Merge branch 'dev' into feature-document-versions-1218

2026-02-11 23:59:31 -06:00 · 2026-02-09 23:41:44 -08:00
parent b436530e4f c4ed4e7f36
commit 7f2789e323
724 changed files with 146173 additions and 72126 deletions
--- a/src/documents/serialisers.py
+++ b/src/documents/serialisers.py
@@ -4,8 +4,10 @@ import logging
 import math
 import re
 from datetime import datetime
+from datetime import timedelta
 from decimal import Decimal
 from typing import TYPE_CHECKING
+from typing import Literal

 import magic
 from celery import states
@@ -15,9 +17,16 @@ from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import ValidationError
 from django.core.validators import DecimalValidator
+from django.core.validators import EmailValidator
 from django.core.validators import MaxLengthValidator
+from django.core.validators import MaxValueValidator
+from django.core.validators import MinValueValidator
 from django.core.validators import RegexValidator
 from django.core.validators import integer_validator
+from django.db.models import Count
+from django.db.models import Q
+from django.db.models.functions import Lower
+from django.utils import timezone
 from django.utils.crypto import get_random_string
 from django.utils.dateparse import parse_datetime
 from django.utils.text import slugify
@@ -34,7 +43,9 @@ from guardian.utils import get_group_obj_perms_model
 from guardian.utils import get_user_obj_perms_model
 from rest_framework import fields
 from rest_framework import serializers
+from rest_framework.exceptions import PermissionDenied
 from rest_framework.fields import SerializerMethodField
+from rest_framework.filters import OrderingFilter

 if settings.AUDIT_LOG_ENABLED:
    from auditlog.context import set_actor
@@ -42,6 +53,7 @@ if settings.AUDIT_LOG_ENABLED:

 from documents import bulk_edit
 from documents.data_models import DocumentSource
+from documents.filters import CustomFieldQueryParser
 from documents.models import Correspondent
 from documents.models import CustomField
 from documents.models import CustomFieldInstance
@@ -53,6 +65,7 @@ from documents.models import PaperlessTask
 from documents.models import SavedView
 from documents.models import SavedViewFilterRule
 from documents.models import ShareLink
+from documents.models import ShareLinkBundle
 from documents.models import StoragePath
 from documents.models import Tag
 from documents.models import UiSettings
@@ -62,8 +75,11 @@ from documents.models import WorkflowActionEmail
 from documents.models import WorkflowActionWebhook
 from documents.models import WorkflowTrigger
 from documents.parsers import is_mime_type_supported
+from documents.permissions import get_document_count_filter_for_user
 from documents.permissions import get_groups_with_only_permission
+from documents.permissions import get_objects_for_user_owner_aware
 from documents.permissions import set_permissions_for_object
+from documents.regex import validate_regex_pattern
 from documents.templating.filepath import validate_filepath_template_and_render
 from documents.templating.utils import convert_format_str_to_template_format
 from documents.validators import uri_validator
@@ -72,6 +88,9 @@ from documents.validators import url_validator
 if TYPE_CHECKING:
    from collections.abc import Iterable

+    from django.db.models.query import QuerySet
+
+
 logger = logging.getLogger("paperless.serializers")


@@ -82,7 +101,7 @@ class DynamicFieldsModelSerializer(serializers.ModelSerializer):
    controls which fields should be displayed.
    """

-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, **kwargs) -> None:
        # Don't pass the 'fields' arg up to the superclass
        fields = kwargs.pop("fields", None)

@@ -134,10 +153,11 @@ class MatchingModelSerializer(serializers.ModelSerializer):
            and self.initial_data["matching_algorithm"] == MatchingModel.MATCH_REGEX
        ):
            try:
-                re.compile(match)
-            except re.error as e:
+                validate_regex_pattern(match)
+            except ValueError as e:
+                logger.debug(f"Invalid regular expression: {e!s}")
                raise serializers.ValidationError(
-                    _("Invalid regular expression: %(error)s") % {"error": str(e.msg)},
+                    "Invalid regular expression, see log for details.",
                )
        return match

@@ -185,12 +205,12 @@ class SetPermissionsMixin:
                    del permissions_dict[action]
        return permissions_dict

