions"]
            )
        else:
            has_remote_ocr_action = self.instance is not None and (
                self.instance.actions.filter(
                    type=WorkflowAction.WorkflowActionType.REMOTE_OCR,
                ).exists()
            )
            has_ai_suggestions_action = self.instance is not None and (
                self.instance.actions.filter(
                    type=WorkflowAction.WorkflowActionType.APPLY_AI_SUGGESTIONS,
                ).exists()
            )
        if "triggers" in attrs:
            has_consumption_trigger = any(
                trigger.get("type") == WorkflowTrigger.WorkflowTriggerType.CONSUMPTION
                for trigger in attrs["triggers"]
            )
            has_non_consumption_trigger = any(
                trigger.get("type") != WorkflowTrigger.WorkflowTriggerType.CONSUMPTION
                for trigger in attrs["triggers"]
            )
        else:
            has_consumption_trigger = self.instance is not None and (
                self.instance.triggers.filter(
                    type=WorkflowTrigger.WorkflowTriggerType.CONSUMPTION,
                ).exists()
            )
            has_non_consumption_trigger = self.instance is not None and (
                self.instance.triggers.exclude(
                    type=WorkflowTrigger.WorkflowTriggerType.CONSUMPTION,
                ).exists()
            )
        # Remote OCR can only work with consumption triggers
        if has_remote_ocr_action and not has_consumption_trigger:
@@ -3568,6 +3384,14 @@ class WorkflowSerializer(serializers.ModelSerializer[Workflow]):
                "Remote OCR actions require a consumption started trigger",
            )
        # Suggestions are made from the document content, which does not exist
        # until after consumption has finished
        if has_ai_suggestions_action and not has_non_consumption_trigger:
            raise serializers.ValidationError(
                "Apply AI suggestions actions require a trigger other than "
                "consumption started",
            )
        return attrs
    def update_triggers_and_actions(
@@ -984,6 +984,28 @@ def run_workflows(
                            "triggers, ignoring",
                            extra={"group": logging_group},
                        )
                elif (
                    action.type
                    == WorkflowAction.WorkflowActionType.APPLY_AI_SUGGESTIONS
                ):
                    if use_overrides:
                        # The document has not been parsed yet, so there is no
                        # content for the LLM to make suggestions from
                        logger.debug(
                            "Apply AI suggestions action does not apply to "
                            "consumption triggers, ignoring",
                            extra={"group": logging_group},
                        )
                    else:
                        # Queued rather than run sync
                        from documents.tasks import apply_ai_suggestions
                        # kwargs so the PaperlessTask record can note the
                        # document, see _extract_input_data
                        apply_ai_suggestions.delay(
                            action_id=action.pk,
                            document_id=document.pk,
                        )
            if not use_overrides:
                # limit title to 128 characters
@@ -1039,6 +1061,7 @@ TRACKED_TASKS: dict[str, PaperlessTask.TaskType] = {
    "documents.tasks.update_document_content_maybe_archive_file": PaperlessTask.TaskType.REPROCESS_DOCUMENT,
    "documents.tasks.build_share_link_bundle": PaperlessTask.TaskType.BUILD_SHARE_LINK,
    "documents.bulk_edit.delete": PaperlessTask.TaskType.BULK_DELETE,
    "documents.tasks.apply_ai_suggestions": PaperlessTask.TaskType.APPLY_AI_SUGGESTIONS,
 }
 _CELERY_STATE_TO_STATUS: dict[str, PaperlessTask.Status] = {
@@ -1092,6 +1115,12 @@ def _extract_input_data(
            return {"account_ids": account_ids}
        return {}
    if task_type == PaperlessTask.TaskType.APPLY_AI_SUGGESTIONS:
        document_id = task_kwargs.get("document_id")
        if document_id is not None:
            return {"document_id": document_id}
        return {}
    return {}
@@ -71,6 +71,7 @@ from paperless.config import RemoteOCRConfig
 from paperless.logging import consume_task_id
 from paperless.parsers import ParserContext
 from paperless.parsers.registry import get_parser_registry
 from paperless_ai.exceptions import LLMTimeoutError
 from paperless_ai.indexing import llm_index_add_or_update_document
 from paperless_ai.indexing import llm_index_remove_document
 from paperless_ai.indexing import update_llm_index
@@ -714,6 +715,45 @@ def llmindex_index(
    )
@shared_task(
    bind=True,
    autoretry_for=(LLMTimeoutError,),
    max_retries=3,
    retry_backoff=60,
    retry_backoff_max=600,
    retry_jitter=True,
 )
 def apply_ai_suggestions(self, action_id: int, document_id: int) -> None:
    """
    Deferred "apply AI suggestions" workflow action.
    """
    from documents.models import WorkflowAction
    from documents.workflows.ai import apply_ai_suggestions_to_document
    try:
        action = WorkflowAction.objects.get(pk=action_id)
        document = Document.objects.select_related("owner").get(pk=document_id)
    except (WorkflowAction.DoesNotExist, Document.DoesNotExist):
        logger.warning(
            "Workflow action %s or document %s no longer exists, "
            "not applying AI suggestions",
            action_id,
            document_id,
        )
        return
    if not apply_ai_suggestions_to_document(action, document):
        return
    # No document_updated signal to avoid loop
    clear_document_caches(document.pk)
    index_document.delay(document.pk)
    ai_config = AIConfig()
    if ai_config.llm_index_enabled:
        update_document_in_llm_index.apply_async(kwargs={"document": document})
@shared_task
 def update_document_in_llm_index(document) -> None:
    llm_index_add_or_update_document(document)
@@ -5,9 +5,7 @@ from unittest.mock import ANY
 from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.db import connection
 from django.test import override_settings
 from django.test.utils import CaptureQueriesContext
 from guardian.shortcuts import assign_perm
 from rest_framework import status
 from rest_framework.test import APITestCase
@@ -15,9 +13,6 @@ from rest_framework.test import APITestCase
 from documents.models import CustomField
 from documents.models import CustomFieldInstance
 from documents.models import Document
 from documents.serialisers import CustomFieldInstanceSerializer
 from documents.serialisers import DocumentSerializer
 from documents.tests.factories import DocumentFactory
 from documents.tests.utils import DirectoriesMixin
@@ -535,137 +530,6 @@ class TestCustomFieldsAPI(DirectoriesMixin, APITestCase):
        doc.refresh_from_db()
        self.assertEqual(len(doc.custom_fields.all()), 10)
    def test_document_serializer_custom_fields_validation_batches_field_lookup(
        self,
    ) -> None:
        """
        GIVEN:
            - A document is being validated with several custom field values
              at once (as happens on every PATCH/PUT/POST)
        WHEN:
            - The serializer is validated
        THEN:
            - The referenced CustomField objects are resolved with a single
              query, not one query per custom field
        """
        doc = DocumentFactory(mime_type="application/pdf")
        custom_fields = [
            CustomField.objects.create(
                name=f"Test Custom Field {i}",
                data_type=CustomField.FieldDataType.STRING,
            )
            for i in range(5)
        ]
        serializer = DocumentSerializer(
            doc,
            data={
                "custom_fields": [
                    {"field": custom_field.id, "value": "test value"}
                    for custom_field in custom_fields
                ],
            },
            partial=True,
        )
        with CaptureQueriesContext(connection) as ctx:
            self.assertTrue(serializer.is_valid(), serializer.errors)
        custom_field_lookups = [
            query
            for query in ctx.captured_queries
            if 'FROM "documents_customfield" WHERE "documents_customfield"."id"'
            in query["sql"]
        ]
        self.assertEqual(
            len(custom_field_lookups),
            1,
            "Expected a single batched query to resolve the custom fields, "
            f"got {len(custom_field_lookups)}: {custom_field_lookups}",
        )
    def test_custom_field_lookup_reuses_shared_context_cache(self) -> None:
        """
        GIVEN:
            - A CustomField has already been resolved once, by a serializer
              sharing a given `context` dict
        WHEN:
            - A second, separately-instantiated CustomFieldInstanceSerializer
              validates the same field id, sharing that same context
              (this mirrors what real call sites do, e.g. bulk-edit's
              validate_custom_fields()/_validate_custom_field_values()
              constructing a fresh CustomFieldInstanceSerializer per
              submitted field, all sharing the outer serializer's context)
        THEN:
            - No additional query is issued to resolve the CustomField
        """
        custom_field = CustomField.objects.create(
            name="Test Custom Field",
            data_type=CustomField.FieldDataType.STRING,
        )
        context: dict = {}
        first_pass = CustomFieldInstanceSerializer(
            data={"field": custom_field.id, "value": "a"},
            context=context,
        )
        self.assertTrue(first_pass.is_valid(), first_pass.errors)
        second_pass = CustomFieldInstanceSerializer(
            data={"field": custom_field.id, "value": "b"},
            context=context,
        )
        with CaptureQueriesContext(connection) as ctx:
            self.assertTrue(second_pass.is_valid(), second_pass.errors)
        custom_field_lookups = [
            query
            for query in ctx.captured_queries
            if 'FROM "documents_customfield" WHERE "documents_customfield"."id"'
            in query["sql"]
        ]
        self.assertEqual(
            len(custom_field_lookups),
            0,
            "Expected the second, separately-instantiated serializer to reuse "
            f"the already-resolved CustomField, got: {custom_field_lookups}",
        )
    def test_custom_field_validation_rejects_malformed_field_value(self) -> None:
        """
        GIVEN:
            - A document is being validated with a malformed custom_fields
              entry whose "field" value is neither a valid CustomField id
              nor a type DRF's own PrimaryKeyRelatedField can safely reject
              on its own (unhashable, or a non-numeric scalar)
        WHEN:
            - The serializer is validated
        THEN:
            - A normal validation error is raised, not an unhandled
              TypeError/ValueError escaping past DRF's validation layer
        """
        doc = DocumentFactory(mime_type="application/pdf")
        bad_field_values = {
            "unhashable-list": [],
            "unhashable-dict": {},
            "non-numeric-scalar": "abc",
        }