-    def _set_permissions(self, permissions, object):
+    def _set_permissions(self, permissions, object) -> None:
        set_permissions_for_object(permissions, object)


 class SerializerWithPerms(serializers.Serializer):
-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, **kwargs) -> None:
        self.user = kwargs.pop("user", None)
        self.full_perms = kwargs.pop("full_perms", False)
        self.all_fields = kwargs.pop("all_fields", False)
@@ -239,7 +259,7 @@ class OwnedObjectSerializer(
    serializers.ModelSerializer,
    SetPermissionsMixin,
 ):
-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, **kwargs) -> None:
        super().__init__(*args, **kwargs)

        if not self.all_fields:
@@ -252,6 +272,35 @@ class OwnedObjectSerializer(
            except KeyError:
                pass

+    def _get_perms(self, obj, codename: str, target: Literal["users", "groups"]):
+        """
+        Get the given permissions from context or from django-guardian.
+
+        :param codename: The permission codename, e.g. 'view' or 'change'
+        :param target: 'users' or 'groups'
+        """
+        key = f"{target}_{codename}_perms"
+        cached = self.context.get(key, {}).get(obj.pk)
+        if cached is not None:
+            return list(cached)
+
+        # Permission not found in the context, get it from guardian
+        if target == "users":
+            return list(
+                get_users_with_perms(
+                    obj,
+                    only_with_perms_in=[f"{codename}_{obj.__class__.__name__.lower()}"],
+                    with_group_users=False,
+                ).values_list("id", flat=True),
+            )
+        else:  # groups
+            return list(
+                get_groups_with_only_permission(
+                    obj,
+                    codename=f"{codename}_{obj.__class__.__name__.lower()}",
+                ).values_list("id", flat=True),
+            )
+
    @extend_schema_field(
        field={
            "type": "object",
@@ -286,31 +335,14 @@ class OwnedObjectSerializer(
        },
    )
    def get_permissions(self, obj) -> dict:
-        view_codename = f"view_{obj.__class__.__name__.lower()}"
-        change_codename = f"change_{obj.__class__.__name__.lower()}"
-
        return {
            "view": {
-                "users": get_users_with_perms(
-                    obj,
-                    only_with_perms_in=[view_codename],
-                    with_group_users=False,
-                ).values_list("id", flat=True),
-                "groups": get_groups_with_only_permission(
-                    obj,
-                    codename=view_codename,
-                ).values_list("id", flat=True),
+                "users": self._get_perms(obj, "view", "users"),
+                "groups": self._get_perms(obj, "view", "groups"),
            },
            "change": {
-                "users": get_users_with_perms(
-                    obj,
-                    only_with_perms_in=[change_codename],
-                    with_group_users=False,
-                ).values_list("id", flat=True),
-                "groups": get_groups_with_only_permission(
-                    obj,
-                    codename=change_codename,
-                ).values_list("id", flat=True),
+                "users": self._get_perms(obj, "change", "users"),
+                "groups": self._get_perms(obj, "change", "groups"),
            },
        }

@@ -377,7 +409,7 @@ class OwnedObjectSerializer(
    )
    # other methods in mixin

-    def validate_unique_together(self, validated_data, instance=None):
+    def validate_unique_together(self, validated_data, instance=None) -> None:
        # workaround for https://github.com/encode/django-rest-framework/issues/9358
        if "owner" in validated_data and "name" in self.Meta.fields:
            name = validated_data.get("name", instance.name if instance else None)
@@ -413,6 +445,19 @@ class OwnedObjectSerializer(
        return instance

    def update(self, instance, validated_data):
+        user = getattr(self, "user", None)
+        is_superuser = user.is_superuser if user is not None else False
+        is_owner = instance.owner == user if user is not None else False
+        is_unowned = instance.owner is None
+
+        if (
+            ("owner" in validated_data and validated_data["owner"] != instance.owner)
+            or "set_permissions" in validated_data
+        ) and not (is_superuser or is_owner or is_unowned):
+            raise PermissionDenied(
+                _("Insufficient permissions."),
+            )
+
        if "set_permissions" in validated_data:
            self._set_permissions(validated_data["set_permissions"], instance)
        self.validate_unique_together(validated_data, instance)
@@ -557,9 +602,38 @@ class TagSerializer(MatchingModelSerializer, OwnedObjectSerializer):
        ),
    )
    def get_children(self, obj):
+        children_map = self.context.get("children_map")
+        if children_map is not None:
+            children = children_map.get(obj.pk, [])
+        else:
+            filter_q = self.context.get("document_count_filter")
+            request = self.context.get("request")
+            if filter_q is None:
+                user = getattr(request, "user", None) if request else None
+                filter_q = get_document_count_filter_for_user(user)
+                self.context["document_count_filter"] = filter_q
+
+            children = (
+                obj.get_children_queryset()
+                .select_related("owner")
+                .annotate(document_count=Count("documents", filter=filter_q))
+            )
+
+            view = self.context.get("view")
+            ordering = (
+                OrderingFilter().get_ordering(request, children, view)
+                if request and view
+                else None
+            )
+            ordering = ordering or (Lower("name"),)
+            children = children.order_by(*ordering)
+
        serializer = TagSerializer(
-            obj.get_children(),
+            children,
            many=True,
+            user=self.user,
+            full_perms=self.full_perms,
+            all_fields=self.all_fields,
            context=self.context,
        )
        return serializer.data
@@ -620,7 +694,7 @@ class TagSerializer(MatchingModelSerializer, OwnedObjectSerializer):
                temp.clean()
            except ValidationError as e:
                logger.debug("Tag parent validation failed: %s", e)
-                raise serializers.ValidationError({"parent": _("Invalid parent tag.")})
+                raise e

        return super().validate(attrs)

@@ -646,7 +720,7 @@ class StoragePathField(serializers.PrimaryKeyRelatedField):


 class CustomFieldSerializer(serializers.ModelSerializer):
-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, **kwargs) -> None:
        context = kwargs.get("context")
        self.api_version = int(
            context.get("request").version
@@ -772,7 +846,7 @@ class ReadWriteSerializerMethodField(serializers.SerializerMethodField):
    Based on https://stackoverflow.com/a/62579804
    """

-    def __init__(self, method_name=None, *args, **kwargs):
+    def __init__(self, method_name=None, *args, **kwargs) -> None:
        self.method_name = method_name
        kwargs["source"] = "*"
        super(serializers.SerializerMethodField, self).__init__(*args, **kwargs)
@@ -829,6 +903,13 @@ class CustomFieldInstanceSerializer(serializers.ModelSerializer):
                uri_validator(data["value"])
            elif field.data_type == CustomField.FieldDataType.INT:
                integer_validator(data["value"])
+                try:
+                    value_int = int(data["value"])
+                except (TypeError, ValueError):
+                    raise serializers.ValidationError("Enter a valid integer.")
+                # Keep values within the PostgreSQL integer range
+                MinValueValidator(-2147483648)(value_int)
+                MaxValueValidator(2147483647)(value_int)
            elif (
                field.data_type == CustomField.FieldDataType.MONETARY
                and data["value"] != ""
@@ -955,6 +1036,32 @@ class NotesSerializer(serializers.ModelSerializer):
        return ret


+def _get_viewable_duplicates(
+    document: Document,
+    user: User | None,
+) -> QuerySet[Document]:
+    checksums = {document.checksum}
+    if document.archive_checksum:
+        checksums.add(document.archive_checksum)
+    duplicates = Document.global_objects.filter(
+        Q(checksum__in=checksums) | Q(archive_checksum__in=checksums),
+    ).exclude(pk=document.pk)
+    duplicates = duplicates.order_by("-created")
+    allowed = get_objects_for_user_owner_aware(
+        user,
+        "documents.view_document",
+        Document,
+        include_deleted=True,
+    )
+    return duplicates.filter(id__in=allowed)
+
+
+class DuplicateDocumentSummarySerializer(serializers.Serializer):
+    id = serializers.IntegerField()
+    title = serializers.CharField()
+    deleted_at = serializers.DateTimeField(allow_null=True)
+
+
@extend_schema_serializer(
    deprecate_fields=["created_date"],
 )
@@ -972,6 +1079,7 @@ class DocumentSerializer(
    archived_file_name = SerializerMethodField()
    created_date = serializers.DateField(required=False)
    page_count = SerializerMethodField()
+    duplicate_documents = SerializerMethodField()

    notes = NotesSerializer(many=True, required=False, read_only=True)
    head_version = serializers.PrimaryKeyRelatedField(read_only=True)
@@ -999,6 +1107,16 @@ class DocumentSerializer(
    def get_page_count(self, obj) -> int | None:
        return obj.page_count