        for case_id, bad_field_value in bad_field_values.items():
            with self.subTest(case_id):
                serializer = DocumentSerializer(
                    doc,
                    data={
                        "custom_fields": [
                            {"field": bad_field_value, "value": "test value"},
                        ],
                    },
                    partial=True,
                )
                self.assertFalse(serializer.is_valid())
                self.assertIn("custom_fields", serializer.errors)
    def test_change_custom_field_instance_value(self) -> None:
        """
        GIVEN:
@@ -796,72 +660,6 @@ class TestCustomFieldsAPI(DirectoriesMixin, APITestCase):
        assert _cf_4 is not None
        self.assertEqual(_cf_4.value, date_value)
    def test_delete_custom_field_instance_is_hard_deleted_not_soft_deleted(
        self,
    ) -> None:
        """
        GIVEN:
            - A document has two custom field instances
        WHEN:
            - A PATCH request updates custom_fields to omit one of them
        THEN:
            - The omitted instance is immediately hard-deleted: it is gone
              from both the default manager and the soft-deleted manager,
              not left in a soft-deleted, not-yet-purged state
        """
        doc = Document.objects.create(
            title="WOW",
            content="the content",
            checksum="123-hard-delete",
            mime_type="application/pdf",
        )
        kept_field = CustomField.objects.create(
            name="Kept Field",
            data_type=CustomField.FieldDataType.STRING,
        )
        removed_field = CustomField.objects.create(
            name="Removed Field",
            data_type=CustomField.FieldDataType.STRING,
        )
        resp = self.client.patch(
            f"/api/documents/{doc.id}/",
            data={
                "custom_fields": [
                    {"field": kept_field.id, "value": "keep me"},
                    {"field": removed_field.id, "value": "remove me"},
                ],
            },
            format="json",
        )
        self.assertEqual(resp.status_code, status.HTTP_200_OK)
        self.assertEqual(CustomFieldInstance.objects.count(), 2)
        resp = self.client.patch(
            f"/api/documents/{doc.id}/",
            data={
                "custom_fields": [
                    {"field": kept_field.id, "value": "keep me"},
                ],
            },
            format="json",
        )
        self.assertEqual(resp.status_code, status.HTTP_200_OK)
        self.assertEqual(CustomFieldInstance.objects.count(), 1)
        self.assertEqual(
            CustomFieldInstance.deleted_objects.filter(field=removed_field).count(),
            0,
            "Removed custom field instance should be hard-deleted, not left "
            "soft-deleted",
        )
        self.assertEqual(
            CustomFieldInstance.global_objects.filter(field=removed_field).count(),
            0,
            "Removed custom field instance should not exist at all, even in "
            "the all-rows manager",
        )
    def test_custom_field_validation(self) -> None:
        """
        GIVEN:
@@ -1553,81 +1351,6 @@ class TestCustomFieldsAPI(DirectoriesMixin, APITestCase):
        results = response.data["results"]
        self.assertEqual(results[0]["document_count"], 0)
    def test_document_update_custom_fields_sync_query_count(self) -> None:
        """
        GIVEN:
            - A document already has 3 custom field instances attached
        WHEN:
            - A PATCH request updates 2 of them, adds 1 new one, and omits
              the 3rd (which should be deleted)
        THEN:
            - The omitted custom field is removed via exactly one
              delete-shaped query, not drf-writable-nested's old two-step
              soft-delete-then-hard-delete-after pattern (two delete
              passes)
        """
        doc = Document.objects.create(
            title="WOW",
            content="the content",
            checksum="123-sync-count",
            mime_type="application/pdf",
        )
        fields = [
            CustomField.objects.create(
                name=f"Sync Field {i}",
                data_type=CustomField.FieldDataType.STRING,
            )
            for i in range(4)
        ]
        # Attach the first 3 up front; the 4th is added in the PATCH below,
        # and the 3rd is omitted (so it should be deleted).
        for field in fields[:3]:
            CustomFieldInstance.objects.create(
                document=doc,
                field=field,
                value_text="initial",
            )
        self.assertEqual(CustomFieldInstance.objects.count(), 3)
        with CaptureQueriesContext(connection) as ctx:
            resp = self.client.patch(
                f"/api/documents/{doc.id}/",
                data={
                    "custom_fields": [
                        {"field": fields[0].id, "value": "updated 0"},
                        {"field": fields[1].id, "value": "updated 1"},
                        {"field": fields[3].id, "value": "new 3"},
                    ],
                },
                format="json",
            )
        self.assertEqual(resp.status_code, status.HTTP_200_OK)
        delete_queries = [
            q
            for q in ctx.captured_queries
            if 'DELETE FROM "documents_customfieldinstance"' in q["sql"]
            or (
                'UPDATE "documents_customfieldinstance"' in q["sql"]
                and '"deleted_at"' in q["sql"]
                and '"deleted_at" = NULL' not in q["sql"]
            )
        ]
        self.assertEqual(
            len(delete_queries),
            1,
            "Expected exactly one delete/soft-delete-marking query for the "
            f"omitted custom field, got {len(delete_queries)}: {delete_queries}",
        )
        self.assertEqual(CustomFieldInstance.objects.count(), 3)
        doc.refresh_from_db()
        values = {cfi.field_id: cfi.value for cfi in doc.custom_fields.all()}
        self.assertEqual(values[fields[0].id], "updated 0")
        self.assertEqual(values[fields[1].id], "updated 1")
        self.assertEqual(values[fields[3].id], "new 3")
        self.assertNotIn(fields[2].id, values)
    def test_patch_document_invalid_date_custom_field_returns_validation_error(
        self,
    ) -> None:
@@ -11,6 +11,7 @@ from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import FieldError
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.test import TestCase as DjangoTestCase
 from django.utils import timezone
 from rest_framework import status
 from rest_framework.test import APITestCase
@@ -21,6 +22,7 @@ from documents.filters import TitleContentFilter
 from documents.models import Document
 from documents.tests.utils import DirectoriesMixin
 from documents.tests.utils import read_streaming_response
 from documents.views import DocumentSelectionMixin
 if TYPE_CHECKING:
    from pathlib import Path
@@ -923,3 +925,36 @@ class TestVersionAwareFilters(TestCase):
        self.assertIs(result, queryset)
        queryset.filter.assert_not_called()
 class TestBulkSelectionExcludesVersions(DjangoTestCase):
    def test_select_all_matching_does_not_select_version_documents(self) -> None:
        """
        "Select all matching" reconstructs the document list, which never
        contains version documents as rows of their own.
        """
        user = User.objects.create_superuser(username="bulk_versions")
        root = Document.objects.create(
            title="shared-title root",
            checksum="bulk-root",
            mime_type="application/pdf",
            content="root",
        )
        Document.objects.create(
            title="shared-title version",
            checksum="bulk-version",
            mime_type="application/pdf",
            root_document=root,
            version_index=1,
            content="version",
        )
        selected = DocumentSelectionMixin()._resolve_document_ids(
            user=user,
            validated_data={
                "all": True,
                "filters": {"title__icontains": "shared-title"},
            },
        )
        self.assertEqual(selected, [root.id])
@@ -1,6 +1,5 @@
 import datetime
 import json
 import re
 import shutil
 import tempfile
 import uuid
@@ -22,9 +21,7 @@ from django.core import mail
 from django.core.cache import cache
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.db import DataError
 from django.db import connection
 from django.test import override_settings
 from django.test.utils import CaptureQueriesContext
 from django.utils import timezone
 from guardian.shortcuts import assign_perm
 from rest_framework import status
@@ -255,82 +252,6 @@ class TestDocumentApi(DirectoriesMixin, ConsumeTaskMixin, APITestCase):
        doc.refresh_from_db()
        self.assertEqual(doc.created, date(2023, 6, 28))
    def test_document_update_tags_batches_tag_lookup(self) -> None:
        """
        GIVEN:
            - A document is being updated with several tags at once
        WHEN:
            - API PATCH request is made setting the document's tags
        THEN:
            - The referenced Tag objects are resolved with a single batched
              query, not one query per tag
        """
        doc = Document.objects.create(
            title="none",
            checksum="123",
            mime_type="application/pdf",
        )
        tags = [TagFactory() for _ in range(8)]
        with CaptureQueriesContext(connection) as ctx:
            response = self.client.patch(
                f"/api/documents/{doc.pk}/",
                {"tags": [t.id for t in tags]},
                format="json",
            )
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        # Match `"documents_tag"."id" = <literal>` (a single-row WHERE lookup)
        # but not the same substring appearing as a JOIN's ON condition
        # (`"documents_tag"."id" = "documents_document_tags"."tag_id"`),
        # which is a legitimate, unrelated response-serialization query.
        single_tag_lookup_re = re.compile(r'"documents_tag"\."id" = \d')
        single_tag_lookups = [
            q for q in ctx.captured_queries if single_tag_lookup_re.search(q["sql"])
        ]
        self.assertEqual(
            len(single_tag_lookups),
            0,
            "Expected tags to be resolved with a batched query, not "
            f"per-tag lookups, got: {single_tag_lookups}",
        )
        doc.refresh_from_db()
        self.assertCountEqual(
            doc.tags.values_list("id", flat=True),
            [t.id for t in tags],
        )
    def test_document_update_tags_rejects_out_of_range_id(self) -> None:
        """
        GIVEN:
            - A document is being updated with a tag id too large for the
              database's integer column
        WHEN:
            - API PATCH request is made setting the document's tags
        THEN:
            - A normal 400 validation error is returned, not an unhandled
              OverflowError/DataError escaping as a 500
        Django's IntegerFieldOverflow guard converts an out-of-range int
        into a clean "no match" for exact/gt/gte/lt/lte lookups, but not for
        `in` -- the batched tag resolution uses `pk__in=`, so this has to be
        guarded explicitly rather than relying on Django to do it.
        """
        doc = Document.objects.create(
            title="none",
            checksum="123",
            mime_type="application/pdf",
        )
        response = self.client.patch(
            f"/api/documents/{doc.pk}/",
            {"tags": [99999999999999999999999999999]},
            format="json",
        )
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
    def test_document_update_legacy_created_format(self) -> None:
        """
        GIVEN:
@@ -2,15 +2,10 @@ import datetime
 import json
 from unittest import mock
 from django.contrib.auth.models import Group
 from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.db import connection
 from django.test import override_settings
 from django.test.utils import CaptureQueriesContext
 from guardian.shortcuts import assign_perm
 from guardian.shortcuts import get_groups_with_perms
 from guardian.shortcuts import get_users_with_perms
 from rest_framework import status
 from rest_framework.test import APITestCase
@@ -820,59 +815,6 @@ class TestBulkEditObjects(APITestCase):
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        self.assertEqual(StoragePath.objects.count(), 0)
    def test_bulk_objects_set_permissions_query_count_independent_of_object_count(
        self,
    ) -> None:
        """
        GIVEN:
            - Many tags are being bulk-edited to set permissions at once
        WHEN:
            - bulk_edit_objects API endpoint is called with set_permissions
              operation over a small batch vs. a much larger one
        THEN:
            - The number of queries issued is the same either way -- each
              user/group is applied across all tags with one batched call,
              not one call per (tag, user) pair
        """
        group1 = Group.objects.create(name="perm-group")
        permissions = {
            "view": {"users": [self.user1.id, self.user2.id], "groups": [group1.id]},
            "change": {"users": [self.user1.id], "groups": [group1.id]},
        }
        def run_with_n_tags(n: int) -> int:
            tags = [Tag.objects.create(name=f"perm-tag-{n}-{i}") for i in range(n)]
            with CaptureQueriesContext(connection) as ctx:
                response = self.client.post(
                    "/api/bulk_edit_objects/",
                    json.dumps(
                        {
                            "objects": [t.id for t in tags],
                            "object_type": "tags",
                            "operation": "set_permissions",
                            "permissions": permissions,
                            "merge": False,
                        },
                    ),
                    content_type="application/json",
                )
            self.assertEqual(response.status_code, status.HTTP_200_OK)
            for tag in tags:
                self.assertEqual(get_users_with_perms(tag).count(), 2)
                self.assertEqual(get_groups_with_perms(tag).count(), 1)
            return len(ctx.captured_queries)
        small_batch_queries = run_with_n_tags(5)
        large_batch_queries = run_with_n_tags(50)
        self.assertEqual(
            small_batch_queries,
            large_batch_queries,
            "Expected the same query count regardless of tag count, got "
            f"{small_batch_queries} queries for 5 tags vs. "
            f"{large_batch_queries} for 50",
        )
    def test_bulk_objects_delete_all_filtered(self) -> None:
        """
        GIVEN:
@@ -641,6 +641,145 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
        self.assertEqual(self.workflow.triggers.get(), self.trigger)
    def _post_ai_suggestions_workflow(self, *, trigger_types, action: dict):
        def trigger(trigger_type):
            # consumption triggers require a filter of their own
            if trigger_type == WorkflowTrigger.WorkflowTriggerType.CONSUMPTION:
                return {"type": trigger_type, "filter_filename": "*.pdf"}
            return {"type": trigger_type}
        return self.client.post(
            self.ENDPOINT,
            json.dumps(
                {
                    "name": "Apply AI suggestions",
                    "order": 1,
                    "triggers": [trigger(t) for t in trigger_types],
                    "actions": [
                        {
                            "type": WorkflowAction.WorkflowActionType.APPLY_AI_SUGGESTIONS,
                            **action,
                        },
                    ],
                },
            ),
            content_type="application/json",
        )
    def test_api_create_apply_ai_suggestions_action(self) -> None:
        """
        GIVEN:
            - API request to create a workflow with an apply AI suggestions
              action and a valid set of fields
        WHEN:
            - API is called
        THEN:
            - The workflow is created with the chosen options
        """
        response = self._post_ai_suggestions_workflow(
            trigger_types=[WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED],
            action={
                "ai_suggestion_fields": ["title", "tags", "correspondent"],
                "ai_create_missing": True,
                "ai_overwrite_existing": True,
            },
        )
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
        action = Workflow.objects.get(name="Apply AI suggestions").actions.first()
        self.assertEqual(
            action.ai_suggestion_fields,
            ["title", "tags", "correspondent"],
        )
        self.assertTrue(action.ai_create_missing)
        self.assertTrue(action.ai_overwrite_existing)
    def test_api_create_apply_ai_suggestions_action_requires_fields(self) -> None:
        """
        GIVEN:
            - API request to create an apply AI suggestions action with no
              fields selected, which could never do anything
        WHEN:
            - API is called
        THEN:
            - Correct HTTP 400 response
            - No objects are created
        """
        existing_count = Workflow.objects.count()
        response = self._post_ai_suggestions_workflow(
            trigger_types=[WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED],
            action={"ai_suggestion_fields": []},
        )
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
        self.assertEqual(Workflow.objects.count(), existing_count)
    def test_api_create_apply_ai_suggestions_action_rejects_unknown_field(
        self,
    ) -> None:
        """
        GIVEN:
            - API request to create an apply AI suggestions action naming a
              field that does not exist
        WHEN:
            - API is called
        THEN:
            - Correct HTTP 400 response
        """
        response = self._post_ai_suggestions_workflow(
            trigger_types=[WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED],
            action={"ai_suggestion_fields": ["title", "not_a_field"]},
        )
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
    def test_api_create_apply_ai_suggestions_action_rejects_consumption_only(
        self,
    ) -> None:
        """
        GIVEN:
            - API request to create an apply AI suggestions action whose only
              trigger is consumption started, so there is no document content
              to make suggestions from yet
        WHEN:
            - API is called
        THEN:
            - Correct HTTP 400 response
            - No objects are created
        """
        existing_count = Workflow.objects.count()
        response = self._post_ai_suggestions_workflow(
            trigger_types=[WorkflowTrigger.WorkflowTriggerType.CONSUMPTION],
            action={"ai_suggestion_fields": ["title"]},
        )
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
        self.assertEqual(Workflow.objects.count(), existing_count)
    def test_api_create_apply_ai_suggestions_action_allows_extra_consumption_trigger(
        self,
    ) -> None:
        """
        GIVEN:
            - API request to create an apply AI suggestions action with a
              consumption trigger alongside a usable one
        WHEN:
            - API is called
        THEN:
            - The workflow is created, the action applies to the other trigger
        """
        response = self._post_ai_suggestions_workflow(
            trigger_types=[
                WorkflowTrigger.WorkflowTriggerType.CONSUMPTION,
                WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
            ],
            action={"ai_suggestion_fields": ["title"]},
        )
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
    def test_api_create_workflow_trigger_action_empty_fields(self) -> None:
        """
        GIVEN:
@@ -5,11 +5,8 @@ from unittest import mock
 import pikepdf
 from django.contrib.auth.models import Group
 from django.contrib.auth.models import Permission
 from django.contrib.auth.models import User
 from django.db import connection
 from django.test import TestCase
 from django.test.utils import CaptureQueriesContext
 from guardian.shortcuts import assign_perm
 from guardian.shortcuts import get_groups_with_perms
 from guardian.shortcuts import get_users_with_perms
@@ -22,7 +19,6 @@ from documents.models import Document
 from documents.models import DocumentType
 from documents.models import StoragePath
 from documents.models import Tag
 from documents.permissions import set_permissions_for_objects
 from documents.tests.utils import DirectoriesMixin
@@ -348,100 +344,6 @@ class TestBulkEdit(DirectoriesMixin, TestCase):
        assert _cf_3 is not None
        self.assertNotIn(self.doc3.id, _cf_3.value)
    def test_modify_custom_fields_batches_field_lookup(self) -> None:
        """
        GIVEN:
            - Several documents are being bulk-edited to add several custom
              fields at once
        WHEN:
            - modify_custom_fields runs
        THEN:
            - Each CustomField is resolved with one batched query total, not
              once per (field, document) pair
        """
        docs = [
            Document.objects.create(checksum=f"batch-{i}", title=f"batch-{i}")
            for i in range(6)
        ]
        fields = [
            CustomField.objects.create(
                name=f"Batch Field {i}",
                data_type=CustomField.FieldDataType.STRING,
            )
            for i in range(4)
        ]
        with CaptureQueriesContext(connection) as ctx:
            bulk_edit.modify_custom_fields(