+    @extend_schema_field(DuplicateDocumentSummarySerializer(many=True))
+    def get_duplicate_documents(self, obj):
+        view = self.context.get("view")
+        if view and getattr(view, "action", None) != "retrieve":
+            return []
+        request = self.context.get("request")
+        user = request.user if request else None
+        duplicates = _get_viewable_duplicates(obj, user)
+        return list(duplicates.values("id", "title", "deleted_at"))
+
    def get_original_file_name(self, obj) -> str | None:
        return obj.original_filename

@@ -1022,7 +1140,7 @@ class DocumentSerializer(
            doc["versions"] = sorted(doc["versions"], reverse=True)
            doc["versions"].append(doc["id"])

-        if api_version < 9:
+        if api_version < 9 and "created" in self.fields:
            # provide created as a datetime for backwards compatibility
            from django.utils import timezone

@@ -1149,7 +1267,7 @@ class DocumentSerializer(
        CustomFieldInstance.deleted_objects.filter(document=instance).delete()
        return instance

-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, **kwargs) -> None:
        self.truncate_content = kwargs.pop("truncate_content", False)

        # return full permissions if we're doing a PATCH or PUT
@@ -1180,6 +1298,7 @@ class DocumentSerializer(
            "archive_serial_number",
            "original_file_name",
            "archived_file_name",
+            "duplicate_documents",
            "owner",
            "permissions",
            "user_can_change",
@@ -1345,7 +1464,7 @@ class DocumentListSerializer(serializers.Serializer):
        child=serializers.IntegerField(),
    )

-    def _validate_document_id_list(self, documents, name="documents"):
+    def _validate_document_id_list(self, documents, name="documents") -> None:
        if not isinstance(documents, list):
            raise serializers.ValidationError(f"{name} must be a list")
        if not all(isinstance(i, int) for i in documents):
@@ -1383,6 +1502,7 @@ class BulkEditSerializer(
            "split",
            "delete_pages",
            "edit_pdf",
+            "remove_password",
        ],
        label="Method",
        write_only=True,
@@ -1390,7 +1510,7 @@ class BulkEditSerializer(

    parameters = serializers.DictField(allow_empty=True, default={}, write_only=True)

-    def _validate_tag_id_list(self, tags, name="tags"):
+    def _validate_tag_id_list(self, tags, name="tags") -> None:
        if not isinstance(tags, list):
            raise serializers.ValidationError(f"{name} must be a list")
        if not all(isinstance(i, int) for i in tags):
@@ -1405,7 +1525,7 @@ class BulkEditSerializer(
        self,
        custom_fields,
        name="custom_fields",
-    ):
+    ) -> None:
        ids = custom_fields
        if isinstance(custom_fields, dict):
            try:
@@ -1458,11 +1578,13 @@ class BulkEditSerializer(
            return bulk_edit.delete_pages
        elif method == "edit_pdf":
            return bulk_edit.edit_pdf
+        elif method == "remove_password":
+            return bulk_edit.remove_password
        else:  # pragma: no cover
            # This will never happen as it is handled by the ChoiceField
            raise serializers.ValidationError("Unsupported method.")

-    def _validate_parameters_tags(self, parameters):
+    def _validate_parameters_tags(self, parameters) -> None:
        if "tag" in parameters:
            tag_id = parameters["tag"]
            try:
@@ -1472,7 +1594,7 @@ class BulkEditSerializer(
        else:
            raise serializers.ValidationError("tag not specified")

-    def _validate_parameters_document_type(self, parameters):
+    def _validate_parameters_document_type(self, parameters) -> None:
        if "document_type" in parameters:
            document_type_id = parameters["document_type"]
            if document_type_id is None:
@@ -1485,7 +1607,7 @@ class BulkEditSerializer(
        else:
            raise serializers.ValidationError("document_type not specified")

-    def _validate_parameters_correspondent(self, parameters):
+    def _validate_parameters_correspondent(self, parameters) -> None:
        if "correspondent" in parameters:
            correspondent_id = parameters["correspondent"]
            if correspondent_id is None:
@@ -1497,7 +1619,7 @@ class BulkEditSerializer(
        else:
            raise serializers.ValidationError("correspondent not specified")

-    def _validate_storage_path(self, parameters):
+    def _validate_storage_path(self, parameters) -> None:
        if "storage_path" in parameters:
            storage_path_id = parameters["storage_path"]
            if storage_path_id is None:
@@ -1511,7 +1633,7 @@ class BulkEditSerializer(
        else:
            raise serializers.ValidationError("storage path not specified")

-    def _validate_parameters_modify_tags(self, parameters):
+    def _validate_parameters_modify_tags(self, parameters) -> None:
        if "add_tags" in parameters:
            self._validate_tag_id_list(parameters["add_tags"], "add_tags")
        else:
@@ -1522,7 +1644,7 @@ class BulkEditSerializer(
        else:
            raise serializers.ValidationError("remove_tags not specified")

-    def _validate_parameters_modify_custom_fields(self, parameters):
+    def _validate_parameters_modify_custom_fields(self, parameters) -> None:
        if "add_custom_fields" in parameters:
            self._validate_custom_field_id_list_or_dict(
                parameters["add_custom_fields"],
@@ -1545,7 +1667,7 @@ class BulkEditSerializer(
            raise serializers.ValidationError("Specified owner cannot be found")
        return ownerUser

-    def _validate_parameters_set_permissions(self, parameters):
+    def _validate_parameters_set_permissions(self, parameters) -> None:
        parameters["set_permissions"] = self.validate_set_permissions(
            parameters["set_permissions"],
        )
@@ -1554,7 +1676,7 @@ class BulkEditSerializer(
        if "merge" not in parameters:
            parameters["merge"] = False

-    def _validate_parameters_rotate(self, parameters):
+    def _validate_parameters_rotate(self, parameters) -> None:
        try:
            if (
                "degrees" not in parameters
@@ -1564,7 +1686,7 @@ class BulkEditSerializer(
        except ValueError:
            raise serializers.ValidationError("invalid rotation degrees")

-    def _validate_parameters_split(self, parameters):
+    def _validate_parameters_split(self, parameters) -> None:
        if "pages" not in parameters:
            raise serializers.ValidationError("pages not specified")
        try:
@@ -1593,7 +1715,7 @@ class BulkEditSerializer(
        else:
            parameters["delete_originals"] = False

-    def _validate_parameters_delete_pages(self, parameters):
+    def _validate_parameters_delete_pages(self, parameters) -> None:
        if "pages" not in parameters:
            raise serializers.ValidationError("pages not specified")
        if not isinstance(parameters["pages"], list):
@@ -1601,7 +1723,7 @@ class BulkEditSerializer(
        if not all(isinstance(i, int) for i in parameters["pages"]):
            raise serializers.ValidationError("pages must be a list of integers")

-    def _validate_parameters_merge(self, parameters):
+    def _validate_parameters_merge(self, parameters) -> None:
        if "delete_originals" in parameters:
            if not isinstance(parameters["delete_originals"], bool):
                raise serializers.ValidationError("delete_originals must be a boolean")
@@ -1613,7 +1735,7 @@ class BulkEditSerializer(
        else:
            parameters["archive_fallback"] = False

-    def _validate_parameters_edit_pdf(self, parameters, document_id):
+    def _validate_parameters_edit_pdf(self, parameters, document_id) -> None:
        if "operations" not in parameters:
            raise serializers.ValidationError("operations not specified")
        if not isinstance(parameters["operations"], list):
@@ -1654,6 +1776,12 @@ class BulkEditSerializer(
                        f"Page {op['page']} is out of bounds for document with {doc.page_count} pages.",
                    )

+    def validate_parameters_remove_password(self, parameters):
+        if "password" not in parameters:
+            raise serializers.ValidationError("password not specified")
+        if not isinstance(parameters["password"], str):
+            raise serializers.ValidationError("password must be a string")
+
    def validate(self, attrs):
        method = attrs["method"]
        parameters = attrs["parameters"]
@@ -1694,6 +1822,8 @@ class BulkEditSerializer(
                    "Edit PDF method only supports one document",
                )
            self._validate_parameters_edit_pdf(parameters, attrs["documents"][0])
+        elif method == bulk_edit.remove_password:
+            self.validate_parameters_remove_password(parameters)

        return attrs

@@ -1910,6 +2040,51 @@ class BulkDownloadSerializer(DocumentListSerializer):
        }[compression]