                [doc.id for doc in docs],
                add_custom_fields=[field.id for field in fields],
                remove_custom_fields=[],
            )
        field_lookups = [
            q
            for q in ctx.captured_queries
            if 'FROM "documents_customfield"' in q["sql"]
        ]
        self.assertEqual(
            len(field_lookups),
            1,
            "Expected a single batched query to resolve the custom fields, "
            f"got {len(field_lookups)}: {field_lookups}",
        )
        for doc in docs:
            self.assertEqual(doc.custom_fields.count(), len(fields))
    def test_modify_custom_fields_batches_document_lookup_for_documentlink(
        self,
    ) -> None:
        """
        GIVEN:
            - Several documents are being bulk-edited to add a DOCUMENTLINK
              custom field at once
        WHEN:
            - modify_custom_fields runs
        THEN:
            - The Document rows needed to reflect the symmetrical links are
              resolved with one batched query total, not once per document
        """
        docs = [
            Document.objects.create(checksum=f"link-{i}", title=f"link-{i}")
            for i in range(6)
        ]
        target = Document.objects.create(checksum="link-target", title="link-target")
        doclink_field = CustomField.objects.create(
            name="Related",
            data_type=CustomField.FieldDataType.DOCUMENTLINK,
        )
        with CaptureQueriesContext(connection) as ctx:
            bulk_edit.modify_custom_fields(
                [doc.id for doc in docs],
                add_custom_fields={doclink_field.id: [target.id]},
                remove_custom_fields=[],
            )
        single_document_lookups = [
            q
            for q in ctx.captured_queries
            if 'FROM "documents_document"' in q["sql"]
            and '"documents_document"."id" = ' in q["sql"]
        ]
        self.assertEqual(
            len(single_document_lookups),
            0,
            "Expected document rows to come from a batched query, not "
            f"per-document lookups, got: {single_document_lookups}",
        )
        for doc in docs:
            self.assertEqual(
                doc.custom_fields.get(field=doclink_field).value,
                [target.id],
            )
    def test_modify_custom_fields_doclink_self_link(self) -> None:
        """
        GIVEN:
@@ -608,132 +510,6 @@ class TestBulkEdit(DirectoriesMixin, TestCase):
        )
        self.assertEqual(groups_with_perms.count(), 2)
    @mock.patch("documents.tasks.bulk_update_documents.apply_async")
    def test_set_permissions_query_count_independent_of_document_count(
        self,
        m,
    ) -> None:
        """
        GIVEN:
            - Many documents are being bulk-edited to set permissions at once
        WHEN:
            - set_permissions runs over a small batch vs. a much larger one
        THEN:
            - The number of queries issued is the same either way -- each
              user/group is applied across all documents with one batched
              call, not one call per (document, user) pair
        """
        permissions = {
            "view": {
                "users": [self.user1.id, self.user2.id],
                "groups": [self.group2.id],
            },
            "change": {
                "users": [self.user1.id],
                "groups": [self.group2.id],
            },
        }
        def run_with_n_documents(n: int) -> int:
            docs = [
                Document.objects.create(checksum=f"perm-{n}-{i}", title=f"perm-{n}-{i}")
                for i in range(n)
            ]
            with CaptureQueriesContext(connection) as ctx:
                bulk_edit.set_permissions(
                    [doc.id for doc in docs],
                    set_permissions=permissions,
                    owner=self.owner,
                    merge=False,
                )
            for doc in docs:
                self.assertEqual(get_users_with_perms(doc).count(), 2)
                self.assertEqual(get_groups_with_perms(doc).count(), 1)
            return len(ctx.captured_queries)
        small_batch_queries = run_with_n_documents(5)
        large_batch_queries = run_with_n_documents(50)
        self.assertEqual(
            small_batch_queries,
            large_batch_queries,
            "Expected the same query count regardless of document count, got "
            f"{small_batch_queries} queries for 5 documents vs. "
            f"{large_batch_queries} for 50",
        )
    @mock.patch("documents.tasks.bulk_update_documents.apply_async")
    def test_set_permissions_grants_direct_perm_even_if_already_granted_via_group(
        self,
        m,
    ) -> None:
        """
        GIVEN:
            - A user already has view access to a document via group
              membership, with no direct grant of their own
        WHEN:
            - set_permissions explicitly grants that same user direct view
              access via bulk_edit
        THEN:
            - A direct permission grant is created for the user, not skipped
              because they already have equivalent access via the group
        Regression test: guardian's queryset-aware assign_perm() (routed to
        when the target is a list/queryset) skips creating a direct row for
        anyone whose ObjectPermissionChecker.has_perm() already returns True
        -- which includes group-derived access. The single-object assign_perm
        this bulk path replaces has no such check; it always ensures a
        direct row via get_or_create. Losing that guarantee would mean
        revoking the group's grant later silently strips access that was
        supposed to be explicit.
        """
        self.doc1.owner = self.user1
        self.doc1.save()
        self.user1.groups.add(self.group1)
        assign_perm("view_document", self.group1, self.doc1)
        bulk_edit.set_permissions(
            [self.doc1.id],
            set_permissions={
                "view": {"users": [self.user1.id], "groups": []},
            },
            merge=True,
        )
        direct_users = get_users_with_perms(
            self.doc1,
            only_with_perms_in=["view_document"],
            with_group_users=False,
        )
        self.assertIn(self.user1, direct_users)
    def test_set_permissions_for_objects_raises_for_unknown_action(self) -> None:
        """
        GIVEN:
            - An unrecognized permission action name with users to grant it
              to
        WHEN:
            - set_permissions_for_objects is called
        THEN:
            - Permission.DoesNotExist is raised, not a silent no-op
        Regression test: the endpoint that calls this
        (BulkEditObjectPermissionsView) never actually validates action
        names against the raw client-supplied permissions dict --
        BulkEditObjectsSerializer._validate_permissions calls
        validate_set_permissions() only for its side-effecting user/group id
        checks and discards the filtered dict it returns -- so a bogus
        action key reaches this function as-is. Resolving the Permission via
        a bare `.filter()` (which returns empty instead of raising) would
        silently drop the grant and report success.
        """
        with self.assertRaises(Permission.DoesNotExist):
            set_permissions_for_objects(
                {"not_a_real_action": {"users": [self.user1.id], "groups": []}},
                Document,
                [self.doc1.pk],
            )
    @mock.patch("documents.models.Document.delete")
    def test_delete_documents_old_uuid_field(self, m) -> None:
        m.side_effect = Exception("Data too long for column 'transaction_id' at row 1")
@@ -1,58 +0,0 @@
 from django.db import connection
 from django.test import TestCase
 from django.test.utils import CaptureQueriesContext
 from documents.data_models import DocumentMetadataOverrides
 from documents.models import CustomField
 from documents.models import CustomFieldInstance
 from documents.tests.factories import DocumentFactory
 from documents.tests.utils import DirectoriesMixin
 class TestDocumentMetadataOverridesFromDocument(DirectoriesMixin, TestCase):
    def test_from_document_batches_custom_field_lookup_after_refresh_from_db(
        self,
    ) -> None:
        """
        GIVEN:
            - A document has several custom field values
            - The document instance has just been refreshed from the database,
              which drops any prefetched related objects (as
              send_websocket_document_updated does before building overrides)
        WHEN:
            - DocumentMetadataOverrides.from_document() reads the document's
              custom field values
        THEN:
            - The referenced CustomField objects are resolved with a single
              query, not one query per custom field
        """
        doc = DocumentFactory(mime_type="application/pdf")
        for i in range(5):
            CustomFieldInstance.objects.create(
                document=doc,
                field=CustomField.objects.create(
                    name=f"Test Custom Field {i}",
                    data_type=CustomField.FieldDataType.STRING,
                ),
                value_text="value",
            )
        doc.refresh_from_db()
        with CaptureQueriesContext(connection) as ctx:
            overrides = DocumentMetadataOverrides.from_document(doc)
        self.assertEqual(len(overrides.custom_fields), 5)
        unbatched_field_lookups = [
            query
            for query in ctx.captured_queries
            if 'FROM "documents_customfield" WHERE "documents_customfield"."id"'
            in query["sql"]
        ]
        self.assertEqual(
            unbatched_field_lookups,
            [],
            "Expected CustomField data to come from the CustomFieldInstance "
            "join, not a separate per-instance lookup, "
            f"got: {unbatched_field_lookups}",
        )
@@ -385,6 +385,25 @@ class TestTaskFailureHandler:
        task_failure_handler(task_id=None, exception=ValueError("x"), traceback=None)
@pytest.mark.django_db
 class TestApplyAiSuggestionsTracking:
    def test_records_the_document_it_is_for(self) -> None:
        """
        The action queues one task per document, so the tracked record notes
        which document it is for -- otherwise a bulk run is an indistinguishable
        wall of identical entries in the tasks list.
        """
        task_id = send_publish(
            "documents.tasks.apply_ai_suggestions",
            (),
            {"action_id": 1, "document_id": 42},
        )
        task = PaperlessTask.objects.get(task_id=task_id)
        assert task.task_type == PaperlessTask.TaskType.APPLY_AI_SUGGESTIONS
        assert task.input_data == {"document_id": 42}
@pytest.mark.django_db
 class TestTaskRevokedHandler:
    def test_marks_task_revoked(self, mocker: pytest_mock.MockerFixture) -> None:
@@ -14,6 +14,7 @@ from documents.models import Correspondent
 from documents.models import Document
 from documents.models import DocumentType
 from documents.models import Tag
 from documents.models import WorkflowAction
 from documents.sanity_checker import SanityCheckFailedException
 from documents.sanity_checker import SanityCheckMessages
 from documents.tests.test_classifier import dummy_preprocess
@@ -447,3 +448,110 @@ class TestAIIndex(DirectoriesMixin, TestCase):
                rebuild=False,
                document_ids=doc_ids,
            )
 class TestApplyAISuggestionsTask(DirectoriesMixin, TestCase):
    def setUp(self) -> None:
        super().setUp()
        self.doc = Document.objects.create(
            title="doc",
            content="content",
            checksum="apply-ai-suggestions",
        )
        self.action = WorkflowAction.objects.create(
            type=WorkflowAction.WorkflowActionType.APPLY_AI_SUGGESTIONS,
            ai_suggestion_fields=[WorkflowAction.AISuggestionField.TITLE],
        )
    def test_reindexes_without_sending_document_updated(self) -> None:
        """
        GIVEN:
            - An apply AI suggestions action that changes the document
        WHEN:
            - The task runs
        THEN:
            - The search index and caches are refreshed directly, deliberately
              not via the document_updated signal: that re-runs updated
              workflows, which for this action means queueing another LLM
              query for a document it just changed, forever
        """
        with (
            mock.patch(
                "documents.workflows.ai.apply_ai_suggestions_to_document",
                return_value=["title"],
            ),
            mock.patch("documents.tasks.index_document") as index_document,
            mock.patch("documents.tasks.clear_document_caches") as clear_caches,
            mock.patch("documents.tasks.document_updated") as document_updated,
        ):
            tasks.apply_ai_suggestions(self.action.pk, self.doc.pk)
        index_document.delay.assert_called_once_with(self.doc.pk)
        clear_caches.assert_called_once_with(self.doc.pk)
        document_updated.send.assert_not_called()
    def test_no_changes_skips_reindex(self) -> None:
        """
        GIVEN:
            - An apply AI suggestions action that changes nothing
        WHEN:
            - The task runs
        THEN:
            - No reindexing work is queued
        """
        with (
            mock.patch(
                "documents.workflows.ai.apply_ai_suggestions_to_document",
                return_value=[],
            ),
            mock.patch("documents.tasks.index_document") as index_document,
        ):
            tasks.apply_ai_suggestions(self.action.pk, self.doc.pk)
        index_document.delay.assert_not_called()
    @override_settings(AI_ENABLED=True, LLM_EMBEDDING_BACKEND="huggingface")
    def test_updates_llm_index_when_enabled(self) -> None:
        """
        GIVEN:
            - An apply AI suggestions action that changes the document
            - The LLM index is enabled
        WHEN:
            - The task runs
        THEN:
            - The document is updated in the LLM index too
        """
        with (
            mock.patch(
                "documents.workflows.ai.apply_ai_suggestions_to_document",
                return_value=["title"],
            ),
            mock.patch("documents.tasks.index_document"),
            mock.patch(
                "documents.tasks.update_document_in_llm_index",
            ) as update_in_llm_index,
        ):
            tasks.apply_ai_suggestions(self.action.pk, self.doc.pk)
        update_in_llm_index.apply_async.assert_called_once()
    def test_deleted_document_is_a_noop(self) -> None:
        """
        GIVEN:
            - A document that was deleted between the workflow running and the
              queued task starting
        WHEN:
            - The task runs
        THEN:
            - It logs and exits rather than raising
        """
        with (
            mock.patch(
                "documents.workflows.ai.apply_ai_suggestions_to_document",
            ) as apply_suggestions,
            self.assertLogs("paperless.tasks", level="WARNING") as cm,
        ):
            tasks.apply_ai_suggestions(self.action.pk, self.doc.pk + 1000)
        apply_suggestions.assert_not_called()
        self.assertIn("no longer exists", "".join(cm.output))
@@ -31,7 +31,10 @@ from documents.file_handling import create_source_path_directory
 from documents.file_handling import generate_filename
 from documents.file_handling import generate_unique_filename
 from documents.signals.handlers import run_workflows
 from documents.workflows.ai import apply_ai_suggestions_to_document
 from documents.workflows.webhooks import send_webhook
 from paperless_ai.base_model import ClassificationSuggestions
 from paperless_ai.exceptions import LLMTimeoutError
 if TYPE_CHECKING:
    from django.db.models import QuerySet
@@ -5488,3 +5491,516 @@ class TestRemoteOCRWorkflowAction(DirectoriesMixin, SampleDirMixin, APITestCase)
            )
        self.assertIn("only applies to consumption triggers", "".join(cm.output))
 SUGGESTIONS: ClassificationSuggestions = {
    "title": "Suggested Title",
    "tags": {
        "existing_ids": [],
        "new_names": ["Existing Tag", "Suggested Tag"],
    },
    "correspondents": {
        "existing_ids": [],
        "new_names": ["Existing Correspondent", "Suggested Correspondent"],
    },
    "document_types": {
        "existing_ids": [],
        "new_names": ["Suggested Document Type"],
    },
    "storage_paths": {
        "existing_ids": [],
        "new_names": ["Suggested Storage Path"],
    },
    "dates": ["2024-03-05"],
 }
 ALL_SUGGESTION_FIELDS = [
    WorkflowAction.AISuggestionField.TITLE,
    WorkflowAction.AISuggestionField.TAGS,
    WorkflowAction.AISuggestionField.CORRESPONDENT,
    WorkflowAction.AISuggestionField.DOCUMENT_TYPE,
    WorkflowAction.AISuggestionField.STORAGE_PATH,
    WorkflowAction.AISuggestionField.CREATED,
 ]
@override_settings(AI_ENABLED=True)
 class TestApplyAISuggestionsWorkflowAction(
    DirectoriesMixin,
    SampleDirMixin,
    APITestCase,
 ):
    def setUp(self) -> None:
        super().setUp()
        self.user = User.objects.create(username="ai-user")
        self.doc = Document.objects.create(
            title="original.pdf",
            content="the document content",
            checksum="ai-suggestions-checksum",
            mime_type="application/pdf",
            created=datetime.date(2020, 1, 1),
            owner=self.user,
        )
    def make_action(self, **kwargs) -> WorkflowAction:
        return WorkflowAction.objects.create(
            type=WorkflowAction.WorkflowActionType.APPLY_AI_SUGGESTIONS,
            ai_suggestion_fields=kwargs.pop(
                "ai_suggestion_fields",
                ALL_SUGGESTION_FIELDS,
            ),
            **kwargs,
        )
    def make_workflow(self, action: WorkflowAction, trigger_type) -> Workflow:
        trigger = WorkflowTrigger.objects.create(type=trigger_type)
        w = Workflow.objects.create(name="Apply AI suggestions", order=0)
        w.triggers.add(trigger)
        w.actions.add(action)
        w.save()
        return w
    def apply(
        self,
        action: WorkflowAction,
        suggestions: ClassificationSuggestions = SUGGESTIONS,
    ) -> list[str]:
        with mock.patch(
            "documents.workflows.ai.get_ai_document_classification",
            return_value=suggestions,
        ):
            changed = apply_ai_suggestions_to_document(action, self.doc)
        self.doc.refresh_from_db()
        return changed
    def test_fields_persist_when_tags_are_applied_in_the_same_run(self) -> None:
        """
        GIVEN:
            - A document that already has a filename, as any consumed document does
            - Suggestions carrying both a document type and tags
        WHEN:
            - The suggestions are applied
        THEN:
            - The document type is still set after the tags are added
        Adding tags fires m2m_changed, and update_filename_and_move_files
        refreshes the document from the database. Assigning fields and then
        adding tags before saving loses those assignments, and only for
        documents with a filename, so it does not reproduce on a bare
        Document.objects.create().