+class EmailSerializer(DocumentListSerializer):
+    addresses = serializers.CharField(
+        required=True,
+        label="Email addresses",
+        help_text="Comma-separated email addresses",
+    )
+
+    subject = serializers.CharField(
+        required=True,
+        label="Email subject",
+    )
+
+    message = serializers.CharField(
+        required=True,
+        label="Email message",
+    )
+
+    use_archive_version = serializers.BooleanField(
+        default=True,
+        label="Use archive version",
+        help_text="Use archive version of documents if available",
+    )
+
+    def validate_addresses(self, addresses):
+        address_list = [addr.strip() for addr in addresses.split(",")]
+        if not address_list:
+            raise serializers.ValidationError("At least one email address is required")
+
+        email_validator = EmailValidator()
+        try:
+            for address in address_list:
+                email_validator(address)
+        except ValidationError:
+            raise serializers.ValidationError(f"Invalid email address: {address}")
+
+        return ",".join(address_list)
+
+    def validate_documents(self, documents):
+        super().validate_documents(documents)
+        if not documents:
+            raise serializers.ValidationError("At least one document is required")
+
+        return documents
+
+
 class StoragePathSerializer(MatchingModelSerializer, OwnedObjectSerializer):
    class Meta:
        model = StoragePath
@@ -1996,10 +2171,12 @@ class TasksViewSerializer(OwnedObjectSerializer):
            "result",
            "acknowledged",
            "related_document",
+            "duplicate_documents",
            "owner",
        )

    related_document = serializers.SerializerMethodField()
+    duplicate_documents = serializers.SerializerMethodField()
    created_doc_re = re.compile(r"New document id (\d+) created")
    duplicate_doc_re = re.compile(r"It is a duplicate of .* \(#(\d+)\)")

@@ -2024,6 +2201,17 @@ class TasksViewSerializer(OwnedObjectSerializer):

        return result

+    @extend_schema_field(DuplicateDocumentSummarySerializer(many=True))
+    def get_duplicate_documents(self, obj):
+        related_document = self.get_related_document(obj)
+        request = self.context.get("request")
+        user = request.user if request else None
+        document = Document.global_objects.filter(pk=related_document).first()
+        if not related_document or not user or not document:
+            return []
+        duplicates = _get_viewable_duplicates(document, user)
+        return list(duplicates.values("id", "title", "deleted_at"))
+

 class RunTaskViewSerializer(serializers.Serializer):
    task_name = serializers.ChoiceField(
@@ -2041,7 +2229,7 @@ class AcknowledgeTasksViewSerializer(serializers.Serializer):
        child=serializers.IntegerField(),
    )

-    def _validate_task_id_list(self, tasks, name="tasks"):
+    def _validate_task_id_list(self, tasks, name="tasks") -> None:
        if not isinstance(tasks, list):
            raise serializers.ValidationError(f"{name} must be a list")
        if not all(isinstance(i, int) for i in tasks):
@@ -2074,6 +2262,104 @@ class ShareLinkSerializer(OwnedObjectSerializer):
        return super().create(validated_data)


+class ShareLinkBundleSerializer(OwnedObjectSerializer):
+    document_ids = serializers.ListField(
+        child=serializers.IntegerField(min_value=1),
+        allow_empty=False,
+        write_only=True,
+    )
+    expiration_days = serializers.IntegerField(
+        required=False,
+        allow_null=True,
+        min_value=1,
+        write_only=True,
+    )
+    documents = serializers.PrimaryKeyRelatedField(
+        many=True,
+        read_only=True,
+    )
+    document_count = SerializerMethodField()
+
+    class Meta:
+        model = ShareLinkBundle
+        fields = (
+            "id",
+            "created",
+            "expiration",
+            "expiration_days",
+            "slug",
+            "file_version",
+            "status",
+            "size_bytes",
+            "last_error",
+            "built_at",
+            "documents",
+            "document_ids",
+            "document_count",
+        )
+        read_only_fields = (
+            "id",
+            "created",
+            "expiration",
+            "slug",
+            "status",
+            "size_bytes",
+            "last_error",
+            "built_at",
+            "documents",
+            "document_count",
+        )
+
+    def validate_document_ids(self, value):
+        unique_ids = set(value)
+        if len(unique_ids) != len(value):
+            raise serializers.ValidationError(
+                _("Duplicate document identifiers are not allowed."),
+            )
+        return value
+
+    def create(self, validated_data):
+        document_ids = validated_data.pop("document_ids")
+        expiration_days = validated_data.pop("expiration_days", None)
+        validated_data["slug"] = get_random_string(50)
+        if expiration_days:
+            validated_data["expiration"] = timezone.now() + timedelta(
+                days=expiration_days,
+            )
+        else:
+            validated_data["expiration"] = None
+
+        share_link_bundle = super().create(validated_data)
+
+        documents = list(
+            Document.objects.filter(pk__in=document_ids).only(
+                "pk",
+            ),
+        )
+        documents_by_id = {doc.pk: doc for doc in documents}
+        missing = [
+            str(doc_id) for doc_id in document_ids if doc_id not in documents_by_id
+        ]
+        if missing:
+            raise serializers.ValidationError(
+                {
+                    "document_ids": _(
+                        "Documents not found: %(ids)s",
+                    )
+                    % {"ids": ", ".join(missing)},
+                },
+            )
+
+        ordered_documents = [documents_by_id[doc_id] for doc_id in document_ids]
+        share_link_bundle.documents.set(ordered_documents)
+        share_link_bundle.document_total = len(ordered_documents)
+
+        return share_link_bundle
+
+    def get_document_count(self, obj: ShareLinkBundle) -> int:
+        return getattr(obj, "document_total") or obj.documents.count()
+
+
 class BulkEditObjectsSerializer(SerializerWithPerms, SetPermissionsMixin):
    objects = serializers.ListField(
        required=True,
@@ -2148,7 +2434,7 @@ class BulkEditObjectsSerializer(SerializerWithPerms, SetPermissionsMixin):
            )
        return objects