        """
        self.doc.filename = "originals/original.pdf"
        self.doc.save(update_fields=["filename"])
        action = self.make_action(ai_create_missing=True)
        changed = self.apply(action)
        self.assertIn("document_type", changed)
        self.assertIn("tags", changed)
        self.assertIsNotNone(
            self.doc.document_type,
            "document_type was reported as applied but did not persist",
        )
        self.assertEqual(self.doc.document_type.name, "Suggested Document Type")
        self.assertEqual(self.doc.correspondent.name, "Existing Correspondent")
        self.assertCountEqual(
            [t.name for t in self.doc.tags.all()],
            ["Existing Tag", "Suggested Tag"],
        )
    def test_document_added_trigger_queues_task(self) -> None:
        """
        GIVEN:
            - A document added workflow with an apply AI suggestions action
        WHEN:
            - A matching document is added
        THEN:
            - The work is queued rather than run inline, so a slow LLM query
              cannot stall the rest of the workflow run
        """
        action = self.make_action()
        self.make_workflow(action, WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED)
        with mock.patch("documents.tasks.apply_ai_suggestions.delay") as delay:
            run_workflows(
                WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
                self.doc,
            )
        delay.assert_called_once_with(action_id=action.pk, document_id=self.doc.pk)
    def test_consumption_trigger_is_ignored(self) -> None:
        """
        GIVEN:
            - A workflow with an apply AI suggestions action and a consumption
              trigger alongside a valid one
        WHEN:
            - The consumption trigger fires
        THEN:
            - The action is skipped, since the document has not been parsed
              yet and so has no content to make suggestions from
        """
        action = self.make_action()
        w = self.make_workflow(
            action,
            WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
        )
        w.triggers.add(
            WorkflowTrigger.objects.create(
                type=WorkflowTrigger.WorkflowTriggerType.CONSUMPTION,
            ),
        )
        test_file = shutil.copy(
            self.SAMPLE_DIR / "simple.pdf",
            self.dirs.scratch_dir / "simple.pdf",
        )
        with (
            mock.patch("documents.tasks.apply_ai_suggestions.delay") as delay,
            self.assertLogs("paperless.handlers", level="DEBUG") as cm,
        ):
            run_workflows(
                WorkflowTrigger.WorkflowTriggerType.CONSUMPTION,
                ConsumableDocument(
                    source=DocumentSource.ConsumeFolder,
                    original_file=test_file,
                ),
                overrides=DocumentMetadataOverrides(),
            )
        delay.assert_not_called()
        self.assertIn("does not apply to consumption triggers", "".join(cm.output))
    def test_no_selected_fields_does_nothing(self) -> None:
        """
        GIVEN:
            - An action with no suggestion fields selected
        WHEN:
            - The action is applied
        THEN:
            - Nothing is changed and it is logged
        """
        action = self.make_action(ai_suggestion_fields=[])
        with self.assertLogs("paperless.workflows.ai", level="WARNING") as cm:
            changed = self.apply(action)
        self.assertEqual(changed, [])
        self.assertIn("no AI suggestion fields selected", "".join(cm.output))
    @override_settings(AI_ENABLED=False)
    def test_ai_disabled_does_nothing(self) -> None:
        """
        GIVEN:
            - An action on an install where AI has since been disabled
        WHEN:
            - The action is applied
        THEN:
            - Nothing is changed and it is logged
        """
        action = self.make_action()
        with self.assertLogs("paperless.workflows.ai", level="ERROR") as cm:
            changed = self.apply(action)
        self.assertEqual(changed, [])
        self.assertIn("AI is not enabled", "".join(cm.output))
    def test_invalid_configuration_leaves_document_untouched(self) -> None:
        """
        GIVEN:
            - An AI backend that is misconfigured
        WHEN:
            - The action is applied
        THEN:
            - The failure is logged and the document is left alone. It is not
              re-raised, because retrying will not fix a bad configuration
        """
        action = self.make_action()
        with (
            mock.patch(
                "documents.workflows.ai.get_ai_document_classification",
                side_effect=ValueError("nope"),
            ),
            self.assertLogs("paperless.workflows.ai", level="ERROR") as cm,
        ):
            changed = apply_ai_suggestions_to_document(action, self.doc)
        self.assertEqual(changed, [])
        self.doc.refresh_from_db()
        self.assertEqual(self.doc.title, "original.pdf")
        self.assertIn("Invalid AI configuration", "".join(cm.output))
    def test_transient_llm_failure_is_raised_for_retry(self) -> None:
        """
        GIVEN:
            - An LLM backend that times out, or rate limits the request
        WHEN:
            - The action is applied
        THEN:
            - The error propagates so the queued task can back off and retry,
              rather than silently dropping this document's suggestions
        """
        action = self.make_action()
        with (
            mock.patch(
                "documents.workflows.ai.get_ai_document_classification",
                side_effect=LLMTimeoutError(),
            ),
            self.assertRaises(LLMTimeoutError),
        ):
            apply_ai_suggestions_to_document(action, self.doc)
        self.doc.refresh_from_db()
        self.assertEqual(self.doc.title, "original.pdf")
    def test_only_matching_objects_are_applied(self) -> None:
        """
        GIVEN:
            - An action without create missing, and only some of the suggested
              objects existing
        WHEN:
            - The action is applied
        THEN:
            - Only the existing objects are assigned, unmatched suggestions are
              dropped rather than creating anything
        """
        tag = Tag.objects.create(name="Existing Tag", owner=self.user)
        correspondent = Correspondent.objects.create(
            name="Existing Correspondent",
            owner=self.user,
        )
        action = self.make_action(ai_overwrite_existing=True)
        changed = self.apply(action)
        self.assertEqual(self.doc.correspondent, correspondent)
        self.assertEqual(list(self.doc.tags.all()), [tag])
        # Nothing matched for these and create missing is off
        self.assertIsNone(self.doc.document_type)
        self.assertIsNone(self.doc.storage_path)
        self.assertNotIn("document_type", changed)
        self.assertEqual(Tag.objects.count(), 1)
        self.assertEqual(Correspondent.objects.count(), 1)
    def test_existing_id_suggestions_are_applied(self) -> None:
        """
        GIVEN:
            - AI suggestions that select existing taxonomy candidates by ID
        WHEN:
            - The suggestions are applied
        THEN:
            - Each selected object is assigned to the document
        """
        tag = Tag.objects.create(name="Existing Tag", owner=self.user)
        correspondent = Correspondent.objects.create(
            name="Existing Correspondent",
            owner=self.user,
        )
        document_type = DocumentType.objects.create(
            name="Existing Document Type",
            owner=self.user,
        )
        storage_path = StoragePath.objects.create(
            name="Existing Storage Path",
            path="{{ title }}",
            owner=self.user,
        )
        action = self.make_action(ai_overwrite_existing=True)
        suggestions: ClassificationSuggestions = {
            **SUGGESTIONS,
            "tags": {"existing_ids": [tag.pk], "new_names": []},
            "correspondents": {
                "existing_ids": [correspondent.pk],
                "new_names": [],
            },
            "document_types": {
                "existing_ids": [document_type.pk],
                "new_names": [],
            },
            "storage_paths": {
                "existing_ids": [storage_path.pk],
                "new_names": [],
            },
        }
        changed = self.apply(action, suggestions)
        self.assertEqual(list(self.doc.tags.all()), [tag])
        self.assertEqual(self.doc.correspondent, correspondent)
        self.assertEqual(self.doc.document_type, document_type)
        self.assertEqual(self.doc.storage_path, storage_path)
        self.assertTrue(
            {"tags", "correspondent", "document_type", "storage_path"} <= set(changed),
        )
    def test_create_missing_creates_objects_owned_by_document_owner(self) -> None:
        """
        GIVEN:
            - An action with create missing enabled
        WHEN:
            - The action is applied and suggestions match nothing
        THEN:
            - Tags, correspondents and document types are created, owned by the
              document owner so they stay private to them
            - Storage paths are never created, since a path template cannot be
              inferred from a name
        """
        action = self.make_action(
            ai_create_missing=True,
            ai_overwrite_existing=True,
        )
        changed = self.apply(action)
        self.assertEqual(
            sorted(t.name for t in self.doc.tags.all()),
            ["Existing Tag", "Suggested Tag"],
        )
        self.assertEqual(self.doc.correspondent.name, "Existing Correspondent")
        self.assertEqual(self.doc.correspondent.owner, self.user)
        self.assertEqual(self.doc.document_type.name, "Suggested Document Type")
        self.assertEqual(self.doc.document_type.owner, self.user)
        self.assertIsNone(self.doc.storage_path)
        self.assertFalse(StoragePath.objects.exists())
        self.assertNotIn("storage_path", changed)
    def test_overwrite_disabled_keeps_existing_values(self) -> None:
        """
        GIVEN:
            - An action without overwrite existing
            - A document that already has a title, created date and
              correspondent
        WHEN:
            - The action is applied
        THEN:
            - The existing values are kept, only the empty document type is
              filled in
        """
        existing = Correspondent.objects.create(name="Mine", owner=self.user)
        self.doc.correspondent = existing
        self.doc.save()
        action = self.make_action(ai_create_missing=True)
        changed = self.apply(action)
        self.assertEqual(self.doc.title, "original.pdf")
        self.assertEqual(self.doc.created, datetime.date(2020, 1, 1))
        self.assertEqual(self.doc.correspondent, existing)
        self.assertEqual(self.doc.document_type.name, "Suggested Document Type")
        self.assertNotIn("title", changed)
        self.assertNotIn("correspondent", changed)
    def test_overwrite_enabled_replaces_existing_values(self) -> None:
        """
        GIVEN:
            - An action with overwrite existing
            - A document that already has a title and created date
        WHEN:
            - The action is applied
        THEN:
            - The suggested values replace them
        """
        action = self.make_action(
            ai_create_missing=True,
            ai_overwrite_existing=True,
        )
        changed = self.apply(action)
        self.assertEqual(self.doc.title, "Suggested Title")
        self.assertEqual(self.doc.created, datetime.date(2024, 3, 5))
        self.assertIn("title", changed)
        self.assertIn("created", changed)
    def test_tags_are_added_not_replaced(self) -> None:
        """
        GIVEN:
            - A document that already has a tag unrelated to the suggestions
        WHEN:
            - The action is applied with overwrite existing enabled
        THEN:
            - The existing tag is kept, since suggested tags are always
              additive regardless of the overwrite setting
        """
        kept = Tag.objects.create(name="Do Not Remove", owner=self.user)
        self.doc.tags.add(kept)
        Tag.objects.create(name="Existing Tag", owner=self.user)
        action = self.make_action(ai_overwrite_existing=True)
        self.apply(action)
        self.assertEqual(
            sorted(t.name for t in self.doc.tags.all()),
            ["Do Not Remove", "Existing Tag"],
        )
    def test_unselected_fields_are_untouched(self) -> None:
        """
        GIVEN:
            - An action that only selects the title
        WHEN:
            - The action is applied
        THEN:
            - Only the title changes, even though the LLM suggested everything
        """
        action = self.make_action(
            ai_suggestion_fields=[WorkflowAction.AISuggestionField.TITLE],
            ai_create_missing=True,
            ai_overwrite_existing=True,
        )
        changed = self.apply(action)
        self.assertEqual(changed, ["title"])
        self.assertEqual(self.doc.title, "Suggested Title")
        self.assertEqual(self.doc.tags.count(), 0)
        self.assertIsNone(self.doc.correspondent)
        self.assertEqual(self.doc.created, datetime.date(2020, 1, 1))
    def test_another_users_private_objects_are_not_matched(self) -> None:
        """
        GIVEN:
            - A suggested tag name that exists, but is owned by someone else
        WHEN:
            - The action is applied
        THEN:
            - It is not assigned, because the document owner cannot see it
        """
        other = User.objects.create(username="someone-else")
        Tag.objects.create(name="Existing Tag", owner=other)
        action = self.make_action(
            ai_suggestion_fields=[WorkflowAction.AISuggestionField.TAGS],
        )
        self.apply(action)
        self.assertEqual(self.doc.tags.count(), 0)
    def test_unparsable_dates_are_skipped(self) -> None:
        """
        GIVEN:
            - Suggested dates that are not all valid
        WHEN:
            - The action is applied
        THEN:
            - The first usable date is applied and the rest ignored
        """
        action = self.make_action(
            ai_suggestion_fields=[WorkflowAction.AISuggestionField.CREATED],
            ai_overwrite_existing=True,
        )
        with mock.patch(
            "documents.workflows.ai.get_ai_document_classification",
            return_value={**SUGGESTIONS, "dates": ["not a date", "2019-07-04"]},
        ):
            changed = apply_ai_suggestions_to_document(action, self.doc)
        self.doc.refresh_from_db()
        self.assertEqual(changed, ["created"])
        self.assertEqual(self.doc.created, datetime.date(2019, 7, 4))
@@ -178,7 +178,7 @@ from documents.permissions import has_perms_owner_aware
 from documents.permissions import has_system_status_permission
 from documents.permissions import permitted_document_ids
 from documents.permissions import permitted_object_ids
-from documents.permissions import set_permissions_for_objects
+from documents.permissions import set_permissions_for_object
 from documents.plugins.date_parsing import get_date_parser
 from documents.schema import generate_object_with_permissions_schema
 from documents.search import SearchHit
@@ -247,6 +247,7 @@ from paperless.serialisers import GroupSerializer
 from paperless.serialisers import UserSerializer
 from paperless.views import StandardPagination
 from paperless_ai.ai_classifier import get_ai_document_classification
 from paperless_ai.ai_classifier import get_llm_output_language
 from paperless_ai.chat import stream_chat_with_documents
 from paperless_ai.exceptions import LLMTimeoutError
 from paperless_ai.matching import extract_unmatched_names
@@ -665,20 +666,6 @@ class TagViewSet(PermissionsAwareDocumentCountMixin, ModelViewSet[Tag]):
            update_document_parent_tags(tag, new_parent)
 def _get_llm_output_language(ai_config: AIConfig, request) -> str | None:
    output_language = ai_config.llm_output_language
    if (
        not output_language
        and hasattr(request.user, "ui_settings")
        and isinstance(
            request.user.ui_settings.settings,
            dict,
        )
    ):
        output_language = request.user.ui_settings.settings.get("language")
    return output_language
@extend_schema_view(**generate_object_with_permissions_schema(DocumentTypeSerializer))
 class DocumentTypeViewSet(
    PermissionsAwareDocumentCountMixin,
@@ -1133,7 +1120,8 @@ class DocumentViewSet(
                    "custom_fields",
                    queryset=CustomFieldInstance.objects.select_related("field"),
                ),
-                "notes",
+                # NotesSerializer nests the author, this avoids query per note
                Prefetch("notes", queryset=Note.objects.select_related("user")),
            )
        )
@@ -1541,7 +1529,10 @@ class DocumentViewSet(
        if not ai_config.ai_enabled:
            return HttpResponseBadRequest("AI is required for this feature")
-        output_language = _get_llm_output_language(ai_config=ai_config, request=request)
+        output_language = get_llm_output_language(
            ai_config=ai_config,
            user=request.user,
        )
        llm_cache_backend = ":".join(
            part
            for part in (
@@ -2330,7 +2321,10 @@ class ChatStreamingView(GenericAPIView[Any]):
                id__in=permitted_document_ids(request.user),
            )
-        output_language = _get_llm_output_language(ai_config=ai_config, request=request)
+        output_language = get_llm_output_language(
            ai_config=ai_config,
            user=request.user,
        )
        response = StreamingHttpResponse(
            stream_chat_with_documents(
@@ -2794,8 +2788,11 @@ class DocumentSelectionMixin:
            for key, value in filters.items()
            if key not in _TANTIVY_SEARCH_PARAM_NAMES
        }
        # Operations are addressed to roots, a caller that wants
        # to act on a specific version passes its id explicitly instead
        permitted_documents = Document.objects.filter(
            id__in=permitted_document_ids(user),
            root_document__isnull=True,
        )
        # orm-filtered docs
        filtered_documents = DocumentFilterSet(
@@ -4917,12 +4914,12 @@ class BulkEditObjectsView(PassUserMixin):
                    qs_owner_update.update(owner=owner)
                if "permissions" in serializer.validated_data:
-                    set_permissions_for_objects(
+                    for obj in qs:
-                        permissions=permissions,
+                        set_permissions_for_object(
-                        model=object_class,
+                            permissions=permissions,
-                        pks=qs.values_list("pk", flat=True),
+                            object=obj,
-                        merge=merge,
+                            merge=merge,
-                    )
+                        )
            except Exception as e:
                logger.warning(
@@ -0,0 +1,263 @@
 import logging
 from datetime import date
 from datetime import datetime
 from typing import TypeVar
 from django.contrib.auth.models import User
 from documents.models import Correspondent
 from documents.models import Document
 from documents.models import DocumentType
 from documents.models import MatchingModel
 from documents.models import StoragePath
 from documents.models import Tag
 from documents.models import WorkflowAction
 from paperless.config import AIConfig
 from paperless_ai.ai_classifier import get_ai_document_classification
 from paperless_ai.ai_classifier import get_llm_output_language
 from paperless_ai.matching import extract_unmatched_names
 from paperless_ai.matching import match_correspondents_by_name
 from paperless_ai.matching import match_document_types_by_name
 from paperless_ai.matching import match_storage_paths_by_name
 from paperless_ai.matching import match_tags_by_name
 from paperless_ai.matching import resolve_correspondent_ids
 from paperless_ai.matching import resolve_document_type_ids
 from paperless_ai.matching import resolve_storage_path_ids
 from paperless_ai.matching import resolve_tag_ids
 logger = logging.getLogger("paperless.workflows.ai")
 AISuggestionField = WorkflowAction.AISuggestionField
 ObjT = TypeVar("ObjT", bound=MatchingModel)
 # Tags use m2m relation instead
 DIRECT_FIELDS: dict[str, str] = {
    AISuggestionField.TITLE: "title",
    AISuggestionField.CORRESPONDENT: "correspondent",
    AISuggestionField.DOCUMENT_TYPE: "document_type",
    AISuggestionField.STORAGE_PATH: "storage_path",
    AISuggestionField.CREATED: "created",
 }
 def resolve_date(dates: list[str]) -> date | None:
    """
    First usable date out of the suggestions, which are expected as
    YYYY-MM-DD. Document.created is a DateField, so only one can be applied.
    """
    for value in dates:
        try:
            return datetime.strptime(value, "%Y-%m-%d").date()
        except (TypeError, ValueError):
            logger.debug("Ignoring unparsable suggested date %s", value)
    return None
 def resolve_object(
    model: type[ObjT],
    names: list[str],
    matched: list[ObjT],
    *,
    create_missing: bool,
    owner: User | None,
 ) -> ObjT | None:
    """
    Single object from a suggestion list. The best match if there was one, else
    optionally a newly-created object. StoragePaths are excluded.