-    def _validate_permissions(self, permissions):
+    def _validate_permissions(self, permissions) -> None:
        self.validate_set_permissions(
            permissions,
        )
@@ -2198,6 +2484,15 @@ class WorkflowTriggerSerializer(serializers.ModelSerializer):
            "match",
            "is_insensitive",
            "filter_has_tags",
+            "filter_has_all_tags",
+            "filter_has_not_tags",
+            "filter_custom_field_query",
+            "filter_has_any_correspondents",
+            "filter_has_not_correspondents",
+            "filter_has_any_document_types",
+            "filter_has_not_document_types",
+            "filter_has_any_storage_paths",
+            "filter_has_not_storage_paths",
            "filter_has_correspondent",
            "filter_has_document_type",
            "filter_has_storage_path",
@@ -2223,6 +2518,20 @@ class WorkflowTriggerSerializer(serializers.ModelSerializer):
        ):
            attrs["filter_path"] = None

+        if (
+            "filter_custom_field_query" in attrs
+            and attrs["filter_custom_field_query"] is not None
+            and len(attrs["filter_custom_field_query"]) == 0
+        ):
+            attrs["filter_custom_field_query"] = None
+
+        if (
+            "filter_custom_field_query" in attrs
+            and attrs["filter_custom_field_query"] is not None
+        ):
+            parser = CustomFieldQueryParser("filter_custom_field_query")
+            parser.parse(attrs["filter_custom_field_query"])
+
        trigger_type = attrs.get("type", getattr(self.instance, "type", None))
        if (
            trigger_type == WorkflowTrigger.WorkflowTriggerType.CONSUMPTION
@@ -2237,7 +2546,7 @@ class WorkflowTriggerSerializer(serializers.ModelSerializer):
        return attrs

    @staticmethod
-    def normalize_workflow_trigger_sources(trigger):
+    def normalize_workflow_trigger_sources(trigger) -> None:
        """
        Convert sources to strings to handle django-multiselectfield v1.0 changes
        """
@@ -2335,6 +2644,7 @@ class WorkflowActionSerializer(serializers.ModelSerializer):
            "remove_change_groups",
            "email",
            "webhook",
+            "passwords",
        ]

    def validate(self, attrs):
@@ -2391,6 +2701,23 @@ class WorkflowActionSerializer(serializers.ModelSerializer):
                "Webhook data is required for webhook actions",
            )

+        if (
+            "type" in attrs
+            and attrs["type"] == WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL
+        ):
+            passwords = attrs.get("passwords")
+            # ensure passwords is a non-empty list of non-empty strings
+            if (
+                passwords is None
+                or not isinstance(passwords, list)
+                or len(passwords) == 0
+                or any(not isinstance(pw, str) for pw in passwords)
+                or any(len(pw.strip()) == 0 for pw in passwords)
+            ):
+                raise serializers.ValidationError(
+                    "Passwords are required for password removal actions",
+                )
+
        return attrs