    """
    if matched:
        return matched[0]
    if not create_missing or model is StoragePath:
        return None
    unmatched = extract_unmatched_names(names, matched)
    if not unmatched:
        return None
    # (name, owner) is what MatchingModel is unique on
    obj, created = model.objects.get_or_create(
        name=unmatched[0][:128],
        owner=owner,
    )
    if created:
        logger.info("Created %s '%s' from AI suggestion", model.__name__, obj.name)
    return obj
 def resolve_tags(
    names: list[str],
    matched: list[Tag],
    *,
    create_missing: bool,
    owner: User | None,
 ) -> list[Tag]:
    """
    Matched tags, plus newly created ones if create_missing is set.
    """
    tags = list(matched)
    if not create_missing:
        return tags
    for name in extract_unmatched_names(names, matched):
        tag, created = Tag.objects.get_or_create(
            name=name[:128],
            owner=owner,
        )
        if created:
            logger.info("Created tag '%s' from AI suggestion", tag.name)
        tags.append(tag)
    return tags
 def apply_ai_suggestions_to_document(
    action: WorkflowAction,
    document: Document,
    logging_group=None,
 ) -> list[str]:
    """
    Get suggestions about `document` and write the chosen fields.
    Returns the names of the fields that were actually changed.
    """
    selected = set(action.ai_suggestion_fields or [])
    if not selected:
        logger.warning(
            "Workflow action %s has no AI suggestion fields selected, skipping",
            action.pk,
            extra={"group": logging_group},
        )
        return []
    ai_config = AIConfig()
    if not ai_config.ai_enabled:
        logger.error(
            "AI is not enabled, cannot apply AI suggestions for document %s",
            document.pk,
            extra={"group": logging_group},
        )
        return []
    # Workflows run without a user, so we use the document owner
    owner = document.owner
    try:
        suggestions = get_ai_document_classification(
            document,
            owner,
            get_llm_output_language(ai_config, owner),
        )
    except ValueError:
        # A bad AI config will not fix itself, so swallow it rather than
        # letting the caller retry. Timeouts, rate limits, network errors etc
        # propagate so the queued task can back off and try again.
        logger.exception(
            "Invalid AI configuration, cannot get suggestions for document %s",
            document.pk,
            extra={"group": logging_group},
        )
        return []
    overwrite = action.ai_overwrite_existing
    create_missing = action.ai_create_missing
    updated_fields: list[str] = []
    def should_set(field: str) -> bool:
        # The field is selected and (overwrite or it's empty)
        return field in selected and (
            overwrite or getattr(document, DIRECT_FIELDS[field]) in (None, "")
        )
    if should_set(AISuggestionField.TITLE):
        title = suggestions["title"].strip()
        if title:
            # title is capped at 128 characters
            document.title = title[:128]
            updated_fields.append("title")
    if should_set(AISuggestionField.CORRESPONDENT):
        choice = suggestions["correspondents"]
        names = choice["new_names"]
        correspondent = resolve_object(
            Correspondent,
            names,
            resolve_correspondent_ids(choice["existing_ids"], owner)
            + match_correspondents_by_name(names, owner),
            create_missing=create_missing,
            owner=owner,
        )
        if correspondent:
            document.correspondent = correspondent
            updated_fields.append("correspondent")
    if should_set(AISuggestionField.DOCUMENT_TYPE):
        choice = suggestions["document_types"]
        names = choice["new_names"]
        document_type = resolve_object(
            DocumentType,
            names,
            resolve_document_type_ids(choice["existing_ids"], owner)
            + match_document_types_by_name(names, owner),
            create_missing=create_missing,
            owner=owner,
        )
        if document_type:
            document.document_type = document_type
            updated_fields.append("document_type")
    if should_set(AISuggestionField.STORAGE_PATH):
        choice = suggestions["storage_paths"]
        names = choice["new_names"]
        storage_path = resolve_object(
            StoragePath,
            names,
            resolve_storage_path_ids(choice["existing_ids"], owner)
            + match_storage_paths_by_name(names, owner),
            create_missing=create_missing,
            owner=owner,
        )
        if storage_path:
            document.storage_path = storage_path
            updated_fields.append("storage_path")
    if should_set(AISuggestionField.CREATED):
        created = resolve_date(suggestions["dates"])
        if created:
            document.created = created
            updated_fields.append("created")
    tags_to_add: list[Tag] = []
    if AISuggestionField.TAGS in selected:
        choice = suggestions["tags"]
        names = choice["new_names"]
        tags_to_add = resolve_tags(
            names,
            resolve_tag_ids(choice["existing_ids"], owner)
            + match_tags_by_name(names, owner),
            create_missing=create_missing,
            owner=owner,
        )
        if tags_to_add:
            # Suggested tags are always added, so overwrite_existing
            # does not really apply here
            updated_fields.append("tags")
    if updated_fields:
        # save fields and update modified (excluding m2m tags from update_fields)
        direct_updated_fields = [
            field for field in updated_fields if field in DIRECT_FIELDS.values()
        ]
        document.save(update_fields=[*direct_updated_fields, "modified"])
    # Tags at the end so m2m_changed doesn't trigger db and overwrite other changes
    if tags_to_add:
        document.add_nested_tags(tags_to_add)
    logger.info(
        "Applied AI suggestions %s to document %s",
        updated_fields or "(none)",
        document.pk,
        extra={"group": logging_group},
    )
    return updated_fields
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
stumpylog	16f1427b7a	Not bad catches from Copilot, if a little extra secure	2026-08-27 11:37:07 -07:00
stumpylog	8f008a8bf4	feature: add Tantivy full-text fallback adapter for taxonomy candidates This brings users without an embedding backend configured to closer parity with those who do. Reuse the search backend to locate similar documents and use them to provide the LLM with the better suggestion pool to draw from	2026-08-27 09:42:08 -07:00
github-actions[bot]GitHub Crowdin Bot	02b2f55248	New Crowdin translations by GitHub Action (#13811 ) Co-authored-by: Crowdin Bot <support+bot@crowdin.com>	2026-08-27 00:28:39 -07:00
shamoon	a2ea3b9e76	Update SECURITY.md	2026-08-27 00:21:03 -07:00
shamoon	a298568962	Security: harden is_public_ip	2026-08-27 00:21:03 -07:00
shamoon	f6f37898e8	Chore: use PinnedIMAP4	2026-08-27 00:21:02 -07:00
GitHub Actions	0cfe33720a	Auto translate strings	2026-08-27 04:29:13 +00:00
shamoonandGitHub	14b17ddf8d	Fix: navbar brand anchor size + Safari position jitter (#13810 )	2026-08-26 21:28:01 -07:00
github-actions[bot]andGitHub	9009fbb4e9	Documentation: Add v3.1.0 changelog (#13809 )	2026-08-26 19:13:04 -07:00
shamoon	94651d817d	Merge branch 'dev'	2026-08-26 18:42:21 -07:00
shamoon	1630e78aac	Bump version to 3.1.0	2026-08-26 18:07:04 -07:00
github-actions[bot]GitHub Crowdin Bot shamoon	4e79553489	New Crowdin translations by GitHub Action (#13496 ) Co-authored-by: Crowdin Bot <support+bot@crowdin.com> Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>	2026-08-26 18:06:05 -07:00
shamoon	f24d58a383	Tweak: true center search in navbar	2026-08-26 18:02:14 -07:00
shamoonandGitHub	d486dd1205	Fix: prevent config autocomplete craziness (#13808 )	2026-08-26 17:46:34 -07:00
shamoon	406bc1a233	Fix: defer add_nested_tags in ai workflow to avoid losing unsaved changes	2026-08-26 14:18:40 -07:00
GitHub Actions	808746c28c	Auto translate strings	2026-08-26 21:03:06 +00:00
shamoon	ff6d73ce17	Fix missing clear button on select choices	2026-08-26 14:01:04 -07:00
shamoonandGitHub	b4068d38bc	Fix/performance: prevent token re-use in dropdown filtering, also a perf thing (#13804 )	2026-08-26 13:18:09 -07:00
shamoon	139739c2a2	Fix: handle social account sync groups claim sent as str	2026-08-26 12:37:29 -07:00
GitHub Actions	cafed919a1	Auto translate strings	2026-08-26 16:50:29 +00:00
shamoonandGitHub	549afde1fd	Enhancement: Apply AI suggestions workflow action (#13639 )	2026-08-26 16:41:21 +00:00
GitHub Actions	a8576d827e	Auto translate strings	2026-08-26 14:29:05 +00:00
shamoonandGitHub	7330c4d9cb	Fix: exclude version documents from bulk edit "all" (#13791 )	2026-08-26 14:27:31 +00:00
shamoon	aad75b4981	Docs: clarify app config trust	2026-08-26 01:39:50 -07:00
GitHub Actions	2e7cd14964	Auto translate strings	2026-08-26 04:48:45 +00:00
shamoonandGitHub	5090ffe39e	Enhancement: welcome widget visual tweaks (#13794 )	2026-08-25 21:47:13 -07:00
GitHub Actions	35d40b51cb	Auto translate strings	2026-08-25 21:37:07 +00:00
shamoonandGitHub	78025df405	Performance: fetch note authors with prefetch instead of one query each (#13790 )	2026-08-25 14:35:22 -07:00
shamoon	e24db7023a	Tweak: adjust brand leaf opacity	2026-08-25 10:44:49 -07:00
shamoon	f5ddc14588	Fix: also check global change_mailaccount with test	2026-08-25 10:44:49 -07:00