@@ -2411,13 +2738,44 @@ class WorkflowSerializer(serializers.ModelSerializer):
            "actions",
        ]

-    def update_triggers_and_actions(self, instance: Workflow, triggers, actions):
+    def update_triggers_and_actions(
+        self,
+        instance: Workflow,
+        triggers,
+        actions,
+    ) -> None:
        set_triggers = []
        set_actions = []

        if triggers is not None and triggers is not serializers.empty:
            for trigger in triggers:
                filter_has_tags = trigger.pop("filter_has_tags", None)
+                filter_has_all_tags = trigger.pop("filter_has_all_tags", None)
+                filter_has_not_tags = trigger.pop("filter_has_not_tags", None)
+                filter_has_any_correspondents = trigger.pop(
+                    "filter_has_any_correspondents",
+                    None,
+                )
+                filter_has_not_correspondents = trigger.pop(
+                    "filter_has_not_correspondents",
+                    None,
+                )
+                filter_has_any_document_types = trigger.pop(
+                    "filter_has_any_document_types",
+                    None,
+                )
+                filter_has_not_document_types = trigger.pop(
+                    "filter_has_not_document_types",
+                    None,
+                )
+                filter_has_any_storage_paths = trigger.pop(
+                    "filter_has_any_storage_paths",
+                    None,
+                )
+                filter_has_not_storage_paths = trigger.pop(
+                    "filter_has_not_storage_paths",
+                    None,
+                )
                # Convert sources to strings to handle django-multiselectfield v1.0 changes
                WorkflowTriggerSerializer.normalize_workflow_trigger_sources(trigger)
                trigger_instance, _ = WorkflowTrigger.objects.update_or_create(
@@ -2426,10 +2784,39 @@ class WorkflowSerializer(serializers.ModelSerializer):
                )
                if filter_has_tags is not None:
                    trigger_instance.filter_has_tags.set(filter_has_tags)
+                if filter_has_all_tags is not None:
+                    trigger_instance.filter_has_all_tags.set(filter_has_all_tags)
+                if filter_has_not_tags is not None:
+                    trigger_instance.filter_has_not_tags.set(filter_has_not_tags)
+                if filter_has_any_correspondents is not None:
+                    trigger_instance.filter_has_any_correspondents.set(
+                        filter_has_any_correspondents,
+                    )
+                if filter_has_not_correspondents is not None:
+                    trigger_instance.filter_has_not_correspondents.set(
+                        filter_has_not_correspondents,
+                    )
+                if filter_has_any_document_types is not None:
+                    trigger_instance.filter_has_any_document_types.set(
+                        filter_has_any_document_types,
+                    )
+                if filter_has_not_document_types is not None:
+                    trigger_instance.filter_has_not_document_types.set(
+                        filter_has_not_document_types,
+                    )
+                if filter_has_any_storage_paths is not None:
+                    trigger_instance.filter_has_any_storage_paths.set(
+                        filter_has_any_storage_paths,
+                    )
+                if filter_has_not_storage_paths is not None:
+                    trigger_instance.filter_has_not_storage_paths.set(
+                        filter_has_not_storage_paths,
+                    )
                set_triggers.append(trigger_instance)

        if actions is not None and actions is not serializers.empty:
-            for action in actions:
+            for index, action in enumerate(actions):
+                action["order"] = index
                assign_tags = action.pop("assign_tags", None)
                assign_view_users = action.pop("assign_view_users", None)
                assign_view_groups = action.pop("assign_view_groups", None)
@@ -2516,7 +2903,7 @@ class WorkflowSerializer(serializers.ModelSerializer):
            instance.actions.set(set_actions)
        instance.save()

-    def prune_triggers_and_actions(self):
+    def prune_triggers_and_actions(self) -> None:
        """
        ManyToMany fields dont support e.g. on_delete so we need to discard unattached
        triggers and actions manually
@@ -2556,6 +2943,16 @@ class WorkflowSerializer(serializers.ModelSerializer):

        return instance

+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        actions = instance.actions.order_by("order", "pk")
+        data["actions"] = WorkflowActionSerializer(
+            actions,
+            many=True,
+            context=self.context,
+        ).data
+        return data
+

 class TrashSerializer(SerializerWithPerms):
    documents = serializers.ListField(